joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4131d0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x52ff1a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, 0x3f800000
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], edi
mov dword [esi + 0x8c], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], eax
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
mov dword [esi + 0xb0], edi
mov dword [esi + 0xb4], eax
mov dword [esi + 0xb8], edi
mov dword [esi + 0xbc], edi
mov dword [esi + 0xc0], edi
mov dword [esi + 0xc4], eax
mov dword [esi + 0xc8], edi
mov dword [esi + 0xcc], edi
mov dword [esi + 0xd0], edi
mov dword [esi + 0xd4], eax
mov dword [esp + 8], esi
mov dword [esi + 0xd8], edi
mov dword [esp + 0x14], edi
mov dword [esi + 0xdc], edi
mov dword [esi + 0xe0], edi
push sym.MOHAA.exe_public:_void___thiscall_str::destructor_void_
push sym.MOHAA.exe_public:_void___thiscall_str::constructor_void_
push 3
lea eax, [esi + 0xe4]
push 4
push eax
mov byte [esp + 0x28], 2
call fcn.0051abea
mov ecx, 0x64
mov dword [esi + 0x100], edi
mov dword [esi + 0x104], edi
mov dword [esi + 0x108], edi
mov eax, 0x14
mov dword [esi + 0xc], ecx
mov dword [esi + 0x14], ecx
mov dword [esi + 0x1c], ecx
push 3
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], eax
mov dword [esi + 8], 0x10
mov dword [esi + 0xfc], edi
push edi
lea ecx, [esi + 0xf0]
push ecx
call fcn.0044ef50
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x4281d0
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.00428160
add esp, 4
test al, al
je 0x4281e9
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
ret

Function at 0x4282f0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 8], 0
je 0x428370
mov ecx, 0x80
mov edi, 0x571c28
mov edx, 0x571c28
rep stosd dword es:[edi], eax
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x428322
mov eax, dword [str.command.ln]
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x428370
lea ecx, [esp + 8]
push 0
push ecx
push 0x200
push 0x571c28
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ecx
ret

Function at 0x428380
Capabilities:
Delete file
Read file on windows

Disassembly:
push ecx
mov eax, dword [str.command.ln]
push esi
push eax
mov dword [esp + 8], 0
call fcn.00428160
add esp, 4
test al, al
jne 0x4283a3
mov eax, dword [esp + 0xc]
pop esi
pop ecx
ret
xor eax, eax
push edi
mov ecx, 0x80
mov edi, 0x571c28
push eax
push 0x80
rep stosd dword es:[edi], eax
mov ecx, dword [str.command.ln]
push 3
push eax
push 3
push connect
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
pop edi
cmp esi, 0xffffffff
jne 0x4283de
mov eax, dword [esp + 0xc]
pop esi
pop ecx
ret
lea edx, [esp + 4]
push 0
push edx
push 0x200
push 0x571c28
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [str.command.ln]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 0x571c28
pop esi
pop ecx
ret

Function at 0x42a620
Capabilities:
Set socket configuration

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
push 0x3a
push edi
call fcn.0051b030
mov esi, eax
add esp, 8
test esi, esi
je 0x42a654
push edi
mov byte [esi], 0
call sub.WSOCK32.dll_inet_addr
mov edi, dword [esp + 0xc]
inc esi
push esi
mov dword [edi], eax
call fcn.0051ad2b
add esp, 4
mov word [edi + 4], ax
pop edi
pop esi
ret

