joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4630f0
Capabilities:
Capture microphone audio

Disassembly:
sub esp, 0x174
mov eax, dword [0x4bdcf8]
xor eax, esp
mov dword [esp + 0x170], eax
mov eax, 0x4630c0
test eax, eax
jne 0x463124
xor al, al
mov ecx, dword [esp + 0x170]
xor ecx, esp
call fcn.004768b9
add esp, 0x174
ret
xor eax, eax
push 0
mov ecx, 1
mov dword [esp + 0xc], eax
mov edx, ecx
push 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
push 0
mov word [esp + 0x24], ax
mov word [esp + 0x16], dx
lea edx, [esp + 0x14]
mov eax, 2
push edx
mov word [esp + 0x24], ax
mov word [esp + 0x18], cx
push 0xffffffffffffffff
lea eax, [esp + 0x18]
mov ecx, 0x10
push eax
mov dword [esp + 0x24], 0x1f40
mov word [esp + 0x2e], cx
mov dword [esp + 0x28], 0x3e80
call dword [sym.imp.WINMM.dll_waveInOpen]
test eax, eax
jne 0x46310d
mov edx, dword [esp + 4]
push esi
push 0xa0000000
lea ecx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.WINMM.dll_mixerGetID]
mov esi, eax
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.WINMM.dll_waveInClose]
test esi, esi
jne 0x4631d5
mov ecx, dword [esp + 0x20]
push esi
push esi
push esi
push ecx
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.WINMM.dll_mixerOpen]
test eax, eax
je 0x4631ed
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.WINMM.dll_mixerClose]
xor al, al
pop esi
mov ecx, dword [esp + 0x170]
xor ecx, esp
call fcn.004768b9
add esp, 0x174
ret
push edi
push 0xa8
lea ecx, [esp + 0x2c]
push 0
push ecx
call fcn.0047cbe0
mov eax, dword [esp + 0x14]
mov edi, dword [sym.imp.WINMM.dll_mixerGetLineInfoA]
add esp, 0xc
push 3
lea edx, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x34], 0xa8
mov dword [esp + 0x4c], 7
call edi
test eax, eax
jne 0x4632cc
xor esi, esi
cmp dword [esp + 0x48], esi
jbe 0x46329d
jmp 0x463240
push 0xa8
lea edx, [esp + 0xd4]
push 0
push edx
call fcn.0047cbe0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x38]
add esp, 0xc
push 1
lea ecx, [esp + 0xd4]
push ecx
push edx
mov dword [esp + 0xdc], 0xa8
mov dword [esp + 0xe0], eax
mov dword [esp + 0xe4], esi
call edi
test eax, eax
jne 0x4632cc
cmp dword [esp + 0xe8], 0x1003
je 0x4632c1
inc esi
cmp esi, dword [esp + 0x48]
jb 0x463240
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.WINMM.dll_mixerClose]
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x170]
xor ecx, esp
call fcn.004768b9
add esp, 0x174
ret
mov eax, dword [esp + 0x180]
mov dword [eax], esi
jmp 0x46329d
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.WINMM.dll_mixerClose]
mov ecx, dword [esp + 0x178]
pop edi
pop esi
xor ecx, esp
xor al, al
call fcn.004768b9
add esp, 0x174
ret
Function at 0x4657e6
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, ecx
cmp ebx, 1
jne 0x4657ff
mov dword [ebp + 0xc], DirectSoundCreate
jmp 0x46580b
cmp ebx, 2
jne 0x46580b
mov dword [ebp + 0xc], 0xc0000000
xor edi, edi
push edi
push 0x80
push 4
push edi
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00465695
add esp, 0x1c
mov dword [esi + 0x48], eax
cmp eax, edi
je 0x465859
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push dword [ebp + 8]
mov dword [esi + 0x4c], eax
lea eax, [esi + 8]
push eax
mov dword [esi + 4], ebx
call fcn.0047c000
pop ecx
pop ecx
push edi
push edi
push edi
push dword [esi + 0x48]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov al, 1
jmp 0x46585b
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x46591f
Capabilities:
Read file via mapping

