joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41baa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x491700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x40c], eax
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41bac5
sub eax, edx
mov edi, eax
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41bad5
sub eax, edx
mov esi, eax
mov dword [ebp - 0x408], 0
cmp edi, 0x200
ja 0x41bbc9
cmp esi, 0x200
ja 0x41bbc9
push 0x200
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.00453150
push 0x200
lea ecx, [ebp - 0x204]
push 0
push ecx
call fcn.00453150
mov edx, dword [ebp - 0x40c]
push edi
push edx
lea eax, [ebp - 0x404]
push eax
call fcn.004534a0
push esi
lea ecx, [ebp - 0x204]
push ebx
push ecx
call fcn.004534a0
add esp, 0x30
xor eax, eax
nop
movsx ecx, byte [ebp + eax - 0x201]
movsx edx, byte [ebp + eax - 0x401]
movsx ebx, byte [ebp + eax - 0x202]
xor edx, ecx
movsx ecx, byte [ebp + eax - 0x402]
xor ecx, ebx
movsx ebx, byte [ebp + eax - 0x203]
or edx, ecx
movsx ecx, byte [ebp + eax - 0x403]
xor ecx, ebx
movsx ebx, byte [ebp + eax - 0x404]
or edx, ecx
movsx ecx, byte [ebp + eax - 0x204]
xor ecx, ebx
or edx, ecx
or dword [ebp - 0x408], edx
add eax, 4
cmp eax, 0x200
jb 0x41bb50
mov eax, esi
xor eax, edi
or eax, dword [ebp - 0x408]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004533ca
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004533ca
mov esp, ebp
pop ebp
ret
Function at 0x427000
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x491700]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
call fcn.0041a5a0
mov ecx, dword [esi]
test cl, 8
jne 0x427194
cmp dword [esi + 0x18], 0x64
jge 0x427194
push edi
test cl, 2
je 0x42704f
mov edi, dword [esi + 0xb0]
test dword [edi], 0x120
mov dword [ebp - 0x9c], 0x3e8
jne 0x427059
mov dword [ebp - 0x9c], 0x2710
push ebx
test cl, 4
jne 0x4270a0
mov ecx, dword [esi + 0x78]
mov ebx, dword [esi + 0x7c]
mov edi, ecx
or edi, ebx
je 0x427083
mov edi, eax
sub edi, ecx
mov ecx, edx
sbb ecx, ebx
xor ebx, ebx
cmp ecx, ebx
jl 0x4270a0
jg 0x427083
cmp edi, dword [ebp - 0x9c]
jbe 0x4270a0
mov eax, dword [esi + 0x10]
push str.INFO
push 0
push 0x426fc0
push eax
call fcn.004021c0
add esp, 0x10
jmp 0x42718b
mov ecx, eax
sub ecx, dword [esi + 0x40]
mov edi, edx
sbb edi, dword [esi + 0x44]
mov dword [ebp - 0x98], edi
js 0x4270d9
jg 0x4270bc
cmp ecx, 0x3e8
jbe 0x4270d9
mov ecx, dword [esi + 0x10]
push str.PING
push 0
push 0x423ed0
push ecx
call fcn.004021c0
add esp, 0x10
jmp 0x42718b
test byte [esi], 1
je 0x427192
sub eax, dword [esi + 0x48]
sbb edx, dword [esi + 0x4c]
mov dword [ebp - 0x98], edx
js 0x427192
jg 0x427101
cmp eax, 0x1388
jbe 0x427192
mov ecx, dword [esi + 0x10]
lea edx, [ebp - 0x98]
push edx
lea eax, [ebp - 0x94]
mov dword [ebp - 0x98], 0x10
mov edx, dword [ecx + 0x84]
push eax
push edx
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x427192
mov eax, dword [esi]
mov ecx, dword [0x493b40]
mov edx, dword [ebp - 0x90]
shr eax, 7
and eax, 1
push eax
push 0x493b10
push ecx
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push str._s:_d:_s:_d
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.00453e74
mov edx, dword [esi + 0x10]
lea ecx, [ebp - 0x84]
push ecx
push str.__sentinel__:hello
push str.PUBLISH__s__s
push 0
push 0x423fc0
push edx
call fcn.004021c0
add esp, 0x34
test eax, eax
jne 0x427192
inc dword [esi + 0x18]
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004533ca
mov esp, ebp
pop ebp
ret

Function at 0x428be0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
pop ebp
ret
Function at 0x429ec0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
call fcn.0041a5a0
mov esi, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov eax, esi
test eax, eax
jl 0x429ef3
jg 0x429eed
cmp ecx, 0xa
jbe 0x429ef3
mov edi, ecx
mov ebx, eax
jmp 0x429efa
mov edi, 0xa
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x429f53
call fcn.0045320c
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi], eax
