joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50f0e0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x50f106
mov eax, 0x1b
add esp, 0xc
ret
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x800c
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x50f13e
push eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esp + 4], 0
mov eax, 2
add esp, 0xc
ret
push dword [esp + 0x18]
call fcn.004bbad0
add esp, 4
push 0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [esp], 0x20
jne 0x50f195
push 0
lea eax, [esp + 4]
push eax
push dword [esp + 0x18]
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [esp + 8]
test eax, eax
je 0x50f1a4
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x50f1b5
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
add esp, 0xc
ret
Function at 0x50fdf0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0x14]
xor esi, esi
test edi, edi
je 0x50fe3b
mov cl, byte [ebx + esi]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [ebx + esi], cl
inc esi
cmp esi, edi
jb 0x50fe01
pop edi
pop esi
pop ebx
ret
Function at 0x5102c0
Capabilities:
Get hostname

Disassembly:
sub esp, 0x20
mov eax, dword [0x5e1040]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
mov esi, dword [esp + 0x2c]
xor ebx, ebx
push edi
xor edi, edi
mov dword [esp + 0xc], ebx
test byte [esi + 0x44], 1
jne 0x5102e9
mov dword [esi], 0x100
cmp dword [esi + 0x38], ebx
jne 0x5102f5
mov dword [esi + 0x38], 0x4d0
cmp dword [esi + 4], ebx
jne 0x510301
mov dword [esi + 4], 0x7d0
cmp dword [esi + 8], ebx
jne 0x51030d
mov dword [esi + 8], 3
push dword [esi + 0x84]
call fcn.00514030
add esp, 4
test eax, eax
jne 0x5103aa
test dword [esi], 0x200
je 0x510342
pop edi
pop esi
mov eax, 0x1a
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004224b5
add esp, 0x20
ret
push 0x7f000001
mov dword [esp + 0x18], 2
call dword [sym.imp.WS2_32.dll_htonl]
push 0
push 0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
push 0
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00512750
add esp, 0x14
test eax, eax
jne 0x5104b5
push eax
push dword [esp + 0x10]
push esi
call fcn.00512b40
push dword [esp + 0x18]
mov ebx, eax
call fcn.005139a0
add esp, 0x10
test ebx, ebx
je 0x5103aa
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004224b5
add esp, 0x20
ret
push ebp
cmp dword [esi + 0x28], edi
jne 0x510477
mov ebp, 0x40
mov dword [esi + 0x28], edi
push ebp
mov dword [esp + 0x18], ebp
call dword [0x5e15e8]
mov edi, eax
add esp, 4
test edi, edi
jne 0x5103e6
lea eax, [ebp - 0x31]
pop ebp
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004224b5
add esp, 0x20
ret
push ebp
push edi
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x51041f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x271e
jne 0x510423
mov eax, dword [esp + 0x14]
add ebp, ebp
add eax, eax
push eax
push edi
mov dword [esp + 0x1c], eax
call dword [0x5e15ec]
add esp, 8
test eax, eax
je 0x510449
mov edi, eax
jmp 0x5103e6
test eax, eax
je 0x510426
mov byte [edi], 0
push 0x2e
push edi
call fcn.00548670
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x510477
push 4
call dword [0x5e15e8]
add esp, 4
mov dword [esi + 0x24], eax
test eax, eax
jne 0x510450
mov ebx, 0xf
jmp 0x5104a4
lea eax, [ebp + 1]
push eax
call fcn.005146c0
mov ecx, dword [esi + 0x24]
add esp, 4
mov dword [ecx], eax
mov eax, dword [esi + 0x24]
cmp dword [eax], 0
jne 0x510470
mov ebx, 0xf
jmp 0x5104a4
mov dword [esi + 0x28], 1
cmp dword [esi + 0x30], 0
jne 0x510484
mov dword [esi + 0x2c], 0
cmp dword [esi + 0x34], 0
jne 0x5104a4
push 0x59aea0
call fcn.005146c0
