joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f1c0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x20
mov edx, dword [esp + 0x24]
mov ecx, dword [edx + 0x3c]
mov eax, dword [ecx]
push ebx
push ebp
push esi
push edi
call fcn.0040b670
movzx esi, word [edx + 0xc]
mov ebp, dword [edx + 0x40]
mov dword [esp + 0x20], esi
movzx esi, word [edx + 0x10]
mov dword [esp + 0x1c], esi
movzx esi, word [ecx + 0x18]
xor ecx, ecx
mov ebx, eax
movzx eax, byte [edx + 5]
mov ch, byte [eax + ebp + 5]
mov dword [esp + 0x10], esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x18], 0
mov cl, byte [eax + ebp + 6]
mov edi, ecx
mov ecx, esi
sub ecx, edi
lea esi, [edi + ebp]
add edi, ebx
mov ebx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
lea edi, [esi + ecx*2]
mov dword [esp + 0x20], edi
jle 0x41f2e8
add esi, ebp
mov dword [esp + 0x14], esi
jmp 0x41f250
mov esi, dword [esp + 0x14]
xor eax, eax
mov ah, byte [esi]
mov al, byte [esi + 1]
mov esi, eax
cmp esi, edi
mov dword [esp + 0x28], esi
jl 0x41f34a
mov eax, dword [esp + 0x10]
add eax, 0xfffffffc
cmp esi, eax
jg 0x41f34a
mov ecx, dword [esp + 0x24]
add esi, ecx
push esi
mov eax, edx
call fcn.0040c950
movzx ecx, ax
sub ebx, ecx
add esp, 4
cmp ebx, edi
jl 0x41f336
mov edx, dword [esp + 0x28]
lea eax, [ecx + edx]
cmp eax, dword [esp + 0x10]
jg 0x41f336
mov eax, dword [esp + 0x14]
mov edx, ecx
shr ecx, 2
lea edi, [ebx + ebp]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x34]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x20]
mov ecx, ebx
sar ecx, 8
mov byte [eax], cl
mov ecx, dword [esp + 0x18]
mov byte [eax + 1], bl
add eax, 2
inc ecx
mov dword [esp + 0x14], eax
cmp ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], ecx
jl 0x41f24c
mov eax, dword [esp + 0x2c]
mov byte [eax + ebp + 6], bl
mov ecx, ebx
sar ecx, 8
mov byte [eax + ebp + 5], cl
sub ebx, edi
mov byte [eax + ebp + 1], 0
mov byte [eax + ebp + 2], 0
mov byte [eax + ebp + 7], 0
mov ecx, ebx
mov esi, ecx
add edi, ebp
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
movzx edx, word [edx + 0xe]
pop edi
pop esi
pop ebp
cmp ebx, edx
pop ebx
je 0x41f35e
add esp, 0x20
mov dword [esp + 4], 0xaeff
jmp fcn.0041d790
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
mov dword [esp + 4], 0xaeee
jmp fcn.0041d790
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
mov dword [esp + 4], 0xaee2
jmp fcn.0041d790
xor eax, eax
add esp, 0x20
ret
Function at 0x41fb30
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 0xc]
cmp dword [eax], 0
jne 0x41fbe9
movzx ecx, word [esi + 0xc]
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esi + 0x40]
push ebp
movzx ebp, byte [esi + 5]
add ecx, ebx
push edi
lea edi, [ecx + edx*2]
xor edx, edx
mov dh, byte [edi]
xor eax, eax
mov ah, byte [ebx + ebp + 5]
mov dl, byte [edi + 1]
mov al, byte [ebx + ebp + 6]
cmp edx, eax
jl 0x41fbd3
mov ecx, dword [esi + 0x3c]
movzx eax, word [ecx + 0x18]
mov ecx, dword [esp + 0x14]
add ecx, edx
cmp ecx, eax
jg 0x41fbd3
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.0041f530
add esp, 8
test eax, eax
jne 0x41fbe0
mov eax, dword [esp + 0x10]
movzx edx, word [esi + 0x10]
inc eax
cmp eax, edx
jge 0x41fbb7
lea esp, [esp]
mov cl, byte [edi + 2]
mov dl, byte [edi + 3]
mov byte [edi], cl
mov byte [edi + 1], dl
movzx ecx, word [esi + 0x10]
inc eax
add edi, 2
cmp eax, ecx
jl 0x41fba0
dec word [esi + 0x10]
mov ax, word [esi + 0x10]
mov byte [ebx + ebp + 3], ah
mov dl, byte [esi + 0x10]
mov byte [ebx + ebp + 4], dl
add word [esi + 0xe], 2
pop edi
