joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4979f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e2750
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x208
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
lea edx, [ebp - 0x214]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x497a24
lea eax, [ebp - 0x214]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x497a37
sub eax, edx
mov edi, eax
mov eax, dword [ebp + 8]
push 0x5f6698
push eax
mov dword [ebp + 0xc], edi
call dword [sym.imp.msvcrt.dll_fopen]
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x497a89
push 0x637c4c
lea ecx, [ebp - 0x14]
push ecx
mov dword [ebp - 0x14], 0xff67697f
call sub.msvcrt.dll__CxxThrowException
mov eax, 0x497a78
ret
mov esi, dword [ebp + 0x14]
jmp 0x497a91
mov edi, dword [ebp + 0xc]
cmp byte [esi], 0
je 0x497c15
push edi
lea edx, [ebp - 0x214]
push edx
push esi
call dword [sym.imp.msvcrt.dll__strnicmp]
add esp, 0xc
test eax, eax
jne 0x497acd
cmp esi, dword [ebp + 0x14]
je 0x497ade
movsx eax, byte [esi - 1]
push eax
call dword [sym.imp.msvcrt.dll_isalnum]
add esp, 4
test eax, eax
jne 0x497acd
cmp byte [esi - 1], 0x5f
jne 0x497ade
movsx eax, byte [esi]
push ebx
push eax
inc esi
call dword [sym.imp.msvcrt.dll_fputc]
add esp, 8
jmp 0x497a91
push ebx
push 1
push edi
push esi
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
add esi, edi
mov edi, edi
mov al, byte [esi]
cmp al, 0x20
je 0x497b02
cmp al, 9
je 0x497b02
cmp al, 0xd
je 0x497b02
cmp al, 0xa
jne 0x497b13
movsx eax, al
push ebx
push eax
inc esi
call dword [sym.imp.msvcrt.dll_fputc]
add esp, 8
jmp 0x497af0
cmp byte [esi], 0x3d
jne 0x497a91
mov edi, dword [sym.imp.msvcrt.dll_fputc]
push ebx
push 0x3d
inc esi
call edi
mov al, byte [esi]
add esp, 8
cmp al, 0x20
je 0x497b3d
cmp al, 9
je 0x497b3d
cmp al, 0xd
je 0x497b3d
cmp al, 0xa
jne 0x497b44
movsx eax, al
push ebx
push eax
jmp 0x497b25
mov al, byte [esi]
push ebx
cmp al, 0x22
je 0x497bd5
cmp al, 0x27
je 0x497b8d
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.msvcrt.dll_fputs]
add esp, 8
mov al, byte [esi]
test al, al
je 0x497a8e
cmp al, 0x2c
je 0x497a8e
cmp al, 0x3b
je 0x497a8e
cmp al, 0xd
je 0x497a8e
cmp al, 0xa
je 0x497a8e
inc esi
jmp 0x497b60
movsx eax, al
push eax
inc esi
call edi
mov edi, dword [ebp + 0x10]
add esp, 8
lea ebx, [ebx]
mov al, byte [edi]
test al, al
je 0x497bc0
cmp al, 0x27
je 0x497bb8
movsx edx, al
push ebx
push edx
call dword [sym.imp.msvcrt.dll_fputc]
add esp, 8
inc edi
jmp 0x497ba0
mov al, byte [esi]
test al, al
je 0x497a8e
cmp al, 0x27
je 0x497a8e
inc esi
jmp 0x497bc0
movsx eax, al
push eax
inc esi
call edi
mov edi, dword [ebp + 0x10]
add esp, 8
mov al, byte [edi]
test al, al
je 0x497c00
cmp al, 0x22
je 0x497bfa
movsx eax, al
push ebx
push eax
call dword [sym.imp.msvcrt.dll_fputc]
add esp, 8
inc edi
jmp 0x497be2
mov al, byte [esi]
test al, al
je 0x497a8e
cmp al, 0x22
je 0x497a8e
inc esi
jmp 0x497c00
push ebx
call dword [sym.imp.msvcrt.dll_fclose]
mov ecx, dword [ebp - 0xc]
add esp, 4
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x497d30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e2770
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
lea edx, [ebp - 0x218]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x497d61
lea eax, [ebp - 0x218]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x497d74
