joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4131c0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x53159a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, 0x3f800000
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], edi
mov dword [esi + 0x8c], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], eax
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
mov dword [esi + 0xb0], edi
mov dword [esi + 0xb4], eax
mov dword [esi + 0xb8], edi
mov dword [esi + 0xbc], edi
mov dword [esi + 0xc0], edi
mov dword [esi + 0xc4], eax
mov dword [esi + 0xc8], edi
mov dword [esi + 0xcc], edi
mov dword [esi + 0xd0], edi
mov dword [esi + 0xd4], eax
mov dword [esp + 8], esi
mov dword [esi + 0xd8], edi
mov dword [esp + 0x14], edi
mov dword [esi + 0xdc], edi
mov dword [esi + 0xe0], edi
push sym.MOHAA.exe_public:_void___thiscall_str::destructor_void_
push sym.MOHAA.exe_public:_void___thiscall_str::constructor_void_
push 3
lea eax, [esi + 0xe4]
push 4
push eax
mov byte [esp + 0x28], 2
call fcn.0051c26a
mov ecx, 0x64
mov dword [esi + 0x100], edi
mov dword [esi + 0x104], edi
mov dword [esi + 0x108], edi
mov eax, 0x14
mov dword [esi + 0xc], ecx
mov dword [esi + 0x14], ecx
mov dword [esi + 0x1c], ecx
push 3
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], eax
mov dword [esi + 8], 0x10
mov dword [esi + 0xfc], edi
push edi
lea ecx, [esi + 0xf0]
push ecx
call fcn.0044ee30
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x427f50
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.00427ee0
add esp, 4
test al, al
je 0x427f69
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
ret

Function at 0x428070
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 8], 0
je 0x4280f0
mov ecx, 0x80
mov edi, 0x575070
mov edx, 0x575070
rep stosd dword es:[edi], eax
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4280a2
mov eax, dword [str.command.ln]
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4280f0
lea ecx, [esp + 8]
push 0
push ecx
push 0x200
push 0x575070
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ecx
ret

Function at 0x428100
Capabilities:
Delete file
Read file on windows

Disassembly:
push ecx
mov eax, dword [str.command.ln]
push esi
push eax
mov dword [esp + 8], 0
call fcn.00427ee0
add esp, 4
test al, al
jne 0x428123
mov eax, dword [esp + 0xc]
pop esi
pop ecx
ret
xor eax, eax
push edi
mov ecx, 0x80
mov edi, 0x575070
push eax
push 0x80
rep stosd dword es:[edi], eax
mov ecx, dword [str.command.ln]
push 3
push eax
push 3
push closesocket
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
pop edi
cmp esi, 0xffffffff
jne 0x42815e
mov eax, dword [esp + 0xc]
pop esi
pop ecx
ret
lea edx, [esp + 4]
push 0
push edx
push 0x200
push 0x575070
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [str.command.ln]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 0x575070
pop esi
pop ecx
ret

Function at 0x42a3a0
Capabilities:
Set socket configuration

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
push 0x3a
push edi
call fcn.0051c6b0
mov esi, eax
add esp, 8
test esi, esi
je 0x42a3d4
push edi
mov byte [esi], 0
call sub.WSOCK32.dll_inet_addr
mov edi, dword [esp + 0xc]
inc esi
push esi
mov dword [edi], eax
call fcn.0051c3ab
add esp, 4
mov word [edi + 4], ax
pop edi
pop esi
ret

Function at 0x42aa60
Capabilities:
Create udp socket

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
xor ebp, ebp
xor ebx, ebx
mov eax, dword [esi + 0x6c]
push edi
cmp eax, ebp
jle 0x42aac1
xor edi, edi
push 0x11
push 2
push 2
call sub.WSOCK32.dll_socket
mov ecx, dword [esi + 8]
mov dword [edi + ecx], eax
mov edx, dword [esi + 8]
mov ecx, dword [edx + edi]
lea eax, [edx + edi]
cmp ecx, 0xffffffff
je 0x42aab0
mov dword [eax + 4], ebp
mov eax, dword [esi + 8]
inc ebx
mov dword [eax + edi + 8], ebp
mov eax, dword [esi + 0x6c]
add edi, 0x1c
cmp ebx, eax
jl 0x42aa75
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
cmp ebx, ebp
jne 0x42aabe
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
mov dword [esi + 0x6c], ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x42aad0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x10
push esi
push 0x70e4
mov word [esp + 8], 2
call sub.WSOCK32.dll_htons
push 0x548b1c
mov word [esp + 0xa], ax
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 8], eax
jne 0x42ab20
push 0x548b1c
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x42ab15
mov eax, 2
pop esi
add esp, 0x10
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [esp + 8], edx
push 6
push 1
push 2
call sub.WSOCK32.dll_socket
mov esi, dword [esp + 0x18]
cmp eax, 0xffffffff
mov dword [esi + 0x88], eax
jne 0x42ab44
mov eax, 1
pop esi
add esp, 0x10
ret
lea ecx, [esp + 4]
push 0x10
push ecx
push eax
call sub.WSOCK32.dll_connect
test eax, eax
je 0x42ab6b
mov edx, dword [esi + 0x88]
push edx
call sub.WSOCK32.dll_closesocket
mov eax, 3
pop esi
add esp, 0x10
ret
xor eax, eax
pop esi
add esp, 0x10
ret

Function at 0x42ab80
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x140
lea eax, [esp]
push esi
mov esi, dword [esp + 0x148]
push edi
push 0
mov ecx, dword [esi + 0x88]
push 0xff
push eax
push ecx
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
je 0x42ad02
lea edx, [esp + 8]
push str._secure_
push edx
mov byte [esp + eax + 0x10], 0
call fcn.0051c9c0
mov edi, eax
add esp, 8
test edi, edi
jne 0x42abdb
pop edi
mov eax, 5
pop esi
add esp, 0x140
ret
add edi, 8
push 6
push edi
lea eax, [esi + 0x2c]
push 6
push eax
call fcn.0042bfc0
lea ecx, [esp + 0x118]
push ecx
push 6
push edi
call fcn.0042bf10
lea edx, [esp + 0x124]
lea eax, [esi + 0x4c]
push edx
push 0x548bcc
push eax
lea ecx, [esp + 0x30]
push str.gamename_sgamever_slocation0_validate_s_finalqueryid1.1_
push ecx
call fcn.0051be3e
lea edi, [esp + 0x38]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x30
repne scasb al, byte es:[edi]
mov eax, dword [esi + 0x88]
push 0
not ecx
dec ecx
lea edx, [esp + 0xc]
push ecx
push edx
push eax
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
je 0x42ad02
test eax, eax
je 0x42ad02
mov eax, dword [esi + 0x90]
cmp eax, 6
jne 0x42ac6e
mov eax, str.groups
mov dword [esi + 0x98], 0
jmp 0x42ac89
cmp eax, 7
jne 0x42ac84
mov eax, str.info2
mov dword [esi + 0x98], 0
jmp 0x42ac89
mov eax, 0x548b74
mov ecx, dword [esp + 0x150]
lea edx, [esp + 8]
test ecx, ecx
je 0x42acae
push ecx
lea ecx, [esi + 0xc]
push ecx
push eax
push str.list_sgamename_swhere_s_final_
push edx
call fcn.0051be3e
add esp, 0x14
jmp 0x42acc1
lea ecx, [esi + 0xc]
push ecx
push eax
push str.list_sgamename_s_final_
push edx
call fcn.0051be3e
add esp, 0x10
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0xc]
push ecx
mov ecx, dword [esi + 0x88]
push eax
push ecx
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
je 0x42ad02
test eax, eax
je 0x42ad02
push 1
push esi
call fcn.0042ad10
add esp, 8
xor eax, eax
pop edi
pop esi
add esp, 0x140
ret
pop edi
mov eax, 3
pop esi
add esp, 0x140
ret
Function at 0x42add0
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ecx
push 0x11
push 2
push 2
mov dword [esp + 0xc], 1
call sub.WSOCK32.dll_socket
mov ecx, dword [esp + 8]
cmp eax, 0xffffffff
mov dword [ecx + 0x88], eax
jne 0x42adfa
mov eax, 1
pop ecx
ret
lea edx, [esp]
push 4
push edx
push 0x20
push 0xffff
push eax
call sub.WSOCK32.dll_setsockopt
neg eax
sbb eax, eax
neg eax
pop ecx
ret