Function at 0x42ace0
Capabilities:
Create udp socket

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
xor ebp, ebp
xor ebx, ebx
mov eax, dword [esi + 0x6c]
push edi
cmp eax, ebp
jle 0x42ad41
xor edi, edi
push 0x11
push 2
push 2
call sub.WSOCK32.dll_socket
mov ecx, dword [esi + 8]
mov dword [edi + ecx], eax
mov edx, dword [esi + 8]
mov ecx, dword [edx + edi]
lea eax, [edx + edi]
cmp ecx, 0xffffffff
je 0x42ad30
mov dword [eax + 4], ebp
mov eax, dword [esi + 8]
inc ebx
mov dword [eax + edi + 8], ebp
mov eax, dword [esi + 0x6c]
add edi, 0x1c
cmp ebx, eax
jl 0x42acf5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
cmp ebx, ebp
jne 0x42ad3e
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
mov dword [esi + 0x6c], ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x42ad50
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x10
push esi
push 0x70e4
mov word [esp + 8], 2
call sub.WSOCK32.dll_htons
push 0x546b0c
mov word [esp + 0xa], ax
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 8], eax
jne 0x42ada0
push 0x546b0c
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x42ad95
mov eax, 2
pop esi
add esp, 0x10
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [esp + 8], edx
push 6
push 1
push 2
call sub.WSOCK32.dll_socket
mov esi, dword [esp + 0x18]
cmp eax, 0xffffffff
mov dword [esi + 0x88], eax
jne 0x42adc4
mov eax, 1
pop esi
add esp, 0x10
ret
lea ecx, [esp + 4]
push 0x10
push ecx
push eax
call sub.WSOCK32.dll_connect
test eax, eax
je 0x42adeb
mov edx, dword [esi + 0x88]
push edx
call sub.WSOCK32.dll_closesocket
mov eax, 3
pop esi
add esp, 0x10
ret
xor eax, eax
pop esi
add esp, 0x10
ret

Function at 0x42ae00
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x140
lea eax, [esp]
push esi
mov esi, dword [esp + 0x148]
push edi
push 0
mov ecx, dword [esi + 0x88]
push 0xff
push eax
push ecx
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
je 0x42af82
lea edx, [esp + 8]
push str._secure_
push edx
mov byte [esp + eax + 0x10], 0
call fcn.0051b340
mov edi, eax
add esp, 8
test edi, edi
jne 0x42ae5b
pop edi
mov eax, 5
pop esi
add esp, 0x140
ret
add edi, 8
push 6
push edi
lea eax, [esi + 0x2c]
push 6
push eax
call fcn.0042c240
lea ecx, [esp + 0x118]
push ecx
push 6
push edi
call fcn.0042c190
lea edx, [esp + 0x124]
lea eax, [esi + 0x4c]
push edx
push 0x546bbc
push eax
lea ecx, [esp + 0x30]
push str.gamename_sgamever_slocation0_validate_s_finalqueryid1.1_
push ecx
call fcn.0051a7be
lea edi, [esp + 0x38]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x30
repne scasb al, byte es:[edi]
mov eax, dword [esi + 0x88]
push 0
not ecx
dec ecx
lea edx, [esp + 0xc]
push ecx
push edx
push eax
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
je 0x42af82
test eax, eax
je 0x42af82
mov eax, dword [esi + 0x90]
cmp eax, 6
jne 0x42aeee
mov eax, str.groups
mov dword [esi + 0x98], 0
jmp 0x42af09
cmp eax, 7
jne 0x42af04
mov eax, str.info2
mov dword [esi + 0x98], 0
jmp 0x42af09
mov eax, 0x546b64
mov ecx, dword [esp + 0x150]
lea edx, [esp + 8]
test ecx, ecx
je 0x42af2e
push ecx
lea ecx, [esi + 0xc]
push ecx
push eax
push str.list_sgamename_swhere_s_final_
push edx
call fcn.0051a7be
add esp, 0x14
jmp 0x42af41
lea ecx, [esi + 0xc]
push ecx
push eax
push str.list_sgamename_s_final_
push edx
call fcn.0051a7be
add esp, 0x10
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0xc]
push ecx
mov ecx, dword [esi + 0x88]
push eax
push ecx
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
je 0x42af82
test eax, eax
je 0x42af82
push 1
push esi
call fcn.0042af90
add esp, 8
xor eax, eax
pop edi
pop esi
add esp, 0x140
ret
pop edi
mov eax, 3
pop esi
add esp, 0x140
ret
Function at 0x42b050
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ecx
push 0x11
push 2
push 2
mov dword [esp + 0xc], 1
call sub.WSOCK32.dll_socket
mov ecx, dword [esp + 8]
cmp eax, 0xffffffff
mov dword [ecx + 0x88], eax
jne 0x42b07a
mov eax, 1
pop ecx
ret
lea edx, [esp]
push 4
push edx
push 0x20
push 0xffff
push eax
call sub.WSOCK32.dll_setsockopt
neg eax
sbb eax, eax
neg eax
pop ecx
ret

