joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53cde4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
mov esi, eax
lea eax, [ebp - 0x118]
mov edx, esi
call fcn.0053cfb3
mov eax, esi
call fcn.0053cfd9
shr eax, 1
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x53ce1a
mov byte [esi], 0
jmp 0x53cfac
lea eax, [ebp - 0x118]
mov dword [ebp - 0x14], eax
mov edi, dword [ebp - 8]
test edi, edi
jl 0x53ce59
inc edi
xor ebx, ebx
push edx
mov eax, dword [ebp - 0x14]
mov dx, word [eax]
mov al, dl
sub al, 0x30
aam 0x10
aad 9
shl al, 4
mov dl, al
mov al, dh
sub al, 0x30
aam 0x10
aad 9
add al, dl
mov byte [esi + ebx], al
add dword [ebp - 0x14], 2
inc ebx
dec edi
jne 0x53ce2e
pop edx
mov eax, dword [ebp - 8]
mov al, byte [esi + eax - 3]
mov byte [ebp - 0xc], al
mov eax, dword [ebp - 8]
mov al, byte [esi + eax - 2]
mov byte [ebp - 0xb], al
mov eax, dword [ebp - 8]
mov al, byte [esi + eax - 1]
mov byte [ebp - 0xa], al
mov eax, dword [ebp - 8]
mov al, byte [esi + eax]
mov byte [ebp - 9], al
sub dword [ebp - 8], 4
mov eax, dword [ebp - 8]
mov byte [esi + eax + 1], 0
mov dword [0x5c1110], 0xcf671
mov edi, dword [ebp - 8]
test edi, edi
jl 0x53ced5
inc edi
xor ebx, ebx
xor eax, eax
mov al, byte [esi + ebx]
mov word [ebp - 4], ax
mov eax, 8
call fcn.0053cfee
mov byte [ebp - 1], al
push ax
push cx
mov cl, byte [ebp - 1]
mov ax, word [ebp - 4]
rol al, cl
mov word [ebp - 4], ax
pop cx
pop ax
mov al, byte [ebp - 4]
mov byte [esi + ebx], al
inc ebx
dec edi
jne 0x53cea0
mov dword [0x5c1110], 0x3039
mov ebx, pe_nt_image_headers32
mov edi, dword [ebp - 8]
inc edi
mov eax, edi
call fcn.0053cfee
lea eax, [esi + eax]
push eax
mov eax, edi
call fcn.0053cfee
lea eax, [esi + eax]
pop edx
call fcn.0053d004
dec ebx
jne 0x53cee4
mov dword [0x5c1110], 0xa564
mov edi, dword [ebp - 8]
test edi, edi
jl 0x53cf3b
inc edi
xor ebx, ebx
xor eax, eax
mov al, byte [esi + ebx]
mov word [ebp - 4], ax
mov eax, pe_nt_image_headers32
call fcn.0053cfee
xor word [ebp - 4], ax
mov al, byte [ebp - 4]
mov byte [esi + ebx], al
inc ebx
dec edi
jne 0x53cf1a
mov dword [0x5c1110], 0xd431
mov edi, dword [ebp - 8]
test edi, edi
jl 0x53cf8c
inc edi
xor ebx, ebx
xor eax, eax
mov al, byte [esi + ebx]
mov word [ebp - 4], ax
mov eax, pe_nt_image_headers32
call fcn.0053cfee
movzx edx, word [ebp - 4]
add edx, 0x100
sub edx, eax
and edx, 0x800000ff
jns 0x53cf7e
dec edx
or edx, 0xffffff00
inc edx
mov word [ebp - 4], dx
mov al, byte [ebp - 4]
mov byte [esi + ebx], al
inc ebx
dec edi
jne 0x53cf4f
mov dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 8]
inc edx
mov eax, esi
call fcn.0053d00f
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
je 0x53cfac
mov byte [esi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x53cfee
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x5c1110], 0x8088405
inc edx
mov dword [0x5c1110], edx
mul edx
mov eax, edx
ret
Function at 0x53d00f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
push edi
push esi
push ebx
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov esi, 0x53d054
mov ecx, dword [ebp - 0xc]
or ecx, ecx
je 0x53d048
xor ebx, ebx
mov bl, al
shr eax, 8
xor bl, byte [edi]
inc edi
shl ebx, 2
xor eax, dword [esi + ebx]
dec ecx
jne 0x53d035
mov ebx, dword [ebp - 8]
mov dword [ebx], eax
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x5660b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x3c], ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x566a62
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x5c1574], 0
pop esp
add byte [eax], al
Function at 0x5749ac
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004040cc
xor eax, eax
push ebp
push 0x574a52
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.004040dc
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x574a3c
