joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007a00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
call fcn.10007700
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
lea eax, [ebp - 8]
push eax
call fcn.10007a60
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x10007a59
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x14]
mov dword [ebp - 4], ecx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10007ae0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov bl, byte [esi]
test eax, eax
je 0x10007b27
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x10]
mov dword [ebp - 4], ecx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10016260
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
not eax
push edi
mov edi, dword [esp + 0xc]
test esi, esi
je 0x1001628e
movzx ecx, byte [edi]
lea edi, [edi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100d5998]
sub esi, 1
jne 0x10016274
pop edi
not eax
pop esi
ret

Function at 0x100162a0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
not ebx
push edi
mov edi, dword [esp + 0x14]
mov eax, ebx
test edi, edi
je 0x10016302
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x100162e6
cmp edi, 2
jb 0x100162e6
cmp byte [esi], cl
jne 0x100162e6
cmp byte [esi + 1], cl
jne 0x100162e6
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100d5998]
jmp 0x100162b7
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100d5998]
test edi, edi
jne 0x100162b7
pop edi
pop esi
not eax
pop ebx
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10016338
nop dword [eax]
cmp cl, 0x23
jne 0x1001631f
cmp byte [esi], cl
jne 0x1001631f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100d5998]
test cl, cl
jne 0x10016310
pop edi
pop esi
not eax
pop ebx
ret

Function at 0x10016e90
Capabilities:
Read file on windows

Disassembly:
push dword [esp + 0x18]
push dword [esp + 0x14]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.100b43d2
add esp, 0x10
xor edx, edx
ret
Function at 0x10049380
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x100493a7
push eax
mov dword [esi + 4], 0
mov dword [esi], 0
call fcn.10014690
add esp, 4
mov dword [esi + 8], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x100493cc
push eax
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
call fcn.10014690
add esp, 4
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x20]
test eax, eax
je 0x100493f1
push eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
call fcn.10014690
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov eax, dword [esi + 0x44]
test eax, eax
je 0x10049432
push eax
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
call fcn.10014690
add esp, 4
mov dword [esi + 0x44], 0
mov eax, dword [esi + 0x50]
test eax, eax
je 0x10049457
push eax
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
call fcn.10014690
add esp, 4
mov dword [esi + 0x50], 0
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x1004947c
push eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
call fcn.10014690
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.10045ac0

Function at 0x1004abe0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, ecx
cmp esi, 8
ja 0x1004acef
test byte [edi], 2
jne 0x1004acef
mov eax, dword [edi + 0x468]
lea esi, [esi + esi*2]
mov ecx, dword [edi + 0x50]
movss xmm2, dword [esi*8 + 0x100e7c48]
movss xmm4, dword [esi*8 + 0x100e7c4c]
lea edx, [eax*8]
sub edx, eax
movzx eax, word [ecx + edx*4 + 4]
movd xmm5, eax
movzx eax, word [ecx + edx*4 + 6]
cvtdq2ps xmm5, xmm5
movd xmm3, eax
addss xmm5, dword [esi*8 + 0x100e7c40]
mov eax, dword [esp + 0x14]
cvtdq2ps xmm3, xmm3
movaps xmm1, xmm5
addss xmm3, dword [esi*8 + 0x100e7c44]
movss dword [eax + 4], xmm4
movss dword [eax], xmm2
mov ecx, dword [esi*8 + 0x100e7c50]
mov edx, dword [esi*8 + 0x100e7c54]
mov eax, dword [esp + 0x10]
addss xmm4, xmm3
movaps xmm0, xmm3
mov dword [eax], ecx
mov dword [eax + 4], edx
mulss xmm1, dword [edi + 0x2c]
mov eax, dword [esp + 0x18]
mulss xmm0, dword [edi + 0x30]
movss dword [eax], xmm1
movaps xmm1, xmm2
movss dword [eax + 4], xmm0
addss xmm1, xmm5
addss xmm5, dword [0x100ed828]
movaps xmm0, xmm4
mulss xmm0, dword [edi + 0x30]
mulss xmm1, dword [edi + 0x2c]
movss dword [eax + 0xc], xmm0
movaps xmm0, xmm5
addss xmm5, xmm2
movss dword [eax + 8], xmm1
mulss xmm0, dword [edi + 0x2c]
mov eax, dword [esp + 0x1c]
mulss xmm3, dword [edi + 0x30]
movss dword [eax], xmm0
movss dword [eax + 4], xmm3
mulss xmm5, dword [edi + 0x2c]
mulss xmm4, dword [edi + 0x30]
pop edi
movss dword [eax + 8], xmm5
pop esi
movss dword [eax + 0xc], xmm4
mov al, 1
ret 0x14
pop edi
xor al, al
pop esi
ret 0x14
Function at 0x1004f8a0
Capabilities:
Compute adler32 checksum