pop ebp
pop ebx
ret
push 0xbf81
call fcn.0041d790
add esp, 4
mov ecx, dword [esp + 0x18]
pop edi
pop ebp
mov dword [ecx], eax
pop ebx
ret
Function at 0x4548d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x80
push ebx
push ebp
push esi
push edi
mov eax, dword [esp + 0x94]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x30], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x34], edx
mov edx, dword [eax + 0xc]
xor eax, eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x98]
mov dword [esp + 0x48], eax
mov dword [esp + 0x3c], edx
mov edx, dword [ecx]
mov dword [esp + 0x4c], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x70], edx
mov edx, dword [ecx + 8]
mov dword [esp + 0x74], eax
mov eax, dword [ecx + 0xc]
xor ecx, ecx
mov dword [esp + 0x78], edx
mov edx, dword [esp + 0x9c]
mov dword [esp + 0x7c], eax
mov eax, dword [edx]
mov dword [esp + 0x80], ecx
mov dword [esp + 0x84], ecx
mov dword [esp + 0x50], eax
mov dword [esp + 0x88], ecx
mov dword [esp + 0x8c], ecx
mov ecx, dword [edx + 4]
mov eax, dword [edx + 8]
mov dword [esp + 0x58], eax
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x54], ecx
mov ecx, dword [edx + 0xc]
xor edx, edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x60], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x64], edx
mov dword [esp + 0x68], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x5c], ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], eax
mov dword [esp + 0x6c], edx
push ecx
lea edx, [esp + 0x54]
mov dword [esp + 0x30], eax
push edx
mov eax, ecx
push eax
mov dword [esp + 0x1c], 1
call fcn.00452910
add esp, 0xc
xor esi, esi
xor ebp, ebp
mov ebx, dword [esp + ebp*4 + 0x70]
test ebx, ebx
mov edi, 0x20
je 0x454a31
mov edi, edi
test bl, 1
je 0x454a29
test esi, esi
je 0x454a02
lea esp, [esp]
lea ecx, [esp + 0x30]
push ecx
call fcn.00451620
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x58]
push eax
mov ecx, edx
push ecx
call fcn.00452910
add esp, 0x10
dec esi
jne 0x4549e0
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x34]
push eax
mov ecx, edx
push ecx
call fcn.004533e0
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x60]
push eax
mov ecx, edx
push ecx
call fcn.00452910
add esp, 0x18
shr ebx, 1
inc esi
dec edi
test ebx, ebx
jne 0x4549d0
add esi, edi
inc ebp
cmp ebp, 4
jb 0x4549c1
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xa0]
mov ecx, dword [esp + 0x14]
mov dword [edx], eax
mov eax, dword [esp + 0x18]
pop edi
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x18]
pop esi
mov dword [edx + 8], eax
pop ebp
mov dword [edx + 0xc], ecx
pop ebx
add esp, 0x80
ret
Function at 0x45afe0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4c4c5c], 0xffffffff
push ebx
push ebp
push esi
push edi
mov edi, 0x4e7350
mov esi, 0x4e7358
jge 0x45aee4
push 0x1105
call fcn.0045ae90
add esp, 4
mov ecx, dword [0x4e7350]
mov eax, dword [0x4e7354]
mov dword [0x4c4c5c], 0x26f
mov dword [0x4e7d14], 0x4e7354
mov edx, 0xe3
jmp 0x45af10
mov ebp, dword [esi + 0x62c]
mov ebx, eax
xor ebx, ecx
and ebx, 0x7ffffffe
xor ebx, ecx
mov ecx, eax
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, 0x9908b0df
xor ebx, ecx
xor ebx, ebp
mov dword [edi], ebx
mov ecx, eax
mov eax, dword [esi]
add edi, 4
add esi, 4
dec edx
jne 0x45af10
mov ebx, 0x4e7350
mov ebp, 0x18c
mov edx, eax
xor edx, ecx
and edx, 0x7ffffffe
xor edx, ecx
mov ecx, eax
and cl, 1
shr edx, 1
neg cl
sbb ecx, ecx
and ecx, 0x9908b0df
xor edx, ecx
xor edx, dword [ebx]
mov dword [edi], edx
mov ecx, eax