add esp, 4
mov dword [esi + 0x34], eax
test eax, eax
mov ecx, 0xf
cmove ebx, ecx
test edi, edi
je 0x5104b2
push edi
call dword [0x5e15f0]
add esp, 4
mov eax, ebx
pop ebp
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004224b5
add esp, 0x20
ret
Function at 0x5149d0
Capabilities:
Generate random numbers via rtlgenrandom
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [ebx]
xor esi, esi
sub eax, 1
je 0x514ad0
sub eax, 1
je 0x514a7c
sub eax, 2
jne 0x514ab0
mov ecx, dword [ebx + 0x10c]
mov eax, dword [ebx + 0x108]
mov dword [esp + 0x10], ecx
test edi, edi
je 0x514a6a
inc eax
movzx eax, al
mov dword [esp + 0x18], eax
mov ebp, dword [esp + 0x18]
mov cl, byte [eax + ebx + 8]
mov eax, dword [esp + 0x10]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [esp + 0x10], eax
movzx eax, byte [eax + ebx + 8]
mov byte [ebx + ebp + 8], al
mov eax, dword [esp + 0x10]
mov byte [eax + ebx + 8], cl
mov eax, ebp
mov ebp, dword [esp + 0x1c]
movzx eax, byte [eax + ebx + 8]
add eax, edx
movzx eax, al
movzx eax, byte [eax + ebx + 8]
mov byte [esi + ebp], al
inc esi
mov eax, dword [esp + 0x18]
cmp esi, edi
jb 0x514a14
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword [ebx + 0x108], eax
mov dword [ebx + 0x10c], ecx
pop ebx
pop ecx
ret
push dword [ebx + 8]
push edi
push 1
push ebp
call fcn.0054ca9a
add esp, 0x10
test eax, eax
je 0x514ab0
nop
add esi, eax
cmp esi, edi
je 0x514ad7
push dword [ebx + 8]
mov eax, edi
sub eax, esi
push eax
lea eax, [esi + ebp]
push 1
push eax
call fcn.0054ca9a
add esp, 0x10
test eax, eax
jne 0x514a90
mov eax, dword [ebx]
sub eax, 2
jne 0x514ac2
push dword [ebx + 8]
call fcn.0054b86c
add esp, 4
push ebx
call fcn.005147c0
add esp, 4
jmp 0x5149e1
push edi
push ebp
call sub.ADVAPI32.dll_SystemFunction036
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x515300
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x14]
lea eax, [esp + 4]
push eax
push 0
push 0
push 0
push dword [esp + 0x20]
mov dword [esp + 0x18], 0
push dword [esp + 0x20]
mov dword [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x515338
cmp eax, 0xea
jne 0x515395
mov eax, dword [esp + 4]
test eax, eax
je 0x515395
inc eax
push eax
call dword [0x5e15e8]
add esp, 4
mov dword [esi], eax
test eax, eax
je 0x515395
lea ecx, [esp + 4]
push ecx
push eax
push 0
push 0
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x515384
mov ecx, dword [esp + 4]
cmp ecx, 1
je 0x515384
mov eax, dword [esi]
pop esi
mov byte [ecx + eax], 0
mov eax, 1
pop ecx
ret
push dword [esi]
call dword [0x5e15f0]
add esp, 4
mov dword [esi], 0
xor eax, eax
pop esi
pop ecx
ret
Function at 0x516770
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push edi
test ebx, ebx
je 0x5167db
mov edi, dword [esp + 0xc]
test edi, edi
je 0x5167db
push esi
push 0x14
call fcn.0050fff0
mov esi, eax
add esp, 4
test esi, esi
jne 0x51679a
lea eax, [esi + 0xf]
pop esi
pop edi
pop ebx
ret
mov eax, dword [esp + 0x18]
mov dword [esi + 0xc], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x5167f0
push 0
push 0
mov dword [esi + 8], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
jne 0x5167d3
push esi
call dword [0x5e15f0]
add esp, 4
mov eax, 3
pop esi
pop edi
pop ebx
ret
mov dword [edi], esi
xor eax, eax
pop esi
pop edi
pop ebx
ret
pop edi
mov eax, 2
pop ebx
ret

Function at 0x517a30
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
test eax, eax
je 0x517b1d
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x517b1d
push esi
push edi
push 0x5861fc
push eax
call fcn.0054b649
mov edi, eax
add esp, 8
test edi, edi
jne 0x517a85
