joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5dc560
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x2314
call fcn.0078c8d0
push ebx
mov ebx, dword [esp + 0x2324]
push ebp
mov ebp, dword [esp + 0x2324]
push esi
push edi
mov dword [esp + 0x10], 0
lea eax, [esp + 0x18]
lea ecx, [esp + 0x324]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x28]
push 0
lea ecx, [esp + 0x234]
push eax
mov eax, dword [esp + 0x233c]
push ecx
push edx
push eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0x2000
mov dword [esp + 0x3c], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
mov dword [esp + 0x20], eax
jne 0x5dc741
mov eax, dword [esp + 0x14]
dec eax
je 0x5dc6d6
sub eax, 2
je 0x5dc664
dec eax
jne 0x5dc741
mov edi, str.DWORD_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x24]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x228]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x328]
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x2c]
push ecx
push ebp
mov ecx, ebx
call fcn.005e1030
jmp 0x5dc741
mov edi, str.BIN_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x24]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x224]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x18]
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x328]
lea edx, [esp + 0x28]
push ecx
push edx
push ebp
mov ecx, ebx
call fcn.005e0a60
jmp 0x5dc741
mov edi, str.STRING_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x24]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x224]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x324]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x28]
push ecx
push ebp
mov ecx, ebx
call fcn.005e1a10
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
inc ecx
test eax, eax
mov dword [esp + 0x10], ecx
je 0x5dc584
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2314
ret
Function at 0x5dc770
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x424
push ebp
mov ebp, dword [esp + 0x42c]
xor eax, eax
lea ecx, [esp + 0xc]
push esi
mov dword [esp + 0x24], eax
push ecx
push 0xf003f
push eax
mov esi, 0x100
push ebp
push reloc.WSOCK32.dll_bind
mov dword [esp + 0x1c], 0
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x3c], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5dc947
mov edx, dword [esp + 0x434]
mov eax, dword [esp + 0x10]
push ebx
push edi
push edx
push ebp
push eax
call fcn.005dc560
add esp, 0xc
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x338]
push edx
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x30]
push 0
lea edx, [esp + 0x244]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
push eax
push ecx
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ebx, eax
test ebx, ebx
jne 0x5dc929
or ecx, 0xffffffff
mov edi, ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x34]
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x34]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
mov dword [esp + 0x1c], eax
rep movsb byte es:[edi], byte [esi]
mov edi, 0x7f7618
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x28], eax
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x34]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x234]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x34]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
push 0xf003f
push eax
push edx
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5dc924
push eax
push eax
push eax
push eax
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x38]
push eax
push ebx
lea ecx, [esp + 0x34]
push ebx
push ecx
push ebx
push ebx
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [esp + 0x1c]
test eax, eax
jbe 0x5dc8f7
mov eax, dword [esp + 0x43c]
lea ecx, [esp + 0x34]
push eax
push ecx
call fcn.005dc770
add esp, 8
mov eax, dword [esp + 0x28]
test eax, eax
jbe 0x5dc919
mov edx, dword [esp + 0x43c]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x34]
push edx
push eax
push ecx
call fcn.005dc560
add esp, 0xc
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x100
mov ecx, dword [esp + 0x10]
inc ecx
test ebx, ebx
mov dword [esp + 0x10], ecx
je 0x5dc7d5
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x424
ret
Function at 0x5e66d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
mov dword [esp + 0xc], ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0x67
xor eax, eax
push ebp
add ecx, 8
push esi
push edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 0xfa
jmp 0x5e66ff
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x28]
mov esi, eax
inc eax
xor ebx, ebx
mov dword [esp + 0x20], eax
mov edx, dword [ebx + 0x80b34c]
mov eax, esi
xor edx, esi
add ebx, 4
mov esi, edx
sar edx, 0x10
and esi, 0xffff
mov edi, edx
imul edx, edi
imul edi, esi
mov ecx, esi
imul ecx, esi
not edx
add edx, ecx
mov ecx, edx
sar ecx, 0x10
shl edx, 0x10
or ecx, edx
mov edx, dword [ebx + 0x80b398]
xor ecx, edx
add ecx, edi
xor ecx, ebp
cmp ebx, 0x10
mov esi, ecx
mov ebp, eax
jl 0x5e670c
mov eax, dword [esp + 0x10]
mov dword [eax], esi
add eax, 4
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
dec eax
mov dword [esp + 0x14], eax
jne 0x5e66fb
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4

