joyce8/EMBER2024-capa huggingface dataset:
Function at 0x774360
Capabilities:
Contain obfuscated stackstrings
Send data
Send data on socket

Disassembly:
sub esp, 0x21c
mov al, 0x5c
mov cl, 0x64
mov byte [esp], al
mov byte [esp + 5], al
mov byte [esp + 6], al
mov byte [esp + 0xa], al
mov byte [esp + 0xd], al
mov byte [esp + 0x10], al
mov byte [esp + 0x13], al
mov byte [esp + 0x16], al
mov eax, dword [esp + 0x220]
mov byte [esp + 1], cl
mov byte [esp + 9], cl
mov byte [esp + 0xc], cl
mov byte [esp + 0xf], cl
mov byte [esp + 0x18], cl
mov ecx, dword [eax + 0x2c]
mov dl, 0x25
push esi
add eax, 4
mov byte [esp + 0xf], dl
mov byte [esp + 0x15], dl
mov byte [esp + 0x1b], dl
mov edx, dword [0x86acd8]
push ecx
push eax
lea eax, [esp + 0xc]
push edx
lea ecx, [esp + 0x2c]
push eax
push ecx
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x1b], 0x73
mov byte [esp + 0x1c], 0x63
mov byte [esp + 0x1f], 0x70
mov byte [esp + 0x20], 0x69
mov byte [esp + 0x26], 0x63
mov byte [esp + 0x2a], 0x73
mov byte [esp + 0x2c], 0x69
mov byte [esp + 0x2d], 0x70
mov byte [esp + 0x31], 0
call fcn.0078cdc6
mov esi, eax
add esp, 0x14
xor edx, edx
mov ecx, 0x86aacc
test esi, esi
jle 0x774434
push ebx
mov al, byte [ecx]
mov bl, byte [esp + edx + 0x24]
xor bl, al
mov al, byte [ecx + 1]
inc ecx
mov byte [esp + edx + 0x24], bl
test al, al
jne 0x77442e
mov ecx, 0x86aacc
inc edx
cmp edx, esi
jl 0x774415
pop ebx
mov edx, dword [0x815ba4]
push 0x10
push 0x86b0e0
push 0
lea ecx, [esp + 0x2c]
push esi
push ecx
push edx
call sub.WSOCK32.dll_sendto
pop esi
add esp, 0x21c
ret

Function at 0x775200
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x6c]
push esi
push edi
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x24], 0x67452301
mov dword [esp + 0x28], 0xefcdab89
mov dword [esp + 0x2c], 0x98badcfe
mov dword [esp + 0x30], 0x10325476
call fcn.00774740
add esp, 0xc
xor esi, esi
lea ecx, [esp + 0x28]
mov al, byte [ecx]
add ecx, 4
mov byte [esp + esi + 8], al
mov eax, dword [ecx - 4]
mov edx, eax
add esi, 4
shr edx, 8
mov byte [esp + esi + 5], dl
mov edx, eax
shr edx, 0x10
shr eax, 0x18
mov byte [esp + esi + 6], dl
mov byte [esp + esi + 7], al
cmp esi, 8
jb 0x775252
mov ecx, dword [esp + 0x28]
mov eax, 0x38
shr ecx, 3
and ecx, 0x3f
cmp ecx, 0x38
jb 0x775298
mov eax, 0x78
sub eax, ecx
push eax
lea eax, [esp + 0x1c]
push 0x815bd8
push eax
call fcn.00774740
lea ecx, [esp + 0x14]
push 8
lea edx, [esp + 0x28]
push ecx
push edx
call fcn.00774740
add esp, 0x18
xor esi, esi
lea ecx, [esp + 0x18]
mov al, byte [ecx]
add ecx, 4
mov byte [esp + esi + 8], al
mov eax, dword [ecx - 4]
mov edx, eax
add esi, 4
shr edx, 8
mov byte [esp + esi + 5], dl
mov edx, eax
shr edx, 0x10
shr eax, 0x18
mov byte [esp + esi + 6], dl
mov byte [esp + esi + 7], al
cmp esi, 0x10
jb 0x7752c4
mov ecx, 0x16
xor eax, eax
lea edi, [esp + 0x18]
xor esi, esi
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x7c]
xor eax, eax
mov al, byte [esp + esi + 8]
push eax
push str._02x
push edi
call fcn.0078cdc6
add esp, 0xc
inc esi
add edi, 2
cmp esi, 0x10
jb 0x775304
pop edi
pop esi
add esp, 0x68
ret
Function at 0x775330
Capabilities:
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
test ebx, ebx
push edi
je 0x775345
mov dword [ebx], 0
call fcn.00772c80
push 0x11
push 2
push 2
call sub.WSOCK32.dll_socket
mov edi, eax
cmp edi, 0xffffffff
je 0x775468
mov esi, dword [esp + 0x30]
lea ebp, [esi + 0x64]
cmp esi, ebp
jge 0x7753c3
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x14]
push 0
push eax
push esi
push ebx
call fcn.00775b50
add esp, 0x10
push 0x7f000001
call sub.WSOCK32.dll_htonl
cmp dword [esp + 0x18], eax
jne 0x775398
mov dword [esp + 0x18], 0
lea ecx, [esp + 0x14]
push 0x10
push ecx
push edi
call sub.WSOCK32.dll_bind
test eax, eax
je 0x7753bf
inc esi
cmp esi, ebp
jl 0x77536f
test eax, eax
je 0x7753bf
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x14
ret
mov ebx, dword [esp + 0x28]
test esi, esi
jne 0x775403
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push edi
mov dword [esp + 0x1c], 0x10
call sub.WSOCK32.dll_getsockname
test eax, eax
je 0x7753f0
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x14
ret
mov ecx, dword [esp + 0x16]
push ecx
call sub.WSOCK32.dll_ntohs
mov si, ax
and esi, 0xffff
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x44]
push eax
push ecx
push edx
push edi
push edi
push esi
push ebx
call fcn.00775480
add esp, 0x2c
test ebx, ebx
jne 0x775442
mov dword [esp + 0x28], 0x815d44
mov ebx, dword [esp + 0x28]
mov eax, dword [ebx]
push 0
add eax, 0xec
push eax
push 0x6cfc
push str.master.gamespy.com
call fcn.00775b50
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret
Function at 0x7755e0
Capabilities:
Check for time delay via gettickcount
Send data
Send data on socket

Disassembly:
sub esp, 0x100
push ebx
push ebp
push esi
mov esi, dword [esp + 0x110]
test esi, esi
push edi
jne 0x7755fb
mov esi, dword [0x815d44]
call sub.KERNEL32.dll_GetTickCount
cmp dword [esi + 4], 0xffffffff
je 0x77574b
mov ecx, dword [esi + 0xd8]
mov edx, eax
sub edx, ecx
cmp edx, 0x493e0
ja 0x7756e4
test ecx, ecx
je 0x7756e4
cmp eax, ecx
jb 0x7756e4
mov al, byte [esi + 0xe8]
test al, al
jle 0x77574b
cmp edx, 0x7530
jbe 0x77574b
mov ecx, dword [esi + 0xe4]
lea eax, [esi + 8]
push eax
push ecx
lea edx, [esp + 0x18]
push str.heartbeat_dgamename_s
push edx
call fcn.0078cdc6
mov eax, dword [0x86d4c8]
add esp, 0x10
xor ebx, ebx
test eax, eax
jle 0x7756a6
mov ebp, 0x86b448
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
push 0x10
repne scasb al, byte es:[edi]
not ecx
push ebp
dec ecx
push 0
push ecx
mov ecx, dword [esi + 4]
lea eax, [esp + 0x20]
push eax
push ecx
call sub.WSOCK32.dll_sendto
mov eax, dword [0x86d4c8]
inc ebx
add ebp, 0x10
cmp ebx, eax
jl 0x775677
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 0xd8], eax
mov cl, byte [esi + 0xe8]
inc cl
mov al, cl
mov byte [esi + 0xe8], cl
cmp al, 0xa
jle 0x77574b
push esi
mov byte [esi + 0xe8], 0
call fcn.00775780
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret
mov eax, dword [esi + 0xe4]
lea edx, [esi + 8]
push edx
push eax
lea ecx, [esp + 0x18]
push str.heartbeat_dgamename_s
push ecx
call fcn.0078cdc6
mov eax, dword [0x86d4c8]
add esp, 0x10
xor ebx, ebx
test eax, eax
jle 0x775740
mov ebp, 0x86b448
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
push 0x10
repne scasb al, byte es:[edi]
mov eax, dword [esi + 4]
push ebp
not ecx
dec ecx
push 0
lea edx, [esp + 0x1c]
push ecx
push edx
push eax
call sub.WSOCK32.dll_sendto
mov eax, dword [0x86d4c8]
inc ebx
add ebp, 0x10
cmp ebx, eax
jl 0x775711
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 0xd8], eax
push esi
call fcn.00775780
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret

Function at 0x775780
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x120
push ebx
push esi
mov esi, dword [esp + 0x12c]
xor ebx, ebx
mov dword [esp + 8], 0x10
mov dword [esp + 0xc], ebx
mov eax, dword [esi + 0xe4]
mov dword [esp + 0x10], ebx
cmp eax, ebx
je 0x775813
mov eax, dword [esi]
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], eax
lea ecx, [esp + 0xc]
lea edx, [esp + 0x24]
push ecx
push ebx
push ebx
push edx
push 0x40
call sub.WSOCK32.dll_select
cmp eax, 0xffffffff
je 0x775813
cmp eax, ebx
je 0x775813
mov edx, dword [esi]
lea eax, [esp + 8]
lea ecx, [esp + 0x14]
push eax
push ecx
push ebx
push 0xff
push 0x86b344
push edx
call sub.WSOCK32.dll_recvfrom
cmp eax, 0xffffffff
je 0x7757b9
lea ecx, [esp + 0x14]
mov byte [eax + 0x86b344], bl
push ecx
push eax
push 0x86b344
push esi
call fcn.00775e80
add esp, 0x10
jmp 0x7757b9
pop esi
pop ebx
add esp, 0x120
ret
Function at 0x775a30
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x100
push ebp
mov ebp, dword [esp + 0x108]
push esi
push edi
test ebp, ebp
jne 0x775a4a
mov ebp, dword [0x815d44]
mov ecx, dword [ebp + 0xe4]
lea eax, [ebp + 8]
push eax
push ecx
lea edx, [esp + 0x14]
push str.heartbeat_dgamename_s
push edx
call fcn.0078cdc6
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 2
push str._statechanged_d
lea eax, [esp + ecx + 0x14]
push eax
call fcn.0078cdc6
mov eax, dword [0x86d4c8]
add esp, 0xc
xor esi, esi
test eax, eax
jle 0x775aca
push ebx
mov ebx, 0x86b448
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp + 4]
repne scasb al, byte es:[edi]
not ecx
push 0x10
push ebx
dec ecx
push 0
push ecx
lea ecx, [esp + 0x20]
push ecx
push edx
call sub.WSOCK32.dll_sendto
mov eax, dword [0x86d4c8]
inc esi
add ebx, 0x10
cmp esi, eax
jl 0x775a9a
pop ebx
call sub.KERNEL32.dll_GetTickCount
pop edi
mov dword [ebp + 0xd8], eax
pop esi
pop ebp
add esp, 0x100
ret

Function at 0x775b50
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x10
push ebx
push ebp
push edi
mov edi, dword [esp + 0x28]
mov cl, 0x32
mov al, 0x35
mov byte [esp + 0xc], cl
mov byte [esp + 0x10], cl
mov byte [esp + 0x14], cl
mov byte [esp + 0x18], cl
mov byte [esp + 0xd], al
mov byte [esp + 0xe], al
mov byte [esp + 0x11], al
mov byte [esp + 0x12], al
mov byte [esp + 0x15], al
mov byte [esp + 0x16], al
mov byte [esp + 0x19], al
mov byte [esp + 0x1a], al
mov ecx, edi
xor eax, eax
mov dl, 0x2e
mov byte [esp + 0x1b], 0
mov dword [ecx], eax
mov byte [esp + 0xf], dl
mov byte [esp + 0x13], dl
mov byte [esp + 0x17], dl
mov edx, dword [esp + 0x24]
mov dword [ecx + 4], eax
push edx
xor ebx, ebx
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov word [edi], 2
call sub.WSOCK32.dll_htons
mov ebp, dword [esp + 0x20]
mov word [edi + 2], ax
cmp ebp, ebx
jne 0x775bd2
mov dword [edi + 4], ebx
jmp 0x775bdb
push ebp
call sub.WSOCK32.dll_inet_addr
mov dword [edi + 4], eax
cmp dword [edi + 4], 0xffffffff
jne 0x775c33
push esi
lea esi, [esp + 0x10]
mov eax, ebp
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x775c0c
test cl, cl
je 0x775c08
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x775c0c
add eax, 2
add esi, 2
test cl, cl
jne 0x775be8
xor eax, eax
jmp 0x775c11
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
pop esi
je 0x775c33
push ebp
call sub.WSOCK32.dll_gethostbyname
mov ebx, eax
test ebx, ebx
jne 0x775c29
pop edi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [edi + 4], edx
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x775c3d
mov dword [eax], ebx
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret
Function at 0x775d20
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x108
xor eax, eax
lea ecx, [esp + 8]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x775d2c
push ebx
push ebp
mov ebp, dword [esp + 0x118]
push esi
push edi
mov byte [esp + 0x10], 0
xor eax, eax
lea ecx, [esp + 0x18]
mov edi, 0x100
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x11c]
and esi, 0xff
xor edx, edx
mov dl, byte [esi + ebx]
xor ebx, ebx
mov bl, byte [ecx]
add eax, edx
add ebx, eax
and ebx, 0x800000ff
jns 0x775d7f
dec ebx
or ebx, 0xffffff00
inc ebx
lea eax, [esi + 1]
mov byte [esp + 0x14], bl
cdq
idiv ebp
mov eax, dword [esp + 0x14]
and eax, 0xff
inc ecx
dec edi
mov bl, byte [esp + eax + 0x18]
mov byte [esp + 0x10], dl
mov dl, byte [ecx - 1]
mov byte [ecx - 1], bl
mov byte [esp + eax + 0x18], dl
jne 0x775d51
mov eax, dword [esp + 0x128]
xor ebp, ebp
test eax, eax
jle 0x775e66
mov edi, dword [esp + 0x124]
xor ecx, ecx
xor esi, esi
xor eax, eax
xor edx, edx
mov dl, byte [eax + edi]
lea ecx, [edx + ecx + 1]
and ecx, 0x800000ff
jns 0x775ddf
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
xor edx, edx
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [esp + ecx + 0x18]
add edx, esi
and edx, 0x800000ff
jns 0x775e05
dec edx
or edx, 0xffffff00
inc edx
mov byte [esp + 0x14], dl
mov dl, byte [esp + ecx + 0x18]
mov esi, dword [esp + 0x14]
and esi, 0xff
mov bl, byte [esp + esi + 0x18]
mov byte [esp + ecx + 0x18], bl
mov byte [esp + esi + 0x18], dl
xor edx, edx
xor ebx, ebx
mov dl, byte [esp + esi + 0x18]
mov bl, byte [esp + ecx + 0x18]
add edx, ebx
and edx, 0x800000ff
jns 0x775e41
dec edx
or edx, 0xffffff00
inc edx
mov bl, byte [eax + edi]
and edx, 0xff
mov dl, byte [esp + edx + 0x18]
xor bl, dl
mov edx, dword [esp + 0x128]
inc ebp
mov byte [eax + edi], bl
movsx eax, bp
cmp eax, edx
jl 0x775dc6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x7764d0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x50
or ecx, 0xffffffff
xor eax, eax
push ebp
mov ebp, dword [esp + 0x60]
push edi
mov edi, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x776564
push ebx
mov ebx, dword [esp + 0x60]
push esi
lea ecx, [esp + 0x10]
mov edi, dword [ebx + 0xe0]
inc edi
mov eax, edi
mov dword [ebx + 0xe0], edi
push eax
mov eax, dword [ebx + 0xdc]
push eax
push str.queryid_d._d
push ecx
call fcn.0078cdc6
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x10
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, dword [esp + 0x6c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [ebx]
push ebp
push ecx
call sub.WSOCK32.dll_sendto
pop esi
mov byte [ebp], 0
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x776570
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x50
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
push ebx
push ebp
mov ebp, dword [esp + 0x64]
push esi
push edi
mov edi, ebp
repne scasb al, byte es:[edi]
mov ebx, dword [esp + 0x70]
not ecx
dec ecx
mov edi, ebx
mov esi, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
add esi, ecx
cmp esi, 0x546
jb 0x776641
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x546
jbe 0x776670
xor ecx, ecx
mov eax, ebx
cmp ecx, 0x546
mov edi, ebx
jge 0x77671a
cmp byte [eax], 0x5c
jne 0x7765ea
mov ecx, edx
and ecx, 0x80000001
jns 0x7765e5
dec ecx
or ecx, 0xfffffffe
inc ecx
jne 0x7765e9
mov edi, eax
inc edx
inc eax
mov ecx, eax
sub ecx, ebx
cmp ecx, 0x546
jl 0x7765d1
cmp edi, ebx
je 0x77671a
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x64]
push ebx
push ebp
push edx
push eax
mov byte [edi], 0
call fcn.00776570
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
mov byte [edi], 0x5c
mov ebx, edi
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebp
mov esi, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
add esi, ecx
cmp esi, 0x546
jae 0x7765a7
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x7766fb
mov eax, dword [esp + 0x64]
mov edi, dword [eax + 0xe0]
inc edi
mov dword [eax + 0xe0], edi
mov eax, dword [eax + 0xdc]
mov ecx, edi
push ecx
push eax
lea ecx, [esp + 0x18]
push str.queryid_d._d
push ecx
call fcn.0078cdc6
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x10
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, dword [esp + 0x6c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esp + 0x74]
push ebp
mov edx, dword [ecx]
push edx
call sub.WSOCK32.dll_sendto
mov byte [ebp], 0
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
Function at 0x776840
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x2a0
push ebx
push ebp
mov ebp, dword [esp + 0x2b4]
mov ebx, dword [esp + 0x2ac]
push esi
mov esi, dword [esp + 0x2bc]
push edi
cmp byte [esi], 0
je 0x776919
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edx, ecx
cmp edx, 0x80
mov dword [esp + 0x14], edx
jg 0x7769cb
lea eax, [esp + 0x68]
mov edi, esi
mov dword [esp + 0x10], eax
or ecx, 0xffffffff
xor eax, eax
push edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x6c]
lea esi, [ebx + 0x48]
push ecx
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
call fcn.00775d20
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x1f8]
push edx
lea ecx, [esp + 0x7c]
push eax
push ecx
call fcn.00775c50
add esp, 0x1c
lea edx, [esp + 0x1e8]
lea eax, [esp + 0xe8]
push edx
push str._validate_s
push eax
call fcn.0078cdc6
mov edx, dword [esp + 0x2c4]
lea ecx, [esp + 0xf4]
push ecx
push ebp
push edx
push ebx
call fcn.00776570
add esp, 0x1c
lea eax, [esp + 0xe8]
push str._final_
push eax
call fcn.0078cdc6
mov edx, dword [esp + 0x2c0]
lea ecx, [esp + 0xf0]
push ecx
push ebp
push edx
push ebx
call fcn.00776570
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x7769cb
mov edi, dword [ebx + 0xe0]
lea ecx, [esp + 0x18]
inc edi
mov eax, edi
mov dword [ebx + 0xe0], edi
push eax
mov eax, dword [ebx + 0xdc]
push eax
push str.queryid_d._d
push ecx
call fcn.0078cdc6
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x10
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, dword [esp + 0x2bc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [ebx]
push ebp
push ecx
call sub.WSOCK32.dll_sendto
mov byte [ebp], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a0
ret
Function at 0x777e90
Capabilities:
Get socket status

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x314
xor edx, edx
push ebx
push ebp
push esi
cmp eax, edx
push edi
je 0x777ebe
mov eax, dword [esp + 0x328]
mov ecx, 1
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
lea edi, [esp + 0x18]
jmp 0x777ecc
mov eax, dword [esp + 0x328]
xor edi, edi
mov ecx, 1
cmp dword [esp + 0x330], edx
je 0x777eec
mov dword [esp + 0x120], eax
mov dword [esp + 0x11c], ecx
lea ebx, [esp + 0x11c]
jmp 0x777eee
xor ebx, ebx
cmp dword [esp + 0x334], edx
je 0x777f0e
mov dword [esp + 0x224], eax
mov dword [esp + 0x220], ecx
lea ebp, [esp + 0x220]
jmp 0x777f10
xor ebp, ebp
lea eax, [esp + 0x10]
mov dword [esp + 0x10], edx
push eax
push ebp
push ebx
push edi
push 0x40
mov dword [esp + 0x28], edx
call sub.WSOCK32.dll_select
mov esi, eax
cmp esi, 0xffffffff
jne 0x777f3b
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x314
ret
mov eax, dword [esp + 0x32c]
test eax, eax
je 0x777f78
test esi, esi
jle 0x777f6b
mov ecx, dword [esp + 0x328]
push edi
push ecx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x777f6b
mov edx, dword [esp + 0x32c]
mov dword [edx], 1
jmp 0x777f78
mov eax, dword [esp + 0x32c]
mov dword [eax], 0
mov edi, dword [esp + 0x330]
test edi, edi
je 0x777fa7
test esi, esi
jle 0x777fa1
mov ecx, dword [esp + 0x328]
push ebx
push ecx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x777fa1
mov dword [edi], 1
jmp 0x777fa7
mov dword [edi], 0
mov edi, dword [esp + 0x334]
test edi, edi
je 0x777fe4
test esi, esi
jle 0x777fde
mov edx, dword [esp + 0x328]
push ebp
push edx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x777fde
mov dword [edi], 1
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x314
ret
mov dword [edi], 0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x314
ret

Function at 0x778000
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [ebx]
mov eax, dword [esi + 0xf4]
dec edi
test eax, eax
je 0x778049
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [esi + 0xf8]
mov edx, dword [0x815fe4]
add ecx, edx
cmp eax, ecx
jae 0x778038
pop edi
pop esi
mov eax, 1
pop ebx
ret
mov dword [esi + 0xf8], eax
mov eax, dword [0x815fe0]
cmp edi, eax
jl 0x778049
mov edi, eax
mov edx, dword [esi + 0x40]
push 0
push edi
mov edi, dword [esp + 0x1c]
push edi
push edx
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x778096
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x77802f
cmp eax, 0x2734
je 0x77802f
mov ecx, 1
mov dword [esi + 0x30], 5
mov dword [esi + 0xbc], ecx
mov dword [esi + 0x44], eax
mov dword [esi + 0xf0], ecx
pop edi
pop esi
mov eax, 3
pop ebx
ret
test eax, eax
jne 0x7780ad
mov dword [esi + 0xf0], 1
pop edi
pop esi
mov eax, 2
pop ebx
ret
mov byte [eax + edi], 0
pop edi
mov dword [ebx], eax
pop esi
xor eax, eax
pop ebx
ret
Function at 0x7780c0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push 0
push eax
mov edx, dword [esi + 0x40]
push ecx
push edx
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
jne 0x778108
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x7780ef
xor eax, eax
pop esi
ret
mov dword [esi + 0xbc], 1
mov dword [esi + 0x30], 5
mov dword [esi + 0x44], eax
or eax, 0xffffffff
pop esi
ret
cmp dword [esi + 0xc], 3
jne 0x778114
add dword [esi + 0x108], eax
pop esi
ret

Function at 0x778120
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
push edi
mov ecx, dword [esi + 0x54]
mov edi, dword [esp + 0x18]
test ecx, ecx
jne 0x77818c
push eax
mov eax, dword [esi + 0x40]
push edi
push ebx
push eax
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
jne 0x77817e
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x778164
xor eax, eax
cmp eax, edi
jne 0x77818c
pop edi
pop esi
mov eax, 1
pop ebx
ret
mov dword [esi + 0xbc], 1
mov dword [esi + 0x30], 5
mov dword [esi + 0x44], eax
pop edi
pop esi
xor eax, eax
pop ebx
ret
cmp dword [esi + 0xc], 3
jne 0x778157
add dword [esi + 0x108], eax
jmp 0x778157
sub edi, eax
add eax, ebx
push edi
add esi, 0x48
push eax
push esi
call fcn.007793b0
add esp, 0xc
neg eax
sbb eax, eax
pop edi
pop esi
and eax, 2
pop ebx
ret