Function at 0x42b0a0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
movsx eax, si
push edi
mov edi, dword [esp + 0x28]
cmp eax, edi
mov word [esp + 0xc], 2
mov dword [esp + 0x10], 0xffffffff
jg 0x42b0fe
push ebp
mov ebp, dword [esp + 0x30]
push esi
call sub.WSOCK32.dll_htons
mov edx, dword [ebx + 0x88]
lea ecx, [esp + 0x10]
push 0x10
push ecx
push 0
push 8
push str._status_
push edx
mov word [esp + 0x2a], ax
call sub.WSOCK32.dll_sendto
add esi, ebp
movsx eax, si
cmp eax, edi
jle 0x42b0cd
pop ebp
push 2
push ebx
call fcn.0042af90
add esp, 8
call sub.KERNEL32.dll_GetTickCount
pop edi
mov dword [ebx + 0x8c], eax
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
Function at 0x42b240
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
push eax
call sub.WSOCK32.dll_inet_addr
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
mov ebx, eax
push ebp
push ebx
push esi
call fcn.0042b1a0
mov edi, eax
mov eax, dword [esi]
add esp, 0xc
test eax, eax
jne 0x42b303
push esi
call fcn.0042ace0
add esp, 4
test eax, eax
jne 0x42b392
cmp edi, 0xffffffff
je 0x42b2b8
mov ecx, dword [esi + 4]
push edi
push ecx
call fcn.0042a110
mov eax, dword [eax]
push edi
mov dword [esp + 0x30], eax
mov word [eax + 6], 0x270f
mov edx, dword [esi + 4]
push edx
call fcn.0042a220
mov ecx, dword [esi + 4]
lea eax, [esp + 0x34]
push eax
push ecx
call fcn.0042a130
add esp, 0x18
jmp 0x42b2c8
mov edx, dword [esp + 0x24]
push edx
push ebp
push ebx
push esi
call fcn.0042b3a0
add esp, 0x10
mov eax, dword [esi + 4]
push eax
call fcn.0042a100
dec eax
push 3
push esi
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], 0
call fcn.0042af90
mov eax, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x42b390
push esi
call fcn.0042afb0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp edi, 0xffffffff
jne 0x42b323
mov ecx, dword [esp + 0x24]
mov edx, dword [esi + 0x70]
push ecx
push edx
push ebp
push ebx
push esi
call fcn.0042b3e0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esi + 4]
push edi
push eax
call fcn.0042a110
mov ecx, dword [esi + 0x70]
mov eax, dword [eax]
add esp, 8
cmp edi, ecx
mov dword [esp + 0x24], eax
jge 0x42b390
mov word [eax + 6], 0x270f
mov ecx, dword [esp + 0x24]
push ecx
push esi
call fcn.0042b210
add esp, 8
cmp eax, 0xffffffff
je 0x42b36a
lea edx, [eax*8]
