joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a3de3
Capabilities:
Encode data using xor

Disassembly:
jbe 0x4a3e58
cmp esi, esp
invalid
out 0xc6, al
inc esi
pop ebx
popal
push ebp
out dx, al
xchg edi, eax
sub eax, 0xc616d04a
invalid
and dh, byte [ebp - 0x1b]
mov ebx, ecx
adc eax, 0xb78230a3
imul esi, dword [0x28639870], 0x6f
and al, 7
dec edi
xchg esp, eax
test dword [ebp + 0x4a63efb6], 0x209fc4bb
jle 0x4a3eae
xchg ecx, eax
xor eax, 0x12a868a6
push ecx
mov bl, 0x96
adc dword [esi + 0x2f], 0xecc6097d
and al, 0x38
sub dh, 0x5f
jb 0x4a3e7c
in eax, dx
jnp 0x4a3de6
cmp ebp, dword [ebx - 0x2873b3b6]
xlatb
pushal
je 0x4a3e18
adc esp, eax
mov ebx, 0x8130590f
or al, 0x3f
aad 0x85
push esi
in al, dx
mov esi, 0xe5a7affd
xor al, dl
inc ebp
mov ebp, 0x7b4a3775
xchg esp, eax
arpl word [ebp - 0x470afefe], bx
xor dl, byte [esp + ecx*8 - 0x46]
add ebp, esi
mov eax, 0xbacc5432
and eax, 0xb9c7817a
mov word [edi + 0x1b], gs
mov cl, 0xec
or esp, dword [edi + eax]
sti
cld
pop ebx
call 0xec33f0b0
shl dword [edx - 4], 1
xor bl, cl
dec esp
leave
xchg edx, eax
out dx, eax
cmpsb byte [esi], byte es:[edi]
or byte [ebx + 0x23], 0x49
jne 0x4a3e86
invalid
das
scasb al, byte es:[edi]
scasb al, byte es:[edi]
and ebp, ecx
jno 0x4a3f2a
jno 0x4a3f2a
xchg esp, eax
sub ebx, dword [esi - 6]
dec ebx
inc edi
aas
fyl2x
pop ds
mov ebx, 0x6ee79ee6
jns 0x4a3f3c
jb 0x4a3f25
or eax, 0x17b1411f
sub dword [ebp - 0x7146b91e], esp
pop edi
push ebx
push esp
dec eax
iretd
aas
mov ecx, 0x39045916
sbb eax, 0x5e239129
ret
scasd eax, dword es:[edi]
jg 0x4a3f7e
pop eax
lds esi, [eax + 0x70]
mov ch, 0xdf
fldenv [edi - 0x73f7b72d]
mov ebx, 0x1de1cc8d
xchg byte [edx + eax*4 - 0x74], dl
wait
push esp
invalid
or byte [ebx + ebx*4 - 0x1b8ac8ac], 5
retf
aaa
jne 0x4a3f23
add eax, 0xb9cabfcb
mov esi, 0x78b00e6
pop edi
or esp, ebp
movsx edi, ah
das
mov ah, 0x4f
test eax, 0xbe566728
mov byte ds:[edx], bl
mov ecx, 0xa91569ce
and al, 0xba
push ecx
xchg edx, eax
xor ebx, dword [edi]
into
sahf
mov byte [eax + 0x13], dh
add al, 0x3a
jnp 0x4a3ef4
xor eax, 0x1232f4d2
add al, 0x89
and byte [edi], ah
movsb byte es:[edi], byte [esi]
lcall 0xb53, 0x2502dc28
lodsd eax, dword [esi]
scasd eax, dword es:[edi]
pop eax
xchg esi, eax
insb byte es:[edi], dx
push ebx
or ebp, dword [ebp + 0x6c9658af]
sbb byte [edx + 0x7e4decc6], ah
sbb al, 0xd2
sub esi, dword [eax + 0x7d673d0b]
fisub word [esi + 0x71]
js 0x4a3ffb
out dx, eax
push esi
dec ecx
dec esp
popfd
ror dword [edx], cl
stosd dword es:[edi], eax
jo 0x4a3fc9
stosb byte es:[edi], al
jp 0x4a3f38
aaa
adc eax, 0x7a24f27b
xchg ebx, eax
cmp byte [0x97cf0d14], dl
pushal
invalid
xor al, byte [edx]
jmp 0x4a4022
shl byte [edi], cl
push esi
mov eax, 0xa39d5505
das
inc ecx
lcall 0x37ba, 0xe69a1e22
xchg ecx, eax
cmp dword [ebx], edi
mov ch, 0xaa
dec eax
mov bl, 0xd6
invalid
Function at 0x4a5157
Capabilities:
Check for software breakpoints

Disassembly:
adc eax, dword [esi - 0x4f]
inc ebp
pushfd
lea edx, [eax]
sub dword [esp + ecx*8 + 0x57], 0x3a
jp 0x4a5162
cmp bh, byte [edx - 3]
inc ebx
sub byte [ebx], al
adc dword [edx], edi
jg 0x4a516e
xor dl, byte [edi]
pop ss
adc dword [ecx - 0x3c0cfef5], ecx
inc ebp
mov bl, 0x65
or dl, byte [ecx + 0x2f9c4941]
stosb byte es:[edi], al
mov dl, 0xa4
