joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ec948
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0x38
push 0x9bb0c8
call fcn.007f0df9
pop ecx
pop ecx
call fcn.007ec8ef
test eax, eax
je 0x7ecb19
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x2c]
and dword [ebp - 0xc], 0
mov dword [0x9bb0d4], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, 0
cpuid
mov esi, dword [ebp - 4]
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], edx
mov dword [esi + 0xc], ecx
mov eax, dword [ebp - 0x1c]
test eax, eax
lea esi, [ebp - 0x18]
mov edi, 0x9bb0dc
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], eax
mov byte [0x9bb0e8], 0
jle 0x7ecb32
push 0xd
mov eax, 0x9bb0dc
pop edx
mov edi, str.GenuineIntel
mov esi, eax
mov ecx, edx
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x7ec9dd
or byte [0x9bb0db], 1
jmp 0x7eca23
mov edi, str.AuthenticAMD
mov esi, eax
mov ecx, edx
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x7ec9f5
or byte [0x9bb0db], 2
jmp 0x7eca23
mov edi, str.CyrixInstead
mov esi, eax
mov ecx, edx
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x7eca0d
or byte [0x9bb0db], 4
jmp 0x7eca23
mov esi, eax
mov edi, str.CentaurHauls
mov ecx, edx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x7eca23
or byte [0x9bb0db], 8
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, 1
cpuid
mov esi, dword [ebp - 4]
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], edx
mov dword [esi + 0xc], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, eax
sar ecx, 8
and cl, 0xf
mov byte [0x9bb0d8], cl
mov ecx, eax
and al, 0xf
sar ecx, 4
mov byte [0x9bb0da], al
and cl, 0xf
lea eax, [ebp - 0x1c]
mov byte [0x9bb0d9], cl
mov dword [ebp - 4], eax
mov eax, DirectSoundCreate
cpuid
mov esi, dword [ebp - 4]
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], edx
mov dword [esi + 0xc], ecx
mov edi, 0x2000000
test dword [0x9bb0d8], edi
je 0x7ecabe
cmp dword [ebp - 0x1c], 0x80000000
jbe 0x7ecabe
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, reloc.DSOUND.dll_DirectSoundCreate
cpuid
mov esi, dword [ebp - 4]
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], edx
mov dword [esi + 0xc], ecx
mov eax, dword [ebp - 0x14]
and eax, 0x80400000
or dword [0x9bb0d0], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, 1
cpuid
mov esi, dword [ebp - 4]
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], edx
mov dword [esi + 0xc], ecx
mov eax, dword [ebp - 0x14]
and eax, 0x6000000
or dword [0x9bb0d0], eax
test dword [0x9bb0d0], edi
je 0x7ecaf6
or byte [0x9bb0d2], 0x40
cmp dword [ebp - 8], 2
jl 0x7ecb32
lea eax, [ebp - 0x1c]
mov dword [ebp - 8], eax
mov eax, 2
cpuid
mov esi, dword [ebp - 8]
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], edx
mov dword [esi + 0xc], ecx
jmp 0x7ecb32
call fcn.007ec926
shl eax, 0x1a
xor eax, dword [0x9bb0d8]
and eax, 0x4000000
xor dword [0x9bb0d8], eax
and dword [ebp - 4], 0
fnstcw word [ebp - 4]
movzx eax, word [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x7eee8a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [0x907700]
mov eax, esi
add eax, 3
push edi
and eax, 0xfffffffc