call fcn.0045320c
cmp dword [eax], 2
je 0x429f39
call fcn.0045320c
cmp dword [eax], 0x2733
jne 0x429f44
call fcn.0045320c
mov dword [eax], 0xb
call fcn.0045320c
cmp dword [eax], 0xb
jne 0x429fa8
mov esi, dword [ebp + 0x18]
jmp 0x429f59
add dword [ebp + 0xc], eax
sub dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], 0
je 0x429f93
mov ecx, dword [ebp + 8]
push ebx
push edi
push 2
push ecx
call fcn.00404fa0
add esp, 0x10
call fcn.0041a5a0
sub eax, dword [ebp - 0xc]
sbb edx, dword [ebp - 8]
cmp edx, esi
jg 0x429f9d
jl 0x429f85
cmp eax, dword [ebp + 0x14]
jae 0x429f9d
mov ecx, dword [ebp + 0x14]
sub ecx, eax
mov eax, esi
sbb eax, edx
jmp 0x429ee2
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0045320c
mov dword [eax], 0x8a
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429fc0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x10]
dec eax
mov dword [ebp - 0x10], 0
je 0x42a156
push ebx
push esi
push edi
lea ebx, [ebx]
lea eax, [ebp + 0x13]
mov dword [ebp - 4], 1
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
call fcn.0041a5a0
mov esi, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, esi
test eax, eax
jl 0x42a018
jg 0x42a012
cmp ecx, 0xa
jbe 0x42a018
mov edi, ecx
mov ebx, eax
jmp 0x42a01f
mov edi, 0xa
xor ebx, ebx
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x42a0e9
cmp eax, 0xffffffff
jne 0x42a084
call fcn.0045320c
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi], eax
call fcn.0045320c
cmp dword [eax], 2
je 0x42a066
call fcn.0045320c
cmp dword [eax], 0x2733
jne 0x42a071
call fcn.0045320c
mov dword [eax], 0xb
call fcn.0045320c
cmp dword [eax], 0xb
jne 0x42a102
mov esi, dword [ebp + 0x18]
jmp 0x42a08d
add dword [ebp - 8], eax
sub dword [ebp - 4], eax
add dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x42a0c7
mov ecx, dword [ebp + 8]
push ebx
push edi
push 1
push ecx
call fcn.00404fa0
add esp, 0x10
call fcn.0041a5a0
sub eax, dword [ebp - 0x18]
sbb edx, dword [ebp - 0x14]
cmp edx, esi
jg 0x42a123
jl 0x42a0b9
cmp eax, dword [ebp + 0x14]
jae 0x42a123
mov ecx, dword [ebp + 0x14]
sub ecx, eax
mov eax, esi
sbb eax, edx
jmp 0x42a007
cmp dword [ebp - 0xc], 0xffffffff
je 0x42a12e
mov cl, byte [ebp + 0x13]
cmp cl, 0xa
je 0x42a138
mov eax, dword [ebp + 0xc]
mov byte [eax], cl
inc eax
inc dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
mov byte [eax], 0
jmp 0x429fe0
push str.syncRead_returned_0
push 3
call fcn.0041a370
add esp, 8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0045320c
mov edx, dword [eax]
push edx
push str.syncRead_returned__1_:__d
push 3
call fcn.0041a370
add esp, 0xc
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0045320c
mov dword [eax], 0x8a
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
test eax, eax
je 0x42a131
cmp byte [ecx - 1], 0xd
jne 0x42a131
pop edi
pop esi
mov byte [ecx - 1], 0
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4353b0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0x477184
push str._dev_urandom
call fcn.0045431c
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, eax
add esp, 8
mov dword [ebp - 4], edi
test edi, edi
je 0x4353eb
push edi
push 1
push ebx
push esi
call fcn.00454932
add esp, 0x10
test eax, eax
jne 0x435440
call sub.KERNEL32.dll_GetCurrentProcessId
mov edi, eax
lea eax, [ebp - 0xc]
push 0
push eax
call fcn.00435aa0
add esp, 8
cmp ebx, 4
jb 0x435423
mov ecx, dword [ebp - 8]
lea eax, [ebx - 4]
mov dword [esi], ecx
cmp eax, 4
jb 0x435423
mov edx, dword [ebp - 0xc]
sub eax, 4
mov dword [esi + 4], edx
cmp eax, 4
jb 0x435423
mov dword [esi + 8], edi
xor edi, edi
test ebx, ebx
je 0x43543d
lea esp, [esp]
call fcn.004355f0
xor byte [edi + esi], al
inc edi
cmp edi, ebx
jb 0x435430
mov edi, dword [ebp - 4]
xor eax, eax
test ebx, ebx
je 0x435465
jmp 0x435450
movsx ecx, byte [eax + esi]
and ecx, 0xf
mov dl, byte [ecx + str.0123456789abcdef]
mov byte [eax + esi], dl
inc eax
cmp eax, ebx
jb 0x435450
test edi, edi
je 0x435472
push edi
call fcn.00454006