sub ebx, dword [ebx - 0x20c46baf]
pop ss
aad 0x2c
test dword [ebx], esp
mov edi, 0x958ae50b
stc
jl 0x4a51c6
and ebp, dword [edi + 0x5c]
push es
out dx, eax
xchg esi, eax
in al, 0x8d
xchg ebp, eax
cmp al, 0xcc
pop ebx
in al, dx
and dword [ecx], 0xc7516f7d
invalid
movsb byte es:[edi], byte [esi]
mov eax, dword [0xd4c238b4]
cmp dl, al
aam 0x91

Function at 0x4c1508
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esi - 0x3c9d7322], ecx
xchg esp, eax
cmp al, 0xe2
out dx, eax
fcmovbe st(0), st(6)
jecxz fcn.004c1493
xor al, 0x34
pop ebx
sbb al, 0xa3
adc byte [ebx], ah
and dword [eax - 0x75], 0xf56bcc9d
pushal
and ch, byte [edx]
lodsd eax, dword [esi]
adc eax, 0xee3da440
mov dh, 0xed
nop
jg 0x4c14ff
fucomp st(2)
nop
test byte [esi + 0x5ec53330], bh
sub byte [ebx], dl
xchg byte [edi - 0x2e], dl
push ecx
ror dword [ebx + 0x3c], 0x28
pushal
aam 0xaf
xlatb
sbb edi, edx
cwde
test eax, 0xfa649386
add ch, al
wait
insd dword es:[edi], dx
wait
mov ebp, gs
pop ebx
invalid

Function at 0x4c37a4
Capabilities:
Encode data using xor

Disassembly:
pop ds
bound esi, qword [ecx + ecx*2 - 0x51abde70]
mov eax, 0x491998b
out 0x2a, al
inc esp
jle 0x4c37de
add al, 0xe6
sub al, byte [esi + edi*2 + 0x27]
sti
salc
xor ecx, dword [esi + 0x2f]
das
salc
mov dh, 0x67
not dword [ecx]
xor dh, ah
lodsb al, byte ss:[si]
and al, 0x93
cmp byte [eax - 0x4db249a1], bh
adc byte [esi + 0x66], cl
sub ecx, dword [edx + esi*4 + 0x1c]
mov esi, 0x263d97b7
xor byte [0x5bd6dd57], bl
salc
pop ebx
jecxz 0x4c37b1
dec edx
jo 0x4c37bb
pop edi
push ecx
insb byte es:[edi], dx
xchg ebp, eax
test al, 0xd8
in eax, dx
frstor dword [eax + esi*8]
fst qword [esi]
stosd dword es:[edi], eax
les edx, [edi]
mov ebp, 0xd6be6f66
cld
mov eax, dword [0x8b07e41e]
cmp byte [ebx], 0xa1
Function at 0x4c7a72
Capabilities:
Encode data using xor

Disassembly:
dec ecx
mov esi, 0xec8d4f8a
cmp dl, byte [edi + ebx - 0x4142c066]
invalid
popfd
fidivr word [esi]
mov ch, 0xe2
insb byte es:[edi], dx
pop ss
jns 0x4c7ac3
mov ah, 0x14
jle 0x4c79f2
push ebp
push edx
sub dword [esi], eax
dec ebp
inc eax
cmp ch, byte [ecx + 0x25]
and eax, 0xd845e7a2
mov al, byte [0xd9c3e358]
xchg edx, eax
pop edi
test byte [esi + 0x3b], cl
sbb bl, byte [ebp + 0x44b0cf7b]
cmp ecx, dword [ecx - 0x4681920a]
insd dword es:[edi], dx
jle 0x4c7a2e
jle 0x4c7a2e
xchg ebp, eax
mov bl, 0x6e
sar dword [esi - 0x80], 1
mov dh, 0xc9
xchg esi, eax
jno 0x4c7a73
cmp dword [eax + 0x2d], ebx
lahf
sbb esp, dword [edx]
jle 0x4c7a8e
invalid
inc edx
mov al, byte [0x6eaa4c61]
popal
dec esp
stosb byte es:[edi], al
outsb dx, byte [esi]
pop ebp
loope 0x4c7afc
cmp bl, byte [esi + ebp*8 - 0x47]
fcmovnu st(0), st(6)
arpl word [ecx - 0x16a007ae], bp
clc
pop edi
jmp 0x20f220b7
shr dword [edx + 0x3a0d1986], 1
invalid
sbb ecx, edi
les edi, [edx - 0x8db2eb1]
dec edi
shl dword [edi + esi*8], 1
lodsd eax, dword [esi]
and al, 0xb4
xor byte [ebx + 0x39], dh
pushal
adc byte [ebx], cl
in eax, 0xbb
jo 0x4c7ab2
pop ss
push 0xb7d2a362
in al, dx
mov dl, 0xa4
mov eax, dword [0xb35c8ec4]
pop esp
mov bl, 0xd
outsb dx, byte [esi]
sbb eax, 0xffffffd0
fcom st(0)
jp 0x4c7aa1
insb byte es:[edi], dx
in eax, dx
sub eax, 0x49042730
pop esi
jae 0x4c7b0f
les ebx, [ebx]
and bl, byte [edi + edi*8 + 0x9ea411a]