sub eax, edx
mov ebx, eax
mov eax, dword [ebp + 8]
push 0x5f6698
push eax
mov dword [ebp - 0x14], ebx
call dword [sym.imp.msvcrt.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
jne 0x497dc6
push 0x637c4c
lea ecx, [ebp - 0x18]
push ecx
mov dword [ebp - 0x18], 0xff67697f
call sub.msvcrt.dll__CxxThrowException
mov eax, 0x497db5
ret
mov esi, dword [ebp + 0x10]
jmp 0x497dd3
mov ebx, dword [ebp - 0x14]
cmp byte [esi], 0
je 0x497efd
push ebx
lea edx, [ebp - 0x218]
push edx
push esi
call dword [sym.imp.msvcrt.dll__strnicmp]
add esp, 0xc
test eax, eax
jne 0x497e0f
cmp esi, dword [ebp + 0x10]
je 0x497e20
movsx eax, byte [esi - 1]
push eax
call dword [sym.imp.msvcrt.dll_isalnum]
add esp, 4
test eax, eax
jne 0x497e0f
cmp byte [esi - 1], 0x5f
jne 0x497e20
movsx eax, byte [esi]
push edi
push eax
inc esi
call dword [sym.imp.msvcrt.dll_fputc]
add esp, 8
jmp 0x497dd3
push edi
push 1
push ebx
push esi
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
add esi, ebx
mov al, byte [esi]
cmp al, 0x20
je 0x497e3a
cmp al, 9
jne 0x497e4b
movsx eax, al
push edi
push eax
inc esi
call dword [sym.imp.msvcrt.dll_fputc]
add esp, 8
jmp 0x497e30
mov al, byte [esi]
test al, al
je 0x497dd3
cmp al, 0xd
je 0x497dd3
cmp al, 0xa
je 0x497dd3
cmp al, 0x22
jne 0x497e7f
push edi
push 0x22
mov bl, 1
inc esi
call dword [sym.imp.msvcrt.dll_fputc]
add esp, 8
cmp byte [esi], 0
je 0x497dd0
jmp 0x497e92
xor bl, bl
cmp byte [ebp + 0x14], bl
je 0x497e92
push edi
push 0x22
call dword [sym.imp.msvcrt.dll_fputc]
add esp, 8
mov ecx, dword [ebp + 0xc]
push edi
push ecx
call dword [sym.imp.msvcrt.dll_fputs]
add esp, 8
test bl, bl
je 0x497eb9
mov al, byte [esi]
test al, al
je 0x497dd0
cmp al, 0x22
je 0x497dd0
inc esi
jmp 0x497ea4
cmp byte [ebp + 0x14], 0
je 0x497ed0
push edi
push 0x22
call dword [sym.imp.msvcrt.dll_fputc]
add esp, 8
jmp 0x497ed0
mov al, byte [esi]
test al, al
je 0x497dd0
cmp al, 0xd
je 0x497dd0
cmp al, 0xa
je 0x497dd0
cmp al, 9
je 0x497dd0
cmp al, 0x7d
je 0x497dd0
inc esi
jmp 0x497ed0
push edi
call dword [sym.imp.msvcrt.dll_fclose]
mov ecx, dword [ebp - 0xc]
add esp, 4
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x498270
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x608
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov byte [ebx], 0
call fcn.004968b0
mov ecx, dword [str.SOFTWARE_]
mov edx, dword [0x606fac]
mov dword [ebp - 0x608], ecx
mov cx, word [0x606fb0]
mov word [ebp - 0x600], cx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x604], edx
mov esi, ecx
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4982b1
push edi
sub ecx, esi
lea edi, [ebp - 0x608]
mov edx, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4982c4
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp + 0x10]
push edx
and ecx, 3
push 1
rep movsb byte es:[edi], byte [esi]
push 0
lea ecx, [ebp - 0x608]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop edi
test eax, eax
jne 0x49837b
lea edx, [ebp - 8]
push edx
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x208]
push eax
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 4]
push ecx
push 0
push edx
push eax
mov dword [ebp - 8], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x498371
mov eax, dword [ebp - 4]
dec eax
je 0x498354
sub eax, 3
jne 0x498371
mov ecx, dword [ebp - 0x208]
push ecx
push 0x607e44
