joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50da16
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5bbef5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 0x38]
mov dword [esp + 0x10], 7
call fcn.005a5ad7
lea ecx, [esi + 0x34]
mov byte [esp + 0x10], 6
call fcn.005a5ad7
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 5
call fcn.005a5ad7
lea ecx, [esi + 0x2c]
mov byte [esp + 0x10], 4
call fcn.005a5ad7
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 3
call fcn.005a5ad7
lea ecx, [esi + 0xc]
mov byte [esp + 0x10], 2
call fcn.005a5ad7
lea ecx, [esi + 8]
mov byte [esp + 0x10], 1
call fcn.005a5ad7
lea ecx, [esi + 4]
mov byte [esp + 0x10], 0
call fcn.005a5ad7
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
call fcn.005a5ad7
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x5111e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x5111eb
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x5112ee
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x717be0]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x717be0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x717be0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x717be0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x717be0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x717be0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x717be0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x717be0]
xor eax, edx
inc ecx
dec edi
jne 0x511206
pop edi
test esi, esi
je 0x511310
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x717be0]
xor eax, edx
inc ecx
dec esi
jne 0x5112f2
pop esi
pop ebx
not eax
ret
Function at 0x514c40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5bc6b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov al, byte [esp + 0x28]
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov byte [esi], al
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov cl, byte [esp + 0x2c]
mov dword [esp + 0x20], eax
mov byte [esp + 8], cl
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x2c]
push ecx
push 1
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 1
mov dword [esp + 0x38], edx
call fcn.00505660
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], edx
push eax
push 1
push ecx
lea ecx, [esp + 0x14]
call fcn.00505660
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x34]
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], edx
push eax
push 1
push ecx
lea ecx, [esp + 0x14]
call fcn.00505660
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x38]
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], edx
push eax
push 1
push ecx
lea ecx, [esp + 0x14]
call fcn.00505660
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], edx
push eax
push 1
push ecx
lea ecx, [esp + 0x14]
call fcn.00505660
mov eax, dword [esp + 0x28]
lea edx, [esp + 8]
push edx
push eax
mov ecx, esi
call fcn.00514d50
mov ecx, dword [esp + 0xc]
push ecx
call fcn.005a5841
mov ecx, dword [esp + 0x1c]
add esp, 4
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x20
ret 0x18
Function at 0x51a800
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5bc8d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov al, byte [esp + 0x30]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 8], al
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov edx, dword [esp + 0x38]
lea ecx, [esp + 8]
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x38], ebx
call fcn.0051a910
test al, al
jne 0x51a897
mov ecx, dword [esp + 0xc]
cmp ecx, ebx
je 0x51a882
mov al, byte [ecx - 1]
cmp al, bl
je 0x51a878
cmp al, 0xff
je 0x51a878
dec al
pop esi
mov byte [ecx - 1], al
xor al, al
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
dec ecx
push ecx
call fcn.005a5841
add esp, 4
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
call fcn.00512eb0
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
push ecx
mov ecx, esi
call fcn.0051b690
mov ecx, eax
call fcn.005133d0
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], bl
call fcn.00513200
mov ecx, dword [esp + 0xc]
cmp ecx, ebx
je 0x51a8ee
mov al, byte [ecx - 1]
cmp al, bl
je 0x51a8e4
cmp al, 0xff
je 0x51a8e4
dec al
mov byte [ecx - 1], al
jmp 0x51a8ee
dec ecx
push ecx
call fcn.005a5841
add esp, 4
mov ecx, dword [esp + 0x28]
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x51b470
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5bc9bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov al, byte [esp + 0x34]
push ebx
xor ebx, ebx
push esi
push edi
mov esi, ecx
mov byte [esp + 0x18], al
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x34], ebx
mov edx, dword [ecx]
