joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c890
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4b8970
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4e02dc]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea esi, [esp + 0x18]
xor edi, edi
call fcn.0042dcf0
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x2c], edi
call fcn.0042dd80
add esp, 4
mov byte [esp + 0x28], 1
mov ecx, dword [esp + 0x14]
push edi
push ecx
call fcn.004965a0
add esp, 8
test eax, eax
je 0x46c907
mov edx, dword [esp + 0x18]
push edx
xor esi, esi
push esi
push str.AutoReupdateDelayTime
push 0x4c9d4c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x46c98a
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push eax
push 0
push str.alertreboot
push 0x4c9d4c
call esi
mov ecx, dword [esp + 0x14]
push ecx
push 0
push str.alertreboot
push 0x4c9d4c
mov edi, eax
call esi
mov edx, dword [esp + 0x18]
push edx
push 0
push str.forcereboot
push 0x4c9d4c
mov ebp, eax
call esi
mov ebx, eax
mov eax, dword [esp + 0x14]
push eax
push 0
push str.forcereboot
push 0x4c9d4c
call esi
mov ecx, dword [esp + 0x14]
push ecx
push 0
push str.AutoReupdateDelayTime
push 0x4c9d4c
mov dword [esp + 0x2c], eax
call esi
xor edx, edx
cmp ebx, dword [esp + 0x1c]
setne dl
xor ecx, ecx
cmp edi, ebp
setne cl
mov esi, edx
mov edi, ecx
cmp dword [0x4e4af0], 0
jne 0x46c999
mov dword [0x4e4af0], esi
push eax
push 0
push esi
push edi
push str.KHelper::LoadUpdateConfig_bAlertReboot:_d__groupupdate:_d__ReupdateForceReboot:_d__AutoReupdateDelayTime:_ds
mov ecx, 0x4e49b4
mov dword [0x4e4b40], eax
call fcn.00419ab0
mov byte [esp + 0x3c], 0
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
add esp, 0x14
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x46c9da
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46ca02
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x46f460
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4b6786
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4e02dc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esi], vtable.KCurlHttpImpl.0
mov eax, dword [0x4e3844]
mov edx, dword [eax + 0xc]
mov ecx, 0x4e3844
call edx
add eax, 0x10
mov dword [esi + 0xc], eax
xor edi, edi
mov dword [esp + 0x14], edi
mov eax, dword [0x4e3844]
mov edx, dword [eax + 0xc]
mov ecx, 0x4e3844
call edx
add eax, 0x10
mov dword [esi + 0x10], eax
lea eax, [esi + 0x30]
push eax
mov byte [esp + 0x18], 1
call fcn.0046f1f0
mov edx, dword [0x4e3844]
mov eax, dword [edx + 0xc]
mov ecx, 0x4e3844
call eax
add eax, 0x10
mov dword [esi + 0x60], eax
mov dword [esi + 8], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x20], 0xffffffff
mov dword [esi + 0x64], edi
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x46fff0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
push edi
mov edi, dword [esp + 0x10]
je 0x470010
push eax
mov eax, dword [esp + 0x10]
push edi
push 1
push eax
call fcn.00494ab5
add esp, 0x10
add dword [esi + 4], edi
pop edi
xor eax, eax
pop esi
ret 8

Function at 0x4708f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b56b6
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4e02dc]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov dword [esi], eax
call fcn.00466380
mov dword [esi + 8], eax
mov bl, 1
mov byte [eax + 0x11], bl
mov eax, dword [esi + 8]
mov dword [eax + 4], eax
mov eax, dword [esi + 8]
mov dword [eax], eax
mov eax, dword [esi + 8]
xor edi, edi
mov dword [eax + 8], eax
mov dword [esi + 0xc], edi
mov dword [esp + 0x18], edi
call fcn.004699d0
mov dword [esi + 0x14], eax
mov byte [eax + 0x2d], bl
mov eax, dword [esi + 0x14]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x14]
mov dword [eax], eax
mov eax, dword [esi + 0x14]
mov dword [eax + 8], eax
mov dword [esi + 0x18], edi
mov byte [esp + 0x18], bl
call fcn.00466380
mov dword [esi + 0x3c], eax
mov byte [eax + 0x11], bl
mov eax, dword [esi + 0x3c]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x3c]
mov dword [eax], eax
mov eax, dword [esi + 0x3c]
mov dword [eax + 8], eax
mov dword [esi + 0x40], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x24], 5
mov dword [esi + 0x2c], 0x4e200c
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8
Function at 0x471460
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b9302
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x4e02dc]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
push eax
call fcn.00416600
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x30], 0