push ebx
call dword [sym.imp.msvcrt.dll_sprintf]
mov eax, dword [ebp + 0x10]
add esp, 0xc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x3ff
lea edx, [ebp - 0x208]
push edx
push ebx
call dword [sym.imp.msvcrt.dll_strncpy]
mov byte [ebx + 0x400], 0
add esp, 0xc
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x498b80
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00498b30

Function at 0x499410
Capabilities:
Resolve dns

Disassembly:
mov al, byte [esi]
test al, al
jne 0x49948b
mov ecx, dword [esi + 4]
push edi
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edx, dword [esi + 4]
push edx
mov edi, eax
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
call fcn.004992e0
mov al, byte [esi]
test al, al
jne 0x499471
test edi, edi
je 0x49945b
mov ecx, dword [edi + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [0x6f1ad8], eax
mov byte [0x6f1ab5], 0
jmp 0x49946c
mov dword [0x6f1ad8], 0xffffffff
mov byte [0x6f1ab5], 1
call fcn.004993c0
mov ecx, dword [0x6f1ad4]
pop edi
cmp ecx, esi
jne 0x499486
mov dword [0x6f1ad4], 0
call fcn.00499310
push esi
call fcn.0040106c
pop ecx
ret

Function at 0x499c50
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 8]
sub eax, 0
je 0x499c73
dec eax
je 0x499c6d
dec eax
je 0x499c67
xor eax, eax
pop ebp
ret 4
pop ebp
jmp fcn.00499c20
pop ebp
jmp fcn.00499be0
mov eax, dword [ebp + 8]
push eax
call fcn.00499b90
add esp, 4
pop ebp
ret 4
Function at 0x499ca0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
push esi
push edi
mov edi, ecx
push eax
lea ecx, [ebp - 8]
call fcn.0043c460
test byte [ebp + 0x10], 8
mov esi, dword [ebp + 0xc]
je 0x499cc8
push esi
call fcn.004526a0
add esp, 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push esi
lea ecx, [ebp - 8]
push ecx
lea ecx, [edi + 0x2a8]
call fcn.0043c5b0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x499d20
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1254
call fcn.00521200
push esi
push edi
mov esi, ecx
call fcn.004557a0
test al, al
je 0x499d46
mov eax, dword [esi + 0x40]
push eax
call fcn.00455a30
add esp, 4
lea ecx, [ebp - 0xa54]
push ecx
call fcn.00499b70
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
add esp, 4
lea edx, [ebp - 0xa54]
push edx
call edi
lea edx, [ebp - 0x154]
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x499d70
lea eax, [ebp - 0xa54]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
mov esi, dword [ebp + 8]
push esi
call fcn.00452230
add esp, 4
test al, al
je 0x499eea
push esi
call edi
lea edx, [ebp - 0x254]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x499da6
xor eax, eax
jmp 0x499dc0
mov cl, byte [ebp + eax - 0xa54]
mov byte [ebp + eax - 0x1254], cl
inc eax
test cl, cl
jne 0x499dc0
push str.Update.bat
lea ecx, [ebp - 0x1254]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [ebp - 0x1254]
push 0x6070e4
push edx
call dword [sym.imp.msvcrt.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x499eea
mov edi, dword [sym.imp.msvcrt.dll_fprintf]
push str.:Repeat_n
push esi
call edi
lea eax, [ebp - 0x154]
push eax
push str.del___s__n
push esi
call edi
lea ecx, [ebp - 0x154]
push ecx
push str.if_exist___s__goto_Repeat_n
push esi
call edi
lea edx, [ebp - 0x154]
push edx
lea eax, [ebp - 0x254]
push eax
push str.ren___s____s__n
push esi
call edi
lea ecx, [ebp - 0x154]
push ecx
