joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410830
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
push edi
lea ebx, [esi + 0x4ac]
nop dword [eax]
nop dword [eax + eax]
lea edi, [esi + 0x4d0]
cmp dword [esi + 0x4cc], 0
je 0x410880
push 0x265
push str.ypkt_win
push str.ASSERT_FAILED:_s:_d_n
push 0x265
push str.ypkt_win
call fcn.00409950
add esp, 0x14
xorps xmm0, xmm0
movups xmmword [ebx], xmm0
mov dword [ebx + 0x10], 0
mov eax, dword [esi + 0x4c4]
push ebx
mov dword [esi + 0x4bc], eax
lea eax, [ebp - 8]
push eax
push 0x41
push edi
push dword [esi + 0x4c0]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x410978
push dword [esi + 0x15c]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x58], 0
jne 0x410933
push 0x44
call fcn.00449be3
movups xmm0, xmmword [esi + 0x4d1]
mov ecx, eax
add esp, 4
movups xmmword [ecx], xmm0
movups xmm0, xmmword [esi + 0x4e1]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [esi + 0x4f1]
movups xmmword [ecx + 0x20], xmm0
movups xmm0, xmmword [esi + 0x501]
mov dword [ecx + 0x40], 0
movups xmmword [ecx + 0x30], xmm0
cmp dword [esi + 0x38], 0
jne 0x41091f
push dword [esi + 0x164]
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x410928
mov eax, dword [esi + 0x3c]
mov dword [eax + 0x40], ecx
mov dword [esi + 0x3c], ecx
inc dword [esi + 0x40]
add dword [esi + 0x48], 1
adc dword [esi + 0x4c], 0
push dword [esi + 0x160]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [esi + 0x15c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x500b60]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [0x500b60]
mov edi, dword [eax + 0xc]
test edi, edi
je 0x410850
mov ecx, edi
call dword [0x460280]
call edi
jmp 0x410850
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x4109ae
mov ecx, dword [ebp - 4]
test ecx, ecx
jne 0x410996
pop edi
pop esi
lea eax, [ecx - 8]
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
push eax
mov edx, esi
mov ecx, 0x26c
call fcn.0040f930
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov dword [esi + 0x4cc], 1
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411d30
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x4ff004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x64], ecx
mov ecx, edx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x60], 0x67452301
lea esi, [ecx + 1]
mov dword [ebp - 0x5c], 0xefcdab89
mov dword [ebp - 0x58], 0x98badcfe
mov dword [ebp - 0x54], 0x10325476
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x411d80
sub ecx, esi
push ecx
lea ecx, [ebp - 0x60]
call fcn.00412fa0
push 1
mov edx, 0x466cfc
lea ecx, [ebp - 0x60]
call fcn.00412fa0
mov ecx, ebx
add esp, 8
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x411db0
sub ecx, esi
mov edx, ebx
push ecx
lea ecx, [ebp - 0x60]
call fcn.00412fa0
push 1
mov edx, 0x466cfc
lea ecx, [ebp - 0x60]
call fcn.00412fa0
mov eax, edi
add esp, 8
lea esi, [eax + 1]
nop dword [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411de0
sub eax, esi
lea ecx, [ebp - 0x60]
push eax
mov edx, edi
call fcn.00412fa0
mov edx, dword [ebp - 0x64]
lea ecx, [ebp - 0x60]
add esp, 4
call fcn.00413080
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004423fe
mov esp, ebp
pop ebp
ret

Function at 0x411e20
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x4ff004]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x64], 0x67452301
mov ecx, edx
mov dword [ebp - 0x60], 0xefcdab89
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x5c], 0x98badcfe
lea edi, [ecx + 1]
mov dword [ebp - 0x58], 0x10325476
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x411e67
sub ecx, edi
push ecx
lea ecx, [ebp - 0x64]
call fcn.00412fa0
push 1
mov edx, 0x466cfc
lea ecx, [ebp - 0x64]
call fcn.00412fa0
mov eax, esi
add esp, 8
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x411e90
sub eax, edi
lea ecx, [ebp - 0x64]
push eax
mov edx, esi
call fcn.00412fa0
add esp, 4
lea ecx, [ebp - 0x64]
mov edx, ebx
call fcn.00413080
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004423fe
mov esp, ebp
pop ebp
ret
Function at 0x411ed0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x4ff004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x98], ecx
lea ecx, [ebp - 0x38]
push 1
push 0x10
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], 0x67452301
mov dword [ebp - 0x8c], 0xefcdab89
mov dword [ebp - 0x88], 0x98badcfe
mov dword [ebp - 0x84], 0x10325476
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 0
call fcn.00411cd0
push 0x20
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x90]
call fcn.00412fa0
push 1
mov edx, 0x466cfc
lea ecx, [ebp - 0x90]
call fcn.00412fa0
mov ecx, ebx
add esp, 0x10
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x411f70
sub ecx, edx
mov edx, ebx
push ecx
lea ecx, [ebp - 0x90]
call fcn.00412fa0
push 1
mov edx, 0x466cfc
lea ecx, [ebp - 0x90]
call fcn.00412fa0
add esp, 8
test esi, esi
je 0x41200d
test edi, edi
je 0x41200d
mov ecx, esi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x411fb0
sub ecx, edx
mov edx, esi
push ecx
lea ecx, [ebp - 0x90]
call fcn.00412fa0
push 1
mov edx, 0x466cfc
lea ecx, [ebp - 0x90]
call fcn.00412fa0
mov ecx, edi
add esp, 8
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x411fe1
sub ecx, edx
mov edx, edi
push ecx
lea ecx, [ebp - 0x90]
call fcn.00412fa0
push 6
mov edx, str.:auth:
lea ecx, [ebp - 0x90]
call fcn.00412fa0
add esp, 8
mov edx, dword [ebp - 0x94]
lea ecx, [ebp - 0x38]
push 1
push 0x10
call fcn.00411cd0
push 0x20
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x90]
call fcn.00412fa0
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x90]
call fcn.00413080
mov ecx, dword [ebp - 0x98]
lea edx, [ebp - 0x14]
push 1
push 0x10
call fcn.00411cd0
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004423fe
mov esp, ebp
pop ebp
ret
Function at 0x4126c0
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, ecx
push ebx
push esi
push edi
mov edi, dword [eax]
mov esi, dword [eax + 8]
mov ebx, dword [eax + 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edi
mov edi, dword [eax + 4]
mov eax, dword [eax + 0x10]
mov dword [ebp - 4], eax
mov eax, 0x4ffca4
mov ecx, dword [eax - 0x20]
xor ecx, dword [eax - 0x18]
xor ecx, dword [eax + 0x14]
xor ecx, dword [eax]
rol ecx, 1
mov dword [eax + 0x20], ecx
add eax, 4
cmp eax, 0x4ffda4
jl 0x4126e7
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], 0x4ffc84
nop dword [eax + eax]
mov edx, ecx
mov eax, esi
and eax, edi
rol edx, 5
mov ecx, edi
not ecx
and ecx, ebx
or ecx, eax
mov eax, dword [ebp - 0xc]
add edx, ecx
add edx, dword [eax]
mov eax, dword [ebp - 4]
add eax, 0x5a827999
mov dword [ebp - 4], ebx
add edx, eax
mov ebx, esi
mov eax, dword [ebp - 0xc]
mov esi, edi
mov edi, dword [ebp - 8]
add eax, 4
ror esi, 2
mov ecx, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
cmp eax, 0x4ffcd4
jl 0x412710
mov dword [ebp - 0xc], 0x4ffcd4
nop dword [eax + eax]
mov eax, ebx
rol edx, 5
xor eax, esi
xor eax, edi
add edx, eax
mov eax, dword [ebp - 0xc]
add edx, dword [eax]
mov eax, dword [ebp - 4]
add eax, 0x6ed9eba1
mov dword [ebp - 4], ebx
add edx, eax
mov ebx, esi
mov eax, dword [ebp - 0xc]
mov esi, edi
add eax, 4
ror esi, 2
mov dword [ebp - 0xc], eax
mov edi, ecx
mov ecx, edx
cmp eax, 0x4ffd24
jl 0x412760
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0x4ffd24
mov ecx, esi
rol edx, 5
or ecx, edi
mov eax, esi
and eax, edi
and ecx, ebx
or ecx, eax
add edx, 0x8f1bbcdc
mov eax, dword [ebp - 0xc]
add edx, dword [ebp - 4]
mov dword [ebp - 4], ebx
mov ebx, esi
mov esi, edi
mov edi, dword [ebp - 8]
add ecx, dword [eax]
add eax, 4
add edx, ecx
ror esi, 2
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
cmp eax, 0x4ffd74
jl 0x4127a2
mov dword [ebp - 0xc], 0x4ffd74
mov ecx, dword [ebp - 0xc]
mov eax, ebx
xor eax, esi
rol edx, 5
add edx, dword [ebp - 4]
xor eax, edi
add eax, 0xca62c1d6
mov dword [ebp - 4], ebx
add eax, dword [ecx]
mov ebx, esi
add edx, eax
mov esi, edi
mov edi, dword [ebp - 8]
mov eax, ecx
add eax, 4
ror esi, 2
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
cmp eax, 0x4ffdc4
jl 0x4127e5
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
add eax, edx
mov dword [0x4ffc84], eax
mov eax, dword [ecx + 4]
add eax, edi
mov dword [0x4ffc88], eax
mov eax, dword [ecx + 8]
add eax, esi
mov dword [0x4ffc8c], eax
mov eax, dword [ecx + 0xc]
add eax, ebx
mov dword [0x4ffc90], eax
mov eax, dword [ecx + 0x10]
add eax, dword [ebp - 4]
pop edi
pop esi
mov dword [0x4ffc94], eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4128f0
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
ret
Function at 0x415d40
Capabilities:
Connect socket
Connect udp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4ff004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov esi, edx
cmp dword [edi], 0xffffffff
jne 0x415f26
cmp dword [edi + 4], 0xffffffff
jne 0x415f26
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x415dbf
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test esi, esi
jne 0x415d9b
mov eax, 0xfffffff8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004423fe
mov esp, ebp
pop ebp
ret
push esi
push eax
mov edx, pe_nt_image_headers32
mov ecx, str.ytcp
call fcn.00415bd0
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004423fe
mov esp, ebp
pop ebp
ret
push 4
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 1
push ecx
push 4
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0x10
mov eax, 2
movups xmmword [ebp - 0x14], xmm0
push 0x4f8af0
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jns 0x415e44
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test esi, esi
je 0x415d86
push esi
push eax
mov edx, 0x103
mov ecx, str.ytcp
call fcn.00415bd0
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004423fe
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jns 0x415e8a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test esi, esi
je 0x415d86
push esi
push eax
mov edx, 0x106
mov ecx, str.ytcp
call fcn.00415bd0
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004423fe
mov esp, ebp
pop ebp
ret
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
jne 0x415ed0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test esi, esi
je 0x415d86
push esi
push eax
mov edx, 0x10a
mov ecx, str.ytcp
call fcn.00415bd0
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004423fe
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x415f14
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test esi, esi
je 0x415d86
push esi
push eax
mov edx, 0x10d
mov ecx, str.ytcp
call fcn.00415bd0
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004423fe
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004423fe
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x415f4c
push 0xf3
push str.ytcp
push str.WakeUpSocket_already_Started
push str._s___s:_d_
push 0x100
push esi
call fcn.0041c830
add esp, 0x18
mov ecx, dword [ebp - 4]
mov eax, 0xfffffffe
pop edi
xor ecx, ebp
pop esi
call fcn.004423fe
mov esp, ebp
pop ebp
ret
Function at 0x415fa0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push edi
mov esi, ecx
mov ebx, edx
push edi
push esi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x415fdb
push esi
push str.Unable_to_resolve_host_name__s
push 0x100
push ebx
call fcn.0041c830
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, ecx
test eax, eax
je 0x416007
cmp dword [eax + 4], 2
je 0x416001
mov eax, dword [eax + 0x1c]
test eax, eax
jne 0x415fe4
push ecx
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [eax + 0x18]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416570
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x4ff004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov dword [ebp - 0x114], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
mov esi, eax
push edi
mov edi, edx
test eax, eax
jle 0x416647
push 0
push esi
push edi
push ebx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x4165e9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x41663c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
mov eax, dword [ebp - 0x114]
test eax, eax
jne 0x416658
mov eax, 0xfffffff8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004423fe
mov esp, ebp
pop ebp
ret
sub esi, eax
add edi, eax
cmp esi, eax
je 0x41663c
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x10c], ebx
push eax
push 0
lea eax, [ebp - 0x110]
mov dword [ebp - 0x110], 1
push eax
xorps xmm0, xmm0
lea eax, [ebx + 1]
push 0
movlpd qword [ebp - 0x11c], xmm0
push eax
mov dword [ebp - 0x11c], 0x3c
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x4166bf
je 0x41667d
test esi, esi
jg 0x4165a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004423fe
mov esp, ebp
pop ebp
ret
push eax
push ecx
mov edx, 0x2a8
mov ecx, str.ytcp
call fcn.00415bd0
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004423fe
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x114]
test eax, eax
je 0x4166a9
push 0x2c3
push str.ytcp
push str.Timeout_during_TCP_write
push str._s___s:_d_
push 0x100
push eax
call fcn.0041c830
add esp, 0x18
mov eax, 0xfffffff9
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004423fe
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
mov eax, dword [ebp - 0x114]
test eax, eax
je 0x4165d3
push eax
push ecx
mov edx, 0x2c0
mov ecx, str.ytcp
call fcn.00415bd0
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004423fe
mov esp, ebp
pop ebp
ret
Function at 0x418bf0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
nop word [eax + eax]
mov word [ebp - 3], 0xffff
mov byte [ebp - 1], 0xff
test bx, bx
je 0x418cfb
mov cl, byte [edi]
add ebx, 0xffff
mov al, cl
mov dword [ebp - 8], ebx
and cl, 3
shr al, 2
inc edi
shl cl, 4
mov dword [ebp - 0xc], edi
mov byte [ebp - 4], al
mov byte [ebp - 3], cl
test bx, bx
je 0x418c8e
mov dl, byte [edi]
add ebx, 0xffff
mov al, dl
mov dword [ebp - 8], ebx
shr al, 4
and dl, 0xf
inc edi
shl dl, 2
or al, cl
mov dword [ebp - 0xc], edi
mov byte [ebp - 3], al
mov byte [ebp - 2], dl
test bx, bx
je 0x418c8e
mov cl, byte [edi]
add ebx, 0xffff
mov al, cl
mov dword [ebp - 8], ebx
shr al, 6
inc edi
or al, dl
mov dword [ebp - 0xc], edi
and cl, 0x3f
mov byte [ebp - 2], al
mov byte [ebp - 1], cl
mov edi, 4
lea edx, [ebp - 4]
lea ebx, [edi + 0x2b]
nop dword [eax]
mov al, byte [edx]
cmp al, 0x19
ja 0x418caa
add al, 0x41
jmp 0x418cce
cmp al, 0x33
ja 0x418cb2
add al, 0x47
jmp 0x418cce
cmp al, 0x3d
ja 0x418cba
add al, 0xfc
jmp 0x418cce
cmp al, 0x3e
jne 0x418cc2
mov al, 0x2b
jmp 0x418cce
cmp al, 0x3f
mov ecx, 0x3d
cmove ecx, ebx
mov al, cl
mov byte [esi], al
inc edx
inc esi
sub edi, 1
jne 0x418ca0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
add eax, 0xfffc
mov ebx, dword [ebp - 8]
add ecx, 4
mov edi, dword [ebp - 0xc]
mov dword [ebp + 0xc], eax
mov dword [ebp - 0x10], ecx
cmp ax, 4
jae 0x418c10
pop edi
pop esi
mov ax, cx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x418d10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x4ff004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0x7c
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x94], edx
mov edi, ecx
mov dword [ebp - 0x9c], eax
jle 0x418d61
push 0x8c2
push str.ytcp
push str.ASSERT_FAILED:_s:_d_n
push 0x8c2
push str.ytcp
call fcn.00409950
add esp, 0x14
call fcn.0044c47b
mov edx, dword [ebp + 0x10]
mov ebx, eax
shl byte [ebp - 0x94], 3
shr eax, 0x18
mov dword [ebp - 0x98], eax
mov byte [ebp - 0x8d], al
lea ecx, [edx + 1]
mov eax, ebx
mov byte [ebp - 0x90], 0x82
shr eax, 8
or cl, 0x80
mov byte [ebp - 0x8b], al
mov al, byte [ebp + 8]
mov byte [ebp - 0x8f], cl
and al, 7
or al, byte [ebp - 0x94]
mov ecx, ebx
shr ecx, 0x10
xor al, cl
mov byte [ebp - 0x8e], cl
mov byte [ebp - 0x8c], bl
mov byte [ebp - 0x8a], al
test edx, edx
je 0x418dd5
mov al, byte [esi]
xor al, byte [ebp - 0x98]
mov byte [ebp - 0x89], al
cmp edx, 1
jle 0x418e8f
lea eax, [edx - 1]
push eax
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.00444290
mov edx, dword [ebp + 0x10]
add esp, 0xc
add edx, 2
xor eax, eax
sar edx, 2
test edx, edx
jle 0x418e8c
cmp edx, 0x10
jb 0x418e7b
mov ecx, edx
and ecx, reloc.WS2_32.dll_ntohs
jns 0x418e1c
dec ecx
or ecx, 0xfffffff0
inc ecx
mov esi, edx
movd xmm0, ebx
sub esi, ecx
pshufd xmm2, xmm0, 0