call fcn.00412600
add esp, 4
mov byte [esp + 0x2c], 1
mov eax, dword [eax]
push eax
lea edx, [esp + 0x14]
push edx
call fcn.00416940
mov esi, eax
mov byte [esp + 0x2c], 0
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4714dc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
mov ecx, 0x4e49b4
je 0x47152a
push str.KUpdateProtocolEx::LoadChannelListFromKisliveIni
call fcn.00419ab0
mov edx, dword [esp + 0x38]
add esp, 4
lea ecx, [esp + 0x10]
push ecx
push edx
call fcn.00470a40
mov esi, eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x30], 0xffffffff
call fcn.00416690
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret 4
push str.KUpdateProtocolEx::LoadChannelListFromKisliveIni_parse_data_fail
call fcn.00419ab0
add esp, 4
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x30], 0xffffffff
call fcn.00416690
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret 4
Function at 0x475510
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b4433
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4e02dc]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov dword [ebx + 4], eax
mov dword [ebx], vtable.KPacketNameParser.0
mov edx, dword [0x4e3844]
mov eax, dword [edx + 0xc]
mov ecx, 0x4e3844
lea ebp, [ebx + 8]
call eax
add eax, 0x10
mov dword [ebp], eax
mov dword [esp + 0x24], 0
mov ecx, dword [esi]
cmp dword [ecx - 0xc], 0
jne 0x475625
xor edi, edi
lea esi, [esp + 0x30]
call fcn.00427120
mov byte [esp + 0x24], 1
mov ecx, dword [esp + 0x30]
lea esi, [esp + 0x14]
call fcn.00427210
mov byte [esp + 0x24], 2
mov esi, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
mov ecx, esi
call fcn.00427380
add esp, 4
mov edi, ebp
mov byte [esp + 0x24], 3
call fcn.0040a8e0
mov byte [esp + 0x24], 2
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4755dd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [esp + 0x24], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4755fe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x24], 0
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47562e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x47562e
mov eax, esi
mov edi, ebp
call fcn.0040a8e0
mov eax, ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x4769d0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4b7a28
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x4e02dc]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4e02dc]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x248]
mov dword [esp + 0x20], ebp
xor ebx, ebx
push 0x206
lea eax, [esp + 0x32]
push ebx
mov dword [esp + 0x248], ebx
push eax
mov word [esp + 0x38], bx
call fcn.0049a440
lea ecx, [esp + 0x28]
add esp, 0xc
push ecx
push ecx
mov dword [esp + 0x20], 0x104
call fcn.004743c0
add esp, 4
push eax
mov ecx, str.svrid_reg_key
call fcn.00473be0
mov eax, dword [eax]
push eax
lea edx, [esp + 0x250]
push edx
lea edi, [esp + 0x20]
lea esi, [esp + 0x34]
call fcn.0041ce20
mov esi, eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x476a92
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp esi, ebx
jne 0x476ac0
lea eax, [esp + 0x2c]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x476aa0
sub eax, edx
sar eax, 1
cmp eax, 0x20
jne 0x476ac0
lea edi, [ebp + 0xc]
lea edx, [esp + 0x2c]
call fcn.00401710
mov ebp, dword [esp + 0x24c]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x20]
push eax
push ebx
push str.time
mov esi, 4
push ebp
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x34], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x476b07
cmp dword [esp + 0x18], esi
jne 0x476b07
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [eax], ecx
mov dword [eax + 4], ebx
push 0x208
lea edx, [esp + 0x30]
push ebx
push edx
call fcn.0049a440
add esp, 0xc
push str.desc
lea eax, [esp + 0x250]
push eax
lea edi, [esp + 0x20]
lea esi, [esp + 0x34]
mov dword [esp + 0x20], 0x104
call fcn.0041ce20
test eax, eax
jne 0x476b66
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x476b45
sub eax, edx
sar eax, 1
je 0x476b66
mov edi, dword [esp + 0x20]
add edi, 0x10
lea edx, [esp + 0x2c]
call fcn.00401710
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x20]
push eax
push ebx
push str.user_type
mov esi, 4
push ebp
mov dword [esp + 0x40], ebx
mov dword [esp + 0x34], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x476ba4
cmp dword [esp + 0x18], esi
jne 0x476ba4
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
mov dword [edx + 8], ecx
cmp ebp, ebx
je 0x476baf