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x4c]
push edi
cmp eax, ecx
jbe 0x46592c
mov eax, ecx
mov edi, dword [esp + 0x18]
xor ebx, ebx
mov dword [esi + 0x54], eax
cmp edi, ebx
jne 0x46593b
mov edi, ecx
add eax, edi
cmp eax, ecx
jbe 0x465945
xor eax, eax
jmp 0x46597c
cmp dword [esi + 0x50], ebx
jne 0x465960
push ebx
push ebx
push ebx
push 2
push ebx
push dword [esi + 0x48]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 0x50], eax
cmp eax, ebx
je 0x465941
push edi
push dword [esi + 0x54]
push ebx
push 4
push dword [esi + 0x50]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x4659f6
Capabilities:
Create process on windows

Disassembly:
push esi
push 0x4a9504
push str.errorlog.txt
call fcn.004656f1
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x465a2e
push esi
push dword [esp + 0xc]
call fcn.004782d2
push esi
call fcn.0047766d
add esp, 0xc
push 5
push str.errorlog.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
call fcn.0047c410
pop esi

Function at 0x46b630
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
push 1
mov esi, ecx
push 9
push esi
call fcn.004787ff
mov ebx, dword [esp + 0x24]
add esp, 0x10
test ebx, ebx
jge 0x46b653
movzx ebx, byte [esi + 4]
mov eax, dword [esi + 5]
xor ecx, ecx
sar eax, 1
mov edx, 2
mul edx
seto cl
mov byte [esi + 4], bl
neg ecx
or ecx, eax
push ecx
call fcn.00476b22
mov ecx, dword [esi + 5]
push edi
push 1
push ecx
push eax
mov dword [esi + 0xc], eax
call fcn.004787ff
add esp, 0x14
cmp byte [0x4c02cc], 0
jne 0x46b698
test ebx, ebx
je 0x46b698
mov ecx, esi
call fcn.0046b240
pop edi
pop esi
pop ebx
ret 8
Function at 0x46b710
Capabilities:
Write file on windows

Disassembly:
cmp byte [0x4c02cc], 0
push esi
mov esi, ecx
jne 0x46b727
test byte [esi + 4], 1
je 0x46b727
call fcn.0046b2f0
push edi
mov edi, dword [esp + 0xc]
push edi
push 1
push 9
push esi
call fcn.0047897e
mov eax, dword [esi + 5]
mov ecx, dword [esi + 0xc]
push edi
push 1
push eax
push ecx
call fcn.0047897e
add esp, 0x20
cmp byte [0x4c02cc], 0
pop edi
jne 0x46b761
test byte [esi + 4], 1
je 0x46b761
mov ecx, esi
call fcn.0046b240
pop esi
ret 4