push str.start__GameRanger____s___updated_n
push esi
call edi
push 0x6104a8
push esi
call edi
add esp, 0x44
push esi
call dword [sym.imp.msvcrt.dll_fclose]
mov ecx, dword [0x6e7464]
add esp, 4
test ecx, ecx
je 0x499e79
call fcn.004723c0
mov ecx, dword [0x717ef8]
test ecx, ecx
je 0x499e88
call fcn.00518510
push 0x44
lea edx, [ebp - 0x54]
push 0
push edx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x54]
push ecx
lea edx, [ebp - 0xa54]
push edx
push 0
push 0x8000000
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1254]
push eax
mov dword [ebp - 0x54], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x499eea
mov ecx, dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [ebp - 0x10]
push edx
call esi
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x49a840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
test byte [ecx + 0x3d], 1
je 0x49a8a2
cmp byte [ecx + 0x14], 0
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax + 4]
jne 0x49a86c
push 0x637c4c
lea ecx, [ebp + 8]
push ecx
mov dword [ebp + 8], 0xff67697f
call sub.msvcrt.dll__CxxThrowException
xor ebx, ebx
cmp dword [ecx + 0x44], ebx
jbe 0x49a89c
mov eax, 0xcccccccd
mul ebx
shr edx, 4
lea edx, [edx + edx*4]
add edx, edx
add edx, edx
mov eax, ebx
sub eax, edx
mov dl, byte [eax + ecx + 0x15]
xor dl, byte [ebx + esi + 0x10]
xor dl, bl
mov byte [ebx + esi + 0x10], dl
inc ebx
cmp ebx, dword [ecx + 0x44]
jb 0x49a873
and byte [ecx + 0x3d], 0xfe
pop esi
pop ebx
pop ebp
ret 4
Function at 0x49c100
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e28f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 8]
push edi
mov dword [ebp - 0x10], esp
push eax
push str.Arc:DLa_u_n
mov dword [ebp - 0x1c], esi
call fcn.005152d0
mov eax, dword [ebp + 0x18]
mov cl, byte [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
mov dword [esi + 0x2cc], eax
xor eax, eax
add esp, 8
mov byte [esi + 0x2c4], cl
cmp edi, eax
mov ecx, esi
mov dword [esi + 0x2c8], edx
mov word [esi + 0x306], 0
mov dword [esi + 0x294], eax
mov dword [esi + 0x298], eax
mov dword [ebp - 4], eax
setne bl
call fcn.00499770
test al, al
jne 0x49c194
push 0x637c4c
lea ecx, [ebp - 0x14]
push ecx
mov dword [ebp - 0x14], 0xff67697f
call sub.msvcrt.dll__CxxThrowException
test bl, bl
je 0x49c1a4
push edi
mov ecx, esi
call fcn.0049a1b0
test al, al
jne 0x49c1c8
mov edx, dword [ebp + 8]
push edx
mov ecx, esi
call fcn.0049b570
test al, al
jne 0x49c1c8
push 0x637c4c
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 0xff67697f
call sub.msvcrt.dll__CxxThrowException
push 0
push 2
push 2
mov dword [ebp - 4], 0xffffffff
mov byte [esi + 0x304], 1
call dword [sym.imp.WS2_32.dll_socket]
push 0
mov ecx, esi
mov dword [esi + 0x328], eax
call fcn.00499960
lea ecx, [esi + 0x2d8]
call fcn.00440720
push 1
push esi
call fcn.0049b550
push 5
mov dword [esi + 0x344], eax
call fcn.0043bb40
push str.Arc:DL:TC_n
mov dword [esi + 0x348], eax
call fcn.005152d0
push esi
call fcn.0049c0e0
push str.Arc:DL__n
call fcn.005152d0
add esp, 0x18
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x49cc10
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0
push 1
push 2
mov esi, ecx
mov dword [ebp - 0x10], 1
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x18], eax
cmp eax, 0xffffffff
je 0x49cc3a
test eax, eax
jne 0x49cc4f
push 0x637c4c
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], 0xff67697f