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x435480
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x491700]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4354cd
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x4354cd
shr eax, 8
cmp al, 2
jne 0x4354cd
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004533ca
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.004533ca
mov esp, ebp
pop ebp
ret

Function at 0x435520
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 9
jne 0x43556b
mov eax, dword [ebp + 8]
push esi
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0x7f
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x43555f
call fcn.0045320c
push esi
mov dword [eax], 0x16
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
pop esi
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
pop ebp
ret
call fcn.0045320c
mov dword [eax], 0x16
or eax, 0xffffffff
pop ebp
ret

Function at 0x4355f0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x49de68]
mov dword [ebp - 4], 0
test eax, eax
jne 0x43562d
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.SystemFunction036
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x49de68], eax
test eax, eax
jne 0x43562d
mov eax, 1
mov esp, ebp
pop ebp
ret
push 4
lea ecx, [ebp - 4]
push ecx
call eax
mov eax, dword [ebp - 4]
shr eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x435660
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
push esi
push eax
call fcn.00459637
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
jne 0x43568d
call fcn.0045320c
mov dword [eax], 9
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push 0
lea ecx, [ebp - 8]
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x435685
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
neg eax
dec eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4356c0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0xb
push ebx
push eax
mov edi, 0x32
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x43571a
nop
call fcn.0045320c
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
call fcn.0045320c
cmp dword [eax], 5
jne 0x435721
dec edi
jne 0x435709
push 0xa
mov edi, 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 8]
push 0xb
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x4356e0
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x435760
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 8
call fcn.00455be8
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
push ecx
push 0x10000
push eax
push 0x435730
push 0x400000
push 0
mov dword [eax + 4], edx
call fcn.00459a55
add esp, 0x1c
test eax, eax
jne 0x4357a0
call fcn.0045320c
mov eax, dword [eax]
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop ebp
ret

Function at 0x435e60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x493ec4], 0
je 0x435e7c
call fcn.0045320c
mov dword [eax], 0x16
or eax, 0xffffffff
pop ebp
ret
push esi
mov dword [0x493ec4], 3
call fcn.00436c50
cmp dword [0x493ed0], 0
jne 0x435ef8
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0
push 0
call esi
mov dword [0x493ec8], eax
test eax, eax
je 0x435ee2
push 0
push 0
push 0
push 0
call esi
mov dword [0x493ecc], eax
test eax, eax
je 0x435ee2
push 0
push 0
push 0x493ec0
push 0x435dd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x493ed0], eax
test eax, eax
jne 0x435ef8
call fcn.00435d50
call fcn.0045320c
mov dword [eax], 0x16
or eax, 0xffffffff
pop esi
pop ebp
ret
mov esi, dword [ebp + 8]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x435f00
sub eax, edx
inc eax
push eax
call fcn.00439100
add esp, 4
mov dword [0x493ed4], eax
mov ecx, esi
mov edx, eax
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x435f20
mov ecx, dword [0x493ec8]
mov eax, dword [ebp + 0xc]
push ecx
mov dword [0x493edc], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4372b0
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [0x492c90]
push eax
push ecx
call dword [0x492c9c]