Function at 0x5e6890
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx + 4]
push ebx
push ebp
push esi
lea edx, [eax + 1]
push edi
mov edi, dword [ecx]
mov dword [ecx + 4], edx
xor esi, esi
mov ecx, dword [esi + 0x80b34c]
mov ebx, eax
xor ecx, eax
add esi, 4
mov edx, ecx
sar ecx, 0x10
and edx, 0xffff
mov eax, ecx
imul eax, ecx
imul ecx, edx
mov ebp, edx
imul ebp, edx
not eax
add eax, ebp
mov ebp, eax
sar ebp, 0x10
shl eax, 0x10
or ebp, eax
mov eax, dword [esi + 0x80b398]
xor ebp, eax
add ebp, ecx
xor ebp, edi
cmp esi, 0x10
mov eax, ebp
mov edi, ebx
jl 0x5e68a1
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x5e6a40
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [ecx + 0x9c0], 0x270
jl 0x5e6aff
push esi
push edi
mov edx, ecx
mov edi, 0xe3
mov esi, dword [edx]
mov eax, dword [edx + 4]
xor eax, esi
add edx, 4
and eax, 0x7fffffff
xor eax, esi
mov esi, eax
and esi, 1
shr eax, 1
mov esi, dword [esi*4 + 0x80b3ec]
xor esi, eax
mov eax, dword [edx + 0x630]
xor esi, eax
dec edi
mov dword [edx - 4], esi
jne 0x5e6a59
lea edx, [ecx + 0x38c]
mov edi, 0x18c
mov esi, dword [edx]
mov eax, dword [edx + 4]
xor eax, esi
add edx, 4
and eax, 0x7fffffff
xor eax, esi
mov esi, eax
and esi, 1
shr eax, 1
mov esi, dword [esi*4 + 0x80b3ec]
xor esi, eax
mov eax, dword [edx - 0x390]
xor esi, eax
dec edi
mov dword [edx - 4], esi
jne 0x5e6a93
mov edx, dword [ecx + 0x9bc]
mov esi, dword [ecx]
mov eax, edx
pop edi
xor eax, esi
mov esi, dword [ecx + 0x630]
and eax, 0x7fffffff
xor eax, edx
mov edx, eax
and edx, 1
shr eax, 1
mov edx, dword [edx*4 + 0x80b3ec]
mov dword [ecx + 0x9c0], 0
xor edx, esi
pop esi
xor edx, eax
mov dword [ecx + 0x9bc], edx
mov edx, dword [ecx + 0x9c0]
mov eax, dword [ecx + edx*4]
inc edx
mov dword [ecx + 0x9c0], edx
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
and edx, 0xff3a58ad
shl edx, 7
xor eax, edx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov edx, eax
shr edx, 0x12
xor eax, edx
ret
Function at 0x5e6bd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
je 0x5e6c0a
push ebx
push esi
lea esi, [ecx + 1]
mov ecx, dword [esp + 0xc]
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x80b3f4]
xor eax, edx
inc ecx
dec esi
jne 0x5e6bea
pop esi
pop ebx
not eax
ret

Function at 0x5e6c50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
not esi
mov al, byte [edi]
test al, al
je 0x5e6c90
movsx eax, al
push eax
inc edi
call fcn.0078ed40
mov ecx, esi
and eax, 0xff
and ecx, 0xff
add esp, 4
xor eax, ecx
shr esi, 8
mov edx, dword [eax*4 + 0x80b3f4]
mov al, byte [edi]
xor esi, edx
test al, al
jne 0x5e6c62
mov eax, esi
pop edi
not eax
pop esi
ret

