joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455810
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
cmp esi, dword [eax]
jne 0x45583f
cmp ecx, eax
jne 0x45583f
mov ecx, ebx
call fcn.004554f0
mov eax, dword [ebx + 4]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
pop esi
mov dword [eax], ecx
pop ebx
pop ebp
ret 0xc
cmp esi, ecx
je 0x4558fb
push edi
mov edx, dword [esi]
mov dword [ebp + 0xc], edx
mov edx, dword [esi + 8]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x455855
sub eax, edi
add eax, edx
mov edi, 0x811c9dc5
cmp edx, eax
je 0x455880
lea esp, [esp]
movsx ecx, byte [edx]
imul edi, edi, 0x1000193
inc edx
xor edi, ecx
cmp edx, eax
jne 0x455870
mov ecx, dword [ebx + 0x20]
mov eax, ecx
and eax, edi
cmp dword [ebx + 0x24], eax
ja 0x455895
shr ecx, 1
or edx, 0xffffffff
sub edx, ecx
add eax, edx
mov ecx, dword [ebx + 0x10]
cmp dword [ecx + eax*8 + 4], esi
lea edx, [ecx + eax*8]
jne 0x4558be
cmp dword [edx], esi
jne 0x4558b6
mov ecx, dword [ebx + 4]
mov dword [edx], ecx
mov edx, dword [ebx + 0x10]
mov ecx, dword [ebx + 4]
mov dword [edx + eax*8 + 4], ecx
jmp 0x4558c6
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
jmp 0x4558c6
cmp dword [edx], esi
jne 0x4558c6
mov ecx, dword [esi]
mov dword [edx], ecx
cmp esi, dword [ebx + 4]
je 0x4558ee
mov edx, dword [esi + 4]
mov eax, dword [esi]
mov dword [edx], eax
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov dword [ecx + 4], edx
lea ecx, [esi + 8]
call fcn.00453ca0
push esi
call sub.mfc100u.dll_delete
add esp, 4
dec dword [ebx + 8]
mov esi, dword [ebp + 0xc]
cmp esi, dword [ebp + 0x10]
jne 0x455848
pop edi
mov eax, dword [ebp + 8]
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x456800
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cf97b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x65db30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebx + 4]
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
cmp edi, dword [eax]
jne 0x456863
cmp ecx, eax
jne 0x456863
mov ecx, ebx
call fcn.00456440
mov eax, dword [ebx + 4]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edi, ecx
je 0x456995
jmp 0x456870
mov edx, dword [edi]
mov dword [ebp + 0xc], edx
mov ecx, dword [edi + 8]
mov al, byte [ecx]
mov esi, 0x811c9dc5
test al, al
je 0x45689f
lea edx, [eax - 0x41]
inc ecx
cmp dl, 0x19
ja 0x45688e
add al, 0x20
imul esi, esi, 0x1000193
movsx eax, al
xor esi, eax
mov al, byte [ecx]
test al, al
jne 0x456883
mov ecx, dword [ebx + 0x20]
mov eax, ecx
and eax, esi
cmp dword [ebx + 0x24], eax
ja 0x4568b4
shr ecx, 1
or edx, 0xffffffff
sub edx, ecx
add eax, edx
mov ecx, dword [ebx + 0x10]
cmp dword [ecx + eax*8 + 4], edi
lea ecx, [ecx + eax*8]
jne 0x4568dd
cmp dword [ecx], edi
jne 0x4568d5
mov edx, dword [ebx + 4]
mov dword [ecx], edx
mov ecx, dword [ebx + 4]
mov edx, dword [ebx + 0x10]
mov dword [edx + eax*8 + 4], ecx
jmp 0x4568e5
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x4568e5
cmp dword [ecx], edi
jne 0x4568e5
mov edx, dword [edi]
mov dword [ecx], edx
cmp edi, dword [ebx + 4]
je 0x456989
mov eax, dword [edi + 4]
mov ecx, dword [edi]
mov dword [eax], ecx
mov edx, dword [edi]
mov eax, dword [edi + 4]
lea ebx, [edi + 8]
mov dword [edx + 4], eax
mov dword [ebp - 0x18], ebx
xor ecx, ecx
lea eax, [ebx + 4]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], eax
lea esi, [eax + 0x10]
mov byte [ebp - 4], 1
cmp dword [esi], ecx
je 0x456931
mov ecx, esi
call dword [sym.imp.MSVCP100.dll_public:_void___thiscall_std::_Container_base0::_Orphan_all_void_]