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
mov eax, 0x5e6ea9af
push edi
mov edi, dword [esp + 0x1c]
mul edi
movzx ecx, si
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, edi
shr esi, 0x10
sub edx, eax
mov dword [esp + 0x14], edx
test edi, edi
je 0x1004f9cf
mov edi, dword [esp + 0x18]
push ebx
push ebp
nop dword [eax]
xor ebx, ebx
cmp edx, 7
jbe 0x1004f93c
mov ebp, 7
sub ebp, edi
nop
movzx eax, byte [edi]
add ebx, 8
add ecx, eax
movzx eax, byte [edi + 1]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 2]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 3]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 4]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 5]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 6]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 7]
add edi, 8
add esi, ecx
add ecx, eax
add esi, ecx
lea eax, [edi + ebp]
cmp eax, edx
jb 0x1004f8f0
xor ebp, ebp
cmp ebx, edx
jae 0x1004f992
mov eax, edx
sub eax, ebx
cmp eax, 2
jb 0x1004f983
sub edx, ebx
sub edx, 2
shr edx, 1
inc edx
lea eax, [ebx + edx*2]
mov ebx, ebp
mov dword [esp + 0x14], eax
nop dword [eax]
movzx eax, byte [edi]
add ecx, eax
movzx eax, byte [edi + 1]
add ebp, ecx
add edi, 2
add ecx, eax
add ebx, ecx
sub edx, 1
jne 0x1004f960
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x1c]
jae 0x1004f98d
jmp 0x1004f985
mov ebx, ebp
movzx eax, byte [edi]
add ecx, eax
add esi, ecx
inc edi
lea eax, [ebx + ebp]
add esi, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul eax, edx, 0xffff000f
mov edx, dword [esp + 0x1c]
add esi, eax
sub dword [esp + 0x24], edx
mov edx, 0x15b0
mov dword [esp + 0x1c], edx
jne 0x1004f8e0
pop ebp
pop ebx
shl esi, 0x10
pop edi
lea eax, [ecx + esi]
pop esi
add esp, 8
ret
Function at 0x10064aa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0xc]
or eax, 2
mov dword [esp + 0xc], eax
jmp fcn.10064ab0
Function at 0x10084f70
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
sub esp, 0x2c
push esi
push 0xc
call fcn.100aeab9
mov esi, eax
add esp, 4
mov dword [esp + 8], esi
test esi, esi
je 0x10084ffc
xorps xmm0, xmm0
mov dword [esi], 0
lea eax, [esp + 0xc]
mov dword [esi + 4], 0
push eax
mov dword [esi + 8], 0
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0x30], 0
movups xmmword [esp + 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x10]
xor edx, edx
mov eax, 0x1000
div ecx
test edx, edx
jne 0x10084fd4
mov ecx, 0x1000
jmp 0x10084fdc
sub ecx, edx
add ecx, 0x1000
push 0x40
push 0x3000
push ecx
push 0
mov dword [esi + 4], ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esi], eax
mov eax, dword [esp + 0x34]
mov dword [eax], esi
pop esi
add esp, 0x2c
ret
mov eax, dword [esp + 0x34]
pop esi
mov dword [eax], 0
add esp, 0x2c
ret
Function at 0x10086b00
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push esi
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.d3d9.dll
lea eax, [esp + 8]
push 0x104
push eax
call fcn.100c1aa1
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [eax + 0x128000]
cmp eax, ecx
jae 0x10086b6c
mov esi, 0x6c7
mov edx, 0x8689
nop dword [eax]
inc eax
cmp word [eax], si
jne 0x10086b62
cmp word [eax + 6], dx
jne 0x10086b62
cmp word [eax + 0xc], dx
je 0x10086b83
lea ecx, [eax + 0x128000]
cmp eax, ecx
jb 0x10086b50
mov ecx, dword [eax + 1]
mov eax, dword [esp + 0x10c]
pop esi
mov eax, dword [ecx + eax*4]
add esp, 0x104
ret 4
mov ecx, dword [eax + 2]
mov eax, dword [esp + 0x10c]
pop esi
mov eax, dword [ecx + eax*4]
add esp, 0x104
ret 4
Function at 0x10091d80
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x20]
mov eax, 0x58bf
push ebp
push esi
mov esi, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0xce6dd971