sub edx, eax
mov eax, dword [esi + 8]
mov dword [eax + edx*4 + 4], 0
mov ecx, dword [esi + 0x70]
mov eax, dword [esi + 4]
lea edx, [esp + 0x24]
push ecx
push edx
push eax
call fcn.0042a150
mov ecx, dword [esi + 4]
push edi
push ecx
call fcn.0042a220
mov eax, dword [esi + 0x70]
add esp, 0x14
dec eax
mov dword [esi + 0x70], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x42c240
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x110
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x42c24c
push ebx
mov ebx, dword [esp + 0x11c]
push ebp
push esi
push edi
mov byte [esp + 0x10], 0
xor esi, esi
lea edi, [esp + 0x20]
mov ebp, 0x100
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x124]
and eax, 0xff
xor ecx, ecx
mov cl, byte [eax + edx]
xor edx, edx
mov dl, byte [edi]
add esi, ecx
add edx, esi
and edx, 0x800000ff
jns 0x42c29e
dec edx
or edx, 0xffffff00
inc edx
inc eax
mov byte [esp + 0x14], dl
cdq
idiv ebx
mov esi, dword [esp + 0x14]
and esi, 0xff
lea eax, [esp + esi + 0x20]
push eax
push edi
mov byte [esp + 0x18], dl
call fcn.0042c140
add esp, 8
inc edi
dec ebp
jne 0x42c271
mov eax, dword [esp + 0x130]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x18], ebp
jle 0x42c39c
xor esi, esi
xor edi, edi
mov ecx, dword [esp + 0x12c]
mov al, byte [ecx + ebp]
and eax, 0xff
lea edx, [eax + esi + 1]
and edx, 0x800000ff
jns 0x42c302
dec edx
or edx, 0xffffff00
inc edx
mov byte [esp + 0x10], dl
xor eax, eax
mov esi, dword [esp + 0x10]
and esi, 0xff
mov al, byte [esp + esi + 0x20]
lea ebx, [esp + esi + 0x20]
add eax, edi
and eax, 0x800000ff
jns 0x42c32a
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x14], al
mov edi, dword [esp + 0x14]
and edi, 0xff
lea eax, [esp + edi + 0x20]
push eax
push ebx
mov dword [esp + 0x24], eax
call fcn.0042c140
mov eax, dword [esp + 0x24]
xor ecx, ecx
mov cl, byte [ebx]
xor edx, edx
mov dl, byte [eax]
add esp, 8
add ecx, edx
and ecx, 0x800000ff
jns 0x42c368
dec ecx
or ecx, 0xffffff00
inc ecx
mov eax, dword [esp + 0x12c]
and ecx, 0xff
mov cl, byte [esp + ecx + 0x20]
mov dl, byte [eax + ebp]
xor cl, dl
mov byte [eax + ebp], cl
mov eax, dword [esp + 0x18]
inc eax
movsx ebp, ax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x130]
cmp ebp, eax
jl 0x42c2df
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret

Function at 0x42d280
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
call fcn.004816f0
lea eax, [esp]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
add esp, 0x190
ret
Function at 0x42d880
Capabilities:
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x14
test eax, eax
je 0x42d891
mov dword [eax], 0
push ebx
push ebp
push esi
push edi
call fcn.0042d280
push 0x11
push 2
push 2
call sub.WSOCK32.dll_socket
mov ebp, eax
cmp ebp, 0xffffffff
je 0x42da5e
mov esi, dword [esp + 0x30]
lea ebx, [esi + 0x64]
cmp esi, ebx
jge 0x42d8fe
mov edi, dword [esp + 0x2c]
lea eax, [esp + 0x14]
push 0
push eax
push esi
push edi
call fcn.0042dc70
add esp, 0x10
push 0x7f000001
call sub.WSOCK32.dll_htonl
cmp dword [esp + 0x18], eax
jne 0x42d8e8
mov dword [esp + 0x18], 0
lea ecx, [esp + 0x14]
push 0x10
push ecx
push ebp
call sub.WSOCK32.dll_bind
test eax, eax
je 0x42d90b
inc esi
cmp esi, ebx
jl 0x42d8bf
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x14
ret
test esi, esi
jne 0x42d94b
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push ebp
mov dword [esp + 0x1c], 0x10
call sub.WSOCK32.dll_getsockname
test eax, eax
je 0x42d938
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x14
ret
mov ecx, dword [esp + 0x16]
push ecx
call sub.WSOCK32.dll_ntohs
mov si, ax
and esi, 0xffff
mov edi, dword [esp + 0x28]
test edi, edi
jne 0x42d95f
mov dword [0x546f70], 0x546e80
jmp 0x42d973
push 0xf0
call fcn.0051b3c0
mov dword [0x546f70], eax
add esp, 4
mov dword [edi], eax
mov edx, dword [0x546f70]
mov ecx, dword [esp + 0x34]
add edx, 8
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x42d980
mov eax, dword [0x546f70]
mov ecx, dword [esp + 0x38]
lea edx, [eax + 0x48]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x42d996
mov ecx, dword [0x546f70]
xor eax, eax
push 0x6cfc
push str.master.gamespy.com
mov dword [ecx + 0xe4], esi
mov edx, dword [0x546f70]
push ebp
mov dword [edx + 0xd8], eax
mov ecx, dword [0x546f70]
mov dword [ecx + 4], ebp
mov edx, dword [0x546f70]
mov dword [edx], ebp
mov ecx, dword [0x546f70]
mov dword [ecx + 0xe0], eax
mov edx, dword [0x546f70]
mov eax, 1
mov dword [edx + 0xdc], eax
mov ecx, dword [0x546f70]
mov byte [ecx + 0xe8], al
mov edx, dword [0x546f70]
mov eax, dword [esp + 0x58]
mov dword [edx + 0xec], eax
mov ecx, dword [0x546f70]
mov edx, dword [esp + 0x48]
mov dword [ecx + 0xc8], edx
mov eax, dword [0x546f70]
mov ecx, dword [esp + 0x4c]
mov dword [eax + 0xcc], ecx
mov edx, dword [0x546f70]
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x50]
mov dword [edx + 0xd4], eax
mov edx, dword [0x546f70]
mov dword [edx + 0xd0], ecx
call fcn.0042dc50
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret
Function at 0x42dab0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x120
push ebx
push esi
mov esi, dword [esp + 0x12c]
xor ebx, ebx
mov dword [esp + 8], 0x10
mov dword [esp + 0xc], ebx
mov eax, dword [esi]
mov dword [esp + 0x10], ebx
cmp eax, 0xffffffff
je 0x42db3d
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 1
lea eax, [esp + 0xc]
lea ecx, [esp + 0x24]
push eax
push ebx
push ebx
push ecx
push 0x40
call sub.WSOCK32.dll_select
cmp eax, 0xffffffff
je 0x42db3d
cmp eax, ebx
je 0x42db3d
mov ecx, dword [esi]
lea edx, [esp + 8]
lea eax, [esp + 0x14]
push edx
push eax
push ebx
push 0xff
push 0x5727a8
push ecx
call sub.WSOCK32.dll_recvfrom
cmp eax, 0xffffffff
je 0x42dae4
lea edx, [esp + 0x14]
mov byte [eax + 0x5727a8], bl
push edx
push 0x5727a8
push esi
call fcn.0042dcf0
add esp, 0xc
jmp 0x42dae4
pop esi
pop ebx
add esp, 0x120
ret