mov eax, dword [esi]
push eax
call sub.mfc100u.dll_delete
mov eax, dword [ebp - 0x14]
add esp, 4
xor ecx, ecx
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
lea esi, [eax + 4]
mov dword [ebp - 0x14], esi
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.004550b0
mov esi, dword [esi]
push esi
call sub.mfc100u.dll_delete
mov eax, dword [ebx]
or esi, 0xffffffff
sub eax, 0x10
add esp, 4
mov dword [ebp - 4], esi
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x456978
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push edi
call sub.mfc100u.dll_delete
mov eax, dword [ebp - 0x10]
add esp, 4
add dword [eax + 8], esi
mov ebx, eax
mov edi, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x10]
jne 0x456870
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45a620
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [edx - 2]
cmp ecx, 0xa
ja case.default.0x45a62c
jmp dword [ecx*4 + 0x45a788]
cmp al, 0x40
jne 0x45a63d
mov eax, 4
ret
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x45a64c
cmp cl, 0x7a
jbe 0x45a69c
cmp al, 0x30
jl 0x45a654
cmp al, 0x39
jle 0x45a69c
cmp al, 0x2d
je 0x45a69c
cmp al, 0x5f
je 0x45a69c
cmp al, 0x2e
je 0x45a69c
cmp al, 0x21
je 0x45a69c
cmp al, 0x7e
je 0x45a69c
cmp al, 0x2a
je 0x45a69c
cmp al, 0x27
je 0x45a69c
cmp al, 0x28
je 0x45a69c
cmp al, 0x29
je 0x45a69c
cmp al, 0x25
je 0x45a69c
cmp al, 0x3b
je 0x45a69c
cmp al, 0x3a
je 0x45a69c
cmp al, 0x26
je 0x45a69c
cmp al, 0x3d
je 0x45a69c
cmp al, 0x2b
je 0x45a69c
cmp al, 0x24
je 0x45a69c
cmp al, 0x2c
jne case.default.0x45a62c
mov eax, 3
ret
cmp al, 0x5b
jne 0x45a6ac
mov eax, 5
ret
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x45a6bb
cmp cl, 0x7a
jbe 0x45a6cf
cmp al, 0x30
jl 0x45a6c3
cmp al, 0x39
jle 0x45a6cf
cmp al, 0x2e
je 0x45a6cf
cmp al, 0x2d
jne case.default.0x45a62c
mov eax, 6
ret
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x45a6e4
cmp cl, 0x7a
jbe 0x45a6cf
cmp al, 0x30
jl 0x45a6ec
cmp al, 0x39
jle 0x45a6cf
cmp al, 0x2e
je 0x45a6cf
cmp al, 0x2d
je 0x45a6cf
cmp al, 0x3a
jne case.default.0x45a62c
mov eax, 0xb
ret
cmp al, 0x5d
jne case.0x45a62c.5
mov eax, 8
ret
cmp al, 0x30
jl 0x45a714
cmp al, 0x39
jle 0x45a73a
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x45a723
cmp cl, 0x66
jbe 0x45a73a
cmp al, 0x3a
je 0x45a73a
cmp al, 0x2e
je 0x45a73a
cmp edx, 7
jne case.default.0x45a62c
cmp al, 0x25
jne case.default.0x45a62c
mov eax, 9
ret
mov eax, 7
ret
cmp al, 0x5d
je 0x45a706
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x45a753
cmp cl, 0x7a
jbe 0x45a76f
cmp al, 0x30
jl 0x45a75b
cmp al, 0x39
jle 0x45a76f
cmp al, 0x25
je 0x45a76f
cmp al, 0x2e
je 0x45a76f
cmp al, 0x2d
je 0x45a76f
cmp al, 0x5f
je 0x45a76f
cmp al, 0x7e
jne case.default.0x45a62c
mov eax, 0xa
ret
sub al, 0x30
cmp al, 9
mov eax, 0xc
jbe 0x45a785
mov eax, 1
ret
Function at 0x45fa60
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
mov esi, ecx
cmp dword [ebp + 0xc], ebx
je 0x45facf
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
push 0x30
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x45fb45
mov eax, dword [ebp + 8]
mov edx, dword [esi + 0x1c]
xor ecx, ecx
cmp word [eax], 2
setne cl
dec ecx
and ecx, 0xfffffff4
add ecx, 0x1c
push ecx
push eax
push edx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x45fac4
cmp eax, 0xffffffff
jne 0x45fabc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x45fac4
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp word [eax], 2
setne cl
dec ecx
and ecx, 0xfffffff4