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
jne 0x4372e3
call fcn.0045320c
mov dword [eax], 0x2726
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
push edi
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
jne 0x437309
call fcn.0045320c
mov dword [eax], 0x2726
or eax, edi
pop edi
mov esp, ebp
pop ebp
ret
mov edx, dword [0x492c90]
push ebx
push edi
push edx
call dword [0x492c9c]
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x437335
call fcn.0045320c
pop ebx
mov dword [eax], 0x2726
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
push esi
push 0x20
mov dword [ebx], 0x400
call fcn.00439100
mov esi, eax
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
push 0x140
mov dword [esi + 0x1c], eax
call fcn.00439100
mov edx, dword [ebp + 8]
add esp, 8
push esi
lea ecx, [ebp - 0xc]
push ecx
push 0x80
push 0x80
push 0
push eax
push edi
push edx
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], edi
mov dword [esi + 0x1c], 0
call dword [0x492c98]
test eax, eax
jne 0x4373e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x4373e2
call fcn.0045320c
mov dword [ebp - 8], eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
and dword [eax], 0xfffff7ff
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
push esi
mov dword [ebx], 0
call fcn.004392f0
add esp, 4
pop esi
pop ebx
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
or dword [eax], 0x800
pop esi
pop ebx
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x437400
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x492c90]
sub esp, 8
push esi
push edi
mov edi, dword [ebp + 8]
push edi
push eax
call dword [0x492c9c]
mov esi, eax
xor ecx, ecx
add esp, 8
cmp esi, ecx
jne 0x437437
call fcn.0045320c
pop edi
mov dword [eax], 0x2726
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
test dword [esi], 0x400
je 0x4374aa
push ecx
lea eax, [esi + 0x10]
mov dword [eax], ecx
mov dword [eax + 4], ecx
push eax
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
push 0x492c94
mov dword [eax + 0x10], ecx
push ecx
mov dword [0x492c94], ecx
mov dword [ebp - 8], ecx
push 1
lea ecx, [ebp - 8]
push ecx
push edi
mov dword [ebp - 4], 0x492c7c
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x4374a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x4374a4
call fcn.0045320c
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi], eax
and dword [esi], 0xfffffeff
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
or dword [esi], 0x100
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4374c0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x492c90]
push esi
mov esi, dword [ebp + 8]
push edi
push esi
push eax
call dword [0x492c9c]
mov edi, eax
add esp, 8
test edi, edi
je 0x4375bb
test dword [edi], 0x2000
je 0x4374f9
push 0
push 0x32
push 2
push esi
call fcn.00404fa0
add esp, 0x10
test dword [edi], 0x400
je 0x4375bb
cmp dword [ebp + 0x24], 0
je 0x4375bb
push ebx
push 0x34
call fcn.00439100
push 0x34
mov esi, eax
push 0
push esi
call fcn.00453150
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
add esp, 0x10
push 0
push esi
mov dword [esi + 0x18], edx
mov dword [esi + 0x24], edx
mov edx, dword [ebp + 0x14]
push edx
push 0
lea eax, [esi + 0x14]
mov dword [esi + 0x30], ebx
mov ebx, dword [ebp + 0x1c]
push 1
mov dword [eax], ecx
push eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x1c], ebx
mov ebx, dword [ebp + 0x20]
mov dword [esi + 0x28], ecx
mov ecx, dword [ebp + 0x24]
push eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x2c], ecx
call dword [sym.imp.WS2_32.dll_WSASend]
pop ebx
test eax, eax
je 0x437599
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x437599
call fcn.0045320c
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push esi
mov dword [edi], eax
call fcn.004392f0
add esp, 4
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
call fcn.0045320c
mov dword [eax], 0x3e5
inc dword [edi + 0xc]
push esi
add edi, 0x24
push edi
call fcn.00403f20
add esp, 8
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
push esi
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4375e4
call fcn.0045320c
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi], eax
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x4375f0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x492c90]
push esi
mov esi, dword [ebp + 8]
push edi
push esi
push eax
mov dword [ebp - 4], 1
call dword [0x492c9c]
mov edi, eax
add esp, 8
test edi, edi
jne 0x43762a
call fcn.0045320c
pop edi
mov dword [eax], 0x2726
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 4]
push ecx
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x437657
call fcn.0045320c
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi], eax
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x43763f
mov edx, dword [0x492c84]
push 0
push esi
push edx
push esi
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test eax, eax
je 0x43763f
mov dword [edi], 0x400
mov dword [edi + 0xc], 0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x437690
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x491700]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x70]
push 0
push eax
call fcn.00435aa0
mov eax, dword [ebp - 0x6c]
add esp, 8
push 0
cdq
push 0x3e8
push edx
push eax
call fcn.00453320
mov esi, eax
mov eax, dword [ebp - 0x70]
push 0
mov ebx, edx
cdq
push 0x3e8
push edx
push eax
call fcn.00453e40
add esi, eax
adc ebx, edx
add esi, 0x32
mov dword [ebp - 0x78], esi
mov esi, dword [ebp + 8]
push 1
push esi
adc ebx, 0
call dword [sym.imp.WS2_32.dll_shutdown]
cmp eax, 0xffffffff
je 0x437771
push 0
push 0x64
lea ecx, [ebp - 0x68]
push ecx
push esi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x437771
push edi
lea ebx, [ebx]
cmp eax, 0xffffffff
je 0x437770
lea edx, [ebp - 0x70]
push 0
push edx
call fcn.00435aa0
mov eax, dword [ebp - 0x6c]
add esp, 8
push 0
cdq
push 0x3e8
push edx
push eax
call fcn.00453320
mov edi, eax
mov eax, dword [ebp - 0x70]
push 0
mov esi, edx
cdq
push 0x3e8
push edx
push eax
call fcn.00453e40
add edi, eax
adc esi, edx
cmp esi, ebx
jg 0x437770
jl 0x43775a
cmp edi, dword [ebp - 0x78]
ja 0x437770
mov ecx, dword [ebp + 8]
push 0
push 0x64
lea eax, [ebp - 0x68]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x437710
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004533ca
mov esp, ebp
pop ebp
ret

Function at 0x44afc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ecx, edi
shr ecx, 5
inc ecx
mov ebx, edi
mov dword [ebp + 0x10], edi
mov edx, edi
cmp edi, ecx
jb 0x44b001
lea ebx, [ebx]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax + edx - 1]
mov esi, ebx
shl esi, 5
add eax, esi
mov esi, ebx
shr esi, 2
add eax, esi
sub edx, ecx
xor ebx, eax
cmp edx, ecx
jae 0x44afe0
mov dword [ebp + 0x10], ebx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x10]
mov edx, dword [eax + 8]
mov eax, dword [eax]
dec edx
and edx, ebx
mov eax, dword [eax + edx*4]
test eax, eax
je 0x44b069
cmp dword [eax + 0xc], edi
jne 0x44b063
mov esi, dword [ebp + 0xc]
mov ecx, edi
lea edx, [eax + 0x10]
cmp edi, 4
jb 0x44b03c
mov ebx, dword [esi]
cmp ebx, dword [edx]
jne 0x44b060
sub ecx, 4
add edx, 4
add esi, 4
cmp ecx, 4
jae 0x44b028
test ecx, ecx
je 0x44b080
mov bl, byte [edx]
cmp bl, byte [esi]
jne 0x44b060
cmp ecx, 1
jbe 0x44b080
mov bl, byte [edx + 1]
cmp bl, byte [esi + 1]
jne 0x44b060
cmp ecx, 2
jbe 0x44b080
mov cl, byte [edx + 2]
cmp cl, byte [esi + 2]
je 0x44b080
mov ebx, dword [ebp + 0x10]
mov eax, dword [eax]
test eax, eax
jne 0x44b016
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
mov eax, ebx
call fcn.0044af20
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x10]
mov cl, byte [eax + 5]
movzx edx, byte [edx + 0x14]
movzx ebx, cl
not edx
and ebx, 3
test bl, dl
je 0x44b07b
pop edi
xor cl, 3
pop esi
mov byte [eax + 5], cl
pop ebx
pop ebp
ret

Function at 0x4533ca
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x491700]
jne 0x4533d4
repz ret
jmp fcn.0045e3bf