mov word [esp + 0x18], ax
push edi
test esi, esi
je 0x10091db5
test ebx, ebx
jne 0x10091dc9
push 0x44
push str.C:UserskeestDocumentsGitHubProjectSamp_GTASAMP_API_ONE_HEADERSAMPRakNetDataBlockEncryptor.cpp
push str.input__inputLength
call fcn.100c24f0
add esp, 0xc
call fcn.100a4070
lea ecx, [ebx + 5]
mov byte [esp + 0x28], al
and cl, 0xf
mov bl, 0xf
sub bl, cl
call fcn.100a4070
mov edx, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
shl al, 4
or al, bl
movzx edi, bl
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
push eax
push esi
lea ecx, [edi + eax]
mov dword [esp + 0x34], ecx
add ecx, 6
mov dword [edx], ecx
lea ecx, [ebp + 6]
add ecx, edi
push ecx
cmp esi, ebp
jne 0x10091e18
call fcn.100b11a0
jmp 0x10091e1d
call fcn.100b11a0
mov al, byte [esp + 0x34]
lea ebx, [ebp + 4]
add esp, 0xc
mov byte [ebx], al
mov eax, dword [esp + 0x14]
xor esi, esi
mov byte [ebp + 5], al
test edi, edi
je 0x10091e44
call fcn.100a4070
mov byte [esi + ebp + 6], al
inc esi
cmp esi, edi
jb 0x10091e36
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x18]
add eax, 2
push eax
push ebx
call fcn.10090c60
mov eax, dword [esp + 0x20]
push ebp
mov dword [ebp], eax
mov eax, dword [esp + 0x14]
push 0x10
push ebp
push eax
lea ecx, [eax + 0x240]
push ecx
mov dword [esp + 0x40], ecx
call fcn.100aa610
mov eax, dword [esp + 0x48]
add esp, 0x14
xor edi, edi
mov esi, dword [eax]
sub esi, 0x10
cmp esi, 0x10
jb 0x10091eed
lea ebx, [esi + ebp]
nop dword [eax]
lea edx, [ebp + 3]
mov ebp, 4
add edx, edi
lea eax, [ebx + 1]
sub edi, esi
nop
movzx ecx, byte [edx - 3]
lea edx, [edx + 4]
xor byte [eax - 1], cl
lea eax, [eax + 4]
movzx ecx, byte [edi + eax - 4]
xor byte [eax - 4], cl
movzx ecx, byte [edx - 5]
xor byte [eax - 3], cl
movzx ecx, byte [edx - 4]
xor byte [eax - 2], cl
sub ebp, 1
jne 0x10091ea0
push ebx
push 0x10
push ebx
push dword [esp + 0x1c]
push dword [esp + 0x3c]
call fcn.100aa610
mov ebp, dword [esp + 0x44]
mov edi, esi
sub esi, 0x10
add esp, 0x14
sub ebx, 0x10
cmp esi, 0x10
jae 0x10091e90
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
Function at 0x100a4070
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x101609a4], 0xffffffff
push ebx
push ebp
push esi
push edi
mov edi, 0x101963a8
mov esi, 0x101963b0
jge 0x100a3f74
push 0x1105
call fcn.100a3f10
add esp, 4
mov eax, dword [0x101963a8]
mov ebx, 0xe3
mov edx, dword [0x101963ac]
mov dword [0x101609a4], 0x26f
mov dword [0x10196d6c], 0x101963ac
nop dword [eax + eax]
mov ecx, edx
xor ecx, eax
and ecx, 0x7ffffffe
xor ecx, eax
mov eax, edx
and al, 1
shr ecx, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edx
xor ecx, dword [esi + 0x62c]
mov dword [edi], ecx
add edi, 4
mov edx, dword [esi]
add esi, 4
sub ebx, 1
jne 0x100a3fa0
mov ebx, 0x101963a8
mov ebp, 0x18c
mov ecx, edx
lea ebx, [ebx + 4]
xor ecx, eax
lea edi, [edi + 4]
and ecx, 0x7ffffffe
lea esi, [esi + 4]
xor ecx, eax
mov eax, edx
and al, 1
shr ecx, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edx
xor ecx, dword [ebx - 4]
mov dword [edi - 4], ecx
mov edx, dword [esi - 4]
sub ebp, 1
jne 0x100a3fe1
mov edx, dword [0x101963a8]
mov ecx, edx
xor ecx, eax
and ecx, 0x7ffffffe
xor ecx, eax
mov eax, edx
and al, 1
shr ecx, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edx
xor ecx, dword [ebx]
shr eax, 0xb
xor edx, eax
mov dword [edi], ecx
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
pop edi
pop esi
mov eax, edx
shr eax, 0x12
pop ebp
xor eax, edx
pop ebx
ret
sub dword [0x101609a4], 1
js 0x100a3f50
mov eax, dword [0x10196d6c]
mov ecx, dword [eax]
add eax, 4
mov dword [0x10196d6c], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret

Function at 0x100a91d0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
push esi
push edi
mov edi, dword [eax + ecx*4 + 0xd4]
mov ecx, dword [eax + ecx*4 + 0xd0]
mov ax, word [edi + 8]
mov word [edx], ax
mov esi, dword [edi + 4]
test esi, esi
jle 0x100a922a
push ebx
push ebp
lea ebx, [edi + 0x48]
lea ebp, [edi + 8]
lea ebx, [ebx + esi*4]
lea ebp, [ebp + esi*2]
nop word [eax + eax]
mov ax, word [ebp - 2]
lea ebp, [ebp - 2]
mov word [ebp + 2], ax
lea ebx, [ebx - 4]
mov eax, dword [ebx]
dec esi
mov dword [ebx + 4], eax
test esi, esi
jg 0x100a9210
pop ebp
pop ebx
mov eax, dword [ecx + 4]
mov edx, dword [esp + 0x14]
movzx eax, word [ecx + eax*2 + 6]
mov word [edi + 8], ax
mov eax, dword [ecx + 4]
mov eax, dword [ecx + eax*4 + 0x44]
inc dword [edi + 4]
mov dword [edi + 0x48], eax
dec dword [ecx + 4]
mov ecx, dword [esp + 0x10]
movzx eax, word [edi + 8]
mov word [ecx + edx*2 + 8], ax
mov ecx, dword [esp + 0x18]
movzx eax, word [edi + 8]
pop edi
pop esi
mov word [ecx + 2], ax
pop ecx
ret 0xc
Function at 0x100ab0e0
Capabilities:
Encode data using xor

Disassembly:
push edi
movzx edi, byte [esp + 0xc]
test edi, edi
je 0x100ab12a
mov eax, dword [esp + 8]
add eax, 2
push esi
movzx ecx, byte [eax + 1]
lea eax, [eax + 4]
movzx edx, byte [eax - 5]
mov esi, dword [ecx*4 + 0x10163aa8]
movzx ecx, byte [eax - 4]
xor esi, dword [edx*4 + 0x101632a8]
xor esi, dword [ecx*4 + 0x101636a8]
movzx ecx, byte [eax - 6]
xor esi, dword [ecx*4 + 0x10162ea8]
mov dword [eax - 6], esi
sub edi, 1
jne 0x100ab0f2
pop esi
pop edi
ret

Function at 0x100ab480
Capabilities:
Hash data using sha1

Disassembly:
mov dword [ecx], 0x101475f8
jmp fcn.100ab490

Function at 0x100ab490
Capabilities:
Hash data using sha1

Disassembly:
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
mov dword [ecx + 0x14], 0xc3d2e1f0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
ret
Function at 0x100acbd0
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x18
push esi
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x100accef
push edi
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [esp + 8]
push 4
push eax
push 4
push 0xffff
push esi
mov dword [esp + 0x1c], 1
call edi
push 4
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x40000
push eax
push 0x1002
push 0xffff
push esi
call edi
push 4
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x4000
push eax
push 0x1001
push 0xffff
push esi
call edi
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 1
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x100acc82
push 0xe6
push str.C:UserskeestDocumentsGitHubProjectSamp_GTASAMP_API_ONE_HEADERSAMPRakNetSocketLayer.cpp
push 0x1014475c
call fcn.100c24f0
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
add esp, 0x18
ret 0xc
push 4
lea eax, [esp + 0xc]
push eax
push 0x20
push 0xffff
push esi
call edi
push dword [esp + 0x24]
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x12], ax
mov eax, 2
mov word [esp + 0x10], ax
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x100accc6
cmp byte [eax], 0
je 0x100accc6
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0x14], eax
jmp 0x100accce
mov dword [esp + 0x14], 0
push 0x10
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
or ecx, 0xffffffff
cmp eax, 0xffffffff
pop edi
cmove esi, ecx
mov eax, esi
pop esi
add esp, 0x18
ret 0xc
or eax, 0xffffffff
pop esi
add esp, 0x18
ret 0xc

Function at 0x100acd00
Capabilities:
Resolve dns

Disassembly:
push dword [esp + 4]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x100acd22
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x100acd22
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
ret 4
xor eax, eax
ret 4

Function at 0x100acd60
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x254
mov eax, 2
mov dword [esp], 0x10
mov word [esp + 4], ax
mov eax, dword [esp + 0x258]
cmp eax, 0xffffffff
je 0x100acdf9
push esi
lea ecx, [esp + 4]
push ecx
lea ecx, [esp + 0xc]
push ecx
push 0
push 0x240
lea ecx, [esp + 0x28]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recvfrom]
mov esi, eax
cmp esi, 1
jge 0x100acdc6
cmp esi, 0xffffffff
jne 0x100acdea
mov eax, dword [esp + 0x264]
pop esi
mov dword [eax], 0
xor eax, eax
add esp, 0x254
ret 0xc
push dword [esp + 0xa]
call dword [sym.imp.WS2_32.dll_ntohs]
push dword [esp + 0x260]
lea ecx, [esp + 0x1c]
movzx eax, ax
push esi
push ecx
push eax
push dword [esp + 0x1c]
call fcn.1009ce70
mov eax, 1
pop esi
add esp, 0x254
ret 0xc
mov eax, dword [esp + 0x260]
mov dword [eax], 0xffffffff
or eax, 0xffffffff
add esp, 0x254
ret 0xc
Function at 0x100ace20
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x50
lea eax, [esp]
push 0x50
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
je 0x100ace90
push ebx
lea eax, [esp + 4]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x100ace8f
mov ecx, dword [ebx + 0xc]
cmp dword [ecx], 0
je 0x100ace8f
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_inet_ntoa]
push esi
push edi
mov edi, dword [esp + 0x64]
xor esi, esi
nop dword [eax]
cmp esi, 0x28
jge 0x100ace8c
mov eax, dword [esi + ecx]
push dword [eax]
call ebp
mov edx, edi
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x100ace70
mov ecx, dword [ebx + 0xc]
add esi, 4
add edi, 0x10
cmp dword [esi + ecx], 0
jne 0x100ace60
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 4