Function at 0x5e6d90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
je 0x5e6dca
push ebx
push esi
lea esi, [ecx + 1]
mov ecx, dword [esp + 0xc]
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x80b7f4]
xor eax, edx
inc ecx
dec esi
jne 0x5e6daa
pop esi
pop ebx
not eax
ret

Function at 0x5e6dd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
not eax
mov cl, byte [edx]
test cl, cl
je 0x5e6e06
push esi
mov esi, eax
and ecx, 0xff
and esi, 0xff
xor ecx, esi
shr eax, 8
mov ecx, dword [ecx*4 + 0x80b7f4]
xor eax, ecx
mov cl, byte [edx + 1]
inc edx
test cl, cl
jne 0x5e6de1
pop esi
not eax
ret
Function at 0x5e75d0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebp
push esi
mov esi, ecx
xor ebp, ebp
mov dword [esp + 8], ebp
mov dword [esp + 0xc], ebp
mov eax, dword [esi]
call dword [eax + 0x18]
test al, al
jne 0x5e7607
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx + 0x1c]
test eax, eax
jne 0x5e75ff
pop esi
pop ebp
add esp, 8
ret 8
mov dword [esp + 0xc], 1
mov eax, dword [esi + 0xc]
push ebx
cmp eax, 0xffffffff
push edi
je 0x5e762c
mov eax, dword [esi]
push 1
push ebp
mov ecx, esi
call dword [eax + 0x28]
mov ecx, dword [esi + 0xc]
mov edi, dword [esp + 0x20]
sub ecx, eax
cmp edi, ecx
jl 0x5e7630
mov edi, ecx
jmp 0x5e7630
mov edi, dword [esp + 0x20]
xor ebx, ebx
cmp edi, ebp
jle 0x5e7680
mov edx, dword [esp + 0x1c]
mov eax, dword [esi + 0x10]
lea ecx, [esp + 0x10]
push ebp
push ecx
push edi
push edx
push eax
mov dword [esp + 0x24], ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov eax, dword [esp + 0x10]
jne 0x5e7674
mov ebp, dword [esi]
sub edi, eax
add ebx, eax
mov eax, dword [esi + 0x14]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call dword [ebp + 0x44]
xor ebp, ebp
jmp 0x5e767c
sub edi, eax
add ebx, eax
cmp eax, ebp
je 0x5e7680
cmp edi, ebp
jg 0x5e7636
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], ebx
pop edi
cmp eax, ebp
pop ebx
je 0x5e7695
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x38]
mov eax, dword [esp + 8]
pop esi
pop ebp
add esp, 8
ret 8
Function at 0x5e76b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi]
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
call dword [eax + 0x18]
test al, al
jne 0x5e76e7
mov edx, dword [esi]
push 2
mov ecx, esi
call dword [edx + 0x1c]
test eax, eax
jne 0x5e76df
pop edi
pop esi
add esp, 8
ret 8
mov dword [esp + 8], 1
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push ebx
push ebp
lea eax, [esp + 0x14]
push edi
push eax
mov eax, dword [esi + 0x10]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x5e771c
mov eax, dword [esi + 0x14]
mov ebx, dword [esi]
push eax
push edi
call ebp
push eax
mov ecx, esi
call dword [ebx + 0x44]
cmp dword [esi + 0xc], 0xffffffff
je 0x5e77c3
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x18]
test al, al
jne 0x5e773f
mov ecx, dword [esi + 0x14]
mov eax, dword [esi]
push ecx
push edi
push 9
mov ecx, esi
call dword [eax + 0x44]
mov edx, dword [esi + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
push edi
push edi
push edx
call ebx
mov edi, eax
cmp edi, 0xffffffff
jne 0x5e7774
mov eax, dword [esi + 0x14]
mov edx, dword [esi]
push eax
push 0
mov dword [esp + 0x28], edx
call ebp
push eax
mov eax, dword [esp + 0x2c]
mov ecx, esi
call dword [eax + 0x44]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
add ecx, edx
cmp edi, ecx
jle 0x5e77c3
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x18]
test al, al
jne 0x5e779a
mov ecx, dword [esi + 0x14]
mov eax, dword [esi]
push ecx
push 0
push 9
mov ecx, esi
call dword [eax + 0x44]
mov edx, dword [esi + 0x10]
push 1
push 0
push 0
push edx
call ebx
mov edi, eax
cmp edi, 0xffffffff
jne 0x5e77bd
mov eax, dword [esi + 0x14]
mov ebx, dword [esi]
push eax
push 0
call ebp
push eax
mov ecx, esi
call dword [ebx + 0x44]
sub edi, dword [esi + 8]
mov dword [esi + 0xc], edi
mov eax, dword [esp + 0x10]
pop ebp
test eax, eax
pop ebx
je 0x5e77d4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x38]
mov eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 8
ret 8