mov eax, dword [esi]
add edi, 4
add ebx, 4
add esi, 4
dec ebp
jne 0x45af50
mov esi, dword [0x4e7350]
mov eax, esi
xor eax, ecx
and eax, 0x7ffffffe
xor eax, ecx
shr eax, 1
mov ecx, esi
and cl, 1
neg cl
mov edx, esi
sbb ecx, ecx
and ecx, 0x9908b0df
xor eax, ecx
xor eax, dword [ebx]
mov dword [edi], eax
mov eax, edx
shr eax, 0xb
xor edx, eax
mov ecx, edx
and ecx, 0xff3a58ad
shl ecx, 7
xor edx, ecx
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
pop edi
pop esi
mov eax, edx
shr eax, 0x12
pop ebp
xor eax, edx
pop ebx
ret
dec dword [0x4c4c5c]
jns 0x45afed
jmp 0x45aec0
mov eax, dword [0x4e7d14]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4e7d14], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov edx, ecx
and edx, 0xff3a58ad
shl edx, 7
xor ecx, edx
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret
Function at 0x460b00
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
mov dword [ecx + 0x14], 0xc3d2e1f0
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
ret

Function at 0x462940
Capabilities:
Hash data using sha1

Disassembly:
mov dword [ecx], 0x4b5240
jmp fcn.00460b00

Function at 0x462a00
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x18
push esi
push 0
push 2
push 2
call dword [sym.imp.WSOCK32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x462a20
or eax, eax
pop esi
add esp, 0x18
ret 0xc
push edi
mov edi, dword [sym.imp.WSOCK32.dll_setsockopt]
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0xffff
push esi
mov dword [esp + 0x1c], 1
call edi
push 4
lea ecx, [esp + 0xc]
push ecx
push 0x1002
push 0xffff
push esi
mov dword [esp + 0x1c], 0x40000
call edi
push 4
lea edx, [esp + 0xc]
push edx
push 0x1001
push 0xffff
push esi
mov dword [esp + 0x1c], 0x4000
call edi
lea eax, [esp + 0xc]
push eax
push 0x8004667e
push esi
mov dword [esp + 0x18], 1
call dword [sym.imp.WSOCK32.dll_ioctlsocket]
test eax, eax
je 0x462aa0
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x18
ret 0xc
push 4
lea ecx, [esp + 0xc]
push ecx
push 0x20
push 0xffff
push esi
call edi
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.WSOCK32.dll_htons]
mov word [esp + 0x12], ax
mov eax, dword [esp + 0x2c]
test eax, eax
mov word [esp + 0x10], 2
je 0x462ae2
cmp byte [eax], 0
je 0x462ae2
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [esp + 0x14], eax
jmp 0x462aea
mov dword [esp + 0x14], 0
push 0x10
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.WSOCK32.dll_bind]
cmp eax, 0xffffffff
je 0x462a95
pop edi
mov eax, esi
pop esi
add esp, 0x18
ret 0xc

Function at 0x462b10
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x462b34
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
test eax, eax
je 0x462b34
mov eax, dword [eax]
mov dword [esp + 4], eax
jmp dword [sym.imp.WSOCK32.dll_inet_ntoa]
xor eax, eax
ret 4
Function at 0x462b40
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x258
push edi
mov edi, dword [esp + 0x260]
cmp edi, 0xffffffff
mov dword [esp + 8], 0x10
mov word [esp + 0xc], 2
jne 0x462b77
mov eax, dword [esp + 0x268]
mov dword [eax], edi
or eax, edi
pop edi
add esp, 0x258
ret 0xc
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push 0x240
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.WSOCK32.dll_recvfrom]
cmp eax, 0xffffffff
mov dword [esp + 4], eax
je 0x462c35
mov ecx, dword [esp + 0xe]
push esi
push ecx
call dword [sym.imp.WSOCK32.dll_ntohs]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
jle 0x462bf8
push edi
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x28]
push edx
push esi