add ecx, 0x1c
push ecx
push eax
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x45fb45
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x1c]
push 0x23
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x45fb45
mov dword [esi + 0x4c], 1
push 0
mov dword [esi + 0x50], 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov edx, dword [eax + 0xb0]
mov ecx, esi
call edx
cmp eax, 2
jne 0x45fac4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x45fb3e
mov eax, 0x4c7
push eax
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8

Function at 0x45fd50
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x18c]
push edi
test eax, eax
jne 0x45fe0c
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
lea esp, [esp]
mov ecx, dword [esi + 0x2c]
mov eax, dword [esi + 0x5c]
mov edx, dword [esi + 0x1c]
push 0
push ecx
push eax
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
jle 0x45fddf
push 0
call ebx
mov eax, dword [esi + 0x5c]
mov edx, dword [esi]
push edi
push eax
mov eax, dword [edx + 0xc0]
mov ecx, esi
call eax
cmp eax, 2
jne 0x45fde8
mov edx, dword [esi + 0x24]
push edx
push str._C_CNNID:__Iu__OnReceive___event_return_HR_ERROR__connection_will_be_closed___n
call fcn.00438830
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x45fdc4
mov eax, 0x4c7
mov dword [esi + 0x10], 4
mov dword [esi + 0x14], eax
mov ecx, 1
mov dword [esi + 0x18], ecx
pop edi
mov dword [esi + 0xc], ecx
pop esi
xor eax, eax
pop ebx
ret
cmp edi, 0xffffffff
je 0x45fdff
test edi, edi
je 0x45fe15
mov ecx, dword [esi + 0x18c]
test ecx, ecx
je 0x45fd70
pop edi
pop esi
mov eax, 1
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x45fdc4
pop edi
pop esi
mov eax, 1
pop ebx
ret
mov dword [esi + 0x10], 5
mov dword [esi + 0x14], 0
mov ecx, 1
mov dword [esi + 0x18], ecx
pop edi
mov dword [esi + 0xc], ecx
pop esi
xor eax, eax
pop ebx
ret
Function at 0x45fe40
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x18]
push esi
mov esi, ecx
mov ecx, dword [ebx + 0x14]
sub eax, ecx
push edi
je 0x45fee6
lea esp, [esp]
mov edx, dword [esi + 0x2c]
cmp eax, edx
jl 0x45fe69
mov eax, edx
push 0
push eax
mov eax, dword [esi + 0x1c]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
test edi, edi
jle 0x45fed3
lea ebx, [esi + 0x154]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub dword [esi + 0x188], edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x14]
mov edx, dword [esi]
push edi
push eax
mov eax, dword [edx + 0xb8]
mov ecx, esi
call eax
cmp eax, 2
jne 0x45fec9
mov ecx, dword [esi + 0x24]
push ecx
push str._C_CNNID:__Iu__OnSend___event_should_not_return_HR_ERROR____n
call fcn.00438830
add esp, 8
push edi
mov ecx, ebx
call fcn.0045d9b0
jmp 0x45fed8
cmp edi, 0xffffffff
je 0x45fef2
mov ecx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x18]
sub eax, ecx
jne 0x45fe60
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x45ff14
mov edx, dword [ebp + 0xc]
pop edi
pop esi
mov dword [edx], 1
mov eax, 1
pop ebx
pop ebp
ret 8
mov ecx, 1
pop edi
mov dword [esi + 0x14], eax
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 3
mov dword [esi + 0x18], ecx
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8

Function at 0x460cf0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x44]
push eax
push 0
push esi
push 0x460af0
push 0
push 0
call dword [sym.imp.MSVCR100.dll__beginthreadex]
xor ecx, ecx
add esp, 0x18
test eax, eax
setne cl
mov dword [esi + 0x40], eax
pop esi
mov eax, ecx
ret
Function at 0x460f00