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.004935b6
add esp, 0x230
ret 8
Function at 0x476c60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4b7a01
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4e02dc]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, dword [esp + 0x34]
xor ebx, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], ebx
mov eax, dword [0x4e3844]
mov edx, dword [eax + 0xc]
mov ecx, 0x4e3844
call edx
add eax, 0x10
mov dword [edi], eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x30], ebx
mov esi, 1
push ecx
mov dword [esp + 0x28], esi
call fcn.004743c0
add esp, 4
push eax
mov ecx, str.uuid_reg_path
call fcn.00473be0
lea ecx, [esp + 0x18]
push ecx
push ecx
mov dword [esp + 0x34], esi
call fcn.004743c0
add esp, 4
push eax
mov ecx, str.uuid_reg_key
call fcn.00473be0
mov byte [esp + 0x2c], 3
mov eax, dword [esp + 0x1c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea edx, [esp + 0x14]
push edx
push eax
push connect
mov dword [esp + 0x20], ebx
call ebp
cmp eax, ebx
jne 0x476d21
mov ecx, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
mov eax, edi
call fcn.0041c490
mov eax, dword [edi]
cmp dword [eax - 0xc], ebx
jne 0x476d61
mov eax, dword [esp + 0x14]
cmp eax, ebx
mov esi, dword [esp + 0x1c]
je 0x476d3b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x14]
push ecx
push esi
push connect
mov dword [esp + 0x20], ebx
call ebp
cmp eax, ebx
jne 0x476d61
mov edx, dword [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
mov eax, edi
call fcn.0041c490
call fcn.00476de0
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x476d75
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esp + 0x2c], 1
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov dword [esp + 0x14], ebx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x476d9e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x2c], bl
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x476dc2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4
Function at 0x478a30
Capabilities:
Compute adler32 checksum

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
movzx ecx, di
shr edi, 0x10
test esi, esi
mov ebx, eax
jne 0x478a4a
pop edi
lea eax, [esi + 1]
pop esi
pop ebx
ret
test ebx, ebx
jbe 0x478b4c
push ebp
cmp ebx, 0x15b0
mov eax, ebx
jb 0x478a62
mov eax, 0x15b0
sub ebx, eax
cmp eax, 0x10
jl 0x478b0b
mov edx, eax
shr edx, 4
mov ebp, edx
neg ebp
shl ebp, 4
add eax, ebp
jmp 0x478a80
movzx ebp, byte [esi]
add ecx, ebp
movzx ebp, byte [esi + 1]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 2]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 3]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 4]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 5]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 6]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 7]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 8]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 9]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xa]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xb]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xc]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xd]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xe]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xf]
add edi, ecx
add ecx, ebp
add edi, ecx
add esi, 0x10
sub edx, 1
jne 0x478a80
test eax, eax
je 0x478b1f
nop
movzx edx, byte [esi]
add ecx, edx
add esi, 1
add edi, ecx
sub eax, 1
jne 0x478b10
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
ja 0x478a53
pop ebp
mov eax, edi
pop edi
shl eax, 0x10
pop esi
or eax, ecx
pop ebx
ret

Function at 0x479020
Capabilities:
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x479027
xor eax, eax
ret
mov eax, dword [esp + 4]
jmp fcn.00479030
Function at 0x479030
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x479062
lea esp, [esp]
test cl, 3
je 0x479062
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4c2230]
add ecx, 1
sub esi, 1
jne 0x479040
cmp esi, 0x20
push ebx
push edi
jb 0x47924c
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x4c2630]
xor edx, dword [ebx*4 + 0x4c2a30]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4c2230]
add ecx, 4
xor edx, dword [eax*4 + 0x4c2e30]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x4c2630]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4c2a30]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x4c2230]
add ecx, 4