nop dword [eax]
movups xmm0, xmmword [ebp + eax*4 - 0x88]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [ebp + eax*4 - 0x88], xmm1
movups xmm0, xmmword [ebp + eax*4 - 0x78]
movaps xmm1, xmm2
pxor xmm0, xmm2
movups xmmword [ebp + eax*4 - 0x78], xmm0
movups xmm0, xmmword [ebp + eax*4 - 0x68]
pxor xmm0, xmm2
movups xmmword [ebp + eax*4 - 0x68], xmm0
movups xmm0, xmmword [ebp + eax*4 - 0x58]
pxor xmm1, xmm0
movups xmmword [ebp + eax*4 - 0x58], xmm1
add eax, 0x10
cmp eax, esi
jl 0x418e30
cmp eax, edx
jge 0x418e8c
nop
xor dword [ebp + eax*4 - 0x88], ebx
inc eax
cmp eax, edx
jl 0x418e80
mov edx, dword [ebp + 0x10]
push dword [ebp - 0x9c]
mov ecx, dword [edi + 0x798]
lea eax, [edx + 7]
push eax
lea edx, [ebp - 0x90]
call fcn.00416570
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004423fe
mov esp, ebp
pop ebp
ret
Function at 0x41b7e0
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
mov eax, dword [0x4ff004]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 0x60
mov esi, edx
mov dword [ebp - 0x270], 0
push 0
push esi
mov ebx, ecx
call fcn.00443620
add esp, 0xc
push 0
push 0
push 0
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
cmp eax, 0xffffffff
jne 0x41b84e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov ecx, 0xd35
call fcn.00415c60
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004423fe
mov esp, ebp
pop ebp
ret
push 0
push 0
lea ecx, [ebp - 0x274]
push ecx
push 0x260
lea ecx, [ebp - 0x26c]
push ecx
push 0
push 0
push 0x4004747f
push eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
jns 0x41b89f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov ecx, 0xd39
call fcn.00415c60
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004423fe
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x274]
mov eax, 0xaf286bcb
mul edi
sub edi, edx
shr edi, 1
add edi, edx
shr edi, 6
test edi, edi
je 0x41b8f6
lea ecx, [ebp - 0x264]
nop
mov eax, dword [ecx - 8]
test al, 4
jne 0x41b8ee
test al, 1
je 0x41b8ee
test al, 0x10
je 0x41b8d2
or dword [esi], 1
test ebx, ebx
je 0x41b8da
cmp ebx, dword [ecx]
jne 0x41b8ee
mov eax, dword [ecx]
inc dword [ebp - 0x270]
mov dword [esi + 4], eax
mov eax, dword [ecx + 0x30]
mov dword [esi + 8], eax
add esi, 0xc
add ecx, 0x4c
sub edi, 1
jne 0x41b8c0
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x270]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004423fe
mov esp, ebp
pop ebp
ret
Function at 0x41c360
Capabilities:
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4ff004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
mov ebx, edx
push edi
cmp dword [0x5015e8], esi
jle 0x41c3e4
lea edi, [ecx + 8]
mov eax, 2
nop word [eax + eax]
xorps xmm0, xmm0
movups xmmword [ebp - 0x14], xmm0
push 0x76c
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
push str.239.255.255.250
mov word [ebp - 0x12], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x70
push str.M_SEARCH__HTTP_1.1_r_nHOST:239.255.255.250:1900_r_nMAN:_ssdp:discover__r_nMX:5_r_nST:urn:yoctopuce_com:device:hub:1_r_n_r_n
push dword [edi]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
js 0x41c3f7
inc esi
add edi, 4
mov eax, 2
cmp esi, dword [0x5015e8]
jl 0x41c390
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004423fe
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
test ebx, ebx
je 0x41c48c
push esi
push 0xee0
push str.ytcp
push str._s:_d:tcp__d_:
push 0x100
push ebx
call fcn.0041c830
mov ecx, ebx
add esp, 0x18
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41c430
push 0
sub ecx, edx
mov eax, 0x100
sub eax, ecx
push eax
lea eax, [ecx + ebx]
push eax
push 0x400
push esi
push 0
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41c460
sub ecx, edx
test ecx, ecx
jle 0x41c48c
dec ecx
mov edx, 1
add ecx, ebx
sub edx, ebx
mov al, byte [ecx]
cmp al, 0xa
je 0x41c481
cmp al, 0xd
jne 0x41c48c
mov byte [ecx], 0
dec ecx
lea eax, [edx + ecx]
test eax, eax
jg 0x41c477
mov ecx, dword [ebp - 4]
mov eax, 0xfffffff8
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004423fe
mov esp, ebp
pop ebp
ret