call sub.msvcrt.dll__CxxThrowException
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea ecx, [ebp - 0x10]
push ecx
push 1
push 6
push eax
call edi
mov ecx, dword [esi + 0x18]
mov ebx, dword [sym.imp.WS2_32.dll_getsockopt]
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x14]
push eax
push 0x1002
push 0xffff
push ecx
mov dword [ebp - 4], 4
mov dword [ebp - 8], 0x80000
call ebx
mov eax, dword [esi + 0x18]
push 4
lea edx, [ebp - 8]
push edx
push 0x1002
push 0xffff
push eax
call edi
mov eax, dword [esi + 0x18]
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
push 0x1002
push 0xffff
push eax
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49ccd0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
mov esi, ecx
call fcn.004574b0
cmp byte [esi + 0x1c], 0
mov dword [ebp - 8], eax
je 0x49cd01
push 0x637c4c
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0xc], 0xff67697c
call sub.msvcrt.dll__CxxThrowException
cmp byte [esi + 4], 0
je 0x49cd1c
push 0x637c4c
lea ecx, [ebp + 0xc]
push ecx
mov dword [ebp + 0xc], 0xff67697d
call sub.msvcrt.dll__CxxThrowException
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x49cd27
dec edi
mov dword [ebp + 0xc], edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x114], 0
test edi, edi
je 0x49cdf5
lea esp, [esp]
call fcn.004574b0
sub eax, dword [ebp - 8]
cmp eax, 0x7530
jae 0x49ce2e
mov edx, dword [ebp - 0x114]
xor ecx, ecx
test edx, edx
je 0x49cd73
mov edi, dword [esi + 0x18]
cmp dword [ebp + ecx*4 - 0x110], edi
je 0x49cd70
inc ecx
cmp ecx, edx
jb 0x49cd62
mov edi, dword [ebp + 0xc]
cmp ecx, edx
jne 0x49cd93
cmp edx, 0x40
jae 0x49cd93
mov edx, dword [esi + 0x18]
mov dword [ebp + ecx*4 - 0x110], edx
mov edx, dword [ebp - 0x114]
inc edx
mov dword [ebp - 0x114], edx
mov ecx, 0x7530
sub ecx, eax
mov eax, dword [esi + 0x18]
imul ecx, ecx, 0x3e8
inc eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], ecx
test edx, edx
je 0x49ce01
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
lea edx, [ebp - 0x114]
push edx
push eax
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x49ce19
mov eax, dword [esi]
mov edx, dword [eax + 8]
push 1
lea ecx, [ebp - 1]
push ecx
mov ecx, esi
call edx
test eax, eax
je 0x49cded
mov al, byte [ebp - 1]
dec edi
mov byte [ebx], al
inc ebx
mov dword [ebp + 0xc], edi
cmp al, 0xa
je 0x49cdf5
test edi, edi
jne 0x49cd40
pop edi
pop esi
mov byte [ebx], 0
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x637c4c
lea edx, [ebp + 0xc]
push edx
mov dword [ebp + 0xc], 0xff67697e
call sub.msvcrt.dll__CxxThrowException
push 0x637c4c
lea ecx, [ebp + 0xc]
push ecx
mov dword [ebp + 0xc], 0xff67697e
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x49cee0
Capabilities:
Connect socket
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e2960
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
xor ebx, ebx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], ebx
mov byte [esi + 4], bl
mov byte [esi + 0x1c], bl
cmp eax, 0xffffffff
je 0x49cf1d
cmp eax, ebx
jne 0x49cf24
mov ecx, esi
call fcn.0049cc10
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov eax, 2
push ecx
mov byte [esi + 5], 1
mov word [ebp - 0x38], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov edx, dword [ebp + 0xc]
push edx
mov dword [ebp - 0x34], eax
