joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd10b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, eax
mov eax, edx
push edi
mov edi, edx
sar eax, 0x1f
push esi
xor edi, eax
push ebx
sub edi, eax
sub esp, 8
cmp edi, 7
mov esi, ecx
movzx ecx, byte [ecx]
mov dword [esp], edx
jg 0xd0fc30
xor edx, edx
mov eax, ebp
call fcn.00d0fa60
movzx ecx, byte [esi + 2]
mov ebx, edi
sar ebx, 2
mov eax, ebp
mov edx, ebx
call fcn.00d0fa60
movsx ebx, byte [ebx + 0x12815a0]
mov dword [esp + 4], ebx
movzx eax, byte [esp + 4]
mov ebx, edi
sar ebx, 1
and ebx, 1
mov edx, ebx
sar al, 1
movsx eax, al
movzx ecx, byte [esi + eax + 2]
mov eax, ebp
call fcn.00d0fa60
mov eax, dword [esp + 4]
mov edx, edi
and edx, 1
movzx eax, byte [ebx + eax + 0x12815a0]
sar al, 1
movsx eax, al
movzx ecx, byte [esi + eax + 2]
mov eax, ebp
call fcn.00d0fa60
test edi, edi
je 0xd0fd07
mov edx, dword [esp]
mov eax, ebp
movzx ecx, byte [esi + 1]
add esp, 8
pop ebx
pop esi
pop edi
pop ebp
shr edx, 0x1f
jmp fcn.00d0fa60
mov edx, 1
mov eax, ebp
call fcn.00d0fa60
movzx ecx, byte [esi + 9]
mov edx, edi
and edx, 1
mov eax, ebp
call fcn.00d0fa60
movzx ecx, byte [esi + 0xa]
mov edx, edi
sar edx, 1
mov eax, ebp
and edx, 1
call fcn.00d0fa60
movzx ecx, byte [esi + 0xb]
mov edx, edi
sar edx, 2
mov eax, ebp
and edx, 1
call fcn.00d0fa60
movzx ecx, byte [esi + 0x12]
mov edx, edi
sar edx, 9
mov eax, ebp
and edx, 1
call fcn.00d0fa60
movzx ecx, byte [esi + 0x11]
mov edx, edi
sar edx, 8
mov eax, ebp
and edx, 1
call fcn.00d0fa60
movzx ecx, byte [esi + 0x10]
mov edx, edi
sar edx, 7
mov eax, ebp
and edx, 1
call fcn.00d0fa60
movzx ecx, byte [esi + 0xf]
mov edx, edi
sar edx, 6
mov eax, ebp
and edx, 1
call fcn.00d0fa60
movzx ecx, byte [esi + 0xe]
mov edx, edi
sar edx, 5
mov eax, ebp
and edx, 1
call fcn.00d0fa60
movzx ecx, byte [esi + 0xd]
mov edx, edi
sar edx, 4
mov eax, ebp
and edx, 1
call fcn.00d0fa60
test edi, 0xfff0
je 0xd0fc14
movzx ecx, byte [esi + 0xc]
mov edx, edi
mov eax, ebp
sar edx, 3
and edx, 1
call fcn.00d0fa60
jmp 0xd0fc14
add esp, 8
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
mov dword [esp], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 4], esi
mov esi, dword [esp + 0x18]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x10]
movzx edx, word [ebx]
mov ecx, esi
mov eax, edi
sar dx, 1
movsx edx, dx
call 0xd0fb80
movzx edx, word [ebx + 2]
lea ecx, [esi + 0x13]
mov eax, edi
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0xc
sar dx, 1
movsx edx, dx
jmp 0xd0fb80
Function at 0xd52f50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov eax, esp
and esp, 0xfffffff0
lea esp, [esp - 0xc]
push eax
sub esp, 0x20
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x14]
movq mm7, qword [edx]