Function at 0x46bb80
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push ebp
mov esi, ecx
push 1
lea ebx, [esi + 0xe]
push 2
push ebx
mov dword [esp + 0x20], esi
call fcn.0047897e
push ebp
push 1
lea edi, [esi + 0x10]
push 2
push edi
call fcn.0047897e
movsx edi, word [edi]
add esp, 0x20
cmp byte [0x4c02cc], 0
jne 0x46bbc1
mov ecx, esi
call fcn.00467930
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.00467390
mov esi, eax
test edi, edi
je 0x46bbef
movsx ecx, word [ebx]
push ebp
push ecx
push 2
push esi
dec edi
call fcn.0047897e
mov edx, dword [esp + 0x28]
add esp, 0x10
lea esi, [esi + edx*2]
test edi, edi
jne 0x46bbd3
mov esi, dword [esp + 0x10]
mov ecx, esi
call fcn.004673c0
cmp byte [0x4c02cc], 0
jne 0x46bc0a
mov ecx, esi
call fcn.00467890
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x46bc20
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push edi
push ebx
push 1
lea eax, [esp + 0x1c]
push 2
push eax
mov edi, ecx
call fcn.004787ff
push ebx
push 1
lea ecx, [esp + 0x20]
push 2
push ecx
call fcn.004787ff
movsx edx, word [esp + 0x28]
movsx eax, word [esp + 0x34]
add esp, 0x20
push edx
push eax
mov ecx, edi
call fcn.00467c90
test eax, eax
je 0x46bcc0
push esi
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
call fcn.00467390
cmp word [esp + 0xc], 0
mov esi, eax
je 0x46bca4
lea ebx, [ebx]
movsx edx, word [edi + 0xe]
dec dword [esp + 0xc]
push ebx
push edx
push 2
push esi
call fcn.004787ff
mov eax, dword [esp + 0x20]
add esp, 0x10
cmp word [esp + 0xc], 0
lea esi, [esi + eax*2]
jne 0x46bc80
dec dword [esp + 0xc]
mov ecx, edi
call fcn.004673c0
cmp byte [0x4c02cc], 0
pop esi
jne 0x46bcc0
mov ecx, edi
call fcn.00467890
pop edi
pop ebx
add esp, 8
ret 4
Function at 0x46da10
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x9c
push ebx
mov ebx, dword [esp + 0xa8]
push esi
test ebx, ebx
je 0x46db13
mov esi, dword [esp + 0xa8]
test esi, esi
je 0x46db13
mov eax, dword [esi]
mov ecx, dword [eax + 0x6c]
push ebp
push edi
push esi
call ecx
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
test edi, edi
jne 0x46da59
push str.createcompatible_dc_failed_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push ebx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
lea edx, [esp + 0x18]
push edx
push 0x18
push ebx
call dword [sym.imp.GDI32.dll_GetObjectA]
mov ebx, dword [esp + 0xc0]
test ebx, ebx
jne 0x46da7e
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0xc4]
test ebp, ebp
jne 0x46da8d
mov ebp, dword [esp + 0x20]
mov eax, dword [esi]
mov edx, dword [eax + 0x58]
lea ecx, [esp + 0x30]
push ecx
push esi
mov dword [esp + 0x38], 0x7c
mov dword [esp + 0x3c], 6
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x44]
lea ecx, [esp + 0x10]
push ecx
push esi
call edx
mov dword [esp + 0x14], eax
test eax, eax
jne 0x46dafd
mov eax, dword [esp + 0xbc]
mov ecx, dword [esp + 0xb8]
mov edx, dword [esp + 0x38]
push 0xcc0020
push ebp
push ebx
push eax
mov eax, dword [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x24]
push edi
push edx
push eax
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_StretchBlt]
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov ecx, dword [edx + 0x68]
push eax
push esi
call ecx
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [esp + 0x14]
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x9c
ret
pop esi
mov eax, 0x80004005
pop ebx
add esp, 0x9c
ret
Function at 0x46fb10
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4c7b4c]
test eax, eax
je 0x46fb49
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4c7b4c]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x46fb3f
mov ecx, dword [0x4c7b4c]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x4c7b4c], 0
ret

Function at 0x470100
Capabilities:
Get common file path

Disassembly:
sub esp, 0x860
mov eax, dword [0x4bdcf8]
xor eax, esp
mov dword [esp + 0x85c], eax
push edi
mov edi, dword [esp + 0x868]
lea eax, [esp + 0x354]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x47014b
xor eax, eax
pop edi
mov ecx, dword [esp + 0x85c]
xor ecx, esp
call fcn.004768b9
add esp, 0x860
ret
cmp dword [0x4c8664], 0
je 0x470133
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x104
lea ecx, [esp + 0x660]
push ecx
push 0xffffffffffffffff
lea edx, [esp + 0x364]
push edx
push 1
push 0
call esi
mov eax, dword [0x4c8664]
mov ecx, dword [eax]
push 0
lea edx, [esp + 0x660]
push edx
push 0x4ad074
push eax
mov eax, dword [ecx + 0x14]
call eax
test eax, eax
je 0x4701b9
cmp eax, 1
je 0x4701b9
pop esi
mov eax, 0x80004005
pop edi
mov ecx, dword [esp + 0x85c]
xor ecx, esp
call fcn.004768b9
add esp, 0x860
ret
push 0x350
lea ecx, [esp + 0xc]
push 0
push ecx
call fcn.0047cbe0
mov eax, dword [0x4ad158]
mov edx, dword [0x4ad154]
mov ecx, dword [0x4ad15c]
add esp, 0xc
push 0x104
mov dword [esp + 0x28], eax
lea eax, [esp + 0x460]
push eax
push 0xffffffffffffffff
push edi
mov dword [esp + 0x30], edx
mov edx, dword [0x4ad160]
push 1
push 0
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], edx
mov dword [esp + 0x20], 0x350
call esi
xor eax, eax
jmp 0x470220
movzx ecx, word [esp + eax + 0x45c]
mov word [esp + eax + 0x140], cx
add eax, 2
test cx, cx
jne 0x470220
mov eax, dword [0x4c866c]
mov dword [esp + 0xc], 0x12
test eax, eax
je 0x470251
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [0x4c8664]
push 0x4c866c
push 0x4acd34
lea edx, [esp + 0x10]
mov dword [0x4c866c], 0
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
mov ecx, dword [esp + 0x864]
pop esi
pop edi
xor ecx, esp
call fcn.004768b9
add esp, 0x860
ret
Function at 0x4739b0
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esi]
mov dword [esp + 0x18], edi
mov edi, dword [esi + 4]
mov dword [esp + 0x14], edi
mov edi, dword [esi + 8]
mov esi, dword [esi + 0xc]
mov dword [esp + 0xc], esi
xor edx, edx
mov dword [esp + 0x1c], edi
mov esi, 0x20
lea edi, [edx + ecx]
xor edi, dword [esp + 0x18]
mov ebx, ecx
shl ebx, 4
add edi, ebx
mov ebx, ecx
shr ebx, 5
add ebx, dword [esp + 0x14]
sub edx, 0x61c88647
xor edi, ebx
add eax, edi
lea edi, [edx + eax]
xor edi, dword [esp + 0x1c]
mov ebx, eax
shl ebx, 4
add edi, ebx
mov ebx, eax
shr ebx, 5
add ebx, dword [esp + 0xc]
dec esi
xor edi, ebx
add ecx, edi
test esi, esi
ja 0x4739e2
mov edx, dword [esp + 0x20]
pop edi
pop esi
mov dword [edx], eax
mov dword [edx + 4], ecx
pop ebx
pop ecx
ret

Function at 0x473a40
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esi]
mov dword [esp + 0x1c], edi
mov edi, dword [esi + 4]
mov dword [esp + 0xc], edi
mov edi, dword [esi + 8]
mov esi, dword [esi + 0xc]
mov dword [esp + 0x14], esi
mov edx, 0xc6ef3720
mov dword [esp + 0x18], edi
mov esi, 0x20
lea edi, [edx + ecx]
xor edi, dword [esp + 0x18]
mov ebx, ecx
shl ebx, 4
add edi, ebx
mov ebx, ecx
shr ebx, 5
add ebx, dword [esp + 0x14]
add edx, 0x61c88647
xor edi, ebx
sub eax, edi
lea edi, [edx + eax]
xor edi, dword [esp + 0x1c]
mov ebx, eax
shl ebx, 4
add edi, ebx
mov ebx, eax
shr ebx, 5
add ebx, dword [esp + 0xc]
dec esi
xor edi, ebx
sub ecx, edi
test esi, esi
ja 0x473a75
mov edx, dword [esp + 0x20]
pop edi
pop esi
mov dword [edx], ecx
mov dword [edx + 4], eax
pop ebx
pop ecx
ret
Function at 0x473c30
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Send data
Send data on socket

Disassembly:
sub esp, 0x98
mov eax, dword [0x4bdcf8]
xor eax, esp
mov dword [esp + 0x94], eax
push esi
push edi
mov esi, ecx
call fcn.00476f95
cdq
mov ecx, 0x64
idiv ecx
mov ecx, esi
mov byte [esi + 0x15], 0
mov byte [esi + 0x14], 0
mov edi, edx
add edi, 5
call fcn.00474230
mov ecx, esi
call fcn.00474520
cmp dword [esi + 0x34], 0
jne 0x473c84
mov dword [esi + 0x30], 1
xor eax, eax
jmp 0x473d9c
push 6
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x473ca5
mov dword [esi + 0x30], 2
xor eax, eax
jmp 0x473d9c
push ebx
mov ebx, dword [esp + 0xb0]
test ebx, ebx
je 0x473cc5
mov edx, dword [0x4ca96c]
push 0x30
push 0x464
push edx
push eax
call sub.WSOCK32.dll_WSAAsyncSelect
mov ecx, dword [esp + 0xac]
push ebp
mov ebp, dword [esp + 0xac]
mov eax, 2
push ecx
mov word [esp + 0x18], ax
mov dword [esp + 0x1c], ebp
call sub.WSOCK32.dll_htons
mov edx, dword [esp + 0x18]
push edx
mov word [esp + 0x1a], ax
call sub.WSOCK32.dll_inet_ntoa
push ebp
call fcn.004737e0
add esp, 4
pop ebp
test al, al
jne 0x473d48
mov byte [esp + 0x28], 0x58
mov byte [esp + 0x3f], 0x5a
test edi, edi
je 0x473d44
push 6
push 1
push 2
call sub.WSOCK32.dll_socket
mov esi, eax
push 0x10
lea eax, [esp + 0x14]
push eax
push esi
call sub.WSOCK32.dll_connect
push 0
push 0x80
lea ecx, [esp + 0x28]
push ecx
push esi
call sub.WSOCK32.dll_send
sub edi, 1
jne 0x473d13
xor eax, eax
jmp 0x473d9b
mov eax, dword [esi + 4]
push 0x10
lea edx, [esp + 0x14]
push edx
push eax
xor edi, edi
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
je 0x473d68
mov edi, 1
mov byte [esi + 0x14], 1
cmp byte [esi + 0x16], 0
je 0x473d75
mov ecx, esi
call fcn.004742d0
mov edx, dword [esi + 4]
lea ecx, [esp + 0xc]
push ecx
push 0x8004667e
push edx
mov dword [esp + 0x18], 1
call sub.WSOCK32.dll_ioctlsocket
test ebx, ebx
je 0x473d99
mov edi, 1
mov eax, edi
pop ebx
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
xor ecx, esp
call fcn.004768b9
add esp, 0x98
ret 0xc

Function at 0x473dc0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 4]
push esi
mov esi, ecx
mov ecx, dword [esp + 0xc]
push eax
push ecx
push edx
call sub.WSOCK32.dll_inet_addr
push eax
mov ecx, esi
call fcn.00473c30
pop esi
ret 0xc

Function at 0x473ff0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x2c]
sub eax, 0x400
cmp ecx, eax
jl 0x474006
xor eax, eax
pop esi
ret
sub eax, ecx
push 0
push eax
mov eax, dword [esi + 8]
add eax, ecx
mov ecx, dword [esi + 4]
push eax
push ecx
call sub.WSOCK32.dll_recv
test eax, eax
jle 0x47402b
add dword [esi + 0x2c], eax
mov eax, dword [esi + 0x2c]
mov edx, dword [esi + 8]
mov byte [eax + edx], 0
mov eax, 1
pop esi
ret
Function at 0x4740f0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x210
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x474199
mov ecx, dword [esp + 0x21c]
mov eax, dword [esp + 0x218]
lea edx, [esp + 4]
push edx
push 0
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x118]
push ecx
lea edx, [esp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 4]
push edx
push eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x128], eax
mov dword [esp + 0x124], 1
call sub.WSOCK32.dll_select
mov ecx, dword [esi + 4]
lea eax, [esp + 0xc]
push eax
push ecx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x4741f9
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x2c]
sub eax, 0x400
cmp ecx, eax
jge 0x474215
mov edx, dword [esi + 8]
push 0
sub eax, ecx
push eax
mov eax, dword [esi + 4]
add edx, ecx
push edx
push eax
call sub.WSOCK32.dll_recv
test eax, eax
jg 0x4741a5
mov byte [esi + 0x14], 0
xor eax, eax
pop esi
add esp, 0x210
ret 8
add dword [esi + 0x2c], eax
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 8]
mov byte [eax + ecx], 0
cmp byte [esi + 0x16], 0
je 0x4741f9
mov edx, dword [esi + 0x18]
cmp edx, dword [esi + 0x2c]
jle 0x4741d3
push str.m_curDecodePos___NowRecvBufPos
push str.ERROR
call fcn.00465616
add esp, 8
int3
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x2c]
sub eax, ecx
cmp eax, 8
jl 0x4741f9
mov edx, eax
and edx, 7
sub eax, edx
push eax
mov eax, dword [esi + 8]
add eax, ecx
mov ecx, dword [esi + 0x28]
push eax
call ecx
add esp, 8
add dword [esi + 0x18], eax
mov eax, dword [esi + 4]
lea edx, [esp + 0x110]
push edx
push eax
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x474215
mov ecx, esi
call fcn.004745b0
mov eax, 1
pop esi
add esp, 0x210
ret 8