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esi + 0x18]
mov word [ebp - 0x36], ax
mov edi, 0x10
push edi
lea eax, [ebp - 0x38]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x49cf87
push 0x637c4c
lea edx, [ebp - 0x18]
push edx
mov dword [ebp - 0x18], 0xff67697f
call sub.msvcrt.dll__CxxThrowException
mov edx, dword [esi + 0x18]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x38]
push ecx
push edx
mov byte [esi + 5], bl
mov dword [ebp - 0x14], edi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x49cfb8
push 0x637c4c
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0xff67697f
call sub.msvcrt.dll__CxxThrowException
mov ecx, dword [ebp - 0x34]
mov ebx, dword [sym.imp.WS2_32.dll_ntohl]
push ecx
call ebx
mov ecx, dword [esi + 0x18]
lea edx, [ebp - 0x14]
mov dword [esi + 0xc], eax
push edx
lea eax, [ebp - 0x38]
push eax
push ecx
mov dword [ebp - 0x14], edi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x49d018
push 0x637c4c
lea edx, [ebp - 0x20]
push edx
mov dword [ebp - 0x20], 0xff67697f
call sub.msvcrt.dll__CxxThrowException
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
mov byte [ecx + 5], 0
call edx
push 0x637c4c
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0xff67697d
call sub.msvcrt.dll__CxxThrowException
mov ecx, dword [ebp - 0x34]
push ecx
call ebx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [esi + 8], eax
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x49d0b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp byte [ebx + 0x1c], 0
mov dword [ebp + 8], eax
jne 0x49d108
cmp byte [ebx + 4], 0
jne 0x49d108
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x49d107
push esi
mov ecx, dword [ebp + 8]
mov edx, dword [ebx + 0x18]
push 0
push edi
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
cmp esi, 0xffffffff
je 0x49d0ff
call fcn.004574a0
add dword [ebp + 8], esi
sub edi, esi
mov dword [ebx + 0x10], eax
jne 0x49d0d1
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ecx, ebx
call fcn.0049d040
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x49d740
Capabilities:
Create udp socket

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
xor ecx, ecx
mov dword [esi + 4], eax
mov dword [esi + 0x10], 0
mov word [esi + 0x14], cx
pop esi
ret

Function at 0x49d770
Capabilities:
Connect socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, ecx
call fcn.004574b0
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0xc], eax
cmp edi, dword [esi + 0x10]
jne 0x49d799
cmp bx, word [esi + 0x14]
je 0x49d7f3
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, 2
push edi
mov word [ebp - 0x10], ax
call dword [sym.imp.WS2_32.dll_htonl]
push ebx
mov dword [ebp - 0xc], eax
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esi + 4]
push 0x10
lea ecx, [ebp - 0x10]
push ecx
push edx
mov word [ebp - 0xe], ax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x49d7ec
push 0x637c4c
lea eax, [ebp + 8]
push eax
mov dword [ebp + 8], 0xff67697f
call sub.msvcrt.dll__CxxThrowException
mov dword [esi + 0x10], edi
mov word [esi + 0x14], bx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [esi + 4]
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
pop edi
pop esi
pop ebx
test eax, eax
jns 0x49d81f
push 0x637c4c
lea ecx, [ebp + 8]
push ecx
mov dword [ebp + 8], eax
call sub.msvcrt.dll__CxxThrowException
mov esp, ebp
pop ebp
ret 0x10