mov edi, esi
add edi, eax
movq mm2, qword [edi + eax*2]
movq mm1, qword [esi + eax*2]
movq mm6, mm1
psubusb mm1, mm2
psubusb mm2, mm6
por mm1, mm2
psubusb mm1, mm7
movq mm4, qword [esi + eax]
movq mm3, mm4
psubusb mm4, mm6
psubusb mm6, mm3
por mm4, mm6
psubusb mm4, mm7
por mm1, mm4
movq mm4, qword [esi]
movq mm0, mm4
psubusb mm4, mm3
psubusb mm3, mm0
por mm4, mm3
movq qword [esp], mm4
psubusb mm4, mm7
por mm1, mm4
neg eax
movq mm2, qword [esi + eax*4]
movq mm4, qword [edi + eax*4]
movq mm5, mm4
psubusb mm4, mm2
psubusb mm2, mm5
por mm4, mm2
psubusb mm4, mm7
por mm1, mm4
movq mm4, qword [esi + eax*2]
movq mm3, mm4
psubusb mm4, mm5
psubusb mm5, mm3
por mm4, mm5
psubusb mm4, mm7
por mm1, mm4
movq mm2, mm3
movq mm4, qword [esi + eax]
movq mm5, mm4
psubusb mm4, mm3
psubusb mm3, mm5
por mm4, mm3
movq qword [esp + 0x10], mm4
psubusb mm4, mm7
por mm1, mm4
movq mm3, qword [edi]
movq mm4, mm3
psubusb mm3, mm2
psubusb mm2, mm4
por mm2, mm3
pand mm2, qword [0x14d4440]
psrlw mm2, 1
movq mm6, mm5
movq mm3, qword [esi]
psubusb mm5, mm3
psubusb mm3, mm6
por mm5, mm3
paddusb mm5, mm5
paddusb mm5, mm2
mov edx, dword [ebp + 0x10]
movq mm7, qword [edx]
psubusb mm5, mm7
por mm1, mm5
pxor mm5, mm5
pcmpeqb mm1, mm5
mov edx, dword [ebp + 0x18]
movq mm7, qword [edx]
movq mm4, qword [esp]
psubusb mm4, mm7
movq mm3, qword [esp + 0x10]
psubusb mm3, mm7
paddb mm4, mm3
pcmpeqb mm4, mm5
pcmpeqb mm5, mm5
pxor mm4, mm5
movq mm2, qword [esi + eax*2]
movq mm7, qword [edi]
pxor mm2, qword [0x14d4450]
pxor mm7, qword [0x14d4450]
psubsb mm2, mm7
pand mm2, mm4
pxor mm6, qword [0x14d4450]
pxor mm0, qword [0x14d4450]
movq mm3, mm0
psubsb mm0, mm6
paddsb mm2, mm0
paddsb mm2, mm0
paddsb mm2, mm0
pand mm1, mm2
movq mm2, mm1
paddsb mm1, qword [0x14d4480]
paddsb mm2, qword [0x14d4470]
pxor mm0, mm0
pxor mm5, mm5
punpcklbw mm0, mm2
punpckhbw mm5, mm2
psraw mm0, 0xb
psraw mm5, 0xb
packsswb mm0, mm5
movq mm2, mm0
pxor mm0, mm0
movq mm5, mm1
punpcklbw mm0, mm1
psraw mm0, 0xb
pxor mm1, mm1
punpckhbw mm1, mm5
psraw mm1, 0xb
movq mm5, mm0
packsswb mm0, mm1
paddsw mm5, qword [0x14d4490]
paddsw mm1, qword [0x14d4490]
psraw mm5, 1
psraw mm1, 1
packsswb mm5, mm1
pandn mm4, mm5
paddsb mm6, mm2
pxor mm6, qword [0x14d4450]
movq qword [esi + eax], mm6
movq mm6, qword [esi + eax*2]
pxor mm6, qword [0x14d4450]
paddsb mm6, mm4
pxor mm6, qword [0x14d4450]
movq qword [esi + eax*2], mm6
psubsb mm3, mm0
pxor mm3, qword [0x14d4450]
movq qword [esi], mm3
psubsb mm7, mm4
pxor mm7, qword [0x14d4450]
movq qword [edi], mm7
add esi, 8
neg eax
dec ecx
jne 0xd52f6b
add esp, 0x20
pop esp
pop edi
pop esi
pop ebp
ret
Function at 0xd53b3c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, 2
mov edx, dword [ebp + 0x10]
movq mm3, qword [edx]
mov edi, esi
add edi, eax
neg eax
movq mm1, qword [esi + eax*2]
movq mm0, qword [edi]
movq mm2, mm1
movq mm7, mm0
movq mm4, mm0
psubusb mm0, mm1
psubusb mm1, mm4
por mm1, mm0
pand mm1, qword [0x14d4440]
psrlw mm1, 1
movq mm5, qword [esi + eax]
movq mm4, qword [esi]
movq mm0, mm4
movq mm6, mm5
psubusb mm5, mm4
psubusb mm4, mm6
por mm5, mm4
paddusb mm5, mm5
paddusb mm5, mm1
psubusb mm5, mm3
pxor mm3, mm3
pcmpeqb mm5, mm3
pxor mm2, qword [0x14d4450]
pxor mm7, qword [0x14d4450]
psubsb mm2, mm7
pxor mm6, qword [0x14d4450]
pxor mm0, qword [0x14d4450]
movq mm3, mm0
psubsb mm0, mm6
paddsb mm2, mm0
paddsb mm2, mm0
paddsb mm2, mm0
pand mm5, mm2
paddsb mm5, qword [0x14d4480]
movq mm0, mm5
psllw mm0, 8
psraw mm0, 3
psrlw mm0, 8
movq mm1, mm5
psraw mm1, 0xb
psllw mm1, 8
por mm0, mm1
psubsb mm3, mm0
pxor mm3, qword [0x14d4450]
movq qword [esi], mm3
psubsb mm5, qword [0x14d4460]
movq mm0, mm5
psllw mm0, 8
psraw mm0, 3
psrlw mm0, 8
psraw mm5, 0xb
psllw mm5, 8
por mm0, mm5
paddsb mm6, mm0
pxor mm6, qword [0x14d4450]
movq qword [esi + eax], mm6
add esi, 8
neg eax
dec ecx
jne 0xd53b4c
pop edi
pop esi
pop ebp
ret
Function at 0xd53c42
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov eax, esp
and esp, 0xfffffff0
lea esp, [esp - 0xc]
push eax
sub esp, 0x20
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
lea esi, [esi + eax*4 - 2]
mov ecx, 2
lea edi, [esi + eax]
movd mm0, dword [edi + eax*2]
movd mm6, dword [esi + eax*2]
punpcklbw mm6, mm0
movd mm0, dword [esi + eax]
movd mm4, dword [esi]
punpcklbw mm4, mm0
movq mm5, mm4
punpcklwd mm4, mm6
punpckhwd mm5, mm6
neg eax
movd mm7, dword [esi + eax]
movd mm6, dword [esi + eax*2]
punpcklbw mm6, mm7
movd mm1, dword [edi + eax*4]
movd mm0, dword [esi + eax*4]
punpcklbw mm0, mm1
movq mm2, mm0
punpcklwd mm0, mm6
punpckhwd mm2, mm6
movq mm1, mm0
punpckldq mm0, mm4
movq mm3, mm2
punpckhdq mm1, mm4
punpckldq mm2, mm5
punpckhdq mm3, mm5
movq mm6, mm0
movq mm7, mm3
psubusb mm7, mm6
psubusb mm6, mm3
por mm6, mm7
pand mm6, qword [0x14d4440]
psrlw mm6, 1
movq mm5, mm1
movq mm4, mm2
psubusb mm5, mm2
psubusb mm4, mm1
por mm5, mm4
paddusb mm5, mm5
paddusb mm5, mm6
mov edx, dword [ebp + 0x10]
movq mm7, qword [edx]
psubusb mm5, mm7
pxor mm7, mm7
pcmpeqb mm5, mm7
movq qword [esp], mm0
movq qword [esp + 0x10], mm3
pxor mm0, qword [0x14d4450]
pxor mm3, qword [0x14d4450]
psubsb mm0, mm3
movq mm6, mm1
movq mm7, mm2
pxor mm6, qword [0x14d4450]
pxor mm7, qword [0x14d4450]
movq mm3, mm7
psubsb mm7, mm6
paddsb mm0, mm7
paddsb mm0, mm7
paddsb mm0, mm7
pand mm5, mm0
paddsb mm5, qword [0x14d4480]
movq mm0, mm5
psllw mm0, 8
psraw mm0, 3
psrlw mm0, 8
movq mm7, mm5
psraw mm7, 0xb
psllw mm7, 8
por mm0, mm7
psubsb mm3, mm0
pxor mm3, qword [0x14d4450]
psubsb mm5, qword [0x14d4460]
movq mm0, mm5
psllw mm0, 8
psraw mm0, 3
psrlw mm0, 8
psraw mm5, 0xb
psllw mm5, 8
por mm0, mm5
paddsb mm6, mm0
pxor mm6, qword [0x14d4450]
movq mm0, qword [esp]
movq mm4, qword [esp + 0x10]
movq mm1, mm0
punpcklbw mm0, mm6
punpckhbw mm1, mm6
movq mm2, mm3
punpcklbw mm2, mm4
movq mm5, mm1
punpckhbw mm3, mm4
movq mm6, mm0
punpcklwd mm0, mm2
punpckhwd mm6, mm2
movd dword [esi + eax*4], mm0
punpcklwd mm1, mm3
psrlq mm0, 0x20
punpckhwd mm5, mm3
movd dword [edi + eax*4], mm0
movd dword [esi + eax*2], mm6
psrlq mm6, 0x20
movd dword [esi], mm1
movd dword [esi + eax], mm6
neg eax
movd dword [esi + eax*2], mm5
psrlq mm1, 0x20
movd dword [edi], mm1
psrlq mm5, 0x20
movd dword [edi + eax*2], mm5
lea esi, [esi + eax*8]
dec ecx
jne 0xd53c63
add esp, 0x20
pop esp
pop edi
pop esi
pop ebp
ret
Function at 0xe9a320
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 4
movzx ebx, byte [eax + 1]
mov dword [esp], edx
movzx edx, byte [eax + 2]
shl ecx, 4
movzx esi, byte [eax + 6]
lea edi, [ecx + 0x14609e0]
shl ebx, 8
shl edx, 0x10
or ebx, edx
movzx edx, byte [eax]
shl esi, 0x10
or ebx, edx
movzx edx, byte [eax + 3]
shl edx, 0x18
or ebx, edx
movzx edx, byte [eax + 5]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 4]
movzx eax, byte [eax + 7]
or edx, esi
shl eax, 0x18
or edx, eax
xor eax, eax
mov ecx, eax
mov esi, edx
and ecx, 3
mov ebp, edx
mov ecx, dword [edi + ecx*4]
shr esi, 5
shl ebp, 4
xor esi, ebp
add esi, edx
add ecx, eax
sub eax, 0x61c88647
xor ecx, esi
add ebx, ecx
mov ecx, ebx
mov esi, ebx
shl esi, 4
shr ecx, 5
xor ecx, esi
mov esi, eax
shr esi, 0xb
add ecx, ebx
and esi, 3
mov esi, dword [edi + esi*4]
add esi, eax
xor ecx, esi
add edx, ecx
cmp eax, 0xc6ef3720
jne 0xe9a372
mov eax, dword [esp]
mov ecx, dword [esp]
mov byte [eax], bl
mov eax, ebx
shr eax, 8
mov byte [ecx + 1], al
mov eax, ebx
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, edx
shr eax, 8
mov byte [ecx + 5], al
mov eax, edx
mov byte [ecx + 4], dl
shr ebx, 0x18
shr eax, 0x10
shr edx, 0x18
mov byte [ecx + 3], bl
mov byte [ecx + 6], al
mov byte [ecx + 7], dl
add esp, 4
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0xe9af00
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x3c
mov dword [esp + 0x30], esi
mov esi, edx
mov edx, dword [ecx + 4]
mov dword [esp + 0x34], edi
mov edi, dword [ecx]
mov dword [esp + 0x2c], ebx
mov ebx, eax
mov dword [esp + 0x38], ebp
mov ebp, ecx
cmp byte [edi + edx], 0
jne 0xe9af73
mov dword [esp], edi
call dword [sym.imp.WS2_32.dll_inet_addr]
sub esp, 4
cmp eax, 0xffffffff
mov dword [esi], eax
je 0xe9afb0
movzx eax, word [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebx], ax
sub esp, 4
mov ebx, 1
cmp edi, dword [ebp]
je 0xe9af5d
mov dword [esp], edi
call fcn.0108ed00
mov eax, ebx
mov esi, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
add esp, 0x3c
ret
lea eax, [edx + 1]
mov dword [esp + 0x1c], edx
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov edx, dword [esp + 0x1c]
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 0x1c], eax
call sub.msvcrt.dll_memcpy
mov ecx, dword [esp + 0x1c]
mov eax, dword [ebp + 4]
mov edi, ecx
mov byte [ecx + eax], 0
jmp 0xe9af24
mov dword [esp], edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
sub esp, 4
test eax, eax
je 0xe9afd2
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
test eax, eax
je 0xe9afd2
mov eax, dword [eax]
mov dword [esi], eax
jmp 0xe9af37
mov dword [esp + 8], edi
xor ebx, ebx
mov dword [esp + 4], str.Problem_accessing_the_DNS.__addr:__s_
mov dword [esp], 1
call fcn.00ea3ac0
jmp 0xe9af50
Function at 0xe9b000
Capabilities:
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
push eax
mov eax, 0x1070
call fcn.01087f10
sub esp, eax
mov eax, dword [esp + 0x1070]
lea edi, [esp + 0x101c]
mov dword [esp + 8], edx
lea ebx, [esp + 0x1c]
mov dword [esp + 0x10], ebx
mov dword [esp + 4], eax
lea eax, [ecx + ecx*2]
mov ecx, 0x12
lea edx, [eax*8 + str.y4wLg]
mov eax, 0x1460c60
mov esi, eax
mov eax, 0x1460cc0
rep movsd dword es:[edi], dword [esi]
mov esi, eax
mov ebp, edx
lea edi, [esp + 0x1c]
lea eax, [esp + 0x101c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x1064]
mov dword [esp], eax
xor eax, eax
mov cx, 0x400
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0xc]
mov ecx, 4
xor edx, edx
xor edi, edi
mov ebx, edx
movzx edx, byte [ebp + eax]
add eax, 1
shl ebx, 8
or edx, ebx
cmp eax, 0x18
cmovge eax, edi
sub ecx, 1
jne 0xe9b07e
xor dword [esi], edx
add esi, 4
cmp esi, dword [esp]
jne 0xe9b075
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
mov dword [esp + 0x106c], 0
mov dword [esp + 0x1070], 0
lea eax, [esp + 0x106c]
lea edx, [esp + 0x1c]
call fcn.00e9a400
mov eax, dword [esp + 0x106c]
mov dword [esi], eax
mov eax, dword [esp + 0x1070]
mov dword [esi + 4], eax
add esi, 8
cmp dword [esp], esi
jne 0xe9b0c0
lea edi, [esp + 0x101c]
xor esi, esi
lea eax, [esp + 0x106c]
lea edx, [esp + 0x1c]
call fcn.00e9a400
mov eax, dword [esp + 0x106c]
mov dword [ebx + esi*4], eax
mov eax, dword [esp + 0x1070]
mov dword [ebx + esi*4 + 4], eax
add esi, 2
cmp esi, 0x100
jne 0xe9b0f4
add ebx, 0x400
cmp ebx, edi
jne 0xe9b0f2
mov edx, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx eax, byte [edx + 1]
movzx edx, byte [edx + 2]
shl eax, 8
shl edx, 0x10
or eax, edx
movzx edx, byte [ecx]
or eax, edx
movzx edx, byte [ecx + 3]
shl edx, 0x18
or eax, edx
movzx edx, byte [ecx + 6]
mov dword [esp + 0x1064], eax
movzx eax, byte [ecx + 5]
shl edx, 0x10
shl eax, 8
or eax, edx
movzx edx, byte [ecx + 4]
or eax, edx
movzx edx, byte [ecx + 7]
shl edx, 0x18
or eax, edx
mov dword [esp + 0x1068], eax
lea edx, [esp + 0x1c]
lea eax, [esp + 0x1064]
call fcn.00e9a400
mov eax, dword [esp + 0x1064]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 8]
mov byte [edx], al
mov edx, eax
shr edx, 8
mov byte [ecx + 1], dl
mov edx, eax
shr eax, 0x18
mov byte [ecx + 3], al
mov eax, dword [esp + 0x1068]
shr edx, 0x10
mov byte [ecx + 2], dl
mov edx, eax
shr edx, 8
mov byte [ecx + 5], dl
mov edx, eax
mov byte [ecx + 4], al
shr edx, 0x10
shr eax, 0x18
mov byte [ecx + 6], dl
mov byte [ecx + 7], al
add esp, 0x1074
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0xe9c8d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov edx, dword [ebx + 4]
test edx, edx
je 0xe9c9a0
mov ecx, dword [ebx + 8]
lea ebp, [ebx + 0xc]
mov eax, 0x4000
mov esi, ebp
sub esi, ecx
sub eax, edx
add eax, esi
mov esi, dword [ebx + 0x4010]
test esi, esi
je 0xe9c9b0
add edx, ecx
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], esi
call fcn.00eb3870
mov edi, eax
cmp edi, 0xffffffff
jne 0xe9c9d7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], str.RTMPSockBuf_Fill
mov dword [esp + 4], str._s__recv_returned__d._GetSockError__:__d___s_
mov dword [esp], 4
mov dword [esp + 0x14], eax
call fcn.00ea3ac0
cmp esi, 4
jne 0xe9c980
mov esi, dword [0x1b30054]
test esi, esi
jne 0xe9c991
mov ecx, dword [ebx + 8]
mov edx, dword [ebx + 4]
jmp 0xe9c8ec
cmp esi, 0xb
jne 0xe9c9dc
mov dword [ebx + 0x400c], 1
xor edi, edi
add esp, 0x2c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebp, [ebx + 0xc]
mov ecx, ebp
mov dword [ebx + 8], ebp
jmp 0xe9c8ec
add edx, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_recv]
sub esp, 0x10
mov edi, eax
jmp 0xe9c91b
add dword [ebx + 4], edi
jmp 0xe9c991
cmp esi, 0x274c
je 0xe9c985
jmp 0xe9c991

Function at 0xe9cb70
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
sub esp, 0x18
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
mov eax, dword [edx + 0x4010]
test eax, eax
je 0xe9cb97
mov dword [esp + 0x20], eax
add esp, 0x18
pop ebx
jmp 0xeb3970
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 4], ecx
mov eax, dword [edx]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
add esp, 0x18
pop ebx
ret
push ebx
sub esp, 0x28
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov ebx, dword [eax + 0x20]
test ebx, ebx
je 0xeb39ed
test byte [eax + 0x30], 1
jne 0xeb39b0
mov ebx, dword [eax + 8]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x34], edx
mov dword [esp + 0x30], eax
mov eax, dword [ebx + 0x20]
add esp, 0x28
pop ebx
jmp eax
mov dword [eax + 0x18], 1
mov dword [esp + 0x10], 0x3d7
mov dword [esp + 0xc], str.ssl_lib.c
mov dword [esp + 8], 0xcf
mov dword [esp + 4], 0xd0
mov dword [esp], 0x14
call fcn.00eefad0
mov eax, 0xffffffff
add esp, 0x28
pop ebx
ret
mov dword [esp + 0x10], 0x3d0
mov dword [esp + 0xc], str.ssl_lib.c
mov dword [esp + 8], 0x114
mov dword [esp + 4], 0xd0
mov dword [esp], 0x14
call fcn.00eefad0
jmp 0xeb39e3
Function at 0xead400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
test eax, eax
je 0xead603
cmp edx, 0x38
jne 0xead603
cmp byte [eax], 0x31
jne 0xead603
test esi, esi
je 0xead610
mov eax, dword [esi + 0x20]
mov dword [esi + 0x18], 0
test eax, eax
je 0xead5f0
mov ebx, dword [esi + 0x24]
test ebx, ebx
je 0xead5e0
cmp edi, 0xffffffff
je 0xead5d1
cmp edi, 9
jg 0xead610
mov eax, edi
shr eax, 0x1f
test al, al
jne 0xead610
mov dword [esp + 8], 0x16c4
mov dword [esp + 4], 1
mov eax, dword [esi + 0x28]
mov dword [esp], eax
call dword [esi + 0x20]
test eax, eax
mov ebx, eax
je 0xead635
mov dword [esi + 0x1c], eax
mov dword [eax], esi
mov dword [eax + 0x18], 1
mov dword [eax + 0x1c], 0
mov dword [eax + 0x30], 0xf
mov dword [eax + 0x2c], 0x8000
mov dword [eax + 0x34], 0x7fff
mov dword [eax + 0x50], 0xf
mov dword [eax + 0x4c], 0x8000
mov dword [eax + 0x54], 0x7fff
mov dword [eax + 0x58], 5
mov dword [esp + 8], 2
mov dword [esp + 4], 0x8000
mov eax, dword [esi + 0x28]
mov dword [esp], eax
call dword [esi + 0x20]
mov dword [ebx + 0x38], eax
mov dword [esp + 8], 2
mov eax, dword [ebx + 0x2c]
mov dword [esp + 4], eax
mov eax, dword [esi + 0x28]
mov dword [esp], eax
call dword [esi + 0x20]
mov dword [ebx + 0x40], eax
mov dword [esp + 8], 2
mov eax, dword [ebx + 0x4c]
mov dword [esp + 4], eax
mov eax, dword [esi + 0x28]
mov dword [esp], eax
call dword [esi + 0x20]
mov dword [ebx + 0x16c0], 0
mov dword [ebx + 0x169c], 0x4000
mov dword [ebx + 0x44], eax
mov dword [esp + 8], 4
mov dword [esp + 4], 0x4000
mov eax, dword [esi + 0x28]
mov dword [esp], eax
call dword [esi + 0x20]
mov edx, dword [ebx + 0x169c]
lea ecx, [edx*4]
mov dword [ebx + 0xc], ecx
mov ecx, dword [ebx + 0x38]
mov dword [ebx + 8], eax
test ecx, ecx
je 0xead617
mov ecx, dword [ebx + 0x40]
test ecx, ecx
je 0xead617
mov ecx, dword [ebx + 0x44]
test ecx, ecx
je 0xead617
test eax, eax
je 0xead617
mov ecx, edx
and ecx, 0xfffffffe
lea edx, [edx + edx*2]
add ecx, eax
add eax, edx
mov dword [ebx + 0x16a4], ecx
mov dword [ebx + 0x1698], eax
mov dword [ebx + 0x84], edi
mov dword [ebx + 0x88], 0
mov byte [ebx + 0x24], 8
mov dword [esp + 0x20], esi
add esp, 0x10
pop ebx
pop esi
pop edi
jmp fcn.00eab840
mov edi, 6
jmp 0xead474
mov dword [esi + 0x24], 0xeadfa0
jmp 0xead455
mov dword [esi + 0x20], 0xeadf80
mov dword [esi + 0x28], 0
jmp 0xead44a
mov eax, 0xfffffffa