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 2
je 0x517a7a
sub eax, 1
je 0x517a7a
mov esi, 0xe
pop edi
mov eax, esi
pop esi
pop ebx
ret
mov esi, 4
pop edi
mov eax, esi
pop esi
pop ebx
ret
push 2
push 0
push edi
call fcn.0054cf00
add esp, 0xc
test eax, eax
je 0x517aaa
push edi
mov esi, 0xe
call fcn.0054b86c
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
ret
push edi
call fcn.0054c896
mov esi, eax
add esp, 4
test esi, esi
js 0x517a96
push 0
push 0
push edi
call fcn.0054cf00
add esp, 0xc
test eax, eax
jne 0x517a96
test esi, esi
je 0x517af8
push esi
push ebx
call fcn.005175d0
add esp, 8
test eax, eax
jne 0x517b09
mov eax, dword [ebx + 8]
add eax, dword [ebx + 4]
je 0x517b09
push edi
push esi
push 1
push eax
call fcn.0054ca9a
add esp, 0x10
cmp eax, esi
jne 0x517a96
add dword [ebx + 4], esi
push edi
xor esi, esi
call fcn.0054b86c
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
ret
mov esi, 0xf
push edi
call fcn.0054b86c
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
ret
mov eax, 2
pop ebx
ret
Function at 0x518c40
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x250
mov eax, dword [0x5e1040]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
mov ebx, dword [esp + 0x258]
push edi
xor edi, edi
mov dword [esp + 0x10], ebx
mov eax, dword [ebx + 0xc0]
test eax, eax
je 0x518c80
push eax
call fcn.005146c0
mov edi, eax
add esp, 4
test edi, edi
je 0x518d8e
cmp dword [esp + 0x260], 0
je 0x518cb0
test edi, edi
je 0x518c98
push edi
call dword [0x5e15f0]
add esp, 4
push str.CARES_HOSTS
call fcn.0056378d
push eax
call fcn.005146c0
add esp, 8
jmp 0x518d88
test edi, edi
jne 0x518daa
push 0x103
lea eax, [esp + 0x51]
mov byte [esp + 0x50], 0
push edi
push eax
call fcn.00547c40
add esp, 0xc
mov dword [esp + 0xc], 0x104
lea eax, [esp + 8]
push eax
push 0x20019
push edi
push str.SystemCurrentControlSetServicesTcpipParameters
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x518d11
lea eax, [edi + 4]
pop edi
pop ebx
mov ecx, dword [esp + 0x24c]
xor ecx, esp
call fcn.004224b5
add esp, 0x250
ret
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x154]
push eax
push 0
push 0
push str.DatabasePath
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x104
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x4c]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x518d58
mov eax, dword [str.hosts]
mov dword [ecx], eax
mov ax, word [0x59b1fc]
mov word [ecx + 4], ax
mov al, byte [0x59b1fe]
mov byte [ecx + 6], al
lea eax, [esp + 0x4c]
push eax
call fcn.005146c0
add esp, 4
mov edi, eax
test edi, edi
jne 0x518daa
pop edi
mov eax, 0xf
pop ebx
mov ecx, dword [esp + 0x24c]
xor ecx, esp
call fcn.004224b5
add esp, 0x250
ret
push ebp
mov ebp, dword [ebx + 0xc8]
lea eax, [esp + 0x20]
push esi
push eax
xorps xmm0, xmm0
push edi
movlpd qword [esp + 0x24], xmm0
call fcn.00562cd0
add esp, 8
test eax, eax
jne 0x518dd7
mov ebx, dword [esp + 0x44]
mov esi, dword [esp + 0x48]
jmp 0x518ddf
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
test ebp, ebp
je 0x518e18
mov eax, ebx
or eax, esi
jne 0x518dfc
push eax
call fcn.0055315f
add esp, 4
mov ebx, eax
sub ebx, 0x3c
mov esi, edx
sbb esi, 0
push edi
push dword [ebp + 8]
call fcn.0051efb0
add esp, 8
test eax, eax
jne 0x518e18
cmp dword [ebp + 4], esi
jg 0x518e68
jl 0x518e18
cmp dword [ebp], ebx
ja 0x518e68
mov ebx, dword [esp + 0x18]
add ebx, 0xc8
mov esi, dword [ebx]
test esi, esi
je 0x518e4b
push dword [esi + 8]
call dword [0x5e15f0]
push dword [esi + 0x10]
call fcn.005143a0
push dword [esi + 0xc]
call fcn.005143a0
push esi
call dword [0x5e15f0]
add esp, 0x10
push ebx