mov dword [esp + 0xc], edx
mov edx, dword [0x71802c]
mov eax, dword [ecx + 4]
push edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x40]
mov ecx, dword [ecx + 8]
push ebx
mov dword [esp + 0x1c], ecx
push eax
lea ecx, [esp + 0x24]
call fcn.005152f0
mov eax, dword [esi + 0x5c]
mov ecx, dword [esp + 0x44]
add esi, 0x30
cmp eax, ebx
mov dword [esp + 0x28], ecx
je 0x51b565
mov eax, dword [esi + 0x1c]
mov edx, dword [esi + 0x18]
cmp eax, edx
je 0x51b565
lea ecx, [eax + 0x20]
cmp ecx, edx
jne 0x51b525
mov dword [esp + 0x40], eax
mov dword [esi + 0x1c], ecx
mov dword [esp + 0x3c], eax
cmp eax, ebx
mov byte [esp + 0x34], 2
je 0x51b518
lea edx, [esp + 0xc]
mov ecx, eax
push edx
call fcn.0051e590
mov ecx, esi
mov byte [esp + 0x34], bl
call fcn.0051d400
jmp 0x51b590
mov edi, eax
mov dword [esi + 0x1c], ecx
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], edi
cmp edi, ebx
mov byte [esp + 0x34], 3
je 0x51b590
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
mov edx, dword [esp + 0x10]
mov dword [eax + 4], edx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
mov dword [eax + 8], ecx
push edx
lea ecx, [edi + 0xc]
call fcn.0051bb50
mov eax, dword [esp + 0x28]
mov dword [edi + 0x1c], eax
jmp 0x51b590
mov ecx, esi
call fcn.0051d400
mov ecx, dword [esi + 0x1c]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x3c], ecx
lea edx, [ecx + 0x20]
mov dword [esi + 0x1c], edx
cmp ecx, ebx
mov byte [esp + 0x34], 1
je 0x51b590
lea eax, [esp + 0xc]
push eax
call fcn.0051e590
mov edx, dword [esi + 0x2c]
mov eax, dword [esp + 0x1c]
inc edx
cmp eax, ebx
mov dword [esi + 0x2c], edx
je 0x51b5bc
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x51b5b3
cmp al, 0xff
je 0x51b5b3
dec al
mov byte [ecx], al
jmp 0x51b5bc
push ecx
call fcn.005a5841
add esp, 4
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc
Function at 0x5201f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5bcc03
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0058e38b
lea ecx, [esp + 0xc]
mov dword [esi + 0x34], eax
call fcn.0058e228
mov edi, dword [0x880934]
lea ecx, [esp + 8]
call fcn.0058e228
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
jae 0x52023c
inc eax
mov dword [edi + 4], eax
lea ecx, [esp + 8]
call fcn.0058e2c4
lea ecx, [esp + 0xc]
call fcn.0058e2c4
lea eax, [esi + 4]
lea ecx, [esi + 0x14]
lea edx, [esi + 0x18]
mov dword [esi + 0xc], eax
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], edx
lea eax, [esi + 8]
lea ecx, [esi + 0x24]
lea edx, [esi + 0x28]
xor edi, edi
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [esi + 0x10], eax
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], edx
mov dword [eax], edi
mov eax, dword [esi + 0x20]
push edi
push edi
mov dword [eax], edi
mov ecx, dword [esi + 0x30]
push edi
mov dword [esp + 0x28], edi
mov dword [ecx], edi
mov ecx, esi
call fcn.00520300
mov cl, byte [esp + 0x24]
xor eax, eax
test cl, 1
mov dword [esi], 0x718160
jne 0x5202aa
mov eax, 4
test cl, 2
jne 0x5202b1
or al, 2
mov edx, dword [esi + 0xc]
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], 0x20
mov dword [esi + 0x44], eax
mov dword [edx], edi
mov eax, dword [esi + 0x1c]
mov dword [eax], edi
mov ecx, dword [esi + 0x2c]
mov dword [ecx], edi
mov edx, dword [esi + 0x10]
mov dword [edx], edi
mov eax, dword [esi + 0x20]
mov dword [eax], edi
mov ecx, dword [esi + 0x30]
mov eax, esi
mov dword [ecx], edi
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x5261b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5bce98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov al, byte [esp + 0x28]
push ebx
xor ebx, ebx
push esi
push ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], ebx
mov byte [esp + 0x10], al
call fcn.0050c2c0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x24], ebx
mov ecx, dword [eax + 4]
cmp ecx, ebx
jne 0x5261f5
xor eax, eax
jmp 0x5261fa
mov eax, dword [eax + 8]
add eax, ecx
mov edx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x3c]
push edx
push eax
push ecx
lea eax, [esp + 0x20]
lea ecx, [esp + 0x44]
push eax
push ecx
call fcn.00526810
mov esi, dword [esp + 0x48]
mov dl, byte [esp + 0x28]
add esp, 0x1c
lea ecx, [esp + 0xc]
mov byte [esi], dl
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov eax, dword [0x718dfc]
push eax
push ebx
push ecx
mov ecx, esi
call fcn.00525900
mov ecx, dword [esp + 0x10]
cmp ecx, ebx
je 0x526278
mov al, byte [ecx - 1]
cmp al, bl
je 0x52626e
cmp al, 0xff
je 0x52626e
dec al
mov byte [ecx - 1], al
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
dec ecx
push ecx
call fcn.005a5841
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret

Function at 0x52c8b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5bd098
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [esp + 0x40]
push ebx
push esi
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, dword [esp + 0x4c]
call fcn.0052cc90
mov esi, eax
lea edx, [esp + 0x48]
xor ebx, ebx
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x4c], 0x85da84
call fcn.0057f9e8
mov ecx, dword [0x718dfc]
mov al, byte [esi]
push ecx
push ebx
push esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x48], 1
mov byte [esp + 0x30], al
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call fcn.00525900
mov esi, 0x718e88
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0xc]
mov byte [esp + 0x3c], 3
cmp eax, ebx
je 0x52c957
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x52c94e
cmp al, 0xff
je 0x52c94e
dec al
mov byte [ecx], al
jmp 0x52c957
push ecx
call fcn.005a5841
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
call fcn.005a0200
mov eax, dword [esp + 0x28]
mov dword [esp + 0x3c], 0xffffffff
cmp eax, ebx
mov dword [esp + 0x18], esi
je 0x52c99d
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x52c994
cmp al, 0xff
je 0x52c994
dec al
mov byte [ecx], al
jmp 0x52c99d
push ecx
call fcn.005a5841
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.0057fa6f
mov ecx, dword [esp + 0x34]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x536b60
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
push 0x800
call fcn.0057e057
mov esi, dword [esp + 0x18]
add esp, 4
mov edx, eax
xor ebp, ebp
test esi, esi
mov dword [esp + 0xc], edx
jne 0x536b88
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
cmp ecx, 0x800
jbe 0x536ba3
pop esi
pop ebp
pop ebx
pop ecx
ret
mov al, byte [esi]
inc esi
test al, al
je 0x536c79
cmp ebp, 0x400
je 0x536c64
cmp al, 0x25
jne 0x536c43
mov al, byte [esi]
inc esi
test al, al
je 0x536c5c
mov cl, byte [esi]
inc esi
test cl, cl
mov byte [esp + 0x14], cl
je 0x536c5c
movsx eax, al
push eax
call fcn.0057fbad
movsx ecx, byte [esp + 0x18]
push ecx
mov bl, al
call fcn.0057fbad
movsx edx, bl
push edx
mov byte [esp + 0x20], al
call fcn.0057d2e3
add esp, 0xc
test eax, eax
je 0x536c72
movsx eax, byte [esp + 0x14]
push eax
call fcn.0057d2e3
add esp, 4
test eax, eax
je 0x536c72
cmp bl, 0x39
jg 0x536c22
add bl, 0xd0
jmp 0x536c25
add bl, 0xa9
mov al, byte [esp + 0x14]
cmp al, 0x39
jg 0x536c31
add al, 0xd0
jmp 0x536c33
add al, 0xa9
mov ecx, dword [esp + 0xc]
shl bl, 4
add bl, al
mov edx, ecx
mov byte [ecx + ebp], bl
jmp 0x536c50
cmp al, 0x2b
jne 0x536c4d
mov byte [edx + ebp], 0x20
jmp 0x536c50
mov byte [edx + ebp], al
mov al, byte [esi]
inc ebp
inc esi
test al, al
jne 0x536bae
cmp ebp, 0x400
jne 0x536c79
pop esi
pop ebp
mov byte [edx + 0x3ff], 0
mov eax, edx
pop ebx
pop ecx
ret
push 0
call fcn.005801e4
mov byte [edx + ebp], 0
pop esi
pop ebp
mov eax, edx
pop ebx
pop ecx
ret