xor eax, dword [edx*4 + 0x4c2e30]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x4c2630]
xor edx, dword [ebx*4 + 0x4c2a30]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4c2230]
xor edx, dword [eax*4 + 0x4c2e30]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x4c2630]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4c2a30]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x4c2230]
xor eax, dword [edx*4 + 0x4c2e30]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x4c2630]
xor edx, dword [ebx*4 + 0x4c2a30]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4c2230]
xor edx, dword [eax*4 + 0x4c2e30]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x4c2630]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4c2a30]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x4c2230]
and edx, 0xff
xor eax, dword [edx*4 + 0x4c2e30]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x4c2630]
xor edx, dword [ebx*4 + 0x4c2a30]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x4c2230]
add ecx, 4
xor edx, dword [eax*4 + 0x4c2e30]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x4c2630]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x4c2a30]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x4c2230]
and edx, 0xff
xor eax, dword [edx*4 + 0x4c2e30]
sub edi, 1
jne 0x479072
cmp esi, 4
jb 0x479299
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x4c2630]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x4c2a30]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x4c2230]
and eax, 0xff
xor edi, dword [eax*4 + 0x4c2e30]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x479256
test esi, esi
pop edi
pop ebx
je 0x4792bd
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4c2230]
add ecx, 1
sub esi, 1
jne 0x4792a0
not eax
pop esi
ret
Function at 0x4792d0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x4e02dc]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x479320
mov ax, word [esp]
cmp al, 2
jne 0x47931a
cmp ah, al
jne 0x47931a
xor eax, eax
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.004935b6
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 2
call fcn.004935b6
add esp, 0x194
ret
Function at 0x483030
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x483062
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0x39
add eax, 0xffffffff
ret
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor eax, eax
ret

Function at 0x4831c0
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esi + 0x140]
test ecx, ecx
je 0x4831db
mov edx, dword [esi + 0xe4]
push edx
push edi
push ebx
push eax
push esi
call ecx
add esp, 0x14
ret
test eax, eax
jl 0x48320f
cmp eax, 2
jg 0x48320f
mov ecx, dword [esi + 0xe0]
push ecx
push 1
lea edx, [eax + eax*2 + 0x4bc9f8]
push 2
push edx
call fcn.00494ab5
mov eax, dword [esi + 0xe0]
push eax
push 1
push edi
push ebx
call fcn.00494ab5
add esp, 0x20
xor eax, eax
ret

Function at 0x483440
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [edi + eax*4 + 0xd4]
push esi
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
cmp esi, 0xffffffff
jne 0x483485
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x48346b
xor eax, eax
pop esi
ret
push eax
push edi
call fcn.0048da90
push eax
mov eax, dword [edi]
push str.Send_failure:__s
push eax
call fcn.004833a0
add esp, 0x14
mov eax, esi
pop esi
ret
Function at 0x483af0
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, dword [edi]
movzx eax, byte [esi + 0x286]
push 4
lea ecx, [esp + 8]
push ecx
push 1
push 6
push edx
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x483b34
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.0048da90
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.00483310
add esp, 0x14
pop esi
pop ecx
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.00483310
add esp, 8
pop esi
pop ecx
ret
Function at 0x483f80
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0x458]
cmp eax, 0xffffffff
je 0x483fe6
mov ecx, dword [ecx + 0x44c]
mov edx, dword [ecx]
cmp dword [edx + eax*4], 0
lea eax, [edx + eax*4]
je 0x483fe6
mov ecx, dword [esp + 0xc]
test ecx, ecx
mov eax, dword [eax]
je 0x483fac
mov dword [ecx], eax
mov ecx, dword [eax + 0xd4]
push esi
mov esi, dword [esp + 0xc]
mov dword [esi], ecx
cmp byte [eax + 0xdc], 0
jne 0x483fdc
mov eax, dword [eax + 0xd4]
push 2
push 1
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x483fe2
mov dword [esi], 0xffffffff
pop esi
xor eax, eax
ret
mov ecx, dword [esp + 8]
mov dword [ecx], 0xffffffff
xor eax, eax
ret