joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50427d
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
mov ebp, dword [edx + 0x1050]
push edi
mov edi, dword [edx + 0x105c]
imul edi, ebp
mov dword [esp + 0xc], eax
mov eax, dword [edx + 0x18]
add edi, eax
cmp eax, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], edi
jae 0x5043c1
push ebx
push esi
mov esi, 0xff00
mov ebx, dword [esp + 0x14]
mov edx, dword [edx + 0x1058]
lea edx, [eax + edx*2]
mov dword [esp + 0x10], ebx
add ebp, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], edx
jae 0x50439b
movzx edx, word [ebx]
movzx edi, word [ebx + 2]
movzx eax, word [ebp + 2]
movzx ebp, word [ebp]
mov dword [esp + 0x18], edx
mov ebx, eax
mov ecx, 0xff
and bx, cx
and dx, cx
add ebx, edx
mov edx, ebp
and dx, cx
add ebx, edx
mov edx, edi
and dx, cx
mov ecx, eax
and cx, si
and eax, esi
lea edx, [ebx + edx + 2]
mov ebx, dword [esp + 0x18]
and bx, si
shr edx, 2
add ecx, ebx
mov ebx, ebp
and bx, si
and ebp, esi
add ecx, ebx
mov ebx, edi
and bx, si
and edi, esi
lea ecx, [ecx + ebx + 0x200]
mov ebx, dword [esp + 0x1c]
shr ecx, 2
xor dl, cl
mov ecx, dword [esp + 0x18]
and ecx, esi
add eax, ecx
add eax, ebp
mov ebp, dword [esp + 0x20]
lea eax, [eax + edi + 0x200]
shr eax, 2
and edx, 0xffff00ff
xor edx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
add ebx, 4
add ebp, 4
cmp ebx, dword [esp + 0x28]
mov word [eax], dx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
jb 0x5042e6
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x30]
mov edx, dword [ecx + 4]
mov edx, dword [edx + 0x1050]
add dword [esp + 0x14], edx
mov edx, dword [ecx]
mov ebp, dword [edx + 0x1050]
lea eax, [eax + ebp*2]
cmp eax, edi
mov dword [esp + 0x24], eax
jb 0x5042bd
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x5043c9
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [edx + 0x18]
push esi
mov esi, dword [edx + 0x105c]
push edi
mov edi, dword [edx + 0x1050]
imul esi, edi
add esi, eax
cmp eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
jae 0x5044ff
push ebx
mov edx, dword [edx + 0x1058]
add edx, eax
add edi, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edx
jae 0x5044da
movzx ebp, byte [ebx]
movzx esi, byte [ebx + 1]
movzx eax, byte [edi + 1]
movzx edi, byte [edi]
mov edx, eax
push 0xf
pop ecx
and edx, ecx
mov ebx, ebp
and ebx, ecx
add edx, ebx
mov ebx, edi
and ebx, ecx
add edx, ebx
mov ebx, esi
and ebx, ecx
lea edx, [edx + ebx + 2]
mov ecx, eax
and ecx, 0xffff00f0
mov ebx, ebp
and ebx, 0xffff00f0
add ecx, ebx
mov ebx, edi
and ebx, 0xffff00f0
add ecx, ebx
mov ebx, esi
and ebx, 0xffff00f0
shr edx, 2
lea ecx, [ecx + ebx + 0x20]
mov ebx, dword [esp + 0x14]
shr ecx, 2
xor dl, cl
mov ecx, 0xf0
and ax, cx
and bp, cx
and di, cx
and si, cx
and dl, 0xf
add eax, ebp
add eax, edi
mov edi, dword [esp + 0x18]
lea eax, [eax + esi + 0x20]
shr eax, 2
xor dl, al
mov eax, dword [esp + 0x10]
inc dword [esp + 0x10]
inc ebx
inc ebx
inc edi
inc edi
cmp ebx, dword [esp + 0x24]
mov byte [eax], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
jb 0x504428
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x1050]
mov edx, dword [ecx]
mov edi, dword [edx + 0x1050]
lea eax, [eax + edi*2]
cmp eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
jb 0x504404
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret

Function at 0x50fb3b
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x50fb68
push esi
call fcn.00516f76
cmp byte [esi + 0x40], 0
pop ecx
je 0x50fb61
mov dword [esi + 0x10], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x50fbd7
mov eax, dword [esi + 0x18c]
cmp byte [eax + 0x10], 0
je 0x50fbcc
mov eax, dword [esi + 8]
test eax, eax
je 0x50fb89
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x18c]
push esi
call dword [eax]
test eax, eax
pop ecx
je 0x50fbc8
cmp eax, 2
je 0x50fbcc
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x50fb7e
cmp eax, 3
je 0x50fbad
cmp eax, 1
jne 0x50fb7e
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
cmp dword [eax + 4], ecx
jl 0x50fb7e
mov edx, dword [esi + 0x118]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x50fb7e
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
jmp 0x50fbf5
cmp eax, 0xcc
je 0x50fbf5
mov eax, dword [esi]
mov dword [eax + 0x14], 0x12
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
pop ecx
call fcn.0050fa0e
pop esi
ret
Function at 0x50fbfc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x50fc54
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x50fc54
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x50fc54
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x50fc7d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x50fceb
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push str.DisableMMX
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x50fce2
cmp dword [ebp - 0xc], 4
jne 0x50fce2
cmp dword [ebp - 0x10], edi
je 0x50fce2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5d7994], edi
xor eax, eax
jmp 0x50fd13
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x5d7994], edi
jge 0x50fd0e
mov dword [0x5d7994], edi
call fcn.0050fc58
test eax, eax
je 0x50fd0e
emms
mov dword [0x5d7994], 1
mov eax, dword [0x5d7994]
pop edi
leave
ret

Function at 0x50fdf3
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
push ebx
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
xor bl, bl
and byte [ebp + 0x73], bl
push eax
mov dword [ebp - 0x24], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x50fe2a
inc bl
mov byte [ebp + 0x73], 1
cmp dword [ebp - 0x14], 1
jne 0x50fe4c
cmp dword [ebp - 0x20], 4
ja 0x50fe56
jne 0x50fe46
cmp dword [ebp - 0x1c], 0xa
jb 0x50fe46
cmp word [ebp - 0x18], 0x55d
jae 0x50fe56
mov byte [ebp + 0x73], 1
jmp 0x50fe56
cmp dword [ebp - 0x14], 2
jne 0x50fe6c
test bl, bl
je 0x50fe87
mov eax, dword [ebp + 0x7c]
sub eax, 6
je 0x50fe77
dec eax
je 0x50fe70
sub eax, 3
jne 0x50fe6c
cmp byte [ebp + 0x73], 0
je 0x50fe98
xor eax, eax
jmp 0x50fea0
call fcn.0050fd16
jmp 0x50fea0
cmp byte [ebp + 0x73], 0
jne 0x50fe6c
call fcn.0050fd4e
and eax, 4
jmp 0x50fea0
cmp dword [ebp + 0x7c], 0xa
je 0x50fe98
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
jmp 0x50fea0
call fcn.0050fd4e
and eax, 8
pop edi
pop ebx
add ebp, 0x74
leave
ret
Function at 0x51923d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x51924b
xor eax, eax
pop ebp
ret
cmp dword [ebp + 0x10], 8
push esi
mov esi, dword [ebp + 8]
not esi
mov ecx, 0xff
jb 0x51931f
mov eax, dword [ebp + 0x10]
push ebx
shr eax, 3
push edi
xor ebx, ebx
mov bl, byte [edx]
mov edi, esi
shr edi, 8
sub dword [ebp + 0x10], 8
xor ebx, esi
and ebx, ecx
mov esi, dword [ebx*4 + 0x5affa0]
xor ebx, ebx
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x5affa0]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x5affa0]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x5affa0]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x5affa0]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x5affa0]
shr esi, 8
xor edi, esi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x5affa0]
shr edi, 8
xor esi, edi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x5affa0]
shr esi, 8
xor esi, edi
inc edx
dec eax
jne 0x519268
pop edi
pop ebx
cmp dword [ebp + 0x10], 0
je 0x51933f
xor eax, eax
mov al, byte [edx]
xor eax, esi
and eax, ecx
mov eax, dword [eax*4 + 0x5affa0]
shr esi, 8
xor esi, eax
inc edx
dec dword [ebp + 0x10]
jne 0x519325
mov eax, esi
not eax
pop esi
pop ebp
ret
Function at 0x536e90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test edx, edx
mov eax, ecx
jne 0x536e9b
xor eax, eax
ret 4
push ebx
push esi
mov esi, dword [esp + 0xc]
cmp esi, 8
not eax
jb 0x536f9a
push edi
mov edi, esi
shr edi, 3
mov ecx, eax
xor ebx, ebx
mov bl, byte [edx]
and ecx, 0xff
xor ecx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [ecx*4 + 0x5b7860]
sub esi, 8
xor eax, ebx
inc edx
mov ecx, eax
xor ebx, ebx
mov bl, byte [edx]
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [edx + 1]
mov ecx, dword [ecx*4 + 0x5b7860]
shr eax, 8
xor ecx, eax
inc edx
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [edx + 1]
mov eax, dword [eax*4 + 0x5b7860]
shr ecx, 8
xor eax, ecx
inc edx
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [edx + 1]
mov ecx, dword [ecx*4 + 0x5b7860]
shr eax, 8
xor ecx, eax
inc edx
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [edx + 1]
mov eax, dword [eax*4 + 0x5b7860]
shr ecx, 8
xor eax, ecx
inc edx
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [edx + 1]
mov ecx, dword [ecx*4 + 0x5b7860]
shr eax, 8
xor ecx, eax
inc edx
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [edx + 1]
mov eax, dword [eax*4 + 0x5b7860]
shr ecx, 8
xor eax, ecx
inc edx
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x5b7860]
xor eax, ecx
inc edx
dec edi
jne 0x536eb2
pop edi
test esi, esi
je 0x536fbc
mov ecx, eax
xor ebx, ebx
mov bl, byte [edx]
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x5b7860]
xor eax, ecx
inc edx
dec esi
jne 0x536f9e
pop esi
pop ebx
not eax
ret 4
Function at 0x558e70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov al, byte [ecx + 0x20]
test al, al
jns 0x558e7c
jmp 0x5591c0
jmp 0x558e90
sub esp, 0xa8
push ebp
mov ebp, ecx
mov eax, dword [ebp + 0x30]
test eax, eax
je 0x5591b5
lea ecx, [esp + 0x44]
call fcn.0053b130
mov eax, dword [ebp + 0x20]
test al, 0x20
je 0x558edf
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 0xbc]
lea edx, [esp + 0x20]
push edx
call fcn.00542490
fld dword [esp + 4]
push 0
fchs
push ecx
fstp dword [esp]
push 0
jmp 0x558f1e
test al, 0x10
je 0x558f27
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 0xbc]
lea edx, [esp + 0x20]
push edx
call fcn.00542490
fld dword [esp + 0x14]
fchs
sub esp, 0xc
fstp dword [esp + 8]
fld dword [esp + 0x10]
fchs
fstp dword [esp + 4]
fld dword [esp + 0x24]
fchs
fstp dword [esp]
lea ecx, [esp + 0x50]
call fcn.0053b240
mov eax, dword [ebp + 0x4c]
push esi
xor esi, esi
test eax, eax
push edi
jle fcn.00558f56
mov eax, dword [ebp + 0x44]
mov dword [eax + esi*4], 0
mov ecx, dword [ebp + 0x48]
mov dword [ecx + esi*4], 0
push esi
mov ecx, ebp
call fcn.00558d10
mov eax, dword [ebp + 0x4c]
inc esi
cmp esi, eax
jl 0x558f32
push esi
mov esi, ecx
mov eax, dword [esi + 0x30]
test eax, eax
je 0x5591f5
push 0
call fcn.00558d80
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
imul ecx, eax
imul edx, eax
mov eax, dword [esi + 0x50]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push eax
push ecx
mov ecx, 0x8b78a0
call fcn.0055cf50
pop esi
ret 8
Function at 0x55f060
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x20
lea eax, [esp]
push eax
mov dword [esp + 4], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
add esp, 0x20
ret
Function at 0x561bf0
Capabilities:
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x18
push ebx
mov ebx, ecx
push ebp
push esi
test ebx, ebx
push edi
mov dword [esp + 0x10], edx
je 0x561c07
mov dword [ebx], 0
call fcn.00564660
push 0x11
push 2
push 2
call sub.WSOCK32.dll_socket
mov edi, eax
cmp edi, 0xffffffff
je 0x561d22
mov esi, dword [esp + 0x2c]
lea ebp, [esi + 0x64]
cmp esi, ebp
jge 0x561c6f
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push 0
push eax
mov edx, esi
call fcn.00562010
push 0x7f000001
call sub.WSOCK32.dll_htonl
cmp dword [esp + 0x1c], eax
jne 0x561c57
mov dword [esp + 0x1c], 0
lea ecx, [esp + 0x18]
push 0x10
push ecx
push edi
call sub.WSOCK32.dll_bind
test eax, eax
je 0x561c86
inc esi
cmp esi, ebp
jl 0x561c2d
jmp 0x561c73
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x561c86
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x18
ret 0x20
test esi, esi
jne 0x561cc8
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push eax
push edi
mov dword [esp + 0x20], 0x10
call sub.WSOCK32.dll_getsockname
test eax, eax
je 0x561cb5
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x18
ret 0x20
mov ecx, dword [esp + 0x1a]
push ecx
call sub.WSOCK32.dll_ntohs
mov si, ax
and esi, 0xffff
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x40]
push eax
mov eax, dword [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x40]
push eax
push ecx
push edx
push edi
push edi
mov edx, esi
mov ecx, ebx
call fcn.00561d40
test ebx, ebx
jne 0x561cff
mov ebx, 0x5e4dfc
mov eax, dword [ebx]
mov edx, 0x5e4e00
add eax, 0xec
mov ecx, edi
push eax
push 0x6cfc
call fcn.00561ff0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x20
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x18
ret 0x20

Function at 0x561ed0
Capabilities:
Check for time delay via gettickcount
Send data
Send data on socket

Disassembly:
push esi
mov esi, ecx
call sub.KERNEL32.dll_GetTickCount
cmp dword [esi + 4], 0xffffffff
je 0x561f2e
mov ecx, dword [esi + 0xd8]
mov edx, eax
sub edx, ecx
cmp edx, 0x493e0
ja 0x561f30
test ecx, ecx
je 0x561f30
cmp eax, ecx
jb 0x561f30
mov al, byte [esi + 0xe8]
test al, al
jle 0x561f2e
cmp edx, 0x7530
jbe 0x561f2e
xor edx, edx
mov ecx, esi
call fcn.00562ac0
mov cl, byte [esi + 0xe8]
inc cl
mov al, cl
mov byte [esi + 0xe8], cl
cmp al, 0xa
jle 0x561f2e
mov byte [esi + 0xe8], 0
pop esi
ret
mov ecx, esi
xor edx, edx
pop esi
jmp fcn.00562ac0

Function at 0x561f60
Capabilities:
Send data
Send data on socket

Disassembly:
test ecx, ecx
jne 0x561f6a
mov ecx, dword [0x5e4dfc]
mov edx, 2
jmp fcn.00562ac0
Function at 0x562010
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push edx
mov ebp, ecx
mov word [ebx], 2
call sub.WSOCK32.dll_htons
test ebp, ebp
mov word [ebx + 2], ax
jne 0x562030
mov dword [ebx + 4], ebp
jmp 0x562039
push ebp
call sub.WSOCK32.dll_inet_addr
mov dword [ebx + 4], eax
cmp dword [ebx + 4], 0xffffffff
jne 0x562070
push esi
push edi
mov edi, str.255.255.255.255
mov esi, ebp
mov ecx, 0x10
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
pop edi
pop esi
je 0x562070
push ebp
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x562064
pop ebp
pop ebx
ret 8
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov ecx, dword [edx]
mov dword [ebx + 4], ecx
jmp 0x562074
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x56207e
mov dword [ecx], eax
pop ebp
mov eax, 1
pop ebx
ret 8

Function at 0x562150
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x110
push ebx
push ebp
push esi
mov dword [esp + 0xc], ecx
push edi
mov ebx, edx
xor eax, eax
lea ecx, [esp + 0x20]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x562166
mov byte [esp + 0x14], 0
xor esi, esi
lea edi, [esp + 0x20]
mov ebp, 0x100
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
and eax, 0xff
xor ecx, ecx
mov cl, byte [eax + edx]
xor edx, edx
mov dl, byte [edi]
add esi, ecx
add edx, esi
and edx, 0x800000ff
jns 0x5621aa
dec edx
or edx, 0xffffff00
inc edx
inc eax
mov byte [esp + 0x18], dl
cdq
idiv ebx
mov esi, dword [esp + 0x18]
mov ecx, edi
and esi, 0xff
mov byte [esp + 0x14], dl
lea edx, [esp + esi + 0x20]
call fcn.005622b0
inc edi
dec ebp
jne 0x562180
mov eax, dword [esp + 0x128]
xor esi, esi
cmp eax, esi
mov dword [esp + 0x10], esi
jle 0x5622a0
xor edi, edi
xor ebx, ebx
mov ecx, dword [esp + 0x124]
xor eax, eax
mov al, byte [esi + ecx]
lea edx, [eax + edi + 1]
and edx, 0x800000ff
jns 0x562208
dec edx
or edx, 0xffffff00
inc edx
mov byte [esp + 0x14], dl
xor eax, eax
mov edi, dword [esp + 0x14]
and edi, 0xff
mov al, byte [esp + edi + 0x20]
lea ebp, [esp + edi + 0x20]
add eax, ebx
and eax, 0x800000ff
jns 0x562230
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x18], al
mov ecx, ebp
mov ebx, dword [esp + 0x18]
and ebx, 0xff
lea edx, [esp + ebx + 0x20]
mov dword [esp + 0x1c], edx
call fcn.005622b0
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov cl, byte [ebp]
xor edx, edx
mov dl, byte [eax]
add ecx, edx
and ecx, 0x800000ff
jns 0x56226c
dec ecx
or ecx, 0xffffff00
inc ecx
mov eax, dword [esp + 0x124]
and ecx, 0xff
mov cl, byte [esp + ecx + 0x20]
mov dl, byte [esi + eax]
xor dl, cl
mov byte [esi + eax], dl
mov eax, dword [esp + 0x10]
inc eax
movsx esi, ax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x128]
cmp esi, eax
jl 0x5621e8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 8
Function at 0x562610
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x54
push ebx
push ebp
mov ebp, dword [esp + 0x60]
push edi
mov ebx, ecx
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xc], edx
je 0x5626a5
mov edi, dword [ebx + 0xe0]
push esi
inc edi
lea ecx, [esp + 0x14]
mov eax, edi
mov dword [ebx + 0xe0], edi
push eax
mov eax, dword [ebx + 0xdc]
push eax
push str.queryid_d._d
push ecx
call fcn.0058815f
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x10
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x14]
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [ebx]
push ebp
push ecx
call sub.WSOCK32.dll_sendto
mov byte [ebp], 0
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x54
ret 4

Function at 0x562ac0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x100
push esi
mov esi, ecx
push edi
mov edi, edx
mov ecx, dword [esi + 0xe4]
lea eax, [esi + 8]
push eax
push ecx
lea edx, [esp + 0x10]
push str.heartbeat_dgamename_s
push edx
call fcn.0058815f
add esp, 0x10
test edi, edi
je 0x562b0e
push edi
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push str._statechanged_d
lea eax, [esp + ecx + 0x10]
push eax
call fcn.0058815f
add esp, 0xc
lea ecx, [esi + 0xec]
push 0x10
push ecx
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esi + 4]
push 0
not ecx
dec ecx
lea edx, [esp + 0x14]
push ecx
push edx
push eax
call sub.WSOCK32.dll_sendto
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 0xd8], eax
pop edi
pop esi
add esp, 0x100
ret

Function at 0x562d20
Capabilities:
Create udp socket

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
xor ebx, ebx
mov eax, dword [esi + 0x6c]
push edi
cmp eax, ebp
jle 0x562d7f
xor edi, edi
push 0x11
push 2
push 2
call sub.WSOCK32.dll_socket
mov ecx, dword [esi + 8]
mov dword [edi + ecx], eax
mov edx, dword [esi + 8]
mov ecx, dword [edx + edi]
lea eax, [edx + edi]
cmp ecx, 0xffffffff
je 0x562d6e
mov dword [eax + 4], ebp
mov eax, dword [esi + 8]
inc ebx
mov dword [eax + edi + 8], ebp
mov eax, dword [esi + 0x6c]
add edi, 0x1c
cmp ebx, eax
jl 0x562d33
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
cmp ebx, ebp
jne 0x562d7c
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
mov dword [esi + 0x6c], ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x562d90
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x10
push esi
push 0x70e4
mov esi, ecx
mov word [esp + 8], 2
call sub.WSOCK32.dll_htons
push str.master.gamespy.com
mov word [esp + 0xa], ax
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 8], eax
jne 0x562de2
push str.master.gamespy.com
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x562dd7
mov eax, 2
pop esi
add esp, 0x10
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [esp + 8], edx
push 6
push 1
push 2
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [esi + 0x88], eax
jne 0x562e02
mov eax, 1
pop esi
add esp, 0x10
ret
lea ecx, [esp + 4]
push 0x10
push ecx
push eax
call sub.WSOCK32.dll_connect
test eax, eax
je 0x562e29
mov edx, dword [esi + 0x88]
push edx
call sub.WSOCK32.dll_closesocket
mov eax, 3
pop esi
add esp, 0x10
ret
xor eax, eax
pop esi
add esp, 0x10
ret