joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ab6c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x38], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x39], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x4c], edx
mov dl, 1
mov eax, dword [0x458ee8]
call fcn.00458f44
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x45ac7c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x45b4e8
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov dword [eax + 0x14], edx
mov dword [eax + 0x10], 0x45b7e8
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov dword [eax + 0x1c], edx
mov dword [eax + 0x18], 0x45bc88
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x30], 1
mov eax, dword [ebp - 0xc]
call fcn.00402a64
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x28]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
call fcn.00402c84
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x2c], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0
xor eax, eax
push ebp
push 0x45ac4a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
call fcn.00458f74
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45ac5b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.00402a94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ac83
mov eax, dword [ebp - 0x14]
call fcn.0040355c
ret
Function at 0x463724
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x118], ecx
mov ecx, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46386f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x58]
cmp eax, dword [ebx + 0x54]
jle 0x46375e
mov bl, 1
jmp 0x463851
cmp byte [ebx + 0x35], 4
je 0x4637d6
cmp byte [ebx + 0x34], 0
jne 0x4637d6
push 0x17802
push 0
lea edx, [ebp - 0x114]
mov eax, 0x4635e4
call fcn.004063fc
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x118]
push eax
xor eax, eax
mov al, byte [ebx + 0x35]
mov dword [ebp - 0x120], eax
mov byte [ebp - 0x11c], 0
lea edx, [ebp - 0x120]
xor ecx, ecx
mov eax, 0x463888
call fcn.0040962c
mov edx, dword [ebp - 0x118]
pop eax
call fcn.00404654
mov ecx, dword [ebp - 0x114]
mov dl, 1
mov eax, dword [0x463138]
call fcn.0045d1f4
call fcn.00403cfc
lea eax, [ebp - 8]
mov dword [ebp - 0xc], eax
cmp ecx, 0xffffffff
jne 0x4637e8
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x463818
test ecx, ecx
jne 0x4637f8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x463818
mov eax, ecx
mov esi, 0x3e8
cdq
idiv esi
mov dword [ebp - 8], eax
mov eax, ecx
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [ebp - 4], eax
lea eax, [ebp - 0x110]
call fcn.00462f6c
lea edx, [ebp - 0x110]
mov eax, dword [ebx + 0x30]
call fcn.00462f5c
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebx + 0x30]
inc eax
push eax
call sub.wsock32.dll_select
test eax, eax
setg al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463876
lea eax, [ebp - 0x118]
mov edx, 2
call fcn.004043b0
ret
Function at 0x463bb8
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x118], ecx
mov ecx, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x463cfd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x58]
cmp eax, dword [ebx + 0x54]
jle 0x463bf2
mov bl, 1
jmp 0x463cdf
cmp byte [ebx + 0x35], 4
je 0x463c64
push 0x17802
push 0
lea edx, [ebp - 0x114]
mov eax, 0x4635e4
call fcn.004063fc
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x118]
push eax
xor eax, eax
mov al, byte [ebx + 0x35]
mov dword [ebp - 0x120], eax
mov byte [ebp - 0x11c], 0
lea edx, [ebp - 0x120]
xor ecx, ecx
mov eax, 0x463d14
call fcn.0040962c
mov edx, dword [ebp - 0x118]
pop eax
call fcn.00404654
mov ecx, dword [ebp - 0x114]
mov dl, 1
mov eax, dword [0x463138]
call fcn.0045d1f4
call fcn.00403cfc
lea eax, [ebp - 8]
mov dword [ebp - 0xc], eax
cmp ecx, 0xffffffff
jne 0x463c76
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x463ca6
test ecx, ecx
jne 0x463c86
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x463ca6
mov eax, ecx
mov esi, 0x3e8
cdq
idiv esi
mov dword [ebp - 8], eax
mov eax, ecx
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [ebp - 4], eax
lea eax, [ebp - 0x110]
call fcn.00462f6c
lea edx, [ebp - 0x110]
mov eax, dword [ebx + 0x30]
call fcn.00462f5c
mov eax, dword [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x110]
push eax
push 0
mov eax, dword [ebx + 0x30]
inc eax
push eax
call sub.wsock32.dll_select
test eax, eax
setne al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463d04
lea eax, [ebp - 0x118]
mov edx, 2
call fcn.004043b0
ret
Function at 0x463d44
Capabilities:
Get local ipv4 addresses
Get socket information
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x463f40
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x30], 0xffffffff
jne 0x463da5
xor edx, edx
mov eax, ebx
call fcn.00464430
test eax, eax
je 0x463da5
push 0x17803
push 0
lea edx, [ebp - 0x20]
mov eax, 0x4635ec
call fcn.004063fc
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x463138]
call fcn.0045d1f4
call fcn.00403cfc
cmp byte [ebx + 0x35], 2
je 0x463dff
push 0x17802
push 0
lea edx, [ebp - 0x24]
mov eax, 0x4635e4
call fcn.004063fc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
xor eax, eax
mov al, byte [ebx + 0x35]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
lea edx, [ebp - 0x30]
xor ecx, ecx
mov eax, 0x463f58
call fcn.0040962c
mov edx, dword [ebp - 0x28]
pop eax
call fcn.00404654
mov ecx, dword [ebp - 0x24]
mov dl, 1
mov eax, dword [0x463138]
call fcn.0045d1f4
call fcn.00403cfc
lea eax, [ebp - 0x1c]
xor ecx, ecx
mov edx, 0x10
call fcn.00402f74
mov word [ebp - 0x1c], 2
mov eax, dword [ebx + 0x48]
call fcn.0040464c
test eax, eax
jne 0x463e27
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x463e9e
mov eax, dword [ebx + 0x48]
call fcn.0040484c
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x463e6a
mov eax, dword [ebx + 0x48]
call fcn.0040484c
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x463e6a
lea edx, [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, 4
call fcn.00402c84
cmp dword [ebp - 8], 0xffffffff
jne 0x463e98
push 0x17804
push 0
lea edx, [ebp - 0x34]
mov eax, 0x4635f4
call fcn.004063fc
mov ecx, dword [ebp - 0x34]
mov dl, 1
mov eax, dword [0x463138]
call fcn.0045d1f4
call fcn.00403cfc
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov ax, word [ebx + 0x4c]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x1a], ax
push 0x10
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.wsock32.dll_bind
mov esi, eax
test esi, esi
je 0x463eca
call fcn.004635fc
mov esi, eax
jmp 0x463f15
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.wsock32.dll_getsockname
mov esi, eax
test esi, esi
je 0x463ef1
call fcn.004635fc
mov esi, eax
jmp 0x463f15
push dword [ebp - 0x18]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebx + 0x40]
call fcn.00404584
mov ax, word [ebp - 0x1a]
push eax
call sub.wsock32.dll_ntohs
movzx eax, ax
mov dword [ebx + 0x44], eax
xor esi, esi
test esi, esi
jne 0x463f1d
mov byte [ebx + 0x35], 3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463f47
lea eax, [ebp - 0x34]
call fcn.0040438c
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.004043b0
ret
Function at 0x464430
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x464544
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebx + 0x35]
test al, al
je 0x4644b2
cmp al, 2
je 0x4644b2
push 0x17802
push 0
lea edx, [ebp - 8]
mov eax, 0x4635e4
call fcn.004063fc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
xor eax, eax
mov al, byte [ebx + 0x35]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x46455c
call fcn.0040962c
mov edx, dword [ebp - 0xc]
pop eax
call fcn.00404654
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x463138]
call fcn.0045d1f4
call fcn.00403cfc
xor eax, eax
mov dword [ebx + 0x54], eax
xor eax, eax
mov dword [ebx + 0x58], eax
cmp byte [ebx + 0x35], 0
jne 0x4644f7
mov byte [ebx + 0x35], 1
mov al, byte [ebp - 1]
mov byte [ebx + 0x34], al
push 0
xor eax, eax
mov al, byte [ebp - 1]
mov eax, dword [eax*4 + 0x4f12c8]
push eax
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx + 0x30], esi
inc esi
jne 0x4644f3
call sub.wsock32.dll_WSAGetLastError
mov esi, eax
jmp 0x4644f9
xor esi, esi
jmp 0x4644f9
xor esi, esi
cmp byte [ebx + 0x5c], 0
jne 0x464503
test esi, esi
je 0x464521
mov byte [ebx + 0x5c], 0
mov byte [ebx + 0x35], 0
test esi, esi
jne 0x464518
mov eax, dword [ebx + 0x30]
push eax
call sub.wsock32.dll_closesocket
mov dword [ebx + 0x30], 0xffffffff
jmp 0x464529
test esi, esi
jne 0x464529
mov byte [ebx + 0x35], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46454b
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004043b0
ret

Function at 0x464564
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
xor edx, edx
mov dword [ebp - 0x194], edx
xor eax, eax
push ebp
push 0x4645eb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x190]
push eax
mov dl, 1
mov al, 1
call fcn.0040722c
push eax
call sub.wsock32.dll_WSAStartup
test eax, eax
je 0x4645cb
push 0x17801
push 0
lea edx, [ebp - 0x194]
mov eax, 0x4635dc
call fcn.004063fc
mov ecx, dword [ebp - 0x194]
mov dl, 1
mov eax, dword [0x463138]
call fcn.0045d1f4
call fcn.00403cfc
mov byte [0x4fdbc4], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4645f2
lea eax, [ebp - 0x194]
call fcn.0040438c
ret
Function at 0x4645f8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x464765
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x35], 4
je 0x46467c
push 0x17802
push 0
lea edx, [ebp - 0xc]
mov eax, 0x4635e4
call fcn.004063fc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
xor eax, eax
mov al, byte [ebx + 0x35]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x18]
xor ecx, ecx
mov eax, 0x464780
call fcn.0040962c
mov edx, dword [ebp - 0x10]
pop eax
call fcn.00404654
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x463138]
call fcn.0045d1f4
call fcn.00403cfc
mov eax, dword [ebx + 0x54]
mov edx, dword [ebx + 0x58]
cmp eax, edx
jge 0x4646d0
xor esi, esi
sub edx, eax
cmp edx, dword [ebp - 8]
jle 0x464696
mov edx, dword [ebp - 8]
mov dword [edi], edx
jmp 0x46469e
mov edx, dword [ebx + 0x58]
sub edx, dword [ebx + 0x54]
mov dword [edi], edx
mov edx, dword [ebx + 0x50]
lea eax, [edx + eax]
mov ecx, dword [edi]
mov edx, dword [ebp - 4]
call fcn.00402c84
mov eax, dword [edi]
mov edx, dword [ebx + 0x58]
sub edx, dword [ebx + 0x54]
cmp eax, edx
jge 0x4646c4
mov eax, dword [edi]
add dword [ebx + 0x54], eax
jmp 0x46474a
xor eax, eax
mov dword [ebx + 0x54], eax
xor eax, eax
mov dword [ebx + 0x58], eax
jmp 0x46474a
mov eax, dword [ebx + 0x50]
call fcn.004054f0
cmp eax, dword [ebp - 8]
jge 0x4646f4
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.wsock32.dll_recv
mov esi, eax
jmp 0x464734
push 0
mov eax, dword [ebx + 0x50]
call fcn.004054f0
push eax
mov eax, dword [ebx + 0x50]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.wsock32.dll_recv
mov esi, eax
cmp esi, 0xffffffff
je 0x464734
mov eax, esi
mov dword [ebx + 0x58], eax
test eax, eax
jle 0x46472c
push edi
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004645f8
jmp 0x464730
xor eax, eax
mov dword [edi], eax
xor esi, esi
jmp 0x46474a
cmp esi, 0xffffffff
jne 0x464746
xor eax, eax
mov dword [edi], eax
call fcn.004635fc
mov esi, eax
jmp 0x46474a
mov dword [edi], esi
xor esi, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46476c
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004043b0
ret
Function at 0x4647e8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4648a5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x35], 4
je 0x464865
push 0x17802
push 0
lea edx, [ebp - 4]
mov eax, 0x4635e4
call fcn.004063fc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
xor eax, eax
mov al, byte [ebx + 0x35]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x4648c0
call fcn.0040962c
mov edx, dword [ebp - 8]
pop eax
call fcn.00404654
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x463138]
call fcn.0045d1f4
call fcn.00403cfc
push 0
push ecx
push edx
mov eax, dword [ebx + 0x30]
push eax
call sub.wsock32.dll_send
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x464886
xor eax, eax
mov dword [esi], eax
call fcn.004635fc
mov ebx, eax
jmp 0x46488a
mov dword [esi], ebx
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4648ac
lea eax, [ebp - 8]
mov edx, 2
call fcn.004043b0
ret
Function at 0x465108
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x20], eax
call sub.kernel32.dll_GetTickCount
mov edx, eax
mov eax, dword [ebp - 0x20]
call fcn.0045d2c4
mov dword [ebp - 0x1c], eax
test ebx, ebx
jbe 0x465148
cmp ebx, dword [ebp - 0x1c]
ja 0x465148
mov byte [ebp - 9], 0
jmp 0x465309
lea eax, [ebp - 0x228]
call fcn.00462f6c
lea eax, [ebp - 0x124]
call fcn.00462f6c
test ebx, ebx
jbe 0x465169
mov edi, ebx
sub edi, dword [ebp - 0x1c]
jmp 0x46516b
xor edi, edi
test edi, edi
jle 0x465197
mov eax, edi
mov ecx, 0x3e8
cdq
idiv ecx
mov dword [ebp - 0x18], eax
mov eax, edi
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], eax
jmp 0x46519c
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x124]
call fcn.00462f6c
lea edx, [ebp - 0x124]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00462f5c
mov eax, dword [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x124]
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
inc eax
push eax
call sub.wsock32.dll_select
mov esi, eax
test esi, esi
je 0x465216
cmp esi, 0xffffffff
je 0x465216
lea edx, [ebp - 0x124]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00462f44
test al, al
je 0x465124
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004647e8
inc eax
jne 0x465226
mov byte [ebp - 9], 0
jmp 0x465309
inc esi
jne 0x465124
mov byte [ebp - 9], 0
jmp 0x465309
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
test ebx, ebx
jbe 0x465243
cmp ebx, dword [ebp - 0x1c]
ja 0x465243
mov byte [ebp - 9], 0
jmp 0x465309
lea eax, [ebp - 0x228]
call fcn.00462f6c
test ebx, ebx
jbe 0x465259
mov edi, ebx
sub edi, dword [ebp - 0x1c]
jmp 0x46525b
xor edi, edi
test edi, edi
jle 0x465287
mov eax, edi
mov ecx, 0x3e8
cdq
idiv ecx
mov dword [ebp - 0x18], eax
mov eax, edi
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], eax
jmp 0x46528c
xor eax, eax
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x228]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00462f5c
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0
lea eax, [ebp - 0x228]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
inc eax
push eax
call sub.wsock32.dll_select
mov esi, eax
test esi, esi
je 0x4652fe
cmp esi, 0xffffffff
je 0x4652fe
lea edx, [ebp - 0x228]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00462f44
test al, al
je 0x465226
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
call fcn.004645f8
inc eax
jne 0x4652f8
mov byte [ebp - 9], 0
jmp 0x465309
mov byte [ebp - 9], 1
jmp 0x465309
inc esi
jne 0x465226
mov byte [ebp - 9], 0
mov al, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x465370
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x4f1348]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4f1348]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4f1348]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4f1348]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4f12cc]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x46539b
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x465468
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
add eax, 0x14
mov eax, dword [eax]
mov dword [edx + 0x14], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x14]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x4f1348]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4f1348]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4f1348]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4f1348]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4f12cc]
mov dword [edx + eax*4 + 0x18], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x18]
mov dword [edx + eax*4 + 0x1c], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x20], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 0x10]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, ebx
mov dword [edx + eax*4 + 0x2c], ecx
add eax, 6
cmp eax, 0x2e
jl 0x4654a3
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x465584
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
lea ecx, [eax + 0x14]
mov ecx, dword [ecx]
mov dword [edx + 0x14], ecx
lea ecx, [eax + 0x18]
mov ecx, dword [ecx]
mov dword [edx + 0x18], ecx
add eax, 0x1c
mov eax, dword [eax]
mov dword [edx + 0x1c], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x1c]
mov edi, ecx
shl edi, 0x18
shr ecx, 8
or edi, ecx
mov ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4f1348]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4f1348]
mov ebx, edi
shr ebx, 0x10
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4f1348]
mov ebx, edi
shr ebx, 0x18
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4f1348]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4f12cc]
mov dword [edx + eax*4 + 0x20], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x20]
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov edi, dword [edx + eax*4 + 0xc]
xor edi, ebx
mov dword [edx + eax*4 + 0x2c], edi
xor ecx, ecx
mov cl, byte [edx + eax*4 + 0x2c]
mov ecx, dword [ecx*4 + 0x4f1348]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4f1348]
mov ebx, edi
shr ebx, 0x10
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4f1348]
mov ebx, edi
shr ebx, 0x18
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4f1348]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x30], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, dword [edx + eax*4 + 0x30]
mov dword [edx + eax*4 + 0x34], ecx
mov ebx, dword [edx + eax*4 + 0x18]
xor ebx, ecx
mov dword [edx + eax*4 + 0x38], ebx
mov ecx, dword [edx + eax*4 + 0x1c]
xor ecx, ebx
mov dword [edx + eax*4 + 0x3c], ecx
add eax, 8
cmp eax, 0x34
jl 0x4655cf
add esp, 0xc
pop edi
pop esi
pop ebx
ret