push edi
mov dword [ebx], 0
call fcn.00518f60
push edi
mov esi, eax
call dword [0x5e15f0]
add esp, 0xc
mov eax, esi
jmp 0x518e74
push edi
call dword [0x5e15f0]
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x25c]
pop esi
pop ebp
pop edi
pop ebx
xor ecx, esp
call fcn.004224b5
add esp, 0x250
ret
Function at 0x51af60
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x5c
mov eax, dword [0x5e1040]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x60]
push ebp
mov ebp, dword [esp + 0x6c]
push esi
mov esi, dword [esp + 0x6c]
cmp eax, 2
jne 0x51af94
push 4
push ebp
push esi
call fcn.0051ac00
add esp, 0xc
mov esi, eax
jmp 0x51b091
cmp eax, 0x17
jne 0x51b0ce
push esi
call fcn.00514710
add esp, 4
cmp eax, 0x46
jb 0x51afbe
push 0x2738
call dword [sym.imp.KERNEL32.dll_SetLastError]
or esi, 0xffffffff
jmp 0x51b091
push edi
push 0x46
lea eax, [esp + 0x20]
push esi
push eax
call fcn.00514660
lea eax, [esp + 0x28]
push 0x2f
push eax
call fcn.00548670
mov edi, eax
add esp, 0x14
test edi, edi
je 0x51afe5
mov byte [edi], 0
inc edi
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0051b0f0
add esp, 8
cmp eax, 1
je 0x51b004
or esi, 0xffffffff
jmp 0x51b090
push ebx
test edi, edi
jne 0x51b025
mov esi, 0x80
lea eax, [esi + 7]
shr eax, 3
push eax
lea eax, [esp + 0x14]
push eax
push ebp
call fcn.00547de0
add esp, 0xc
jmp 0x51b08f
mov al, byte [edi]
xor esi, esi
xor ebx, ebx
test al, al
je 0x51b084
nop
movsx eax, al
lea edi, [edi + 1]
push eax
push 0x59b244
call fcn.00548670
add esp, 8
test eax, eax
je 0x51b084
mov ecx, ebx
inc ebx
test ecx, ecx
je 0x51b053
test esi, esi
je 0x51b084
lea esi, [esi + esi*4]
add esi, esi
sub esi, 0x59b244
add esi, eax
cmp esi, 0x80
ja 0x51b084
mov al, byte [edi]
test al, al
jne 0x51b030
test ebx, ebx
je 0x51b084
lea eax, [esi + 7]
shr eax, 3
cmp eax, 0x10
jbe 0x51b014
push 0x2738
jmp 0x51b086
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
or esi, 0xffffffff
pop ebx
pop edi
cmp esi, 0xffffffff
jne 0x51b0b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x51b0b4
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.004224b5
add esp, 0x5c
ret
sar esi, 0x1f
and esi, 0xfffffffe
lea eax, [esi + 1]
pop esi
pop ebp
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.004224b5
add esp, 0x5c
ret
push 0x273f
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x60]
or eax, 0xffffffff
pop esi
pop ebp
xor ecx, esp
call fcn.004224b5
add esp, 0x5c
ret
Function at 0x51bc90
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x1c
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
push edi
xor edi, edi
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x51be67
mov eax, dword [eax + 0x1c]
mov ebx, edi
inc edi
mov dword [esp + 0x20], ebx
test eax, eax
jne 0x51bca7
test edi, edi
je 0x51be67
lea eax, [edi + edi*4]
shl eax, 3
push esi
push eax
mov dword [esp + 0x2c], eax
call dword [0x5e15e8]
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
test esi, esi
jne 0x51bce7
lea eax, [esi + 0xf]
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x1c
ret
mov ebp, dword [ebp + 0x1c]
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebp
test edi, edi
je 0x51bdec
mov ebx, dword [esp + 0x30]
lea ecx, [esi + 0x24]
mov dword [esp + 0x10], ecx
mov dword [ecx], eax
mov dword [ecx - 0x24], ebp
mov ebp, dword [ebp + 0x18]
movzx ecx, word [ebp]
mov eax, ecx
sub eax, 2
je 0x51bd2d
sub eax, 0x15
je 0x51bd26
xor eax, eax
jmp 0x51bdba
mov eax, 0x1c
jmp 0x51bd32
mov eax, 0x10
push 0x11
push 2
push ecx
push ebx
mov dword [esp + 0x24], eax
call fcn.0051f520
mov esi, eax
add esp, 0x10
cmp esi, 0xffffffff