Function at 0x4745b0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, 0x10004
call fcn.0047d1c0
mov eax, dword [0x4bdcf8]
xor eax, esp
mov dword [esp + 0x10000], eax
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x474650
mov eax, dword [esi + 0x10]
test eax, eax
jle 0x474670
cmp byte [esi + 0x16], 0
je 0x474635
cmp dword [esi + 0x1c], eax
jle 0x4745fa
push 0x4aa1d0
push str.ERROR
call fcn.00465616
add esp, 8
int3
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
sub ecx, eax
push edi
push ecx
mov ecx, dword [esi + 0x24]
add edx, eax
push edx
lea eax, [esp + 0x10]
push eax
call ecx
mov edi, eax
mov eax, dword [esi + 0xc]
add eax, dword [esi + 0x1c]
push edi
lea edx, [esp + 0x18]
push edx
push eax
call fcn.0047bc90
add esp, 0x18
add dword [esi + 0x1c], edi
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x10], eax
pop edi
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 4]
push 0
push ecx
push edx
push eax
call sub.WSOCK32.dll_send
test eax, eax
jge 0x474668
mov byte [esi + 0x14], 0
xor eax, eax
pop esi
mov ecx, dword [esp + 0x10000]
xor ecx, esp
call fcn.004768b9
add esp, 0x10004
ret
push eax
mov ecx, esi
call fcn.004744d0
mov ecx, dword [esp + 0x10004]
pop esi
xor ecx, esp
mov eax, 1
call fcn.004768b9
add esp, 0x10004
ret
Function at 0x475400
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x4bdcf8]
xor eax, esp
mov dword [esp + 0x210], eax
mov eax, dword [esp + 0x218]
push ebx
push ebp
push 0x4b1b94
push eax
xor bl, bl
call fcn.004656f1
mov ebp, eax
add esp, 8
mov dword [esp + 8], ebp
test ebp, ebp
jne 0x475450
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.004768b9
add esp, 0x214
ret
push esi
push edi
push 2
push 0
push ebp
call fcn.004795c7
push ebp
call fcn.004797e9
push 0
push 0
push ebp
mov esi, eax
call fcn.004795c7
push esi
call fcn.004768ae
push ebp
push 1
mov edi, eax
push esi
push edi
call fcn.004787ff
mov eax, 0x4aa204
add esp, 0x30
lea edx, [eax + 1]
jmp 0x475490
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x475490
sub eax, edx
xor ecx, ecx
mov dword [esp + 0x14], eax
test esi, esi
je 0x4754b9
mov eax, ecx
cdq
idiv dword [esp + 0x14]
inc ecx
mov al, byte [edx + 0x4aa204]
xor byte [ecx + edi - 1], al
cmp ecx, esi
jne 0x4754a3
cmp dword [edi], 0x72657465
jne 0x475548
mov ebx, dword [edi + 4]
mov esi, 8
test ebx, ebx
je 0x475546
mov al, byte [esi + edi]
movzx ebp, al
inc esi
push ebp
lea ecx, [esi + edi]
push ecx
lea edx, [esp + 0x124]
push edx
call fcn.0047bc90
add esi, ebp
mov byte [esp + ebp + 0x128], 0
mov al, byte [esi + edi]
movzx ebp, al
inc esi
push ebp
lea eax, [esi + edi]
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.0047bc90
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x138]
push eax
add esi, ebp
mov byte [esp + ebp + 0x38], 0
call fcn.00475300
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x140]
push edx
push str._s__s_n
call fcn.004773be
add esp, 0x2c
sub ebx, 1
jne 0x4754d1
mov ebp, dword [esp + 0x10]
mov bl, 1
push edi
call fcn.004782c7
push ebp
call fcn.0047766d
mov ecx, dword [esp + 0x228]
add esp, 8
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
xor ecx, esp
call fcn.004768b9
add esp, 0x214
ret