xor edi, edi
call fcn.007c94b0
mov eax, esi
add eax, 3
and eax, 0xfffffffc
mov dword [ebp - 0x14], esp
call fcn.007c94b0
mov dword [ebp - 0x10], esp
push 1
push edi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
push dword [ebp + 0x10]
mov ebx, eax
push dword [0x907700]
push dword [ebp - 0x14]
push ebx
push dword [ebp + 8]
call fcn.007edb85
mov dword [ebp - 0x1c], eax
mov eax, dword [0x907700]
add esp, 0x18
push 0
push dword [ebp + 0x10]
mov esi, edi
push eax
xor esi, 1
push dword [ebp + esi*4 - 0x14]
add eax, ebx
push eax
push dword [ebp + 8]
call fcn.007edb85
mov dword [ebp + esi*4 - 0x1c], eax
push dword [ebp + edi*4 - 0x1c]
call fcn.007ed9a6
push dword [ebp + edi*4 - 0x1c]
call fcn.007eda45
add esp, 0x20
push 0
lea ecx, [ebp - 0xc]
push ecx
mov dword [ebp - 4], eax
push dword [ebp - 4]
mov eax, dword [ebp + edi*4 - 0x14]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x7eef77
mov edi, dword [ebp + 0x14]
xor eax, eax
mov ax, word [edi]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.007f1042
add ebx, dword [ebp - 4]
mov word [edi], ax
mov eax, dword [0x907700]
add esp, 0xc
cmp dword [ebp - 4], eax
mov edi, esi
jne 0x7eef7d
cmp byte [0x9bb158], 0
je 0x7eeeeb
jmp 0x7eef7d
or ebx, 0xffffffff
xor edi, 1
push dword [ebp + edi*4 - 0x1c]
call fcn.007edab2
pop ecx
mov eax, ebx
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x7ef647
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov ecx, dword [ebp + 8]
mov byte [ebp - 1], 0
call fcn.007ef0f8
test al, al
je 0x7ef664
mov al, 1
leave
ret
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
jne 0x7ef683
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.007ef205
pop ecx
pop ecx
mov byte [ebp - 1], al
jmp 0x7ef7fe
push dword [0x907708]
call fcn.007edd60
mov esi, eax
mov eax, dword [0x9bb174]
cmp eax, ebx
pop ecx
mov edi, edx
je 0x7ef6a7
mov ebx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x14], eax
jmp 0x7ef6ab
and dword [ebp - 0x14], 0
mov eax, dword [ebp + 0x10]
cdq
mov ecx, eax
mov dword [ebp - 0xc], ecx
add ecx, ebx
mov eax, edx
adc eax, dword [ebp - 0x14]
mov dword [ebp - 8], edx
cmp eax, dword [0x907714]
jg 0x7ef803
jl 0x7ef6d8
cmp ecx, dword [0x907710]
jae 0x7ef803
sub esi, dword [ebp - 0xc]
sbb edi, edx
cmp edi, dword [0x90771c]
jg 0x7ef803
jl 0x7ef6f7
cmp esi, dword [0x907718]
ja 0x7ef803
mov eax, dword [0x907708]
lea edx, [ebp - 0x11c]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x7ef704
mov eax, dword [ebp + 8]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x7ef713
lea edi, [ebp - 0x11c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x7ef723
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x11c]
rep movsb byte es:[edi], byte [esi]
call fcn.007eed65
xor edi, edi
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x7ef7fe
push dword [ebp + 8]
call fcn.007eef91
pop ecx
push edi
mov edi, dword [ebp + 0x10]
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], edi
jne 0x7ef7f1
mov esi, 0x9bb178
mov ecx, esi
call fcn.007ec1bd
mov eax, dword [0x9bb174]
mov edx, dword [eax + 0x10]
add edx, dword [ebp - 0xc]
mov ecx, dword [eax + 0x14]