and al, 3
and dword [ecx + 0x172485e9], esp
xor ecx, dword [esi + ebp*4 - 0x346a5677]
ljmp 0xa94b
stosb byte es:[edi], al
aas
mov cs, word [ebx - 0x57]
clc
das
and byte [eax], cl
loopne 0x4c7b54
daa
cmp edi, dword [ecx + 0x65]
xchg edx, eax
jg 0x4c7a90
pop ecx
into
mov edx, 0x21a9f6ca
xor dword [edx - 0x4a], ecx
clc
or al, 0xbd
je 0x4c7ad4
cmp eax, 0x77b1528a
aas
enter 0x7112, 0xffffffffffffffba
push edx
dec edx
mov cl, 0xd2
sahf
wait
movaps xmm7, xmmword [eax + 0x48146bfd]
and byte [ecx + 0x54], al
ret
idiv ah
outsd dx, dword [esi]
adc al, 0x22
lcall 0x99a4, 0xe81ffb50
pushal
invalid
Function at 0x401db0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
test ecx, ecx
je 0x401dd8
push esi
mov esi, 1
mov edx, 0x10
sub esi, ecx
xor byte [ecx], 0x54
lea eax, [esi + ecx]
lea ecx, [ecx + 1]
sub edx, 1
jne 0x401dc5
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x401ee0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4a2014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x186a0
mov dword [ebp - 8], 0
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x401f1b
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a51d
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push 0x40
push 0x186a0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0042a51d
mov esp, ebp
pop ebp
ret

Function at 0x402670
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.00402640
nop
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call fcn.00402640
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], 0
jmp 0x4026a6
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 4
jge 0x4026c5
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + edx*4]
push ecx
call fcn.00402640
nop
mov edx, dword [ebp - 8]
mov dword [ebp + edx*4 - 0x18], eax
jmp 0x40269d
mov dword [ebp - 0x1c], 0
mov dword [ebp - 8], 0
jmp 0x4026de
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x10
jge 0x402736
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x61c88647
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x20]
shl edx, 4
add edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x1c]
xor edx, eax
mov ecx, dword [ebp - 0x20]
shr ecx, 5
add ecx, dword [ebp - 0x14]
xor edx, ecx
add edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
shl edx, 4
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x1c]
xor edx, eax
mov ecx, dword [ebp - 4]
shr ecx, 5
add ecx, dword [ebp - 0xc]
xor edx, ecx
add edx, dword [ebp - 0x20]
mov dword [ebp - 0x20], edx
jmp 0x4026d5
mov edx, dword [ebp - 4]
push edx
call fcn.00402640
nop
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 0x20]
push edx
call fcn.00402640
nop
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
mov esp, ebp
pop ebp
ret
Function at 0x405c80
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_ntohl]
push esi
mov esi, edx
push edi
push dword [esi]
call ebx
push dword [esi + 4]
mov edi, eax
call ebx
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
sub ebx, eax
nop dword [eax]
lea eax, [ebx + esi*4]
push dword [ebp + eax - 0x14]
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [ebp + esi*4 - 0x14], eax
inc esi
cmp esi, 4
jl 0x405cb0
mov ebx, dword [ebp - 4]
mov edx, 0xe3779b90
mov esi, 0x10