Function at 0x53a6a0
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push 0x8004667e
push ecx
mov dword [esp + 0xc], 0
call sub.WS2_32.dll_ioctlsocket
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov eax, edx
pop ecx
ret

Function at 0x53a6d0
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push 0x8004667e
push ecx
mov dword [esp + 0xc], 1
call sub.WS2_32.dll_ioctlsocket
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov eax, edx
pop ecx
ret

Function at 0x53a700
Capabilities:
Create tcp socket
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 1
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x53a720
or eax, 0xffffffff
add esp, 0x190
ret
push 6
push 1
push 2
call sub.WS2_32.dll_socket
add esp, 0x190
ret
Function at 0x53a750
Capabilities:
Connect socket
Get socket status

Disassembly:
sub esp, 0x228
push esi
mov esi, dword [esp + 0x234]
test esi, esi
je 0x53a93e
mov ecx, dword [esp + 0x23c]
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
push ebx
shr eax, 0x1f
add edx, eax
push edi
test edx, edx
mov edi, 1
mov dword [esp + 0xc], edx
jg 0x53a791
mov dword [esp + 0xc], edi
xor ecx, ecx
push esi
mov dword [esp + 0x18], ecx
mov word [esp + 0x18], 2
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
call sub.WS2_32.dll_inet_addr
mov edx, dword [esp + 0x240]
mov dword [esp + 0x18], eax
push edx
call sub.WS2_32.dll_htons
mov esi, dword [esp + 0x238]
mov word [esp + 0x16], ax
push esi
call fcn.0053a6d0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [esp + 0x14]
push 0x10
push eax
push esi
call sub.WS2_32.dll_connect
test eax, eax
jge 0x53a927
call fcn.0053a340
push eax
call fcn.0053a950
add esp, 4
cmp eax, 0xffffd8cd
je 0x53a824
cmp eax, 0xffffd8cc
je 0x53a824
push esi
mov edi, eax
call fcn.0053a6a0
add esp, 4
mov eax, edi
pop edi
pop ebx
pop esi
add esp, 0x228
ret
mov eax, dword [esp + 0xc]
mov dword [esp + 0x10], 0
test eax, eax
jle 0x53a8d9
lea ebx, [esi + 1]
lea ecx, [esp + 0x24]
lea edx, [esp + 0x2c]
push ecx
push 0
lea eax, [esp + 0x138]
push edx
push eax
push ebx
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], edi
mov dword [esp + 0x148], esi
mov dword [esp + 0x144], edi
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0x2710
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
je 0x53a90d
lea ecx, [esp + 0x2c]
push ecx
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x53a927
lea edx, [esp + 0x130]
push edx
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x53a927
mov ecx, dword [esp + 0x248]
mov eax, dword [esp + 0x24c]
cmp dword [ecx], eax
je 0x53a8f3
call fcn.0053a340
test eax, eax
jne 0x53a90d
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x53a83b
push esi
mov edi, 0xfffffff5
call fcn.0053a6a0
add esp, 4
mov eax, edi
pop edi
pop ebx
pop esi
add esp, 0x228
ret
push esi
mov edi, 0xffffffec
call fcn.0053a6a0
add esp, 4
mov eax, edi
pop edi
pop ebx
pop esi
add esp, 0x228
ret
push esi
mov edi, 0xfffffffb
call fcn.0053a6a0
add esp, 4
mov eax, edi
pop edi
pop ebx
pop esi
add esp, 0x228
ret
push esi
xor edi, edi
call fcn.0053a6a0
add esp, 4
mov eax, edi
pop edi
pop ebx
pop esi
add esp, 0x228
ret
xor eax, eax
pop esi
add esp, 0x228
ret
Function at 0x53ad60
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
sub esp, 0x10c
mov ecx, dword [esp + 0x114]
push esi
mov esi, dword [esp + 0x114]
mov dword [esp + 0xc], 1
test ecx, ecx
mov dword [esp + 0x10], esi
jne 0x53ad93
push ecx
lea eax, [esp + 0x10]
push ecx
push eax
push ecx
lea ecx, [esi + 1]
push ecx
jmp 0x53adeb
cmp ecx, 0xffffffff
jne 0x53adaa
mov dword [esp + 4], 0
mov dword [esp + 8], 0
jmp 0x53add9
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov dword [esp + 4], edx
mov ecx, 0x3e8
cdq
idiv ecx
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
shl edx, 3
mov dword [esp + 8], edx
lea eax, [esp + 4]
lea ecx, [esp + 0xc]
push eax
push 0
push ecx
lea edx, [esi + 1]
push 0
push edx
call sub.WS2_32.dll_select
test eax, eax
jge 0x53ae01
mov eax, 0xfffffffb
pop esi
add esp, 0x10c
ret
jne 0x53ae10
mov eax, 0xfffffffa
pop esi
add esp, 0x10c
ret
lea eax, [esp + 0xc]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x53ae69
mov ecx, dword [esp + 0x11c]
mov edx, dword [esp + 0x120]
push 0
push ecx
push edx
push esi
call sub.WS2_32.dll_send
test eax, eax
jg 0x53ae51
call fcn.0053a340
push eax
call fcn.0053a950
add esp, 4
pop esi
add esp, 0x10c
ret
mov ecx, dword [0x861adc]
test ecx, ecx
je 0x53ae6e
mov edx, dword [ecx]
pop esi
add edx, eax
mov dword [ecx], edx
add esp, 0x10c
ret
mov eax, 0xfffffff7
pop esi
add esp, 0x10c
ret

Function at 0x53ae80
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push eax
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x53ae8f
ret
mov ecx, dword [eax + 0xc]
push esi
push edi
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
call sub.WS2_32.dll_inet_ntoa
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x10]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret

Function at 0x53b020
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
mov edx, dword [esp + 0x18]
lea eax, [esp]
lea ecx, [esp + 4]
push eax
push ecx
push edx
mov dword [esp + 0xc], 0x10
call sub.WS2_32.dll_getsockname
test eax, eax
jne 0x53b056
mov eax, dword [esp + 6]
push eax
call sub.WS2_32.dll_ntohs
and eax, 0xffff
add esp, 0x14
ret
or eax, 0xffffffff
add esp, 0x14
ret

Function at 0x53b060
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x64
lea eax, [esp]
push esi
push 0x64
push eax
xor esi, esi
call sub.WS2_32.dll_gethostname
lea ecx, [esp + 4]
push ecx
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x53b085
pop esi
add esp, 0x64
ret
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
test eax, eax
je 0x53b098
mov eax, dword [eax]
push eax
call sub.WS2_32.dll_inet_ntoa
mov esi, eax
mov eax, esi
pop esi
add esp, 0x64
ret
Function at 0x53b3c0
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
push esi
push eax
call fcn.0053b4f0
add esp, 8
test eax, eax
jne 0x53b3d9
pop esi
ret
mov eax, dword [esi + 0x8c]
test eax, eax
jne 0x53b3e5
pop esi
ret
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 0x8c], 0
pop esi
ret

Function at 0x53b400
Capabilities:
Terminate thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0x38c]
mov esi, dword [edi]
push eax
call fcn.00552ae0
add esp, 4
test esi, esi
je 0x53b48a
mov edi, dword [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x8c]
test eax, eax
je 0x53b47e
cmp dword [esi + 8], 0xffffffff
je 0x53b47e
push 0
push eax
call ebp
mov dword [esi + 0x8c], 0
mov ecx, dword [edi + 0xa0]
test ecx, ecx
je 0x53b46c
mov eax, dword [esi + 0x1c]
push 0
lea edx, [eax*8]
sub edx, eax
lea eax, [ecx + edx*4]
mov ecx, dword [ecx + edx*4 + 0x14]
mov edx, dword [eax + 0xc]
add ecx, edx
push ecx
jmp 0x53b470
push 0
push 0
push esi
push 8
push 0x15
push edi
call fcn.00537070
add esp, 0x18
mov esi, dword [esi + 0x48]
test esi, esi
jne 0x53b426
mov edi, dword [esp + 0x14]
pop ebp
mov edx, dword [edi + 0x38c]
push edx
call fcn.00552af0
add esp, 4
pop edi
pop esi
ret

Function at 0x53c8b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
mov edx, eax
dec eax
test edx, edx
je 0x53c8ec
push ebx
push esi
lea esi, [eax + 1]
mov eax, dword [esp + 0x14]
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, ah
mov ax, word [edx*2 + 0x718e94]
xor ax, bx
inc ecx
dec esi
jne 0x53c8c8
pop esi
pop ebx
ret
mov ax, word [esp + 0xc]
ret