push 2
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer_1
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
mov edx, 0x574a68
call fcn.00403f20
mov eax, dword [ebp + 8]
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00403f18
push eax
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
call fcn.004040e8
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x574a59
lea eax, [ebp - 4]
call fcn.00403c9c
ret
Function at 0x581f98
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004040cc
mov eax, dword [ebp - 8]
call fcn.004040cc
mov eax, dword [ebp + 0x10]
call fcn.004040cc
mov eax, dword [ebp + 0xc]
call fcn.004040cc
lea esi, [ebp - 0x10]
xor eax, eax
push ebp
push 0x5820dd
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 1
mov eax, dword [0x5bb9c0]
cmp byte [eax], 0
je 0x582000
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x5820ad
push esi
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x7bc]
call fcn.00504d08
cmp dword [esi], 0xffffffff
je 0x5820ad
cmp dword [esi], 0xffffffff
jle 0x582092
mov edx, dword [esi]
mov eax, dword [ebx + 0x7bc]
call fcn.005059c4
and eax, 0xff
cmp edi, eax
jne 0x582092
lea ecx, [ebp - 0x14]
mov edx, dword [esi]
mov eax, dword [ebx + 0x7bc]
call fcn.00505968
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00404028
jne 0x582092
lea ecx, [ebp - 0x14]
mov edx, dword [esi]
mov eax, dword [ebx + 0x7bc]
call fcn.00505a2c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 0x10]
call fcn.00404028
jne 0x582092
lea ecx, [ebp - 0x14]
mov edx, dword [esi]
mov eax, dword [ebx + 0x7bc]
call fcn.00505a04
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 0xc]
call fcn.00404028
jne 0x582092
mov byte [ebp - 9], 0
jmp 0x5820ad
push esi
mov ecx, dword [esi]
inc ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x7bc]
call fcn.00504d08
cmp dword [esi], 0xffffffff
jne 0x58201a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5820e4
lea eax, [ebp - 0x14]
call fcn.00403c9c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403cc0
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.00403cc0
ret
Function at 0x58dcc8
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
call fcn.004040cc
xor eax, eax
push ebp
push 0x58dde7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2e]
xor ecx, ecx
mov edx, 0x1e
call fcn.00402c18
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x58dd3f
inc ebx
xor esi, esi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x34]
mov edx, esi
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x34]
push 0x58de00
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403fd8
inc esi
dec ebx
jne 0x58dd16
lea eax, [ebp - 0x10]
mov edx, 0x58de00
call fcn.00403f20
xor eax, eax
mov dword [ebp - 0x2e], eax
mov dword [ebp - 0x2a], 1
mov eax, dword [ebp - 0x10]
call fcn.004040dc
mov dword [ebp - 0x26], eax
lea eax, [ebp - 0x34]
mov ecx, 0x58de0c
mov edx, dword [ebp - 8]
call fcn.00403f64
mov eax, dword [ebp - 0x34]
call fcn.004040dc
mov dword [ebp - 0x22], eax
mov word [ebp - 0x1e], 0
mov dword [ebp - 0xc], 1
xor eax, eax
push ebp
push 0x58ddba
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2e]
push eax
call sub.shell32.dll_SHFileOperationA
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58ddc1
cmp dword [ebp - 0xc], 0
sete bl
ret
Function at 0x58e638
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4c4]
mov edx, 0x80000005
call fcn.00465a1c
mov dl, 1
mov eax, dword [0x42e088]
call fcn.00435978
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x58e798
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x164]
xor ecx, ecx
mov edx, 0x160
call fcn.00402c18
push 0x4101
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0x90
mov eax, dword [0x5c12ec]
call fcn.004040dc
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edx, dword [ebp - 0x164]
mov eax, dword [ebp - 4]
call fcn.00435d1c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4c4]
mov edx, dword [ebp - 4]
call fcn.0046564c
lea eax, [ebp - 0x164]
xor ecx, ecx
mov edx, 0x160
call fcn.00402c18
push 0x4103
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0x90
mov eax, dword [0x5c12ec]
call fcn.004040dc
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edx, dword [ebp - 0x164]
mov eax, dword [ebp - 4]
call fcn.00435d1c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4c4]
mov edx, dword [ebp - 4]
call fcn.0046564c
lea eax, [ebp - 0x164]
xor ecx, ecx
mov edx, 0x160
call fcn.00402c18
push 0xc101
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0x90
mov eax, dword [0x5c12ec]
call fcn.004040dc
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edx, dword [ebp - 0x164]
mov eax, dword [ebp - 4]
call fcn.00435d1c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x4c4]
mov edx, dword [ebp - 4]
call fcn.0046564c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58e79f
mov eax, dword [ebp - 4]
call fcn.00402fb8
ret
Function at 0x599550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, eax
mov eax, dword [edi + 0x208]
call fcn.004b0604
mov esi, eax
dec esi
test esi, esi
jle 0x5995a5
mov ebx, 1
mov eax, dword [edi + 0x208]
mov edx, ebx
call fcn.004b063c
mov edx, 3
call fcn.004b00c4
xor al, 1
push eax
mov eax, dword [edi + 0x208]
mov edx, ebx
call fcn.004b063c
mov edx, 3
pop ecx
call fcn.004b0130
inc ebx
dec esi
jne 0x59956f
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x5a56e4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004040cc
xor eax, eax
push ebp
push 0x5a57a4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8c4]
cmp byte [eax + 0x2c], 0
jne 0x5a572e
mov eax, dword [0x5bb9c0]
cmp byte [eax], 0
je 0x5a578e
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5a578e
mov eax, dword [ebp - 4]
cmp ebx, dword [eax + 0x798]
je 0x5a5744
mov eax, dword [ebp - 4]
cmp ebx, dword [eax + 0x3e8]
jne 0x5a575f
push ebp
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x3f0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x794]
call fcn.005a5590
pop ecx
jmp 0x5a578e
mov eax, dword [ebp - 4]
cmp ebx, dword [eax + 0x794]
je 0x5a5775
mov eax, dword [ebp - 4]
cmp ebx, dword [eax + 0x3f0]
jne 0x5a578e
push ebp
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x3e8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x798]
call fcn.005a5590
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a57ab
lea eax, [ebp - 8]
call fcn.00403c9c
ret

Function at 0x5a7360
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5a73cf
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0xffffffff
je 0x5a73b9
cmp dword [ebx + 0x22c], 0xffffffff
je 0x5a73b9
push 4
lea eax, [ebp - 4]
push eax
push 0x1002
push 0xffff
mov eax, dword [ebx + 0x22c]
push eax
call sub.wsock32.dll_setsockopt
lea eax, [ebp - 8]
push eax
mov cl, 1
xor edx, edx
mov eax, ebx
call fcn.005ac6d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a73d6
lea eax, [ebp - 8]
call fcn.00403c9c
ret

Function at 0x5a73dc
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5a744b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0xffffffff
je 0x5a7435
cmp dword [ebx + 0x22c], 0xffffffff
je 0x5a7435
push 4
lea eax, [ebp - 4]
push eax
push 0x1001
push 0xffff
mov eax, dword [ebx + 0x22c]
push eax
call sub.wsock32.dll_setsockopt
lea eax, [ebp - 8]
push eax
mov cl, 1
xor edx, edx
mov eax, ebx
call fcn.005ac6d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a7452
lea eax, [ebp - 8]
call fcn.00403c9c
ret
Function at 0x5aa6c0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x5aa79b
push dword fs:[eax]
mov dword fs:[eax], esp
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [edi + 0x22c], esi
inc esi
jne 0x5aa701
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dx, 0x2733
mov eax, edi
call fcn.005ac6d8
mov edx, dword [edi + 0xf4]
mov eax, edi
call fcn.005a8e08
mov dl, 1
mov eax, edi
call fcn.005a7458
mov byte [edi + 0x244], 1
mov byte [edi + 0x269], 1
mov byte [edi + 0x188], 0
test bl, bl
je 0x5aa74c
push 0x28
push 0x466
mov eax, dword [edi + 0x248]
push eax
mov eax, dword [edi + 0x22c]
push eax
call sub.wsock32.dll_WSAAsyncSelect
jmp 0x5aa766
push 0x28
push 0x465
mov eax, dword [edi + 0x248]
push eax
mov eax, dword [edi + 0x22c]
push eax
call sub.wsock32.dll_WSAAsyncSelect
push 5
mov eax, dword [edi + 0x22c]
push eax
call sub.wsock32.dll_listen
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dx, 0x2733
mov eax, edi
call fcn.005ac6d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5aa7a2
lea eax, [ebp - 4]
call fcn.00403c9c
ret
Function at 0x5aafec
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x22c]
cmp eax, 0xffffffff
jne 0x5ab014
or ebx, 0xffffffff
jmp 0x5ab146
mov edx, dword [ebp - 4]
cmp byte [edx + 0x1b1], 0
je 0x5ab134
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x22c], 0xffffffff
je 0x5ab041
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1e0], 0
jne 0x5ab049
or ebx, 0xffffffff
jmp 0x5ab158
xor eax, eax
push ebp
push 0x5ab081
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1e0]
push eax
mov eax, dword [0x5bbf3c]
mov eax, dword [eax]
call eax
add esp, 0xc
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5ab08e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1b0], 0
je 0x5ab158
test ebx, ebx
jg 0x5ab12b
cmp dword [ebp - 0x10], 0xc8
jg 0x5ab12b
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1e0]
push eax
mov eax, dword [0x5bc1e8]
mov eax, dword [eax]
call eax
add esp, 8
sub eax, 1
jb 0x5ab12b
je 0x5ab0f7
sub eax, 4
je 0x5ab0d7
dec eax
je 0x5ab0e9
jmp 0x5ab105
test ebx, ebx
je 0x5ab12b
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.005ac530
jmp 0x5ab12b
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.005ac530
jmp 0x5ab12b
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.005ac530
jmp 0x5ab12b
mov eax, dword [ebp - 4]
cmp byte [eax + 0xc4], 0
je 0x5ab12b
inc dword [ebp - 0x10]
cmp byte [ebp + 8], 0
jne 0x5ab12b
mov dx, 2
mov eax, dword [ebp - 4]
call fcn.005acc80
jmp 0x5ab029
test ebx, ebx
jne 0x5ab146
or ebx, 0xffffffff
jmp 0x5ab146
push 0
mov edx, dword [ebp - 0xc]
push edx
mov edx, dword [ebp - 8]
push edx
push eax
call sub.wsock32.dll_recv
mov ebx, eax
test ebx, ebx
jle 0x5ab158
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c8], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5ab164
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebx + 0x22c]
cmp eax, 0xffffffff
jne 0x5ab188
or esi, 0xffffffff
jmp 0x5ab227
cmp byte [ebx + 0x1b1], 0
je 0x5ab215
xor edi, edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebx + 0x1e0]
push eax
mov eax, dword [0x5bbb94]
mov eax, dword [eax]
call eax
add esp, 0xc
mov esi, eax
test esi, esi
jg 0x5ab227
cmp edi, 0x14
jg 0x5ab227
push esi
mov eax, dword [ebx + 0x1e0]
push eax
mov eax, dword [0x5bc1e8]
mov eax, dword [eax]
call eax
add esp, 8
sub eax, 1
jb 0x5ab227
je 0x5ab1fc
sub eax, 4
je 0x5ab1e2
dec eax
je 0x5ab1ef
jmp 0x5ab209
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.005ac530
jmp 0x5ab227
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.005ac530
jmp 0x5ab227
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.005ac530
jmp 0x5ab227
cmp byte [ebx + 0xc4], 2
je 0x5ab227
inc edi
jmp 0x5ab197
push 0
mov edx, dword [ebp - 8]
push edx
mov edx, dword [ebp - 4]
push edx
push eax
call sub.wsock32.dll_send
mov esi, eax
test esi, esi
jle 0x5ab236
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x1cc], eax
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x5add00
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5adf80
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x22
push 0x465
mov eax, dword [ebx + 0x248]
push eax
mov eax, dword [ebx + 0x22c]
push eax
call sub.wsock32.dll_WSAAsyncSelect
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebx + 0xec]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
mov eax, dword [ebx + 0xf4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x1c]
mov ecx, 1
mov eax, 0x5adf98
call fcn.0040a09c
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov ecx, 0x5adfb8
call fcn.00403f64
cmp dword [ebx + 0xd0], 0
je 0x5addd0
push dword [ebp - 8]
push 0x5adfc4
push dword [ebx + 0xd0]
push 0x5adfe8
push dword [ebx + 0xd4]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403fd8
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0xc]
call fcn.0046a328
push dword [ebp - 0xc]
push 0x5adfb8
lea eax, [ebp - 8]
mov edx, 4
call fcn.00403fd8
push dword [ebp - 8]
push 0x5adff4
push 0x5adfb8
push 0x5adfb8
lea eax, [ebp - 8]
mov edx, 4
call fcn.00403fd8
mov eax, dword [ebp - 8]
call fcn.00403f18
push eax
mov eax, dword [ebp - 8]
call fcn.004040dc
mov edx, eax
mov eax, ebx
pop ecx
call fcn.005a9614
xor edx, edx
mov eax, ebx
call fcn.005aa9ac
lea eax, [ebp - 4]
mov edx, 0x2000
call fcn.00404248
mov eax, dword [ebp - 4]
call fcn.004040dc
xor ecx, ecx
mov edx, 0x2000
call fcn.00407950
push 2
push 0x2000
mov eax, dword [ebp - 4]
call fcn.004040dc
push eax
mov eax, dword [ebx + 0x22c]
push eax
call sub.wsock32.dll_recv
lea eax, [ebp - 0xc]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040411c
mov eax, dword [ebp - 0xc]
mov edx, 0x5ae014
call fcn.00404028
jne 0x5adecc
mov edx, dword [ebp - 4]
mov eax, 0x5ae024
call fcn.00404200
mov esi, eax
test esi, esi
jle 0x5aded7
lea edi, [esi + 4]
mov edx, edi
lea eax, [ebp - 4]
call fcn.00404248
mov eax, dword [ebp - 4]
call fcn.004040dc
mov edx, edi
xor ecx, ecx
call fcn.00407950
push 0
push edi
mov eax, dword [ebp - 4]
call fcn.004040dc
push eax
mov eax, dword [ebx + 0x22c]
push eax
call sub.wsock32.dll_recv
mov esi, eax
lea eax, [ebp - 4]
mov edx, esi
call fcn.00404248
jmp 0x5adef6
mov dx, 3
mov eax, ebx
call fcn.005acc80
cmp byte [ebx + 0x268], 0
je 0x5adef6
cmp byte [ebx + 0x216], 0
jne 0x5adef6
cmp byte [ebx + 0x215], 0
je 0x5ade34
mov eax, ebx
call fcn.005aaa04
cmp byte [ebx + 0x1b8], 0
jne 0x5adf34
push 0x23
push 0x465
mov eax, dword [ebx + 0x248]
push eax
mov eax, dword [ebx + 0x22c]
push eax
call sub.wsock32.dll_WSAAsyncSelect
push ebx
push 0
push 0x468
mov eax, dword [ebx + 0x248]
push eax
call sub.user32.dll_SendMessageA
mov byte [ebx + 0x201], 5
mov dword [ebx + 0x258], 0xffffffff
mov dword [ebx + 0x25c], 0xffffffff
mov byte [ebx + 0x158], 1
mov byte [ebx + 0x1ad], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5adf87
lea eax, [ebp - 0x20]
call fcn.00403c9c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403cc0
ret
Function at 0x5ae05c
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5ae0e2
push dword fs:[eax]
mov dword fs:[eax], esp
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
push edi
call sub.wsock32.dll_htons
mov word [ebx + 0x232], ax
push 0x10
lea eax, [ebx + 0x230]
push eax
push esi
call sub.wsock32.dll_bind
push 1
push esi
call sub.wsock32.dll_listen
test eax, eax
sete al
xor al, 1
mov byte [ebp - 1], al
push esi
call sub.wsock32.dll_closesocket
lea eax, [ebp - 8]
push eax
mov cl, 1
xor edx, edx
mov eax, ebx
call fcn.005ac6d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ae0e9
lea eax, [ebp - 8]
call fcn.00403c9c
ret