Function at 0x5e79a0
Capabilities:
Get file size

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0xc]
cmp eax, 0xffffffff
jne 0x5e7a13
mov eax, dword [esi]
call dword [eax + 0x18]
test al, al
je 0x5e79ec
mov ecx, dword [esi + 0x10]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x5e7a09
mov eax, dword [esi + 0x14]
push ebx
mov ebx, dword [esi]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call dword [ebx + 0x44]
mov ecx, dword [esi + 8]
mov eax, edi
sub eax, ecx
pop ebx
mov dword [esi + 0xc], eax
pop edi
pop esi
ret
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx + 0x1c]
test eax, eax
je 0x5e7a09
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x30]
mov edx, dword [esi]
mov ecx, esi
mov edi, eax
call dword [edx + 0x38]
mov ecx, dword [esi + 8]
mov eax, edi
sub eax, ecx
mov dword [esi + 0xc], eax
pop edi
pop esi
ret
Function at 0x5ed6a0
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
lea eax, [esp + 0xc]
mov bl, 1
push eax
push edi
mov dword [esp + 0x14], 0
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jbe 0x5ed738
push ebp
push esi
call fcn.00672b70
add esp, 4
mov ebp, eax
push ebp
push esi
xor esi, esi
push esi
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x5ed725
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x7f7618
push ebp
mov dword [esp + 0x24], esi
mov dword [esp + 0x2c], esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x5ed723
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
mov ecx, 0xd
push ebp
rep movsd dword es:[edi], dword [esi]
call fcn.00672c80
add esp, 4
mov al, bl
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
xor bl, bl
push ebp
call fcn.00672c80
add esp, 4
mov al, bl
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
pop edi
mov al, bl
pop esi
pop ebx
add esp, 8
ret
Function at 0x61f570
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
add esp, 0x190
ret

Function at 0x61f590
Capabilities:
Create udp socket

Disassembly:
mov al, byte [esp + 4]
push 0
push 2
push 2
mov byte [0x854e5c], al
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
jne 0x61f5b8
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x273f
jne 0x61f5be
xor al, al
ret
push eax
call sub.WSOCK32.dll_closesocket
mov cl, byte [0x854e5c]
mov al, 1
neg cl
sbb ecx, ecx
and ecx, 0xc8
add ecx, 0x12c
mov dword [0x80ec7c], ecx
ret