jne 0x51bd60
call fcn.0055e816
cmp dword [eax], 0x273f
jne 0x51be4d
xor eax, eax
jmp 0x51bdba
push dword [esp + 0x14]
push ebp
push esi
push ebx
call fcn.0051f000
add esp, 0x10
cmp eax, 0xffffffff
jne 0x51bd8f
call fcn.0055e816
cmp dword [eax], 0x2714
je 0x51bd60
push esi
push ebx
call fcn.0051efc0
add esp, 8
xor eax, eax
jmp 0x51bdba
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
add eax, 0xffffffe4
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
push esi
push ebx
test eax, eax
jne 0x51be45
call fcn.0051efc0
add esp, 8
mov eax, 1
mov ecx, dword [esp + 0x10]
mov ebp, dword [esp + 0x1c]
mov dword [ecx - 0x20], eax
add ecx, 0x28
mov eax, dword [esp + 0x18]
mov ebp, dword [ebp + 0x1c]
inc eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], ebp
cmp eax, edi
jb 0x51bd07
mov ebx, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
push 0x51c130
push 0x28
push edi
push esi
call fcn.0055f910
mov ecx, dword [esp + 0x44]
add esp, 0x10
mov eax, dword [esi]
mov dword [ecx + 0x1c], eax
test ebx, ebx
je 0x51be22
mov ecx, esi
nop dword [eax]
mov eax, dword [ecx + 0x28]
lea edx, [ecx + 0x28]
mov ecx, dword [ecx]
mov dword [ecx + 0x1c], eax
lea ecx, [edx]
sub ebx, 1
jne 0x51be10
mov eax, dword [esp + 0x28]
push esi
mov eax, dword [eax + esi - 0x28]
mov dword [eax + 0x1c], 0
call dword [0x5e15f0]
add esp, 4
xor eax, eax
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x1c
ret
call fcn.0051efc0
add esp, 8
push dword [esp + 0x20]
call dword [0x5e15f0]
add esp, 4
mov eax, 4
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x1c
ret
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret
Function at 0x51f000
Capabilities:
Connect socket

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0xb4]
test eax, eax
je 0x51f02d
mov eax, dword [eax + 8]
test eax, eax
je 0x51f02d
push dword [ecx + 0xb8]
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x14]
call eax
add esp, 0x10
ret
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_connect]
ret
Function at 0x51f560
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0xb4]
test eax, eax
je 0x51f593
mov eax, dword [eax + 0xc]
test eax, eax
je 0x51f593
push dword [ecx + 0xb8]
push 0
push 0
push 0
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call eax
add esp, 0x1c
ret
push 0
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x14]
call dword [sym.imp.WS2_32.dll_recv]
ret

Function at 0x51f5b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0xb4]
test eax, eax
je 0x51f5e9
mov eax, dword [eax + 0xc]
test eax, eax
je 0x51f5e9
push dword [ecx + 0xb8]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call eax
add esp, 0x1c
ret
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.WS2_32.dll_recvfrom]
ret

Function at 0x51f610
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 8
mov eax, dword [ecx + 0xb4]
test eax, eax
je 0x51f652
mov edx, dword [eax + 0x10]
test edx, edx
je 0x51f652
push dword [ecx + 0xb8]
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
lea eax, [esp + 4]
push 1
push eax
push dword [esp + 0x1c]
call edx
add esp, 0x10
add esp, 8
ret
push 0
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
add esp, 8
ret

Function at 0x51feb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edx, dword [esp + 0xc]
xor ecx, ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
test esi, esi
je 0x51fed5
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x51fec4
pop edi
mov eax, edx
pop esi
ret

Function at 0x51fee0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
push esi
xor esi, esi
push edi