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov eax, 0xfffffffe
jmp 0xead608
mov eax, dword [str.insufficient_memory]
mov dword [ebx + 4], 0x29a
mov dword [esi + 0x18], eax
mov dword [esp], esi
call fcn.00ead010
mov eax, 0xfffffffc
jmp 0xead608
mov eax, 0xfffffffc
jmp 0xead608
Function at 0xee1b80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
test esi, esi
je 0xee1d40
mov eax, dword [esi + 0x14]
mov edx, dword [esi + 0x1c]
test edx, edx
jne 0xee1d30
mov ebx, dword [esi]
test ebx, ebx
je 0xee1d22
lea esi, [esi]
mov eax, dword [ebx]
test eax, eax
je 0xee1bbe
mov dword [esp], ebx
call fcn.00ee0530
mov eax, dword [ebx + 0x14]
test eax, eax
je 0xee1bd0
lea eax, [ebx + 0x14]
mov dword [esp], eax
call fcn.00ee0530
mov eax, dword [ebx + 0x28]
test eax, eax
je 0xee1be2
lea eax, [ebx + 0x28]
mov dword [esp], eax
call fcn.00ee0530
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0xee1bf4
lea eax, [ebx + 0x3c]
mov dword [esp], eax
call fcn.00ee0530
mov eax, dword [ebx + 0x50]
test eax, eax
je 0xee1c06
lea eax, [ebx + 0x50]
mov dword [esp], eax
call fcn.00ee0530
mov ecx, dword [ebx + 0x64]
test ecx, ecx
je 0xee1c18
lea eax, [ebx + 0x64]
mov dword [esp], eax
call fcn.00ee0530
mov edx, dword [ebx + 0x78]
test edx, edx
je 0xee1c2a
lea eax, [ebx + 0x78]
mov dword [esp], eax
call fcn.00ee0530
mov eax, dword [ebx + 0x8c]
test eax, eax
je 0xee1c42
lea eax, [ebx + 0x8c]
mov dword [esp], eax
call fcn.00ee0530
mov eax, dword [ebx + 0xa0]
test eax, eax
je 0xee1c5a
lea eax, [ebx + 0xa0]
mov dword [esp], eax
call fcn.00ee0530
mov eax, dword [ebx + 0xb4]
test eax, eax
je 0xee1c72
lea eax, [ebx + 0xb4]
mov dword [esp], eax
call fcn.00ee0530
mov eax, dword [ebx + 0xc8]
test eax, eax
je 0xee1c8a
lea eax, [ebx + 0xc8]
mov dword [esp], eax
call fcn.00ee0530
mov eax, dword [ebx + 0xdc]
test eax, eax
je 0xee1ca2
lea eax, [ebx + 0xdc]
mov dword [esp], eax
call fcn.00ee0530
mov eax, dword [ebx + 0xf0]
test eax, eax
je 0xee1cba
lea eax, [ebx + 0xf0]
mov dword [esp], eax
call fcn.00ee0530
mov ecx, dword [ebx + 0x104]
test ecx, ecx
je 0xee1cd2
lea eax, [ebx + 0x104]
mov dword [esp], eax
call fcn.00ee0530
mov edx, dword [ebx + 0x118]
test edx, edx
je 0xee1cea
lea eax, [ebx + 0x118]
mov dword [esp], eax
call fcn.00ee0530
mov eax, dword [ebx + 0x12c]
test eax, eax
je 0xee1d02
add ebx, 0x12c
mov dword [esp], ebx
call fcn.00ee0530
mov eax, dword [esi]
mov edx, dword [eax + 0x144]
mov dword [esi + 4], edx
mov dword [esp], eax
call fcn.00ef5c50
mov ebx, dword [esi + 4]
mov dword [esi], ebx
test ebx, ebx
jne 0xee1bb0
mov dword [esp + 0x20], esi
add esp, 0x14
pop ebx
pop esi
jmp fcn.00ef5c50
mov dword [esp], eax
call fcn.00ef5c50
jmp 0xee1b9f
add esp, 0x14
pop ebx
pop esi
ret