mov ecx, edi
mov eax, edi
shr ecx, 5
add ecx, dword [ebp - 8]
shl eax, 4
add eax, dword [ebp - 0xc]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
sub ebx, ecx
mov ecx, ebx
mov eax, ebx
shr ecx, 5
add ecx, dword [ebp - 0x10]
shl eax, 4
add eax, dword [ebp - 0x14]
xor ecx, eax
lea eax, [edx + ebx]
xor ecx, eax
lea edx, [edx + 0x61c88647]
sub edi, ecx
sub esi, 1
jne 0x405cd4
mov esi, dword [sym.imp.WS2_32.dll_htonl]
push edi
call esi
mov edi, dword [ebp + 0xc]
push ebx
mov dword [edi], eax
call esi
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x409e10
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4a2014]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4a3b08], 0
push esi
push edi
mov esi, ecx
je 0x409e3c
cmp dword [esi + 0x4f6], 7
jne 0x409e3c
push ecx
call fcn.0040b750
push ebx
push 4
lea eax, [ebp - 8]
mov dword [ebp - 0x14], 0x6500
push eax
push ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0
push eax
mov ecx, esi
mov word [ebp - 0xc], 0x400
mov dword [ebp - 8], 0
call fcn.00408ee0
mov ebx, dword [esi + 0x402]
mov eax, dword [sym.imp.WS2_32.dll_setsockopt]
test ebx, ebx
je 0x409eb5
mov edi, dword [ebx]
cmp edi, 0xffffffff
je 0x409eaf
push 4
lea ecx, [ebp - 8]
mov dword [ebp - 8], 1
push ecx
push 0x80
push 0xffff
push edi
call eax
push 2
push edi
call dword [sym.imp.WS2_32.dll_shutdown]
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebx], 0xffffffff
mov edi, dword [esi + 0x406]
test edi, edi
je 0x409f00
mov ebx, dword [edi]
cmp ebx, 0xffffffff
je 0x409ef0
push 4
lea ecx, [ebp - 8]
mov dword [ebp - 8], 1
push ecx
push 0x80
push 0xffff
push ebx
call eax
push 2
push ebx
call dword [sym.imp.WS2_32.dll_shutdown]
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [edi], 0xffffffff
mov dword [esi + 0x406], 0
mov eax, dword [esi + 0x466]
pop ebx
test eax, eax
je 0x409f1c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x466], 0
mov eax, dword [0x4a3a30]
test eax, eax
je 0x409f2b
dec eax
mov dword [0x4a3a30], eax
xor eax, eax
mov dword [esi + 0x402], 0
mov dword [esi + 0x3e6], 0
mov dword [esi + 0x550], 0
mov dword [esi + 0x3fa], 0
mov dword [esi + 0x3fe], 0
mov word [esi + 0x53e], ax
mov dword [esi + 0x52e], eax
cmp dword [ebp + 8], eax
je 0x409fab
mov eax, dword [esi + 0x766]
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test eax, eax
je 0x409f91
push eax
call edi
add esp, 4
mov dword [esi + 0x766], 0
mov eax, dword [esi + 0x76e]
test eax, eax
je 0x409fab
push eax
call edi
add esp, 4
mov dword [esi + 0x76e], 0
mov ecx, dword [esi + 0x762]
call dword [sym.imp.mfc140u.dll_CByteArray::FreeExtra]
mov ecx, dword [esi + 0x762]
push 0xffffffffffffffff
push 0
call dword [sym.imp.mfc140u.dll_CByteArray::SetSize]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0042a51d
mov esp, ebp
pop ebp
ret 4
Function at 0x40afd0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4a2014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp + 0xc]
xorps xmm0, xmm0
mov byte [ebp - 0x18], 0
mov edi, ecx
mov word [ebp - 7], 0
movups xmmword [ebp - 0x17], xmm0
mov byte [ebp - 5], 0
call dword [sym.imp.WS2_32.dll_htonl]
lea edx, [ebp - 0x18]
mov ecx, eax
call fcn.0040aa20
mov ebx, dword [edi + 0x402]
mov dword [edi + 0x406], ebx
mov dword [edi + 0x550], 0
test ebx, ebx
je 0x40b062
mov esi, dword [ebx]
cmp esi, 0xffffffff
je 0x40b05c
push 4
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 1
push eax
push 0x80
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
push 2
push esi
call dword [sym.imp.WS2_32.dll_shutdown]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [ebx], 0xffffffff
push 0x10
call dword [sym.imp.mfc140u.dll_operator_2]
mov esi, eax
add esp, 4
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x40b084
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi], 0xffffffff
jmp 0x40b086
xor esi, esi
push 5
push 0
push 0
push 0
push 0
push 0
push ecx
push dword [ebp + 0x10]
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
call fcn.0040d770
test eax, eax
je 0x40b0bc
test esi, esi
je 0x40b0ba
push 0x10
push esi
mov dword [esi], 0xffffffff
call fcn.0042a998
add esp, 8
xor esi, esi
push 0x32
mov dword [edi + 0x402], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [edi + 0x402], 0
je 0x40b0e0
push dword [ebp + 0x1c]
mov ecx, edi
push dword [ebp + 0x18]
call fcn.0040aee0
push dword [ebp + 0x14]
mov ecx, edi
call fcn.0040aaa0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042a51d
mov esp, ebp
pop ebp
ret 0x18
Function at 0x40ce60
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, edx
mov eax, 0x55555556
imul ebx
push edi
mov edi, edx
mov dword [ebp - 0xc], ebx
shr edi, 0x1f
add edi, edx
mov dword [ebp - 8], edi
lea edx, [edi + 1]
mov dword [ebp - 4], edx
test edx, edx
jle 0x40cfcb
mov eax, dword [ebp + 8]
lea edx, [ecx + 2]
mov ebx, dword [ebp - 4]
mov edi, 0x2f
push esi
lea esi, [eax + 2]
nop
mov cl, byte [edx - 2]
shr cl, 2
cmp cl, 0x19
ja 0x40ceb0
add cl, 0x41
jmp 0x40cede
lea eax, [ecx - 0x1a]
cmp al, 0x19
ja 0x40cebc
add cl, 0x47
jmp 0x40cede
lea eax, [ecx - 0x34]
cmp al, 9
ja 0x40cec8
sub cl, 4
jmp 0x40cede
cmp cl, 0x3e
jne 0x40ced1
mov cl, 0x2b
jmp 0x40cede
cmp cl, 0x3f
mov eax, 0x3d
cmove eax, edi
mov cl, al
mov byte [esi - 2], cl
mov cl, byte [edx - 2]
mov al, byte [edx - 1]
and cl, 3
shl cl, 4
shr al, 4
add cl, al
cmp cl, 0x19
ja 0x40cefc
add cl, 0x41
jmp 0x40cf2a
lea eax, [ecx - 0x1a]
cmp al, 0x19
ja 0x40cf08
add cl, 0x47
jmp 0x40cf2a
lea eax, [ecx - 0x34]
cmp al, 9
ja 0x40cf14
sub cl, 4
jmp 0x40cf2a
cmp cl, 0x3e
jne 0x40cf1d
mov cl, 0x2b
jmp 0x40cf2a
cmp cl, 0x3f
mov eax, 0x3d
cmove eax, edi
mov cl, al
mov byte [esi - 1], cl
mov al, byte [edx - 1]
mov cl, byte [edx]
and al, 0xf
shl al, 2
shr cl, 6
add al, cl
cmp al, 0x19
ja 0x40cf44
add al, 0x41
jmp 0x40cf70
lea ecx, [eax - 0x1a]
cmp cl, 0x19
ja 0x40cf50
add al, 0x47
jmp 0x40cf70
lea ecx, [eax - 0x34]
cmp cl, 9
ja 0x40cf5c
sub al, 4
jmp 0x40cf70
cmp al, 0x3e
jne 0x40cf64
mov al, 0x2b
jmp 0x40cf70
cmp al, 0x3f
mov ecx, 0x3d
cmove ecx, edi
mov al, cl
mov byte [esi], al
mov cl, byte [edx]
and cl, 0x3f
cmp cl, 0x19
ja 0x40cf81
add cl, 0x41
jmp 0x40cfaf
lea eax, [ecx - 0x1a]
cmp al, 0x19
ja 0x40cf8d
add cl, 0x47
jmp 0x40cfaf
lea eax, [ecx - 0x34]
cmp al, 9
ja 0x40cf99
sub cl, 4
jmp 0x40cfaf
cmp cl, 0x3e
jne 0x40cfa2
mov cl, 0x2b
jmp 0x40cfaf
cmp cl, 0x3f
mov eax, 0x3d
cmove eax, edi
mov cl, al
mov byte [esi + 1], cl
add edx, 3
add esi, 4
sub ebx, 1
jne 0x40cea0
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
pop esi
lea eax, [edi + edi*2]
sub ebx, eax
cmp ebx, 1
jne 0x40cfe1
mov eax, dword [ebp + 8]
mov word [eax + edi*4 + 2], 0x3d3d
jmp 0x40cfee
cmp ebx, 2
jne 0x40cff0
mov eax, dword [ebp + 8]
mov byte [eax + edi*4 + 3], 0x3d
mov edi, edx
mov ecx, dword [ebp + 8]
lea eax, [edi*4]
pop edi
pop ebx
mov byte [eax + ecx], 0
mov esp, ebp
pop ebp
ret
Function at 0x40d290
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a2014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
call fcn.0040d010
test eax, eax
je 0x40d2c6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call ebx
mov ecx, edi
call fcn.0040d010
test eax, eax
jne 0x40d2b7
push 4
push edi
push 0x700b
push 0xffff
push dword [esi + 0x1c]
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 1
push eax
push 0x98000004
push dword [esi + 0x1c]
mov dword [ebp - 0x18], 0x7530
mov dword [ebp - 0x14], 0x1388
call dword [sym.imp.WS2_32.dll_WSAIoctl]
lea ebx, [edi + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [edi + 4]
push 0
push 0
push 1
push dword [esi + 0x1c]
push edi
call dword [0x4a3a08]
cmp byte [ebp + 8], 0
je 0x40d3aa
mov eax, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
call eax
mov eax, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
dec dword [edi + 4]
push ebx
call eax
push dword [edi + 4]
push 0
push 0
push 3
push dword [esi + 0x1c]
push edi
call dword [0x4a3a08]
mov edi, dword [esi + 0x1c]
cmp edi, 0xffffffff
je 0x40d46b
push 4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
push 0x80
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
push 2
push edi
call dword [sym.imp.WS2_32.dll_shutdown]
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x40d46b
mov dword [esi + 0x18], 2
cmp dword [edi + 0x20], 0
je 0x40d3ef
push dword [esi + 0x20]
call dword [sym.imp.mfc140u.dll_operator_1]
add esp, 4
mov dword [esi + 0x30], 0
push 4
call dword [sym.imp.mfc140u.dll_operator]
mov dword [esi + 0x20], eax
add esp, 4
add eax, dword [esi + 0x30]
mov dword [ebp - 0x20], eax
mov eax, 4
sub eax, dword [esi + 0x30]
mov dword [esi + 0x2c], 4
jmp 0x40d3fa
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [0x4a2720]
push 0
push esi
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 0
push eax
push 1
lea eax, [ebp - 0x24]
mov dword [ebp - 8], 0
push eax
push dword [esi + 0x1c]
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x40d490
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x271e
je 0x40d490
cmp eax, 0x3e5
je 0x40d490
mov eax, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
call eax
mov eax, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
dec dword [edi + 4]
push ebx
call eax
push dword [edi + 4]
push 0
push 0
push 3
push dword [esi + 0x1c]
push edi
call dword [0x4a3a08]
mov ecx, dword [esi + 0x1c]
call fcn.0040e720
push dword [esi + 0x20]
mov dword [esi + 0x1c], 0xffffffff
call dword [sym.imp.mfc140u.dll_operator_1]
add esp, 4
mov dword [esi + 0x20], 0
push 0x34
push esi
call fcn.0042a998
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042a51d
mov esp, ebp
pop ebp
ret 8
Function at 0x40d6d0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4a2014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
push dword [esi + 0x20]
mov edi, dword [esi + 0x1c]
call dword [sym.imp.mfc140u.dll_operator_1]
push 0x34
push esi
mov dword [esi + 0x20], 0
call fcn.0042a998
add esp, 0xc
cmp byte [ebp + 8], 0
je 0x40d750
cmp edi, 0xffffffff
je 0x40d73f
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 0x80
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
push 2
push edi
call dword [sym.imp.WS2_32.dll_shutdown]
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
push dword [ebx + 4]
push 0
push 0
push 5
push edi
push ebx
call dword [0x4a3a08]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042a51d
mov esp, ebp
pop ebp
ret 8
Function at 0x40dc70
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
push 0
push 0
mov edi, ecx
push 0x7010
push 0xffff
push dword [edi]
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0
push 0
push 1
push dword [edi]
push edi
call dword [0x4a3a00]
cmp byte [ebp + 8], 0
je 0x40dcb1
push dword [ebp + 0xc]
push ecx
mov ecx, edi
call fcn.0040df00
pop edi
pop ebp
ret 8
push esi
mov esi, dword [ebp + 0xc]
push dword [esi + 0x1c]
call dword [sym.imp.mfc140u.dll_operator_1]
add esp, 4
cmp dword [edi + 4], 0
je 0x40dcd8
push 4
call dword [sym.imp.mfc140u.dll_operator]
mov dword [esi + 0x28], 4
jmp 0x40dcea
push 0xffff
call dword [sym.imp.mfc140u.dll_operator]
mov dword [esi + 0x28], 0xffff
add esp, 4
mov dword [esi + 0x1c], eax
mov ecx, edi
mov dword [esi + 0x18], 2
mov dword [esi + 0x2c], 0
push esi
call fcn.0040de60
cmp eax, 1
jne 0x40dd14
push esi
push ecx
mov ecx, edi
call fcn.0040df00
pop esi
pop edi
pop ebp
ret 8

Function at 0x40de60
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4a2014]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, dword [ebp + 8]
push 0
push esi
mov dword [ebp - 0xc], 0
mov eax, dword [esi + 0x1c]
add eax, dword [esi + 0x2c]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x28]
sub eax, dword [esi + 0x2c]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [esi + 0x24]
mov dword [esi + 0x14], ecx
push eax
push 1
lea eax, [ebp - 0x14]
mov dword [esi + 0x18], 2
push eax
push dword [ecx]
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x40dede
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x271e
je 0x40dede
cmp eax, 0x3e5
je 0x40dede
mov eax, 1
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0042a51d
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 8]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0042a51d
mov esp, ebp
pop ebp
ret 4

Function at 0x40df00
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4a2014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
push dword [esi + 0x1c]
call dword [sym.imp.mfc140u.dll_operator_1]
push 0x30
push esi
mov dword [esi + 0x1c], 0
call fcn.0042a998
add esp, 0xc
push 0
push 0
push 3
push dword [edi]
push edi
call dword [0x4a3a00]
mov esi, dword [edi]
cmp esi, 0xffffffff
je 0x40df76
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 0x80
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
push 2
push esi
call dword [sym.imp.WS2_32.dll_shutdown]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 4]
mov dword [edi], 0xffffffff
xor ecx, ebp
pop edi
pop esi
call fcn.0042a51d
mov esp, ebp
pop ebp
ret 8