mov edi, dword [esp + 0x1c]
test ebx, ebx
je 0x51ff13
movzx eax, byte [esi + ebp]
push eax
call fcn.00514620
movzx eax, al
inc esi
xor eax, edi
add esp, 4
imul edi, eax, 0x1000193
cmp esi, ebx
jb 0x51fef6
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x524860
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov eax, 1
push esi
push edi
mov ecx, 0x3020100
mov edx, dword [ebp + 0x10c]
mov dword [ebp + 0x114], 0x3020100
add ecx, 0x4040404
mov dword [ebp + eax*4 + 0x114], ecx
inc eax
cmp eax, edx
jbe 0x524882
mov ebx, dword [esp + 0x18]
xor edi, edi
xor esi, esi
test ebx, ebx
je 0x5248da
mov edx, dword [esp + 0x14]
movzx eax, byte [edx + esi]
or edi, eax
mov cl, byte [eax + ebp + 0x114]
mov byte [edx + esi], cl
mov byte [ebp + 0x113], cl
nop word [eax + eax]
mov cl, byte [eax + ebp + 0x113]
mov edx, eax
sub eax, 1
mov byte [edx + ebp + 0x114], cl
jns 0x5248c0
inc esi
cmp esi, ebx
jb 0x5248a0
shr edi, 2
mov dword [ebp + 0x10c], edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x532850
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x18]
and ebp, 0x1f
push edi
mov edi, dword [esp + 0x20]
cmp ebp, 8
jb 0x53296d
mov eax, ebp
shr eax, 3
cmp dword [esp + 0x28], 1
jne 0x5328f0
mov dword [esp + 0x10], eax
push 0xc2b2ae3d
push 0x27d4eb4f
push dword [edi + 4]
push dword [edi]
call fcn.005784a0
mov ecx, eax
add edi, 8
push 0x9e3779b1
shld ecx, edx, 0x1f
shld edx, eax, 0x1f
push 0x85ebca87
push edx
push ecx
call fcn.005784a0
mov ecx, eax
xor edx, esi
xor ecx, ebx
mov eax, ecx
push 0x9e3779b1
shld eax, edx, 0x1b
shld edx, ecx, 0x1b
push 0x85ebca87
push edx
push eax
call fcn.005784a0
mov ebx, eax
mov esi, edx
add ebx, 0xc2b2ae63
adc esi, 0x85ebca77
sub ebp, 8
sub dword [esp + 0x10], 1
jne 0x532881
jmp 0x53296d
mov dword [esp + 0x10], eax
nop dword [eax]
nop dword [eax + eax]
push 0xc2b2ae3d
push 0x27d4eb4f
push dword [edi + 4]
push dword [edi]
call fcn.005784a0
mov ecx, eax
add edi, 8
push 0x9e3779b1
shld ecx, edx, 0x1f
shld edx, eax, 0x1f
push 0x85ebca87
push edx
push ecx
call fcn.005784a0
mov ecx, eax
xor edx, esi
xor ecx, ebx
mov eax, ecx
push 0x9e3779b1
shld eax, edx, 0x1b
shld edx, ecx, 0x1b
push 0x85ebca87
push edx
push eax
call fcn.005784a0
mov ebx, eax
mov esi, edx
add ebx, 0xc2b2ae63
adc esi, 0x85ebca77
sub ebp, 8
sub dword [esp + 0x10], 1
jne 0x532900
mov eax, ebp
mov edx, edi
mov dword [esp + 0x20], eax
cmp ebp, 4
jb 0x5329d4
cmp dword [esp + 0x28], 1
mov eax, edx
mov ecx, dword [eax]
jne 0x532985
add eax, 4
mov dword [esp + 0x20], eax
mov eax, 0x9e3779b1
mul ecx
push 0xc2b2ae3d
mov edi, eax
mov eax, 0x85ebca87
mul ecx
push 0x27d4eb4f
add edi, edx
xor eax, ebx
xor edi, esi
mov ecx, eax
shld ecx, edi, 0x17
shld edi, eax, 0x17
push edi
push ecx
call fcn.005784a0
mov edi, dword [esp + 0x20]
mov ebx, eax
add ebx, 0x9e3779f9
mov esi, edx
adc esi, 0x165667b1
sub ebp, 4
test ebp, ebp
je 0x532a20
nop dword [eax + eax]
movzx eax, byte [edi]
push 0x27d4eb2f
cdq
push 0x165667c5
push edx
push eax
call fcn.005784a0
xor ebx, eax
lea edi, [edi + 1]
xor esi, edx
mov eax, ebx
push 0x9e3779b1
shld eax, esi, 0xb
push 0x85ebca87
shld esi, ebx, 0xb
push esi
push eax
call fcn.005784a0
mov ebx, eax
mov esi, edx
sub ebp, 1
jne 0x5329e0
push 0xc2b2ae3d
xor ecx, ecx
mov edx, esi
push 0x27d4eb4f
shr edx, 1
xor ecx, esi
xor edx, ebx
push ecx
push edx
call fcn.005784a0
mov esi, eax
mov ecx, edx
shrd esi, ecx, 0x1d
push 0x165667b1
shr ecx, 0x1d
xor esi, eax
push 0x9e3779f9
xor ecx, edx
push ecx
push esi
call fcn.005784a0
mov ecx, edx
xor esi, esi
pop edi
xor eax, ecx
xor edx, esi
pop esi
pop ebp
pop ebx
pop ecx
ret