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
push esi
push edi
mov esi, ecx
test eax, eax
jne 0x460f2c
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x1c]
push 0x23
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x460f49
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, 1
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 2
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], eax
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
mov edi, 1
mov dword [esi + 0x4c], edi
push 0
mov dword [esi + 0x50], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov edx, dword [eax + 0x84]
mov ecx, esi
call edx
cmp eax, 2
je 0x460fa5
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x460f9d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x460f9d
test eax, eax
je 0x460f9d
push 0x80004005
call fcn.00436780
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x460fb4
mov eax, 0x4c7
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 5
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], eax
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x461210
Capabilities:
Connect socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
mov esi, ecx
cmp dword [ebp + 0xc], edi
je 0x46127e
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
push 0x30
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x46134e
mov eax, dword [ebp + 8]
mov edx, dword [esi + 0x1c]
xor ecx, ecx
cmp word [eax], 2
setne cl
dec ecx
and ecx, 0xfffffff4
add ecx, 0x1c
push ecx
push eax
push edx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x461349
cmp eax, 0xffffffff
jne 0x461274
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x461349
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebp
ret 8
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp word [eax], 2
setne cl
dec ecx
and ecx, 0xfffffff4
add ecx, 0x1c
push ecx
push eax
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x46134e
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x1c]
push 0x23
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x46134e
mov dword [esi + 0x4c], 1
push 0
mov dword [esi + 0x50], 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov edx, dword [eax + 0x84]
mov ecx, esi
call edx
cmp eax, 2
jne 0x461304
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4612f5
mov eax, 0x4c7
push eax
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, edi
pop edi
pop esi
pop ebp
ret 8
mov eax, dword [esi + 0x1c]
xor edi, edi
push edi
push edi
push edi
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x46132a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x46132a
xor edi, edi
mov ecx, dword [esi + 0x24]
push ecx
push str._C_CNNID:__Iu__send_0_bytes__detect_package__n
call fcn.00438830
add esp, 8
test edi, edi
je 0x461349
push 0x80004005
call fcn.00436780
mov edi, 1
mov eax, edi
pop edi
pop esi
pop ebp
ret 8

Function at 0x461360
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x190]
mov ecx, dword [esi + 0x38]
mov ebx, 1
add dword [esi + 0x190], ebx
cmp eax, ecx
jb 0x461391
xor eax, eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], 5
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
pop esi
pop ebx
ret
mov edx, dword [esi + 0x1c]
push edi
xor edi, edi
push edi
push edi
push edi
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x4613b8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2733
jne 0x4613b8
xor edi, edi
mov eax, dword [esi + 0x24]
push eax
push str._C_CNNID:__Iu__send_0_bytes__detect_package__n
call fcn.00438830