Function at 0x61f5e0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x10]
push edi
lea ecx, [esp + 0x10]
push eax
push ecx
push 0x1001
xor ebp, ebp
mov edi, 4
push 0xffff
push esi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], edi
call sub.WSOCK32.dll_getsockopt
lea edx, [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push eax
push 0x1002
push 0xffff
push esi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], edi
call sub.WSOCK32.dll_getsockopt
mov ebx, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push edi
push ecx
push 0x1001
push 0xffff
push esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], edi
call sub.WSOCK32.dll_setsockopt
lea edx, [esp + 0x10]
push edi
push edx
push 0x1002
push 0xffff
push esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], edi
call sub.WSOCK32.dll_setsockopt
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0x1001
push 0xffff
push esi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], edi
call sub.WSOCK32.dll_getsockopt
lea edx, [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push eax
push 0x1002
push 0xffff
push esi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], edi
call sub.WSOCK32.dll_getsockopt
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x61f6d0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
sub esp, 8
push esi
push 0
push 2
push 2
call sub.WSOCK32.dll_socket
mov esi, dword [esp + 0x10]
lea ecx, [esp + 4]
push 4
push ecx
push 0x20
push 0xffff
push eax
mov dword [esi], eax
mov dword [esp + 0x18], 1
call sub.WSOCK32.dll_setsockopt
mov eax, dword [esi]
lea edx, [esp + 8]
push edx
push 0x8004667e
push eax
mov dword [esp + 0x14], 1
call sub.WSOCK32.dll_ioctlsocket
pop esi
add esp, 8
ret
Function at 0x61f720
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
sub esp, 8
push esi
push edi
push 0
push 2
push 2
call sub.WSOCK32.dll_socket
mov edi, dword [esp + 0x14]
lea ecx, [esp + 8]
push 4
push ecx
push 0x20
mov esi, 1
push 0xffff
push eax
mov dword [edi], eax
mov dword [esp + 0x1c], esi
call sub.WSOCK32.dll_setsockopt
mov eax, dword [edi]
lea edx, [esp + 0xc]
push edx
push 0x8004667e
push eax
mov dword [esp + 0x18], esi
call sub.WSOCK32.dll_ioctlsocket
mov esi, dword [esp + 0x1c]
xor ecx, ecx
mov edx, esi
mov eax, dword [esp + 0x18]
push eax
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov word [esi], 2
mov dword [esi + 4], ecx
call sub.WSOCK32.dll_htons
mov word [esi + 2], ax
mov ecx, dword [edi]
push 0x10
push esi
push ecx
call sub.WSOCK32.dll_bind
test eax, eax
pop edi
pop esi
sete al
add esp, 8
ret

Function at 0x61f7c0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x18]
xor eax, eax
mov dword [esp], eax
push esi
mov dword [esp + 8], eax
push ecx
mov dword [esp + 0x10], eax
mov word [esp + 8], 2
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], 0xffffffff
call sub.WSOCK32.dll_htons
mov esi, dword [esp + 0x20]
lea edx, [esp + 4]
push 0x10
push edx
push 0
mov ecx, esi
mov word [esp + 0x12], ax
call fcn.007848b0
push eax
mov eax, dword [esp + 0x28]
add esi, 4
mov ecx, dword [eax]
push esi
push ecx
call sub.WSOCK32.dll_sendto
pop esi
add esp, 0x10
ret

Function at 0x61f930
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov al, byte [0x81c644]
sub esp, 0x264
test al, al
jne 0x61f950
mov ecx, 0x83f450
call fcn.005ddd50
mov byte [0x81c644], 1
push ebx
push esi
push edi
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ebx, dword [esp + 0x278]
mov edi, dword [esp + 0x274]
lea ecx, [esp + 0x10]
call fcn.0061fa70
lea eax, [esp + 0xc]
lea ecx, [esp + 0x244]
push eax
mov eax, dword [edi]
push ecx
push 0
lea edx, [esp + 0x20]
push 0x224
push edx
push eax
mov dword [esp + 0x24], 0x10
call sub.WSOCK32.dll_recvfrom
mov esi, eax
cmp esi, 0xffffffff
jne 0x61f9a7
call sub.WSOCK32.dll_WSAGetLastError
jmp 0x61f9c2
lea ecx, [esi*8]
push ecx
lea ecx, [esp + 0x14]
call fcn.00784b50
lea edx, [esp + 0x10]
push edx
call ebx
add esp, 4
lea ecx, [esp + 0x10]
call fcn.0061fb50
cmp esi, 0xffffffff
jne 0x61f967
mov al, byte [0x81c644]
pop edi
pop esi
pop ebx
test al, al
jne 0x61f9ed
mov ecx, 0x83f450
call fcn.005ddd50
mov byte [0x81c644], 1
call dword [sym.imp.WINMM.dll_timeGetTime]
add esp, 0x264
ret