adc ecx, dword [ebp - 8]
cmp ecx, dword [0x907714]
jg 0x7ef7db
jl 0x7ef7c8
cmp edx, dword [0x907710]
jae 0x7ef7db
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], ecx
mov byte [ebx + 0x104], 1
mov byte [ebp - 1], 1
jmp 0x7ef7e8
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, esi
call fcn.007ec1c8
jmp 0x7ef7fe
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov al, byte [ebp - 1]
jmp 0x7ef805
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x7f0fea
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
cmp esi, 4
jge 0x7f0ffa
xor eax, eax
jmp 0x7f103f
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx]
shl eax, 0x18
inc ecx
movzx edx, byte [ecx]
shl edx, 0x10
or eax, edx
xor edx, edx
inc ecx
mov dh, byte [ecx]
sub esi, 4
or eax, edx
inc ecx
movzx edx, byte [ecx]
or eax, edx
inc ecx
test esi, esi
not eax
jle 0x7f103d
push edi
movzx edi, byte [ecx]
mov edx, eax
shl eax, 8
shr edx, 0x18
or eax, edi
xor eax, dword [edx*4 + 0x9077a8]
inc ecx
dec esi
jne 0x7f1024
pop edi
not eax
pop esi
pop ebp
ret

Function at 0x7f1042
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
movzx eax, word [esp + 0x14]
xor edx, edx
xor esi, esi
dec ecx
jns 0x7f1062
jmp 0x7f1076
xor eax, esi
mov dl, byte [ebx]
xor dl, al
inc ebx
shr eax, 8
dec ecx
mov esi, dword [edx*4 + 0x907ba8]
jns 0x7f1062
xor eax, esi
pop esi
pop ebx
ret

Function at 0x7f73e1
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
cmp esi, 4
jge 0x7f73f1
xor eax, eax
jmp 0x7f7436
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx]
shl eax, 0x18
inc ecx
movzx edx, byte [ecx]
shl edx, 0x10
or eax, edx
xor edx, edx
inc ecx
mov dh, byte [ecx]
sub esi, 4
or eax, edx
inc ecx
movzx edx, byte [ecx]
or eax, edx
inc ecx
test esi, esi
not eax
jle 0x7f7434
push edi
movzx edi, byte [ecx]
mov edx, eax
shl eax, 8
shr edx, 0x18
or eax, edi
xor eax, dword [edx*4 + 0x908248]
inc ecx
dec esi
jne 0x7f741b
pop edi
not eax
pop esi
pop ebp
ret
Function at 0x7fdd95
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x7fde38
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 0x20]
push eax
call edi
lea eax, [ebp - 8]
push eax
call fcn.007fdd78
mov esi, dword [sym.imp.WINMM.dll_timeGetTime]
pop ecx
call esi
lea ebx, [eax + 5]
jmp 0x7fddd7
call esi
cmp eax, ebx
jb 0x7fddd5
lea eax, [ebp - 0x18]
push eax
call edi
lea eax, [ebp - 4]
push eax
call fcn.007fdd78
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 8]
pop ecx
test eax, eax
mov dword [ebp - 8], eax
fild dword [ebp - 8]
jge 0x7fde01
fadd qword [0x8c3870]
mov eax, dword [ebp - 0x10]
fild dword [ebp - 0x10]
test eax, eax
jge 0x7fde11
fadd qword [0x8c3870]
mov eax, dword [ebp - 0x18]
fmulp st(1)
sub eax, dword [ebp - 0x20]
test eax, eax
mov dword [ebp - 8], eax
fild dword [ebp - 8]
jge 0x7fde29
fadd qword [0x8c3870]
fdivp st(1)
fmul qword [0x8938e0]
call fcn.007c4b80
mov esi, eax
xor edx, edx
mov ecx, 0xc8
lea eax, [esi + esi*2 + 0x64]
div ecx
xor edx, edx
push 3
pop ecx
push 0x32
imul eax, eax, 0xc8
div ecx
xor edx, edx
pop ecx
mov edi, eax
lea eax, [esi + 0x19]
div ecx
mov ecx, eax
imul ecx, ecx, 0x32
mov eax, ecx
sub eax, esi
cdq