push eax
call fcn.00497c50
add esp, 0x14
test eax, eax
jne 0x462bf8
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x24]
push edx
push 0x4ebeb0
call fcn.0046a740
add esp, 0xc
test eax, eax
jne 0x462c08
mov eax, dword [esp + 0x26c]
mov dword [eax], 0
pop esi
mov eax, 1
pop edi
add esp, 0x258
ret 0xc
mov ecx, dword [esp + 0x268]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x14]
push ecx
push edx
push 0x4ebeb0
push esi
push eax
call fcn.004566a0
pop esi
mov eax, 1
pop edi
add esp, 0x258
ret 0xc
mov ecx, dword [esp + 0x268]
mov dword [ecx], 0
xor eax, eax
pop edi
add esp, 0x258
ret 0xc

Function at 0x462c50
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
push ebp
mov ebp, dword [esp + 0x18]
cmp ebp, 0xffffffff
jne 0x462c66
or eax, ebp
pop ebp
add esp, 0x10
ret 0x14
mov eax, dword [esp + 0x28]
push ebx
push esi
push edi
push eax
call dword [sym.imp.WSOCK32.dll_htons]
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ebx, dword [sym.imp.WSOCK32.dll_sendto]
mov word [esp + 0x12], ax
mov dword [esp + 0x14], ecx
mov word [esp + 0x10], 2
push 0x10
lea edx, [esp + 0x14]
push edx
push 0
push esi
push edi
push ebp
call ebx
test eax, eax
je 0x462c96
cmp eax, 0xffffffff
pop edi
pop esi
pop ebx
je 0x462cb9
xor eax, eax
pop ebp
add esp, 0x10
ret 0x14
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
pop ebp
add esp, 0x10
ret 0x14

Function at 0x462cd0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 0x10]
push esi
push eax
mov esi, ecx
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0x14]
push edx
push eax
push ecx
mov ecx, esi
call fcn.00462c50
pop esi
ret 0x14
Function at 0x462d00
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x50
push 0x50
lea eax, [esp + 4]
push eax
call dword [sym.imp.WSOCK32.dll_gethostname]
cmp eax, 0xffffffff
je 0x462d6f
push ebx
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x462d6e
mov eax, dword [ebx + 0xc]
cmp dword [eax], 0
je 0x462d6e
push ebp
mov ebp, dword [sym.imp.WSOCK32.dll_inet_ntoa]
push esi
push edi
mov edi, dword [esp + 0x64]
xor esi, esi
mov edi, edi
cmp esi, 0x28
jge 0x462d6b
mov edx, dword [esi + eax]
mov eax, dword [edx]
push eax
call ebp
mov edx, edi
nop
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x462d50
mov eax, dword [ebx + 0xc]
mov ecx, dword [esi + eax + 4]
add esi, 4
add edi, 0x10
test ecx, ecx
jne 0x462d40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 4

Function at 0x462d80
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
mov edx, dword [esp + 0x18]
lea eax, [esp]
push eax
lea ecx, [esp + 8]
push ecx
push edx
mov dword [esp + 0xc], 0x10
call dword [sym.imp.WSOCK32.dll_getsockname]
test eax, eax
je 0x462dac
xor ax, ax
add esp, 0x14
ret 4
mov eax, dword [esp + 6]
push eax
call dword [sym.imp.WSOCK32.dll_ntohs]
add esp, 0x14
ret 4
Function at 0x463840
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
xor eax, eax
mov dword [esp + 0x10], 8
mov edi, dword [edx]
mov ebx, edi
mov ebp, edi
shr ebx, 5
shl ebp, 4
xor ebx, ebp
add ebx, edi
mov ebp, dword [esi]
mov edi, eax
and edi, 3
movzx edi, byte [edi + ecx + 0x25c]
add edi, eax
xor ebx, edi
add ebp, ebx
mov dword [esi], ebp
add eax, dword [ecx + 0x270]
mov edi, ebp
mov ebx, ebp
shr ebx, 5
shl ebp, 4
xor ebx, ebp
add ebx, edi
mov edi, eax
shr edi, 0xb
and edi, 3
movzx edi, byte [edi + ecx + 0x25c]
add edi, eax
xor ebx, edi
mov edi, dword [edx]
add edi, ebx
mov ebx, edi
mov ebp, edi
mov dword [edx], edi
shr ebx, 5
shl ebp, 4
xor ebx, ebp
add ebx, edi
mov ebp, dword [esi]
mov edi, eax
and edi, 3
movzx edi, byte [edi + ecx + 0x25c]
add edi, eax
xor ebx, edi
add ebp, ebx
mov dword [esi], ebp
add eax, dword [ecx + 0x270]
mov edi, ebp
mov ebx, ebp
shr ebx, 5
shl ebp, 4
xor ebx, ebp
add ebx, edi
mov edi, eax
shr edi, 0xb
and edi, 3
movzx edi, byte [edi + ecx + 0x25c]
add edi, eax
xor ebx, edi
mov edi, dword [edx]
add edi, ebx
mov ebx, edi
mov ebp, edi
shr ebx, 5
mov dword [edx], edi
shl ebp, 4
xor ebx, ebp
mov ebp, dword [esi]
add ebx, edi
mov edi, eax
and edi, 3
movzx edi, byte [edi + ecx + 0x25c]
add edi, eax
xor ebx, edi
add ebp, ebx
mov dword [esi], ebp
add eax, dword [ecx + 0x270]
mov edi, ebp
mov ebx, ebp
shr ebx, 5
shl ebp, 4
xor ebx, ebp
add ebx, edi
mov edi, eax
shr edi, 0xb
and edi, 3
movzx edi, byte [edi + ecx + 0x25c]
add edi, eax
xor ebx, edi
mov edi, dword [edx]
add edi, ebx
mov ebx, edi
mov ebp, edi
mov dword [edx], edi
shr ebx, 5
shl ebp, 4
xor ebx, ebp
mov ebp, dword [esi]
add ebx, edi
mov edi, eax
and edi, 3
movzx edi, byte [edi + ecx + 0x25c]
add edi, eax
xor ebx, edi
add ebp, ebx
mov dword [esi], ebp
add eax, dword [ecx + 0x270]
mov edi, ebp
mov ebx, ebp
shr ebx, 5
shl ebp, 4
xor ebx, ebp
mov ebp, dword [edx]
add ebx, edi
mov edi, eax
shr edi, 0xb
and edi, 3
movzx edi, byte [edi + ecx + 0x25c]
add edi, eax
xor ebx, edi
mov edi, dword [esp + 0x10]
add ebp, ebx
dec edi
mov dword [edx], ebp
mov dword [esp + 0x10], edi
jne 0x463857
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x4639c0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [ecx + 0x26c]
mov edx, dword [esp + 0xc]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov dword [esp + 0x10], 8
jmp 0x4639e0
mov edi, dword [esi]
mov ebx, edi
mov ebp, edi
shr ebx, 5
shl ebp, 4
xor ebx, ebp
add ebx, edi
mov ebp, dword [edx]
mov edi, eax
shr edi, 0xb
and edi, 3
movzx edi, byte [edi + ecx + 0x25c]
add edi, eax
xor ebx, edi
sub ebp, ebx
mov dword [edx], ebp
sub eax, dword [ecx + 0x270]
mov edi, ebp
mov ebx, ebp
shr ebx, 5
shl ebp, 4
xor ebx, ebp
add ebx, edi
mov edi, eax
and edi, 3
movzx edi, byte [edi + ecx + 0x25c]
add edi, eax
xor ebx, edi
mov edi, dword [esi]
sub edi, ebx
mov ebx, edi
mov ebp, edi
mov dword [esi], edi
shr ebx, 5
shl ebp, 4
xor ebx, ebp
add ebx, edi
mov ebp, dword [edx]
mov edi, eax
shr edi, 0xb
and edi, 3
movzx edi, byte [edi + ecx + 0x25c]
add edi, eax
xor ebx, edi
sub ebp, ebx
mov dword [edx], ebp
sub eax, dword [ecx + 0x270]
mov edi, ebp
mov ebx, ebp
shr ebx, 5
shl ebp, 4
xor ebx, ebp
add ebx, edi
mov edi, eax
and edi, 3
movzx edi, byte [edi + ecx + 0x25c]
add edi, eax
xor ebx, edi
mov edi, dword [esi]
sub edi, ebx
mov ebx, edi
mov ebp, edi
mov dword [esi], edi
shr ebx, 5
shl ebp, 4
xor ebx, ebp
mov ebp, dword [edx]
add ebx, edi
mov edi, eax
shr edi, 0xb
and edi, 3
movzx edi, byte [edi + ecx + 0x25c]
add edi, eax
xor ebx, edi
sub ebp, ebx
mov dword [edx], ebp
sub eax, dword [ecx + 0x270]
mov edi, ebp
mov ebx, ebp
shr ebx, 5
shl ebp, 4
xor ebx, ebp
add ebx, edi
mov edi, eax
and edi, 3
movzx edi, byte [edi + ecx + 0x25c]
add edi, eax
xor ebx, edi
mov edi, dword [esi]
sub edi, ebx
mov ebx, edi
mov ebp, edi
mov dword [esi], edi
shr ebx, 5
shl ebp, 4
xor ebx, ebp
mov ebp, dword [edx]
add ebx, edi
mov edi, eax
shr edi, 0xb
and edi, 3
movzx edi, byte [edi + ecx + 0x25c]
add edi, eax
xor ebx, edi
sub ebp, ebx
mov dword [edx], ebp
sub eax, dword [ecx + 0x270]
mov edi, ebp
mov ebx, ebp
shr ebx, 5
shl ebp, 4
xor ebx, ebp
mov ebp, dword [esi]
add ebx, edi
mov edi, eax
and edi, 3
movzx edi, byte [edi + ecx + 0x25c]
add edi, eax
xor ebx, edi
mov edi, dword [esp + 0x10]
sub ebp, ebx
dec edi
mov dword [esi], ebp
mov dword [esp + 0x10], edi
jne 0x4639e0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8

Function at 0x468080
Capabilities:
Initialize winsock library

Disassembly:
xor eax, eax
sub esp, 0x190
push esi
mov esi, ecx
push edi
mov ecx, 0x1c82
lea edi, [esi + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea ecx, [esi + 0x7213]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
lea edx, [esi + 0x722b]
mov ecx, 0x40
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x19c]
test eax, eax
je 0x4680e4
mov dword [esi + 0x732c], 1
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4680d8
jmp 0x4680ee
mov dword [esi + 0x732c], 0
lea edx, [esp + 8]
push edx
push 0x202
mov dword [esi + 4], 0
mov dword [esi], 0xffffffff
call sub.WSOCK32.dll_WSAStartup
pop edi
mov eax, esi
pop esi
add esp, 0x190
ret 4
Function at 0x468088
Capabilities:
Initialize winsock library

Disassembly:
xor eax, eax
sub esp, 0x190
push esi
mov esi, ecx
push edi
mov ecx, 0x1c82
lea edi, [esi + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea ecx, [esi + 0x7213]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
lea edx, [esi + 0x722b]
mov ecx, 0x40
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x19c]
test eax, eax
je 0x4680e4
mov dword [esi + 0x732c], 1
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4680d8
jmp 0x4680ee
mov dword [esi + 0x732c], 0
lea edx, [esp + 8]
push edx
push 0x202
mov dword [esi + 4], 0
mov dword [esi], 0xffffffff
call sub.WSOCK32.dll_WSAStartup
pop edi
mov eax, esi
pop esi
add esp, 0x190
ret 4
Function at 0x468730
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x28
push ebx
push eax
mov ebx, ecx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x468754
mov dword [ebx + 4], 1
xor al, al
pop ebx
add esp, 0x28
ret 8
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
xor edx, edx
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
push esi
mov esi, dword [edx]
mov edx, ecx
push edi
shr ecx, 2
lea edi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x3c]
mov ax, word [eax + 8]
push ecx
mov word [esp + 0x28], ax
call sub.WSOCK32.dll_htons
mov word [esp + 0x26], ax
mov eax, dword [ebx + 0x732c]
test eax, eax
je 0x468804
lea edx, [ebx + 0x722b]
push edx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x4687d9
pop edi
pop esi
mov dword [ebx + 4], 1
xor al, al
pop ebx
add esp, 0x28
ret 8
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
mov esi, dword [edx]
mov edx, ecx
shr ecx, 2
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ax, word [eax + 8]
mov word [esp + 0x14], ax
mov word [esp + 0x16], 0
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
test eax, eax
mov dword [ebx], eax
jge 0x468827
pop edi
pop esi
mov dword [ebx + 4], 2
xor al, al
pop ebx
add esp, 0x28
ret 8
mov ecx, dword [ebx + 0x732c]
test ecx, ecx
je 0x468842
push 0x10
lea ecx, [esp + 0x18]
push ecx
push eax
call sub.WSOCK32.dll_bind
test eax, eax
jl 0x468882
push 8
lea edx, [esp + 0x10]
push edx
mov eax, 0x4e20
push 0x1006
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov eax, dword [ebx]
push 0xffff
push eax
call sub.WSOCK32.dll_setsockopt
mov edx, dword [ebx]
push 0x10
lea ecx, [esp + 0x28]
push ecx
push edx
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x468894
mov ecx, ebx
call fcn.004681b0
pop edi
pop esi
mov dword [ebx + 4], 3
xor al, al
pop ebx
add esp, 0x28
ret 8
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x28
ret 8