add esp, 8
test edi, edi
je 0x4613e3
mov dword [esi + 0x14], edi
pop edi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x10], 5
pop esi
xor eax, eax
pop ebx
ret
pop edi
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x461460
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x18c]
push edi
test eax, eax
jne 0x46154c
xor ebx, ebx
mov ecx, dword [esi + 0x2c]
mov eax, dword [esi + 0x5c]
mov edx, dword [esi + 0x1c]
push ebx
push ecx
push eax
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
cmp edi, ebx
jle 0x461501
mov eax, dword [esi + 0x5c]
push edi
push eax
mov dword [esi + 0x190], ebx
call fcn.0044c900
add esp, 8
test eax, eax
jne 0x461555
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi + 0x5c]
mov edx, dword [esi]
push edi
push eax
mov eax, dword [edx + 0x94]
mov ecx, esi
call eax
cmp eax, 2
jne 0x46153e
mov eax, dword [esi + 0x24]
push eax
push str._C_CNNID:__Iu__OnReceive___event_return_HR_ERROR__connection_will_be_closed___n
call fcn.00438830
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x4614e6
mov eax, 0x4c7
mov ecx, 1
mov dword [esi + 0x18], ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], 4
pop edi
mov dword [esi + 0xc], ecx
pop esi
xor eax, eax
pop ebx
ret
cmp edi, 0xffffffff
jne 0x461523
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x46154c
cmp eax, 0x2744
je 0x46153e
cmp eax, 0x2746
jne 0x4614e6
jmp 0x46153e
cmp edi, ebx
jne 0x46153e
mov ecx, dword [esi + 0x24]
push ecx
push str._C_CNNID:__Iu__recv_0_bytes__detect_package__n
mov dword [esi + 0x190], ebx
call fcn.00438830
add esp, 8
mov edx, dword [esi + 0x18c]
test edx, edx
je 0x461475
pop edi
pop esi
mov eax, 1
pop ebx
ret
pop edi
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0xc], 1
mov dword [esi + 0x10], 5
pop esi
xor eax, eax
pop ebx
ret
Function at 0x461aa0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cfe08
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x65db30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0x70]
mov dword [ebp - 0x14], eax
mov ecx, dword [esi + 0x188]
xor edi, edi
test ecx, ecx
jle 0x461b34
lea ebx, [esi + 0x154]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esi + 0x170]
cmp edi, dword [esi + 0x174]
je 0x461b09
mov eax, dword [edi + 4]
mov dword [esi + 0x170], eax
mov dword [eax + 8], 0
jmp 0x461b1b
test edi, edi
je 0x461b1b
xor eax, eax
mov dword [esi + 0x170], eax
mov dword [esi + 0x174], eax
xor eax, eax
cmp edi, eax
je 0x461b2d
mov dword [edi + 4], eax
mov dword [edi + 8], eax
dec dword [esi + 0x16c]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x461c35
mov eax, dword [edi + 0x18]
sub eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x14]
mov edx, dword [esi + 0x1c]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
mov ebx, eax
test ebx, ebx
jle 0x461bb4
lea eax, [esi + 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub dword [esi + 0x188], ebx
lea eax, [esi + 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [edi + 0x14]
mov edx, dword [esi]
push ebx
push eax
mov eax, dword [edx + 0x8c]
mov ecx, esi
call eax
cmp eax, 2
jne 0x461bb9
mov ecx, dword [esi + 0x24]
push ecx
push str._C_CNNID:__Iu__OnSend___event_should_not_return_HR_ERROR____n
call fcn.00438830
add esp, 8
jmp 0x461bb9
cmp ebx, 0xffffffff
je 0x461be2
mov ecx, dword [ebp - 0x14]
push edi
add ecx, 0x1c
mov dword [ebp - 4], 0xffffffff
call fcn.0043aba0
test eax, eax
jne 0x461ad0
push edi
call fcn.0045db90
add esp, 4
jmp 0x461ad0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x461c4c