mov ebx, eax
xor ebx, edx
mov eax, edi
sub eax, esi
sub ebx, edx
cdq
xor eax, edx
sub eax, edx
cmp ebx, eax
jae 0x7fde7f
mov eax, ecx
jmp 0x7fde8a
cmp edi, 0x29a
mov eax, edi
jne 0x7fde8a
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x820c64
Capabilities:
Create thread

Disassembly:
push 0x9c22ec
xor eax, eax
push eax
push eax
push 0x820bd7
push eax
push eax
mov byte [0x9c2010], 1
mov byte [0x9c2011], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xf
push eax
mov dword [0x9c22e8], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
ret
Function at 0x835187
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x90d2c8]
cmp eax, 0xffffffff
je 0x8351a0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x8351dc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 1
mov edi, eax
push 0
lea eax, [ebp - 4]
push eax
call esi
push eax
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
pop edi
pop esi
je 0x8351d9
push 1
push dword [ebp - 4]
call fcn.00835120
pop ecx
pop ecx
mov eax, dword [ebp - 4]
leave
ret

Function at 0x83a670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
xor dl, dl
test esi, esi
je 0x83a75f
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x83a75f
mov al, byte [ebp]
test al, al
mov byte [esp + 0xc], al
je 0x83a75f
push ebx
mov eax, ebp
push edi
nop
mov cl, byte [esi]
test cl, cl
je 0x83a750
movzx edi, byte [eax]
mov bl, byte [edi + 0x8c6508]
movzx ecx, cl
xor bl, byte [ecx + 0x8c6508]
mov cl, byte [eax + 1]
or dl, bl
inc esi
inc eax
test cl, cl
jne 0x83a6a0
sub eax, ebp
test dl, dl
jne 0x83a6d6
cmp byte [esi], 0x3d
je 0x83a757
cmp byte [esi], 0
je 0x83a750
mov dl, byte [esi + 1]
inc esi
test dl, dl
je 0x83a750
mov edi, eax
mov ecx, esi
sub edi, esi
sub ecx, eax
add edi, ebp
mov bl, 0x20
nop
cmp dl, 0x3d
jne 0x83a746
cmp byte [eax + ecx - 1], bl
jbe 0x83a750
cmp byte [ecx - 1], bl
mov edx, ecx
ja 0x83a746
movzx ebp, byte [ecx]
movzx ebx, byte [esp + 0x14]
mov dword [esp + 0x18], eax
mov al, byte [ebp + 0x8c6508]
cmp al, byte [ebx + 0x8c6508]
mov eax, dword [esp + 0x18]
jne 0x83a740
movzx ebp, byte [edx + 1]
movzx ebx, byte [edi + edx + 1]
inc edx
mov dword [esp + 0x18], eax
mov al, byte [ebp + 0x8c6508]
cmp al, byte [ebx + 0x8c6508]
mov eax, dword [esp + 0x18]
je 0x83a720
cmp edx, esi
je 0x83a757
mov bl, 0x20
mov dl, byte [esi + 1]
inc esi
dec edi
inc ecx
test dl, dl
jne 0x83a6f0
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
ret
pop edi
pop ebx
lea eax, [esi + 1]
pop esi
pop ebp
ret
pop esi
xor eax, eax
pop ebp
ret
Function at 0x840c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 0x61636374
je 0x840d55
cmp eax, 0x75736572
je 0x840d55
cmp eax, 0x61757464
jne 0x840c8b
mov eax, dword [esp + 4]
add eax, 0x148
ret
cmp eax, 0x6c697374
jne 0x840c9d
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x1834]
ret
cmp eax, 0x636f6e66
jne 0x840cae
mov eax, dword [esp + 4]
add eax, 0x588
ret
cmp eax, 0x70617274
jne 0x840cbf
mov eax, dword [esp + 4]
add eax, 0x548
ret
cmp eax, 0x70657264
jne 0x840cd0
mov eax, dword [esp + 4]
add eax, 0x348
ret
cmp eax, 0x70657273
jne 0x840ce1
mov eax, dword [esp + 4]
add eax, 0x15a8
ret
cmp eax, 0x726f6f6d
jne 0x840cf2
mov eax, dword [esp + 4]
add eax, 0x17ec
ret
cmp eax, 0x73656c66
jne 0x840d03
mov eax, dword [esp + 4]
add eax, 0x15a0
ret
cmp eax, 0x73657276
jne 0x840d14
mov eax, dword [esp + 4]
add eax, 0x2098
ret
cmp eax, 0x76657273
jne 0x840d33
mov dword [esp + 8], str.VERS
mov ecx, dword [esp + 4]
add ecx, 0x48
mov dword [esp + 4], ecx
jmp fcn.0083a670
cmp eax, 0x736c7573
jne 0x840d52
mov dword [esp + 8], str.SLUS
mov edx, dword [esp + 4]
add edx, 0x48
mov dword [esp + 4], edx
jmp fcn.0083a670
xor eax, eax
ret
mov eax, dword [esp + 4]
add eax, 0x158c
ret
Function at 0x843c60
Capabilities:
Get geographical location

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
lea eax, [edi + 0x4f8]
push eax
push str.FIRSTNAME
add esi, 0x210
push 0x1000
push esi
call fcn.0083c880
lea ecx, [edi + 0x55c]
push ecx
push str.LASTNAME
push 0x1000
push esi
call fcn.0083c880
lea edx, [edi + 0x5c0]
push edx
push str.NAMEONCARD
push 0x1000
push esi
call fcn.0083c880
lea eax, [edi + 0x688]
push eax
push str.ADDRESS1
push 0x1000
push esi
call fcn.0083c880
add esp, 0x40
lea ecx, [edi + 0x6ec]
push ecx
push str.ADDRESS2
push 0x1000
push esi
call fcn.0083c880
lea edx, [edi + 0x750]
push edx
push str.CITY
push 0x1000
push esi
call fcn.0083c880
lea eax, [edi + 0x7b4]
push eax
push str.STATE
push 0x1000
push esi
call fcn.0083c880
lea ecx, [edi + 0x7dc]
push ecx
push str.POSTCODE
push 0x1000
push esi
call fcn.0083c880
add esp, 0x40
lea edx, [edi + 0x808]
push edx
push str.COUNTRY
push 0x1000
push esi
call fcn.0083c880
lea eax, [edi + 0x83a]
push eax
push str.EMAIL
push 0x1000
push esi
call fcn.0083c880
lea ecx, [edi + 0x8a4]
push ecx
push str.CARDTYPE
push 0x1000
push esi
call fcn.0083c880
lea edx, [edi + 0x8f4]
push edx
push str.CARDNUMBER
push 0x1000
push esi
call fcn.0083c880
mov eax, dword [edi + 0x91c]
add esp, 0x40
push eax
push str.EXPIRYMONTH
push 0x1000
push esi
call fcn.0083a980
mov ecx, dword [edi + 0x920]
push ecx
push str.EXPIRYYEAR
push 0x1000
push esi
call fcn.0083a980
add esp, 0x20
pop edi
pop esi
ret
Function at 0x84a8c0
Capabilities:
Set socket configuration

Disassembly:
push ecx
push ebx
mov ebx, eax
cmp ebx, 0xffffffff
push ebp
mov ebp, dword [esp + 0x14]
mov dword [esp + 8], 1
jne 0x84a8f3
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
push eax
push ebp
push ecx
call sub.WS2_32.dll_socket
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x84a8f3
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
push esi
push edi
push 0x2ec
call fcn.0078af30
add esp, 4
mov esi, eax
lea edx, [esp + 0x10]
push edx
xor eax, eax
push 0x8004667e
mov ecx, 0xbb
mov edi, esi
rep stosd dword es:[edi], eax
push ebx
mov dword [esi + 0x18], ebx
call sub.WS2_32.dll_ioctlsocket
cmp ebp, 2
jne 0x84a93b
push 4
lea eax, [esp + 0x14]
push eax
push 0x20
push 0xffff
push ebx
call sub.WS2_32.dll_setsockopt
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], edx
xor eax, eax
lea ecx, [esi + 0x50]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
call sub.WS2_32.dll_WSACreateEvent
lea edx, [esi + 0x64]
push edx
mov dword [esi + 0x60], eax
call fcn.0084bcc0
push 0
call fcn.0084bd60
mov eax, dword [0x9c36fc]
mov dword [esi], eax
push 0
mov dword [0x9c36fc], esi
call fcn.0084bdf0
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x84aa40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push edi
call fcn.0084bcb0
push 0
mov edi, eax
call fcn.0084bd60
mov eax, dword [esp + 0x10]
mov esi, dword [eax]
add esp, 4
test esi, esi
je 0x84aaa2
push ebp
mov edi, edi
mov edx, dword [esi + 0x44]
test edx, edx
je 0x84aa9b
mov ecx, dword [esi + 0x4c]
test ecx, ecx
je 0x84aa9b
mov eax, dword [esi + 0x40]
cmp eax, 0xffffffff
je 0x84aa9b
mov ebp, edi
sub ebp, eax
cmp ebp, edx
jbe 0x84aa9b
mov edx, dword [esi + 0x48]
push edx
push 0
push esi
mov dword [esi + 0x40], 0xffffffff
call ecx
add esp, 0xc
call fcn.0084bcb0
mov edi, eax
mov dword [esi + 0x40], edi
mov esi, dword [esi]
test esi, esi
jne 0x84aa60
pop ebp
mov eax, dword [0x9c3700]
test eax, eax
pop edi
pop esi
je 0x84aacb
lea ecx, [ecx]
mov ecx, dword [eax + 4]
push eax
mov dword [0x9c3700], ecx
call fcn.0078af60
mov eax, dword [0x9c3700]
add esp, 4
test eax, eax
jne 0x84aab0
mov dword [esp + 4], 0
jmp fcn.0084bdf0
Function at 0x84ab40
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 8
push esi
mov esi, eax
mov eax, dword [esi + 0x98]
test eax, eax
push edi
lea edi, [esi + 0x98]
jne 0x84abff
cmp byte [esi + 0xa8], 1
je 0x84abff
lea eax, [esi + 0xa9]
mov dword [esp + 0xc], eax
cmp dword [esi + 0xc], 2
lea ecx, [esi + 0xa4]
mov dword [esp + 8], 0x240
mov dword [ecx], 0
push 0
jne 0x84abba
lea edx, [esi + 0x50]
push edx
mov edx, dword [esi + 0x18]
lea eax, [esi + 0xa0]
push eax
mov dword [eax], 0x10
lea eax, [esi + 0x88]
push eax
push ecx
push edi
push 1
lea ecx, [esp + 0x24]
push ecx
push edx
call sub.WS2_32.dll_WSARecvFrom
jmp 0x84abd0
mov edx, dword [esi + 0x18]
lea eax, [esi + 0x50]
push eax
push ecx
push edi
push 1
lea ecx, [esp + 0x1c]
push ecx
push edx
call sub.WS2_32.dll_WSARecv
test eax, eax
je 0x84abf5
mov dword [edi], eax
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x3e5
mov dword [esi + 0x9c], eax
jne 0x84abff
pop edi
mov byte [esi + 0xa8], 1
pop esi
add esp, 8
ret
cmp dword [edi], 0
jle 0x84abff
call fcn.0084aae0
pop edi
pop esi
add esp, 8
ret

Function at 0x84ad90
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a0
mov eax, dword [0x906980]
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov dword [esp + 0x1a8], eax
call fcn.0084c010
push 0x9c36fc
push fcn.0084aa40
call fcn.0084be20
xor eax, eax
mov ecx, 0x64
lea edi, [esp + 0x1c]
add esp, 0xc
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
push 2
mov dword [0x9c3704], 0
mov dword [0x9c3708], 0
call sub.WS2_32.dll_WSAStartup
mov ax, word [esp + 0x10]
movzx ecx, ah
push 0
mov ch, al
push 0
push 0
push 0
mov dword [0x9c36f8], ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 0x84ac10
push 0
push 0
mov dword [0x9c3710], eax
mov dword [0x9c370c], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [0x9c370c], eax
je 0x84ae54
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x9c370c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1a4]
call fcn.007d6cb0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x84ae70
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push eax
push ebp
push ecx
mov dword [esp + 0x14], 1
call sub.WS2_32.dll_socket
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x84ae9c
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
push esi
push edi
push 0x2ec
call fcn.0078af30
add esp, 4
mov esi, eax
lea edx, [esp + 0x10]
push edx
xor eax, eax
push 0x8004667e
mov ecx, 0xbb
mov edi, esi
rep stosd dword es:[edi], eax
push ebx
mov dword [esi + 0x18], ebx
call sub.WS2_32.dll_ioctlsocket
cmp ebp, 2
jne 0x84aee4
push 4
lea eax, [esp + 0x14]
push eax
push 0x20
push 0xffff
push ebx
call sub.WS2_32.dll_setsockopt
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], edx
xor eax, eax
lea ecx, [esi + 0x50]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
call sub.WS2_32.dll_WSACreateEvent
lea edx, [esi + 0x64]
push edx
mov dword [esi + 0x60], eax
call fcn.0084bcc0
push 0
call fcn.0084bd60
mov eax, dword [0x9c36fc]
mov dword [esi], eax
push 0
mov dword [0x9c36fc], esi
call fcn.0084bdf0
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x84b000
Capabilities:
Connect socket

Disassembly:
sub esp, 0x14
mov eax, dword [0x906980]
push esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
lea esi, [esp + 0xc]
mov byte [edi + 0x14], 0
call fcn.0084a7c0
mov ecx, dword [edi + 0x18]
push eax
push ecx
call sub.WS2_32.dll_connect
mov esi, eax
call sub.WS2_32.dll_WSAGetLastError
mov ecx, eax
mov eax, esi
call fcn.0084a840
mov esi, eax
test esi, esi
jne 0x84b061
mov edi, dword [edi + 0xc]
cmp edi, 2
je 0x84b055
cmp edi, 3
jne 0x84b061
mov edx, dword [0x9c3710]
push edx
call sub.WS2_32.dll_WSASetEvent
mov ecx, dword [esp + 0x18]
pop edi
mov eax, esi
pop esi
call fcn.007d6cb0
add esp, 0x14
ret
Function at 0x84b110
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
sub esp, 0x14
mov eax, dword [0x906980]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x18], eax
cmp dword [ebp + 0xc], 3
push esi
push edi
mov edi, dword [esp + 0x2c]
jne 0x84b164
movzx eax, byte [edi + 8]
mov edx, dword [ebp + 0x18]
push 4
lea ecx, [esp + 0x2c]
push ecx
push 4
push 0
push edx
mov dword [esp + 0x3c], eax
call sub.WS2_32.dll_setsockopt
mov ebx, dword [esp + 0x30]
xor eax, eax
mov al, byte [edi]
and eax, 0xf
shl eax, 2
sub ebx, eax
add edi, eax
test ebx, ebx
jge 0x84b168
xor ebx, ebx
jmp 0x84b168
mov ebx, dword [esp + 0x30]
lea esi, [ebp + 0x64]
push esi
mov dword [esp + 0x2c], esi
call fcn.0084bd60
mov eax, dword [esp + 0x3c]
add esp, 4
test eax, eax
jne 0x84b18e
push eax
mov eax, dword [ebp + 0x18]
push ebx
push edi
push eax
call sub.WS2_32.dll_send
jmp 0x84b1ae
mov ecx, dword [esp + 0x3c]
push ecx
lea esi, [esp + 0x14]
call fcn.0084a7c0
mov edx, dword [ebp + 0x18]
push eax
push 0
push ebx
push edi
push edx
call sub.WS2_32.dll_sendto
mov esi, dword [esp + 0x28]
push esi
mov edi, eax
call fcn.0084bdf0
add esp, 4
call sub.WS2_32.dll_WSAGetLastError
mov ecx, eax
mov eax, edi
call fcn.0084a840
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
call fcn.007d6cb0
add esp, 0x14
ret