Function at 0x100aced0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
push edi
mov edi, dword [esp + 0x18]
cmp edi, 0xffffffff
jne 0x100acee6
or eax, edi
pop edi
add esp, 0x10
ret 0x14
push ebx
push esi
mov esi, dword [esp + 0x30]
push esi
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0xe], ax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov eax, 2
mov word [esp + 0xc], ax
push 0
movzx eax, si
mov esi, dword [esp + 0x2c]
push eax
push esi
push dword [esp + 0x30]
call fcn.100ae9b0
mov ebx, dword [sym.imp.WS2_32.dll_sendto]
add esp, 0x10
inc esi
push 0x10
lea eax, [esp + 0x10]
push eax
push 0
push esi
push 0x10196f28
push edi
call ebx
test eax, eax
je 0x100acf28
pop esi
pop ebx
cmp eax, 0xffffffff
je 0x100acf4e
xor eax, eax
pop edi
add esp, 0x10
ret 0x14
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop edi
add esp, 0x10
ret 0x14

Function at 0x100acf60
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
lea eax, [esp]
mov dword [esp], 0x10
push eax
lea eax, [esp + 8]
push eax
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x100acf89
xor eax, eax
add esp, 0x14
ret 4
push dword [esp + 6]
call dword [sym.imp.WS2_32.dll_ntohs]
add esp, 0x14
ret 4
Function at 0x100ae9b0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
push ebx
push esi
mov esi, dword [esp + 0x10]
xor bl, bl
test esi, esi
jle 0x100aea4d
cmp esi, 0x20
jb 0x100aea40
movaps xmm3, xmmword [0x10147b80]
mov ecx, esi
and ecx, 0xffffffe0
xorps xmm2, xmm2
xorps xmm1, xmm1
nop dword [eax]
movups xmm0, xmmword [eax + edx]
pand xmm0, xmm3
pxor xmm2, xmm0
movups xmm0, xmmword [eax + edx + 0x10]
add eax, 0x20
pand xmm0, xmm3
pxor xmm1, xmm0
cmp eax, ecx
jl 0x100ae9e0
pxor xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
pxor xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
pxor xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 2
pxor xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 1
pxor xmm1, xmm0
movd ebx, xmm1
cmp eax, esi
jge 0x100aea4d
nop dword [eax]
mov cl, byte [eax + edx]
inc eax
and cl, 0xaa
xor bl, cl
cmp eax, esi
jl 0x100aea40
push esi
push edx
push 0x10196f29
mov byte [0x10196f28], bl
call fcn.100b11a0
add esp, 0xc
xor ecx, ecx
test esi, esi
jle 0x100aea99
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
movzx eax, byte [ecx + 0x10196f29]
mov al, byte [eax + 0x10184338]
mov byte [ecx + 0x10196f29], al
test edx, edx
je 0x100aea91
xor al, bl
xor al, 0xcc
mov byte [ecx + 0x10196f29], al
inc ecx
xor edx, 1
cmp ecx, esi
jl 0x100aea70
pop esi
pop ebx
ret