Function at 0x42ae20
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
movsx eax, si
push edi
mov edi, dword [esp + 0x28]
cmp eax, edi
mov word [esp + 0xc], 2
mov dword [esp + 0x10], 0xffffffff
jg 0x42ae7e
push ebp
mov ebp, dword [esp + 0x30]
push esi
call sub.WSOCK32.dll_htons
mov edx, dword [ebx + 0x88]
lea ecx, [esp + 0x10]
push 0x10
push ecx
push 0
push 8
push str._status_
push edx
mov word [esp + 0x2a], ax
call sub.WSOCK32.dll_sendto
add esi, ebp
movsx eax, si
cmp eax, edi
jle 0x42ae4d
pop ebp
push 2
push ebx
call fcn.0042ad10
add esp, 8
call sub.KERNEL32.dll_GetTickCount
pop edi
mov dword [ebx + 0x8c], eax
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
Function at 0x42afc0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
push eax
call sub.WSOCK32.dll_inet_addr
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
mov ebx, eax
push ebp
push ebx
push esi
call fcn.0042af20
mov edi, eax
mov eax, dword [esi]
add esp, 0xc
test eax, eax
jne 0x42b083
push esi
call fcn.0042aa60
add esp, 4
test eax, eax
jne 0x42b112
cmp edi, 0xffffffff
je 0x42b038
mov ecx, dword [esi + 4]
push edi
push ecx
call fcn.00429e90
mov eax, dword [eax]
push edi
mov dword [esp + 0x30], eax
mov word [eax + 6], 0x270f
mov edx, dword [esi + 4]
push edx
call fcn.00429fa0
mov ecx, dword [esi + 4]
lea eax, [esp + 0x34]
push eax
push ecx
call fcn.00429eb0
add esp, 0x18
jmp 0x42b048
mov edx, dword [esp + 0x24]
push edx
push ebp
push ebx
push esi
call fcn.0042b120
add esp, 0x10
mov eax, dword [esi + 4]
push eax
call fcn.00429e80
dec eax
push 3
push esi
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], 0
call fcn.0042ad10
mov eax, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x42b110
push esi
call fcn.0042ad30
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp edi, 0xffffffff
jne 0x42b0a3
mov ecx, dword [esp + 0x24]
mov edx, dword [esi + 0x70]
push ecx
push edx
push ebp
push ebx
push esi
call fcn.0042b160
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esi + 4]
push edi
push eax
call fcn.00429e90
mov ecx, dword [esi + 0x70]
mov eax, dword [eax]
add esp, 8
cmp edi, ecx
mov dword [esp + 0x24], eax
jge 0x42b110
mov word [eax + 6], 0x270f
mov ecx, dword [esp + 0x24]
push ecx
push esi
call fcn.0042af90
add esp, 8
cmp eax, 0xffffffff
je 0x42b0ea
lea edx, [eax*8]
sub edx, eax
mov eax, dword [esi + 8]
mov dword [eax + edx*4 + 4], 0
mov ecx, dword [esi + 0x70]
mov eax, dword [esi + 4]
lea edx, [esp + 0x24]
push ecx
push edx
push eax
call fcn.00429ed0
mov ecx, dword [esi + 4]
push edi
push ecx
call fcn.00429fa0
mov eax, dword [esi + 0x70]
add esp, 0x14
dec eax
mov dword [esi + 0x70], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x42bfc0
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x110
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x42bfcc
push ebx
mov ebx, dword [esp + 0x11c]
push ebp
push esi
push edi
mov byte [esp + 0x10], 0
xor esi, esi
lea edi, [esp + 0x20]
mov ebp, pe_nt_image_headers32
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x124]
and eax, 0xff
xor ecx, ecx
mov cl, byte [eax + edx]
xor edx, edx
mov dl, byte [edi]
add esi, ecx
add edx, esi
and edx, 0x800000ff
jns 0x42c01e
dec edx
or edx, 0xffffff00
inc edx
inc eax
mov byte [esp + 0x14], dl
cdq
idiv ebx
mov esi, dword [esp + 0x14]
and esi, 0xff
lea eax, [esp + esi + 0x20]
push eax
push edi
mov byte [esp + 0x18], dl
call fcn.0042bec0
add esp, 8
inc edi
dec ebp
jne 0x42bff1
mov eax, dword [esp + 0x130]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x18], ebp
jle 0x42c11c
xor esi, esi
xor edi, edi
mov ecx, dword [esp + 0x12c]
mov al, byte [ecx + ebp]
and eax, 0xff
lea edx, [eax + esi + 1]
and edx, 0x800000ff
jns 0x42c082
dec edx
or edx, 0xffffff00
inc edx
mov byte [esp + 0x10], dl
xor eax, eax
mov esi, dword [esp + 0x10]
and esi, 0xff
mov al, byte [esp + esi + 0x20]
lea ebx, [esp + esi + 0x20]
add eax, edi
and eax, 0x800000ff
jns 0x42c0aa
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x14], al
mov edi, dword [esp + 0x14]
and edi, 0xff
lea eax, [esp + edi + 0x20]
push eax
push ebx
mov dword [esp + 0x24], eax
call fcn.0042bec0
mov eax, dword [esp + 0x24]
xor ecx, ecx
mov cl, byte [ebx]
xor edx, edx
mov dl, byte [eax]
add esp, 8
add ecx, edx
and ecx, 0x800000ff
jns 0x42c0e8
dec ecx
or ecx, 0xffffff00
inc ecx
mov eax, dword [esp + 0x12c]
and ecx, 0xff
mov cl, byte [esp + ecx + 0x20]
mov dl, byte [eax + ebp]
xor cl, dl
mov byte [eax + ebp], cl
mov eax, dword [esp + 0x18]
inc eax
movsx ebp, ax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x130]
cmp ebp, eax
jl 0x42c05f
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret

Function at 0x42d000
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
call fcn.00481630
lea eax, [esp]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
add esp, 0x190
ret
Function at 0x42d600
Capabilities:
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x14
test eax, eax
je 0x42d611
mov dword [eax], 0
push ebx
push ebp
push esi
push edi
call fcn.0042d000
push 0x11
push 2
push 2
call sub.WSOCK32.dll_socket
mov ebp, eax
cmp ebp, 0xffffffff
je 0x42d7de
mov esi, dword [esp + 0x30]
lea ebx, [esi + 0x64]
cmp esi, ebx
jge 0x42d67e
mov edi, dword [esp + 0x2c]
lea eax, [esp + 0x14]
push 0
push eax
push esi
push edi
call fcn.0042d9f0
add esp, 0x10
push 0x7f000001
call sub.WSOCK32.dll_htonl
cmp dword [esp + 0x18], eax
jne 0x42d668
mov dword [esp + 0x18], 0
lea ecx, [esp + 0x14]
push 0x10
push ecx
push ebp
call sub.WSOCK32.dll_bind
test eax, eax
je 0x42d68b
inc esi
cmp esi, ebx
jl 0x42d63f
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x14
ret
test esi, esi
jne 0x42d6cb
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push ebp
mov dword [esp + 0x1c], 0x10
call sub.WSOCK32.dll_getsockname
test eax, eax
je 0x42d6b8
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x14
ret
mov ecx, dword [esp + 0x16]
push ecx
call sub.WSOCK32.dll_ntohs
mov si, ax
and esi, 0xffff
mov edi, dword [esp + 0x28]
test edi, edi
jne 0x42d6df
mov dword [0x548f80], 0x548e90
jmp 0x42d6f3
push 0xf0
call fcn.0051ca40
mov dword [0x548f80], eax
add esp, 4
mov dword [edi], eax
mov edx, dword [0x548f80]
mov ecx, dword [esp + 0x34]
add edx, 8
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x42d700
mov eax, dword [0x548f80]
mov ecx, dword [esp + 0x38]
lea edx, [eax + 0x48]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x42d716
mov ecx, dword [0x548f80]
xor eax, eax
push 0x6cfc
push str.master.gamespy.com
mov dword [ecx + 0xe4], esi
mov edx, dword [0x548f80]
push ebp
mov dword [edx + 0xd8], eax
mov ecx, dword [0x548f80]
mov dword [ecx + 4], ebp
mov edx, dword [0x548f80]
mov dword [edx], ebp
mov ecx, dword [0x548f80]
mov dword [ecx + 0xe0], eax
mov edx, dword [0x548f80]
mov eax, 1
mov dword [edx + 0xdc], eax
mov ecx, dword [0x548f80]
mov byte [ecx + 0xe8], al
mov edx, dword [0x548f80]
mov eax, dword [esp + 0x58]
mov dword [edx + 0xec], eax
mov ecx, dword [0x548f80]
mov edx, dword [esp + 0x48]
mov dword [ecx + 0xc8], edx
mov eax, dword [0x548f80]
mov ecx, dword [esp + 0x4c]
mov dword [eax + 0xcc], ecx
mov edx, dword [0x548f80]
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x50]
mov dword [edx + 0xd4], eax
mov edx, dword [0x548f80]
mov dword [edx + 0xd0], ecx
call fcn.0042d9d0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret
Function at 0x42d830
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x120
push ebx
push esi
mov esi, dword [esp + 0x12c]
xor ebx, ebx
mov dword [esp + 8], 0x10
mov dword [esp + 0xc], ebx
mov eax, dword [esi]
mov dword [esp + 0x10], ebx
cmp eax, 0xffffffff
je 0x42d8bd
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 1
lea eax, [esp + 0xc]
lea ecx, [esp + 0x24]
push eax
push ebx
push ebx
push ecx
push 0x40
call sub.WSOCK32.dll_select
cmp eax, 0xffffffff
je 0x42d8bd
cmp eax, ebx
je 0x42d8bd
mov ecx, dword [esi]
lea edx, [esp + 8]
lea eax, [esp + 0x14]
push edx
push eax
push ebx
push 0xff
push 0x575bf0
push ecx
call sub.WSOCK32.dll_recvfrom
cmp eax, 0xffffffff
je 0x42d864
lea edx, [esp + 0x14]
mov byte [eax + 0x575bf0], bl
push edx
push 0x575bf0
push esi
call fcn.0042da70
add esp, 0xc
jmp 0x42d864
pop esi
pop ebx
add esp, 0x120
ret

Function at 0x42d9f0
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push eax
xor ebp, ebp
mov word [ebx], 2
call sub.WSOCK32.dll_htons
mov esi, dword [esp + 0x10]
mov word [ebx + 2], ax
cmp esi, ebp
jne 0x42da19
mov dword [ebx + 4], ebp
jmp 0x42da22
push esi
call sub.WSOCK32.dll_inet_addr
mov dword [ebx + 4], eax
cmp dword [ebx + 4], 0xffffffff
jne 0x42da58
push edi
mov edi, str.255.255.255.255
mov ecx, 0x10
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
pop edi
je 0x42da58
mov eax, dword [esp + 0x10]
push eax
call sub.WSOCK32.dll_gethostbyname
mov ebp, eax
test ebp, ebp
jne 0x42da4e
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x42da62
mov dword [eax], ebp
pop esi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x42dd70
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x50
or ecx, 0xffffffff
xor eax, eax
push ebp
mov ebp, dword [esp + 0x60]
push edi
mov edi, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x42de04
push ebx
mov ebx, dword [esp + 0x60]
push esi
lea ecx, [esp + 0x10]
mov edi, dword [ebx + 0xe0]
inc edi
mov eax, edi
mov dword [ebx + 0xe0], edi
push eax
mov eax, dword [ebx + 0xdc]
push eax
push str.queryid_d._d
push ecx
call fcn.0051be3e
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x10
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x6c]
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [ebx]
push ebp
push ecx
call sub.WSOCK32.dll_sendto
pop esi
mov byte [ebp], 0
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x42e250
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x100
lea edx, [esp]
push esi
mov esi, dword [esp + 0x108]
push edi
mov ecx, dword [esi + 0xe4]
lea eax, [esi + 8]
push eax
push ecx
push str.heartbeat_dgamename_s
push edx
call fcn.0051be3e
mov eax, dword [esp + 0x120]
add esp, 0x10
test eax, eax
je 0x42e2bf
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [0x549050]
repne scasb al, byte es:[edi]
mov eax, dword [str._statechanged_]
mov ecx, dword [0x54904c]
dec edi
mov dword [edi], eax
mov ax, word [0x549054]
mov dword [edi + 4], ecx
mov cl, byte [0x549056]
mov dword [edi + 8], edx
mov word [edi + 0xc], ax
mov byte [edi + 0xe], cl
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
push 0x10
repne scasb al, byte es:[edi]
mov eax, dword [esi + 4]
push 0x575ef8
not ecx
dec ecx
push 0
lea edx, [esp + 0x14]
push ecx
push edx
push eax
call sub.WSOCK32.dll_sendto
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 0xd8], eax
pop edi
pop esi
add esp, 0x100
ret
Function at 0x4452b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
mov ebx, dword [esp + 0x14]
push esi
push edi
mov edi, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
xor eax, eax
mov al, byte [edi]
shr eax, 7
lea ecx, [ebx + eax*8]
lea eax, [edx + ecx*8]
xor edx, edx
mov dx, word [eax*8 + 0xeead40]
xor ecx, ecx
lea eax, [eax*8 + 0xeead40]
mov esi, edx
and esi, 1
mov ebp, esi
mov cx, word [eax + 4]
shl ebp, 6
sub ebp, esi
xor esi, esi
mov si, word [eax + 2]
add ebp, esi
xor esi, esi
mov si, word [edi + ebp*2 + 0x34]
and esi, edx
mov edx, ecx
and esi, 0xfffffffe
neg esi
sbb esi, esi
and edx, 1
mov ebp, edx
and esi, 2
shl ebp, 6
sub ebp, edx
xor edx, edx
mov dx, word [eax + 6]
xor eax, eax
add ebp, edx
mov ax, word [edi + ebp*2 + 0x34]
pop edi
and eax, ecx
mov ecx, dword [esp + 0x1c]
and al, 0xfe
neg eax
sbb eax, eax
add ebx, ecx
mov ecx, dword [esp + 0x10]
and eax, 4
or esi, eax
and ebx, 1
or esi, ebx
mov eax, dword [esi*4 + 0x54d470]
pop esi
pop ebp
cmp eax, 2
mov dword [ecx + 0x20], eax
pop ebx
jne 0x44537f
mov eax, dword [esp + 8]
fld dword [ecx + 8]
fmul dword [eax + 8]
fld dword [ecx + 4]
fmul dword [eax + 4]
faddp st(1)
fld dword [ecx]
fmul dword [eax]
faddp st(1)
fcomp dword [ecx + 0xc]
fnstsw ax
test ah, 5
jp 0x4453a0
mov dword [ecx + 0x20], 1
ret
cmp eax, 5
je 0x445389
cmp eax, 6
jne 0x4453a0
mov edx, dword [ecx + 0x10]
mov eax, dword [ecx + 0x14]
mov dword [ecx], edx
mov edx, dword [ecx + 0x18]
mov dword [ecx + 4], eax
mov eax, dword [ecx + 0x1c]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
ret
Function at 0x44d160
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0xee2ce4]
test eax, eax
jne 0x44d18c
push str.Server_quit_n
call fcn.004770b0
call fcn.00439f70
call fcn.0047f370
call fcn.0044ec30
push 1
call fcn.004538a0
add esp, 8
jmp 0x481450
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
call fcn.005130d0
call fcn.00512e20
call fcn.00511b20
call fcn.00458dd0
call fcn.0047e950
call fcn.00488980
call fcn.0045d780
mov eax, dword [0x801444]
test eax, eax
jne 0x481489
call fcn.00428000
push 0
call fcn.0051f314

Function at 0x45c950
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret