joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dd278
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x14], edx
mov edx, eax
mov eax, dword [ebp - 0x14]
mov ecx, 0x10
call fcn.004dd084
xor esi, esi
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
test bl, bl
jne 0x4dd354
xor ecx, ecx
mov cl, byte [eax]
mov ecx, dword [ecx*4 + 0x562564]
movzx edi, byte [eax + 1]
xor ecx, dword [edi*4 + 0x562964]
movzx edi, byte [eax + 2]
xor ecx, dword [edi*4 + 0x562d64]
movzx edi, byte [eax + 3]
xor ecx, dword [edi*4 + 0x563164]
mov dword [ebp - 0x18], ecx
xor ecx, ecx
mov cl, byte [ebp - 0x18]
mov cl, byte [ecx + 0x56142c]
lea edi, [esi]
and edi, 0x80000003
jns 0x4dd2ee
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0x10], cl
xor ecx, ecx
mov cl, byte [ebp - 0x17]
mov cl, byte [ecx + 0x56142c]
lea edi, [esi + 1]
and edi, 0x80000003
jns 0x4dd30d
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0xf], cl
xor ecx, ecx
mov cl, byte [ebp - 0x16]
mov cl, byte [ecx + 0x56142c]
lea edi, [esi + 2]
and edi, 0x80000003
jns 0x4dd32c
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0xe], cl
xor ecx, ecx
mov cl, byte [ebp - 0x15]
mov cl, byte [ecx + 0x56142c]
lea edi, [esi + 3]
and edi, 0x80000003
jns 0x4dd34b
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0xd], cl
jmp 0x4dd3d5
lea ecx, [esi]
and ecx, 0x80000003
jns 0x4dd363
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4]
mov cl, byte [ecx + 0x56142c]
mov byte [edx], cl
lea ecx, [esi + 3]
and ecx, 0x80000003
jns 0x4dd382
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4 + 1]
mov cl, byte [ecx + 0x56142c]
mov byte [edx + 1], cl
lea ecx, [esi + 2]
and ecx, 0x80000003
jns 0x4dd3a3
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4 + 2]
mov cl, byte [ecx + 0x56142c]
mov byte [edx + 2], cl
lea ecx, [esi + 1]
and ecx, 0x80000003
jns 0x4dd3c4
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4 + 3]
mov cl, byte [ecx + 0x56142c]
mov byte [edx + 3], cl
inc esi
add edx, 4
add eax, 4
cmp esi, 4
jne 0x4dd29d
mov eax, dword [ebp - 0x14]
mov edi, eax
lea esi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ddae4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff5c
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dl, byte [ebp + 8]
mov byte [eax], dl
mov edx, ebx
mov eax, 0x10
call fcn.00465eec
mov edx, eax
mov eax, 4
call fcn.00465f34
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x24], 0x561310
mov eax, dword [ebp - 4]
add eax, 8
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov ecx, dword [ebp - 0x24]
mov esi, dword [ecx]
mov ecx, esi
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx + 4]
mov dword [ebp - 0xc], esi
mov edi, dword [ebp - 8]
mov edi, dword [edi + 8]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], esi
mov edi, dword [ebp - 8]
mov edi, dword [edi + 0xc]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], esi
mov esi, 8
mov edi, ecx
shl edi, 0xb
xor edx, edi
add dword [ebp - 0xc], edx
add ecx, ebx
mov edi, ebx
shr edi, 2
xor ecx, edi
add dword [ebp - 0x10], ecx
add ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
shl edi, 8
xor ebx, edi
add dword [ebp - 0x14], ebx
mov edi, dword [ebp - 0x10]
add dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x10]
shr edi, 0x10
xor dword [ebp - 0xc], edi
mov edi, dword [ebp - 0xc]
add dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x14]
add dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x14]
shl edi, 0xa
xor dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x10]
add dword [ebp - 0x1c], edi
mov edi, dword [ebp - 0x18]
add dword [ebp - 0x14], edi
mov edi, dword [ebp - 0x18]
shr edi, 4
xor dword [ebp - 0x14], edi
add edx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
add dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x1c]
shl edi, 8
xor dword [ebp - 0x18], edi
add ecx, dword [ebp - 0x18]
add dword [ebp - 0x1c], edx
mov edi, edx
shr edi, 9
xor dword [ebp - 0x1c], edi
add ebx, dword [ebp - 0x1c]
add edx, ecx
dec esi
jne 0x4ddb64
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x10], edx
mov edx, dword [ebp - 0x14]
mov dword [eax + 0x14], edx
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x18], edx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x1c], edx
add eax, 0x20
add dword [ebp - 0x24], 4
dec dword [ebp - 0x20]
jne 0x4ddb32
cmp byte [ebp + 8], 0
jne 0x4ddc93
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
dec eax
test eax, eax
jl 0x4ddc68
inc eax
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 4]
add edx, 8
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
dec ecx
sub ecx, dword [ebp - 0x20]
mov ebx, dword [edx]
mov dword [ebp + ecx*8 - 0xa4], ebx
mov ebx, dword [edx + 4]
mov dword [ebp + ecx*8 - 0xa0], ebx
inc dword [ebp - 0x20]
add edx, 8
dec eax
jne 0x4ddc42
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
dec eax
test eax, eax
jl 0x4ddc93
inc eax
lea edx, [ebp - 0xa4]
mov ebx, dword [ebp - 4]
add ebx, 8
mov ecx, dword [edx]
mov dword [ebx], ecx
mov ecx, dword [edx + 4]
mov dword [ebx + 4], ecx
add ebx, 8
add edx, 8
dec eax
jne 0x4ddc80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4ddc9c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd0
mov dword [esp], edx
mov ebx, eax
lea edx, [esp + 0x20]
mov eax, dword [esp]
mov ecx, 0x10
call fcn.00403168
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 4]
dec eax
test eax, eax
jl 0x4dddf8
inc eax
mov dword [esp + 0x1c], eax
lea eax, [ebx + 8]
mov ebx, eax
mov edx, dword [esp + 0xc]
mov ecx, dword [ebx]
mov esi, dword [esp + 0x10]
mov eax, dword [ebx + 4]
add edx, eax
add eax, edx
mov edi, edx
shr edi, 7
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 0xd
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, esi
shr edi, 0x11
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 9
xor eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 3
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 7
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, eax
shr edi, 0xf
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 0xb
xor eax, edi
mov edi, edx
mov edx, esi
mov esi, edi
mov edi, ecx
mov ecx, eax
mov eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 7
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 0xd
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, esi
shr edi, 0x11
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 9
xor eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 3
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 7
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, eax
shr edi, 0xf
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 0xb
xor eax, edi
xor edx, dword [esp + 0x14]
xor ecx, edx
mov dword [esp + 4], ecx
xor esi, dword [esp + 0x18]
xor eax, esi
mov dword [esp + 8], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x10], eax
add ebx, 8
dec dword [esp + 0x1c]
jne 0x4ddcee
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov edx, dword [esp]
lea eax, [esp + 0x20]
mov ecx, 0x10
call fcn.00403168
add esp, 0x30
pop edi
pop esi
pop ebx
ret

Function at 0x4dde30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffee8
mov ebx, eax
mov edx, esp
mov eax, ebx
mov ecx, 0x118
call fcn.00403168
xor eax, eax
mov dword [esp], eax
mov esi, 0x563564
lea edi, [esp + 4]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov dword [esp + 0x104], eax
mov dword [esp + 0x108], 0x55555555
mov dword [esp + 0x10c], 0x55555555
mov dword [esp + 0x110], 0x55555555
mov dword [esp + 0x114], 0x55555555
mov edx, ebx
mov eax, esp
mov ecx, 0x118
call fcn.00403168
add esp, 0x118
pop edi
pop esi
pop ebx
ret
Function at 0x4ddeac
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffee0
mov edi, ecx
mov ebx, edx
mov dword [esp], eax
lea edx, [esp + 8]
mov eax, dword [esp]
mov ecx, 0x118
call fcn.00403168
dec edi
test edi, edi
jl 0x4ddfcb
inc edi
mov dword [esp + 4], edi
mov esi, ebx
mov al, byte [esi]
mov edx, dword [esp + 8]
xor byte [esp + edx + 0xc], al
inc dword [esp + 8]
cmp dword [esp + 8], 0x100
jne 0x4ddefc
xor edx, edx
mov dword [esp + 8], edx
mov edx, dword [esp + 0x10c]
xor byte [esp + edx + 0x110], al
inc dword [esp + 0x10c]
cmp dword [esp + 0x10c], 8
jne 0x4ddfc0
mov edx, dword [esp + 0x11c]
mov ecx, dword [esp + 0x118]
mov ebx, dword [esp + 0x114]
mov eax, dword [esp + 0x110]
mov edi, 4
add edx, eax
add eax, edx
mov ebp, edx
shr ebp, 7
xor edx, ebp
add ecx, edx
add edx, ecx
mov ebp, ecx
shl ebp, 0xd
xor ecx, ebp
add ebx, ecx
add ecx, ebx
mov ebp, ebx
shr ebp, 0x11
xor ebx, ebp
add eax, ebx
add ebx, eax
mov ebp, eax
shl ebp, 9
xor eax, ebp
add edx, eax
add eax, edx
mov ebp, edx
shr ebp, 3
xor edx, ebp
add ecx, edx
add edx, ecx
mov ebp, ecx
shl ebp, 7
xor ecx, ebp
add ebx, ecx
add ecx, ebx
mov ebp, eax
shr ebp, 0xf
xor ebx, ebp
add eax, ebx
add ebx, eax
mov ebp, eax
shl ebp, 0xb
xor eax, ebp
dec edi
jne 0x4ddf40
mov dword [esp + 0x110], edx
mov dword [esp + 0x114], ecx
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], eax
xor eax, eax
mov dword [esp + 0x10c], eax
inc esi
dec dword [esp + 4]
jne 0x4ddede
mov edx, dword [esp]
lea eax, [esp + 8]
mov ecx, 0x118
call fcn.00403168
add esp, 0x120
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4df45c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4df4cd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x56369c]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x4df4b7
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.004df44c
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4df258]
call fcn.004df4f4
mov dword [0x563700], eax
mov eax, dword [ebp - 4]
call fcn.004df3fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4df4d4
lea eax, [ebp - 8]
call fcn.00407124
ret
Function at 0x4e0f18
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x4e0f47
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x4e0fc6
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004df7d4
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4e0f94
mov cx, word [esp]
sub cx, si
jmp 0x4e0f96
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4e0f7d
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4e0fbc
mov cx, word [esp]
sub cx, si
jmp 0x4e0fbe
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4e0fa5
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x4e1023
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.004e0bec
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x4e100e
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x4e1023
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4e0f22
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4e7558
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x57281c
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4e757a
shr eax, 1
xor eax, 0xedb88320
jmp 0x4e757c
shr eax, 1
dec edx
jne 0x4e7568
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4e7561
mov byte [0x572c1c], 1
pop esi
pop ebx
ret

Function at 0x4e7598
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x572c1c], 0
jne 0x4e75af
call fcn.004e7558
mov eax, edi
dec eax
test eax, eax
jl 0x4e75d8
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x57281c]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4e75b9
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4ea0f4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x4ea125
dec al
je 0x4ea161
dec al
je 0x4ea1a5
dec al
je 0x4ea210
jmp 0x4ea29a
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4ea29a
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4ea135
jmp 0x4ea29a
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4ea29a
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4ea171
jmp 0x4ea29a
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4ea29a
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4ea1d3
xor ebp, ebp
jmp 0x4ea1e4
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4ea1ed
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4ea1b5
jmp 0x4ea29a
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4ea29a
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4ea268
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004e75e0
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4ea224
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4f06e4
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
cmp byte [0x566fec], 0
jne 0x4f0705
push esp
push 0x101
call sub.wsock32.dll_WSAStartup
mov byte [0x566fec], 1
add esp, 0x190
ret
Function at 0x4f4b18
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x27
push 0
push 0
dec ecx
jne 0x4f4b20
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4f4f67
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004f4858
cmp bl, al
je 0x4f4f2c
mov eax, dword [ebp - 4]
call fcn.004f4740
test bl, bl
je 0x4f4f22
mov eax, dword [ebp - 4]
add eax, 0xa8
xor ecx, ecx
mov edx, 0x40
call fcn.00403ac0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x80], edx
call fcn.004f06e4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x44]
mov dl, 1
mov eax, dword [0x4d2f64]
call fcn.004d3b50
mov edx, eax
test edx, edx
je 0x4f4ba1
sub edx, 0xffffffdc
lea eax, [ebp - 8]
call fcn.0040713c
mov eax, dword [ebp - 4]
mov word [eax + 0x94], 2
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x40]
push eax
call sub.wsock32.dll_htons
mov edx, dword [ebp - 4]
mov word [edx + 0x96], ax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
call fcn.00405878
push eax
call sub.wsock32.dll_inet_addr
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x98], ebx
inc ebx
jne 0x4f4c20
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
call fcn.00405878
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4f4c0d
or eax, 0xffffffff
call fcn.004f40e0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
mov dword [edx + 0x98], eax
mov edx, 0x4f4f7c
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x1388
lea ecx, [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004f08bc
test al, al
je 0x4f4f2c
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x1e
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.004058d8
mov eax, dword [ebp - 0x1c]
mov edx, 0x4f4fa4
call fcn.004057c4
je 0x4f4c9d
lea edx, [ebp - 0x120]
mov eax, 0x4f4fcc
call fcn.004f0434
mov edx, dword [ebp - 0x120]
lea eax, [ebp - 0x11c]
mov ecx, 0xff
call fcn.00405654
lea eax, [ebp - 0x11c]
call fcn.004c8f6c
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x41d73c]
call fcn.004228f4
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4f4d29
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x1e
mov eax, dword [ebp - 0x18]
call fcn.00421fc0
lea edx, [ebp - 0x124]
mov eax, dword [ebp - 0x18]
call fcn.004f0608
mov edx, dword [ebp - 0x124]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf4]
mov eax, dword [eax + 0x44]
call fcn.004dcb20
lea edx, [ebp - 0x128]
mov eax, dword [ebp - 0x18]
call fcn.004f0608
mov edx, dword [ebp - 0x128]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf4]
mov eax, dword [eax + 0x44]
call fcn.004dcbbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f4d30
mov eax, dword [ebp - 0x18]
call fcn.0040444c
ret
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004f4810
Function at 0x4f7708
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test dl, dl
je 0x4f771d
add esp, 0xfffffff0
call fcn.004047c4
mov edi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov cl, 1
xor edx, edx
mov eax, ebx
call fcn.004281a8
mov eax, dword [ebp + 8]
mov dword [ebx + 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x4c], eax
push 0
mov cl, 1
mov dl, 1
mov eax, dword [0x4d3304]
call fcn.004d484c
mov edx, eax
test edx, edx
je 0x4f7754
sub edx, 0xfffffff0
lea eax, [ebx + 0x44]
call fcn.0040713c
call fcn.004f06e4
push 0x11
push 2
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx + 0x40], esi
mov eax, esi
call fcn.004f40e0
test edi, edi
je 0x4f77b4
lea eax, [ebp - 0x14]
xor ecx, ecx
mov edx, 0x10
call fcn.00403ac0
mov word [ebp - 0x14], 2
push edi
call sub.wsock32.dll_htons
mov word [ebp - 0x12], ax
xor eax, eax
mov dword [ebp - 0x10], eax
push 0x10
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx + 0x40]
push eax
call sub.wsock32.dll_bind
call fcn.004f40e0
mov eax, ebx
call fcn.004285ec
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4f77d2
call fcn.0040481c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4f78d4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], ecx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405868
xor eax, eax
push ebp
push 0x4f793a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00405678
push eax
mov eax, dword [ebp - 4]
call fcn.00405878
push eax
mov eax, dword [ebx + 0x40]
push eax
call sub.wsock32.dll_sendto
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f7941
lea eax, [ebp - 4]
call fcn.0040539c
ret

Function at 0x4f7948
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp], ecx
push 0x10
lea edx, [esp + 8]
push edx
push 0
push 4
lea edx, [esp + 0x10]
push edx
mov eax, dword [eax + 0x40]
push eax
call sub.wsock32.dll_sendto
add esp, 0x14
pop edi
pop esi
ret
Function at 0x4ff78c
Capabilities:
Access peb ldr_data
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor ecx, ecx
mov dword [ebp - 0x18], ecx
test dl, dl
je 0x4ff7a3
add esp, 0xfffffff0
call fcn.004047c4
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ff8b1
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0040441c
mov dl, 1
mov eax, dword [0x4681c0]
call fcn.00468318
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov dl, 1
mov eax, dword [0x4fe810]
call fcn.004c0450
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
lea ecx, [eax + 0x34]
mov eax, dword [ebp - 0x10]
lea edx, [eax + 0x30]
mov eax, dword [ebp - 0x10]
call fcn.004c04d8
mov dl, 1
mov eax, dword [0x4fe86c]
call fcn.004c0450
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
lea ecx, [eax + 0x30]
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x30]
mov eax, dword [ebp - 0x14]
call fcn.004c04d8
mov eax, dword [ebp - 4]
mov byte [eax + 0x1c0], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x1cd], 0x1e
mov eax, dword [ebp - 4]
mov dword [eax + 0x1c9], 0xffffffff
mov eax, dword [ebp - 4]
add eax, 0x30
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4ff89b
lea eax, [ebp - 0x18]
push eax
call sub.wsock32.dll_WSAGetLastError
mov ecx, eax
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00500cf0
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x40b6f8]
call fcn.004110b0
call fcn.00404cf0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ff8b8
lea eax, [ebp - 0x18]
call fcn.0040539c
ret