Function at 0x42dc70
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push eax
xor ebp, ebp
mov word [ebx], 2
call sub.WSOCK32.dll_htons
mov esi, dword [esp + 0x10]
mov word [ebx + 2], ax
cmp esi, ebp
jne 0x42dc99
mov dword [ebx + 4], ebp
jmp 0x42dca2
push esi
call sub.WSOCK32.dll_inet_addr
mov dword [ebx + 4], eax
cmp dword [ebx + 4], 0xffffffff
jne 0x42dcd8
push edi
mov edi, str.255.255.255.255
mov ecx, 0x10
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
pop edi
je 0x42dcd8
mov eax, dword [esp + 0x10]
push eax
call sub.WSOCK32.dll_gethostbyname
mov ebp, eax
test ebp, ebp
jne 0x42dcce
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x42dce2
mov dword [eax], ebp
pop esi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x42dff0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x50
or ecx, 0xffffffff
xor eax, eax
push ebp
mov ebp, dword [esp + 0x60]
push edi
mov edi, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x42e084
push ebx
mov ebx, dword [esp + 0x60]
push esi
lea ecx, [esp + 0x10]
mov edi, dword [ebx + 0xe0]
inc edi
mov eax, edi
mov dword [ebx + 0xe0], edi
push eax
mov eax, dword [ebx + 0xdc]
push eax
push str.queryid_d._d
push ecx
call fcn.0051a7be
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x10
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x6c]
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [ebx]
push ebp
push ecx
call sub.WSOCK32.dll_sendto
pop esi
mov byte [ebp], 0
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x42e4d0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x100
lea edx, [esp]
push esi
mov esi, dword [esp + 0x108]
push edi
mov ecx, dword [esi + 0xe4]
lea eax, [esi + 8]
push eax
push ecx
push str.heartbeat_dgamename_s
push edx
call fcn.0051a7be
mov eax, dword [esp + 0x120]
add esp, 0x10
test eax, eax
je 0x42e53f
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [0x547040]
repne scasb al, byte es:[edi]
mov eax, dword [str._statechanged_]
mov ecx, dword [0x54703c]
dec edi
mov dword [edi], eax
mov ax, word [0x547044]
mov dword [edi + 4], ecx
mov cl, byte [0x547046]
mov dword [edi + 8], edx
mov word [edi + 0xc], ax
mov byte [edi + 0xe], cl
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
push 0x10
repne scasb al, byte es:[edi]
mov eax, dword [esi + 4]
push 0x572ab0
not ecx
dec ecx
push 0
lea edx, [esp + 0x14]
push ecx
push edx
push eax
call sub.WSOCK32.dll_sendto
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 0xd8], eax
pop edi
pop esi
add esp, 0x100
ret
Function at 0x4453d0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
mov ebx, dword [esp + 0x14]
push esi
push edi
mov edi, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
xor eax, eax
mov al, byte [edi]
shr eax, 7
lea ecx, [ebx + eax*8]
lea eax, [edx + ecx*8]
xor edx, edx
mov dx, word [eax*8 + 0xed99c0]
xor ecx, ecx
lea eax, [eax*8 + 0xed99c0]
mov esi, edx
and esi, 1
mov ebp, esi
mov cx, word [eax + 4]
shl ebp, 6
sub ebp, esi
xor esi, esi
mov si, word [eax + 2]
add ebp, esi
xor esi, esi
mov si, word [edi + ebp*2 + 0x34]
and esi, edx
mov edx, ecx
and esi, 0xfffffffe
neg esi
sbb esi, esi
and edx, 1
mov ebp, edx
and esi, 2
shl ebp, 6
sub ebp, edx
xor edx, edx
mov dx, word [eax + 6]
xor eax, eax
add ebp, edx
mov ax, word [edi + ebp*2 + 0x34]
pop edi
and eax, ecx
mov ecx, dword [esp + 0x1c]
and al, 0xfe
neg eax
sbb eax, eax
add ebx, ecx
mov ecx, dword [esp + 0x10]
and eax, 4
or esi, eax
and ebx, 1
or esi, ebx
mov eax, dword [esi*4 + 0x54b390]
pop esi
pop ebp
cmp eax, 2
mov dword [ecx + 0x20], eax
pop ebx
jne 0x44549f
mov eax, dword [esp + 8]
fld dword [ecx + 8]
fmul dword [eax + 8]
fld dword [ecx + 4]
fmul dword [eax + 4]
faddp st(1)
fld dword [ecx]
fmul dword [eax]
faddp st(1)
fcomp dword [ecx + 0xc]
fnstsw ax
test ah, 5
jp 0x4454c0
mov dword [ecx + 0x20], 1
ret
cmp eax, 5
je 0x4454a9
cmp eax, 6
jne 0x4454c0
mov edx, dword [ecx + 0x10]
mov eax, dword [ecx + 0x14]
mov dword [ecx], edx
mov edx, dword [ecx + 0x18]
mov dword [ecx + 4], eax
mov eax, dword [ecx + 0x1c]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
ret
Function at 0x44d280
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0xed1964]
test eax, eax
jne 0x44d2ac
push str.Server_quit_n
call fcn.004771a0
call fcn.0043a090
call fcn.0047f460
call fcn.0044ed50
push 1
call fcn.00453990
add esp, 8
jmp 0x481510
push 1
call dword [sym.imp.WINMM.dll_timeEndPeriod]
call fcn.00511a50
call fcn.005117a0
call fcn.005104a0
call fcn.00458ec0
call fcn.0047ea40
call fcn.00488a10
call fcn.0045d870
mov eax, dword [0x7fd00c]
test eax, eax
jne 0x481549
call fcn.00428280
push 0
call fcn.0051dc94

Function at 0x45ca40
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret