joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008540
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x114
mov eax, dword [0x1001842c]
xor eax, esp
mov dword [esp + 0x110], eax
mov eax, dword [esp + 0x118]
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esp]
push edx
push str.XPOS
call fcn.10003270
mov eax, dword [esp + 4]
push eax
push str.YPOS
call fcn.10003270
mov ecx, dword [esp + 8]
sub ecx, dword [esp]
push ecx
push str.WIDTH
call fcn.10003270
mov edx, dword [esp + 0xc]
sub edx, dword [esp + 4]
push edx
push str.HEIGHT
call fcn.10003270
mov ecx, dword [0x1001c970]
push pe_nt_image_headers32
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x100085ca
lea edx, [esp + 0x10]
push edx
jmp 0x100085cf
push 0x10014772
push str.JOINMSG
call fcn.100032e0
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.10012622
add esp, 0x114
ret 4

Function at 0x10008a50
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x8c
mov eax, dword [0x1001842c]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x9c]
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x80
lea eax, [esp + 0x1c]
push eax
push 0x432
push esi
call edi
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextA]
push eax
call ebx
mov ebp, dword [sym.imp.MSVCR90.dll_atoi]
lea ecx, [esp + 0x18]
push ecx
call ebp
add esp, 4
push 0x80
lea edx, [esp + 0x1c]
push edx
push 0x433
push esi
mov dword [esp + 0x24], eax
call edi
push eax
call ebx
lea eax, [esp + 0x18]
push eax
call ebp
add esp, 4
push 0
push 0
push 0x147
push 0x434
push esi
mov ebp, eax
call edi
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push eax
call ebx
mov ecx, dword [0x1001c988]
push 0
push 0
push 0x147
push ecx
mov dword [esp + 0x20], eax
call ebx
mov edx, dword [0x1001c980]
push 0
push 0
push 0x147
push edx
mov dword [0x100180e0], eax
call ebx
push 0
push 0
push 0x147
push 0x439
push esi
mov dword [0x100180e4], eax
call edi
push eax
call ebx
push 0
push 0
push 0x147
push 0x43a
push esi
mov dword [0x100180e8], eax
call edi
push eax
call ebx
push 0
push 0
push 0x147
push 0x43b
mov dword [0x100180ec], eax
push esi
call edi
push eax
call ebx
mov dword [0x100180f0], eax
mov eax, dword [esp + 0x14]
push eax
push str.MAXPLAYERS
call 0xfc8be070
push ebp
mov ebp, esp
Function at 0x10009440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp - 0x3a]
test dword [esp + edi*8 - 0x39a80001], esi
test dword [ebp + 0x4afffffc], esi
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.10008c07
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10008bbc
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.10008c07
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10008bbc
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.10008c07
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10008bbc
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.10008bf7
into
mov eax, dword [0xa5808919]
int3
Function at 0x10009670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x533], 0
mov byte [ebp - 0x532], 0x68
and byte [ebp - 0x531], 0
mov byte [ebp - 0x530], 0xd4
mov byte [ebp - 0x52f], 0xfb
mov byte [ebp - 0x52e], 0xf8
mov byte [ebp - 0x52d], 0xe4
mov byte [ebp - 0x52c], 0xf2
mov byte [ebp - 0x52b], 0xdf
mov byte [ebp - 0x52a], 0xf6
mov byte [ebp - 0x529], 0xf9
mov byte [ebp - 0x528], 0xf3
mov byte [ebp - 0x527], 0xfb
mov byte [ebp - 0x526], 0xf2
mov byte [ebp - 0x525], 0x97
lea eax, [ebp - 0x534]
push eax
call fcn.10008c07
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10008bbc
add esp, 0xc
mov dword [ebp - 0x680], eax
call fcn.10008bf7
jp 0x1000970f
dec esp
and byte [ebp - 0x664], 0
and byte [ebp - 0x663], 0
mov byte [ebp - 0x662], 7
and byte [ebp - 0x661], 0
mov byte [ebp - 0x660], 0xb0
mov byte [ebp - 0x65f], 0x9d
mov byte [ebp - 0x65e], 0x99
mov byte [ebp - 0x65d], 0x88
mov byte [ebp - 0x65c], 0xb9
mov byte [ebp - 0x65b], 0x94
mov byte [ebp - 0x65a], 0x94
mov byte [ebp - 0x659], 0x97
mov byte [ebp - 0x658], 0x9b
mov byte [ebp - 0x657], 0xf8
lea eax, [ebp - 0x664]
push eax
call fcn.10008c07
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10008bbc
add esp, 0xc
mov dword [ebp - 0x67c], eax
and byte [ebp - 0x524], 0
invalid
invalid

Function at 0x10009ac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
ror byte [ebp - 0x22e43], 0xff
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.10008bd5
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.10008c07
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10008bbc
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.10008bf7
inc esi
ret
Function at 0x1000c240
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x12c
mov eax, dword [0x1001842c]
xor eax, esp
mov dword [esp + 0x128], eax
mov ecx, dword [0x1001c7e8]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x144]
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x80
lea eax, [esp + 0x3c]
push eax
push 0x3fd
push ecx
mov dword [esp + 0x24], esi
mov byte [0x1001c990], 1
call edi
mov ebp, dword [sym.imp.USER32.dll_GetWindowTextA]
push eax
call ebp
xor ebx, ebx
cmp byte [esp + 0x38], bl
je 0x1000c2bc
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.MSVCR90.dll_atoi]
add esp, 4
mov dword [0x10018410], eax
cmp eax, 0x3e7
ja 0x1000c2c2
mov byte [0x10024a09], 1
jmp 0x1000c2c2
mov byte [0x10024a09], bl
mov eax, dword [esp + 0x14c]
mov edx, 0x1001c808
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x1000c2d0
mov ecx, dword [0x1001c7e8]
push 0x20
lea eax, [esp + 0x1c]
push eax
push 0x3fb
push ecx
call edi
push eax
call ebp
mov edx, dword [0x1001c98c]
push ebx
push ebx
push 0x147
push edx
mov byte [esp + 0x47], bl
call dword [sym.imp.USER32.dll_SendMessageA]
inc al
mov byte [esp + 0x10], al
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0x1001a200
push ebx
call fcn.100106d0
test al, al
je 0x1000c3da
push 0x96
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x144]
mov eax, dword [esp + 0x140]
mov dword [0x1001c968], edx
mov edx, 0x1001c898
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x1000c353
mov eax, dword [0x1001c7e8]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push eax
call esi
mov ecx, dword [0x100184a4]
push ebx
push 0x1000b3f0
push ebx
push 0x6b
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov edx, dword [0x1001c7e8]
push 5
push edx
call esi
mov eax, dword [esp + 0x14]
push 5
push eax
call esi
mov edx, dword [0x1001c7e8]
push 0x80
lea ecx, [esp + 0xbc]
push ecx
push 0x3fc
push edx
call edi
push eax
call ebp
lea eax, [esp + 0xb8]
push eax
call fcn.10010910
call fcn.10010680
mov ecx, dword [0x10018488]
and ecx, 0xfffffff4
or ecx, 4
mov dword [0x10018488], ecx
jmp 0x1000c3e8
push ebx
push ebx
push 0x10015570
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x138]
pop edi
pop esi
pop ebp
mov byte [0x1001c990], bl
pop ebx
xor ecx, esp
call fcn.10012622
add esp, 0x12c
ret 0x10
Function at 0x1000e830
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10013308
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x1001842c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.10002fa0
xor edi, edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], edi
mov dword [esi], vtable.PingSocket.0
call fcn.10002fa0
lea ecx, [esp + 0x10]
call fcn.100031a0
push 0xffffffffffffffff
push edi
mov ecx, esi
mov dword [esi + 0x24], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x28], edi
call fcn.10002b90
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret

Function at 0x1000ffc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x100133b8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1001842c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x1001842c]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, dword [esp + 0x44]
lea ecx, [esp + 0x10]
call fcn.10002fa0
push 0x8000
push 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x44], 0
call fcn.10002b90
mov eax, dword [esp + 0x48]
push eax
push esi
lea ecx, [esp + 0x18]
call fcn.10002d00
push 0
push 0
call fcn.10002fe0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
push 5
push str.PING
lea ecx, [esp + 0x18]
mov edi, eax
call fcn.10002db0
lea ecx, [esp + 0x10]
call fcn.10002e80
test al, al
jne 0x1001007e
mov ebx, dword [esp + 0x4c]
lea esp, [esp]
call esi
sub eax, edi
cmp eax, ebx
jae 0x1001007e
push 0xa
push 0
call fcn.10002fe0
lea ecx, [esp + 0x10]
call fcn.10002e80
test al, al
je 0x10010060
call esi
mov esi, eax
lea ecx, [esp + 0x10]
sub esi, edi
mov dword [esp + 0x3c], 0xffffffff
call fcn.100031a0
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10012622
add esp, 0x30
ret 0xc

Function at 0x10011a60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10013628
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x1001842c]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
mov eax, dword [0x1001842c]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, dword [esp + 0xc]
push 0x10
mov byte [0x10025405], 1
and esi, 0xffffff00
mov byte [esp + 0x14], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0x10
call dword [sym.imp.MSVCR90.dll_malloc]
add esp, 4
mov dword [esp + 0x30], eax
mov byte [eax], 0
and esi, 0xffffff0b
push 2
lea eax, [esp + 0xc]
or esi, 0xb
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x50], 0
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], 0xffff
call fcn.1000fb10
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [0x10025220]
call fcn.100107d0
call fcn.10009fb0
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.10012622
add esp, 0x44
ret
Function at 0x10012622
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001842c]
jne 0x1001262c
repz ret
jmp fcn.10012c4d

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x623c659c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [ebp + 8]
mov dword [ebp - 0xac], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov eax, dword [ebp - 0xac]
mov eax, dword [eax]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x90], 0
cmp dword [ebp + 0x10], 0
jns 0x623c65e0
mov eax, 0xffffffff
jmp 0x623c6779
mov eax, dword [ebp - 0xac]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x623c66e5
call sym.libevent_2_1_6.dll_evthreadimpl_is_lock_debugging_enabled_
test eax, eax
je 0x623c66e5
mov eax, dword [ebp - 0xac]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sym.libevent_2_1_6.dll_evthread_is_debug_lock_held_
test eax, eax
sete al
movzx eax, al
test eax, eax
je 0x623c66e5
mov dword [esp + 0x14], str.evbuffer_write_iovec
mov dword [esp + 0x10], str.evthread_is_debug_lock_held___buffer___lock_
mov dword [esp + 0xc], 0x96d
mov dword [esp + 8], str.buffer.c
mov dword [esp + 4], 0x6240801c
mov dword [esp], 0xdeaddead
call sym._event_errx
mov eax, dword [ebp - 0x98]
mov ecx, dword [eax + 0x1c]
mov eax, dword [ebp - 0x98]
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
lea edx, [ecx + eax]
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*8 - 0x88], edx
mov eax, dword [ebp - 0x98]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp + 0x10]
cmp edx, eax
ja 0x623c66bc
mov eax, dword [ebp - 0x90]
lea edx, [eax + 1]
mov dword [ebp - 0x90], edx
mov edx, dword [ebp - 0x98]
mov edx, dword [edx + 0x10]
mov dword [ebp + eax*8 - 0x8c], edx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x98]
mov eax, dword [eax + 0x10]
sub edx, eax
mov eax, edx
mov dword [ebp + 0x10], eax
jmp 0x623c66d7
mov eax, dword [ebp - 0x90]
lea edx, [eax + 1]
mov dword [ebp - 0x90], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp + eax*8 - 0x8c], edx
jmp 0x623c6701
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x623c6701
cmp dword [ebp - 0x90], 0xf
jg 0x623c6701
cmp dword [ebp + 0x10], 0
jne 0x623c6653
cmp dword [ebp - 0x90], 0
jne 0x623c6711
mov eax, 0
jmp 0x623c6779
mov edx, dword [ebp - 0x90]
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
lea ecx, [ebp - 0x9c]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
lea edx, [ebp - 0x8c]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_WSASend]
call eax
sub esp, 0x1c
test eax, eax
je 0x623c6767
mov dword [ebp - 0x94], 0xffffffff
jmp 0x623c6773
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0xc]
xor ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x623c6789
call sym.___stack_chk_fail
leave
ret
Function at 0x623d28c8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov eax, dword [ebp - 0x20]
movzx eax, word [eax + 0x2c]
mov word [ebp - 0x12], ax
movzx eax, word [ebp - 0x12]
test ax, ax
je 0x623d2902
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x12]
mov dword [eax + 0x30], edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x110]
test eax, eax
je 0x623d29f6
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym.libevent_2_1_6.dll_evthreadimpl_lock_unlock_
jmp 0x623d29f6
movzx eax, word [ebp - 0x12]
sub eax, 1
mov word [ebp - 0x12], ax
movzx edx, word [ebp - 0x12]
mov eax, dword [ebp - 0x20]
mov word [eax + 0x2c], dx
movzx eax, word [ebp - 0x12]
test ax, ax
jne 0x623d295a
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x30], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x20]
mov ebx, dword [edx + 0x10]
mov edx, dword [ebp - 0x20]
movzx edx, word [edx + 0x36]
movsx ecx, dx
mov edx, dword [ebp - 0x20]
mov edx, dword [edx + 0x1c]
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x110]
test eax, eax
je 0x623d29a9
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym.libevent_2_1_6.dll_evthreadimpl_lock_lock_
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x8c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x110]
test eax, eax
je 0x623d29db
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym.libevent_2_1_6.dll_evthreadimpl_lock_unlock_
cmp dword [ebp - 0x10], 0
je 0x623d29f6
movzx eax, word [ebp - 0x12]
test ax, ax
je 0x623d2a05
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x30], 0
jmp 0x623d2a06
movzx eax, word [ebp - 0x12]
test ax, ax
jne 0x623d2931
jmp 0x623d2a06
nop
mov eax, dword [ebp - 0xc]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x623d2a16
call sym.___stack_chk_fail
add esp, 0x34
pop ebx
pop ebp
ret
Function at 0x623d5c2b
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x140]
mov edx, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
lea eax, [ebp - 0xd]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jns 0x623d5ca2
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
cmp eax, 0x2733
je 0x623d5ca2
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
cmp eax, 0xb
je 0x623d5ca2
mov eax, 0xffffffff
jmp 0x623d5ca7
mov eax, 0
mov ecx, dword [ebp - 0xc]
xor ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x623d5cb7
call sym.___stack_chk_fail
leave
ret

Function at 0x623d890f
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [ebp + 0xc]
mov word [ebp - 0x41c], ax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x410], eax
nop
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x400
lea edx, [ebp - 0x40c]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
test eax, eax
jg 0x623d8942
mov eax, dword [ebp - 0x410]
mov eax, dword [eax + 0x110]
test eax, eax
je 0x623d899c
mov eax, dword [ebp - 0x410]
mov eax, dword [eax + 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym.libevent_2_1_6.dll_evthreadimpl_lock_lock_
mov eax, dword [ebp - 0x410]
mov dword [eax + 0x138], 0
mov eax, dword [ebp - 0x410]
mov eax, dword [eax + 0x110]
test eax, eax
je 0x623d89d8
mov eax, dword [ebp - 0x410]
mov eax, dword [eax + 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym.libevent_2_1_6.dll_evthreadimpl_lock_unlock_
nop
mov eax, dword [ebp - 0xc]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x623d89e9
call sym.___stack_chk_fail
leave
ret
Function at 0x623d911e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x110]
test eax, eax
je 0x623d914a
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym.libevent_2_1_6.dll_evthreadimpl_lock_lock_
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x11
mov dword [esp + 4], 1
mov dword [esp], str.Inserted_events:_n
call sym._fwrite
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], sym._dump_inserted_event_fn
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.libevent_2_1_6.dll_event_base_foreach_event_nolock_
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xf
mov dword [esp + 4], 1
mov dword [esp], str.Active_events:_n
call sym._fwrite
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], sym._dump_active_event_fn
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.libevent_2_1_6.dll_event_base_foreach_event_nolock_
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x110]
test eax, eax
je 0x623d91ea
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym.libevent_2_1_6.dll_evthreadimpl_lock_unlock_
nop
leave
ret