lea ebx, [esi + 0x154]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x170]
xor ecx, ecx
cmp eax, ecx
je 0x461c16
mov dword [eax + 8], edi
mov edx, dword [esi + 0x170]
mov dword [edi + 4], edx
jmp 0x461c22
mov dword [edi + 8], ecx
mov dword [edi + 4], ecx
mov dword [esi + 0x174], edi
inc dword [esi + 0x16c]
push ebx
mov dword [esi + 0x170], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 1
mov dword [esi + 0xc], ecx
mov dword [esi + 0x18], ecx
mov ecx, dword [ebp - 0x14]
push edi
add ecx, 0x1c
mov dword [esi + 0x10], 3
mov dword [esi + 0x14], eax
mov dword [ebp - 4], 0xffffffff
call fcn.0043aba0
test eax, eax
jne 0x461c81
push edi
call fcn.0045db90
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x461f90
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0xc]
push edi
mov esi, ecx
mov ecx, dword [ebp + 8]
push eax
push ecx
call fcn.0044ea40
add esp, 0xc
test eax, eax
jne 0x461fb5
pop edi
pop esi
pop ebp
ret 0x14
mov eax, dword [ebp + 0x14]
push ebx
test eax, eax
je 0x461ff2
cmp word [eax], 0
je 0x461ff2
mov ebx, dword [ebp + 0x18]
push ebx
push 0
push eax
call fcn.0044dbf0
add esp, 0xc
test eax, eax
je 0x461fe9
mov dx, word [edi]
cmp dx, word [ebx]
je 0x461ff2
push 0x273f
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x14
movzx eax, word [edi]
push 0x11
push 2
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x1c], eax
cmp eax, 0xffffffff
je 0x461fe9
push 0
push eax
call fcn.0044c890
add esp, 8
test eax, eax
je 0x462021
push 0x80004005
call fcn.00436780
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x1c]
push ecx
push edx
call fcn.0044c790
add esp, 8
test eax, eax
je 0x46203f
push 0x80004005
call fcn.00436780
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [esi + 0x68]
call fcn.004607f0
mov cx, word [ebp + 0x10]
pop ebx
pop edi
mov word [esi + 0x6c], cx
mov eax, 1
pop esi
pop ebp
ret 0x14

Function at 0x462570
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x44]
push eax
push 0
push esi
push 0x4621a0
push 0
push 0
call dword [sym.imp.MSVCR100.dll__beginthreadex]
xor ecx, ecx
add esp, 0x18
test eax, eax
setne cl
mov dword [esi + 0x40], eax
pop esi
mov eax, ecx
ret

Function at 0x462ac0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c8]
push edi
test eax, eax
jne 0x462ba2
lea ebx, [esi + 0x7c]
lea ebx, [ebx]
mov edx, dword [esi + 0x2c]
xor eax, eax
cmp word [ebx], 2
lea ecx, [ebp - 4]
setne al
push ecx
push ebx
push 0
push edx
dec eax
and eax, 0xfffffff4
add eax, 0x1c
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x98]
push eax
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_recvfrom]
mov edi, eax
test edi, edi
js 0x462b74
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi + 0x98]
mov edx, dword [esi]
push edi
push eax
mov eax, dword [edx + 0xa0]
mov ecx, esi
call eax
cmp eax, 2
jne 0x462b94
mov edx, dword [esi + 0x24]
push edx
push str._C_CNNID:__Iu__OnReceive___event_return_HR_ERROR__connection_will_be_closed___n
call fcn.00438830
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x462b56
mov eax, 0x4c7
mov dword [esi + 0x14], eax
mov ecx, 1
mov dword [esi + 0x18], ecx
mov dword [esi + 0x10], 4
pop edi
mov dword [esi + 0xc], ecx
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, 0xffffffff
jne 0x462b94
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x462ba2
cmp eax, 0x2744
je 0x462b94
cmp eax, 0x2746
jne 0x462b56
mov ecx, dword [esi + 0x1c8]
test ecx, ecx
je 0x462ae0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret