joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47c310
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x2c14
call fcn.00462620
mov eax, dword [0x4a30f8]
xor eax, esp
mov dword [esp + 0x2c10], eax
mov eax, dword [esp + 0x2c18]
push edi
xor edi, edi
mov dword [esp + 0xc], eax
cmp eax, edi
je 0x47c47b
cmp dword [esp + 0x2c20], edi
je 0x47c47b
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
mov dword [esp + 0x10], edi
xor ebx, ebx
lea ebx, [ebx]
push ebx
push str..PhysicalDrive_d
lea eax, [esp + 0x30]
push 0x100
push eax
call fcn.00443800
add esp, 0x10
push edi
push edi
push 3
push edi
push 3
push edi
lea ecx, [esp + 0x40]
push ecx
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x47c454
xor eax, eax
push 0x2710
lea edx, [esp + 0x514]
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push edx
mov dword [esp + 0x20], edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call fcn.00461880
add esp, 0xc
push edi
lea eax, [esp + 0x18]
push eax
push 0x2710
lea ecx, [esp + 0x51c]
push ecx
push 0xc
lea edx, [esp + 0x30]
push edx
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x47c447
push 0x3e8
lea eax, [esp + 0x12c]
push edi
push eax
call fcn.00461880
mov edx, dword [esp + 0x534]
lea ecx, [esp + 0x134]
push ecx
push 1
push edx
lea eax, [esp + 0x528]
push eax
call fcn.0047da40
mov edx, dword [esp + 0x2c48]
mov eax, dword [esp + 0x34]
add esp, 0x1c
lea ecx, [esp + 0x128]
push ecx
push edx
push eax
call fcn.0047bc90
test eax, eax
jne 0x47c447
mov dword [esp + 0x10], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], edi
jne 0x47c45e
inc ebx
cmp ebx, 0x10
jl 0x47c360
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
mov ecx, dword [esp + 0x2c10]
xor ecx, esp
call fcn.00461862
add esp, 0x2c14
ret
mov ecx, dword [esp + 0x2c14]
pop edi
xor ecx, esp
xor eax, eax
call fcn.00461862
add esp, 0x2c14
ret
Function at 0x47c720
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x2ec
mov eax, dword [0x4a30f8]
xor eax, esp
mov dword [esp + 0x2e8], eax
push edi
mov edi, dword [esp + 0x2f4]
mov dword [esp + 0x18], edi
test edi, edi
je 0x47c921
cmp dword [esp + 0x2f8], 0
je 0x47c921
push 0x64
lea eax, [esp + 0x20]
push 0
push eax
call fcn.00461880
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push 8
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47c8e8
mov ecx, dword [esp + 4]
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x100]
push eax
push ebx
mov esi, 0x104
push ecx
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x47c8db
lea ebx, [ebx]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push 1
push 0
lea eax, [esp + 0xf8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47c8a9
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x1f4]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0
push str.ServiceName
push edx
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x47c89e
push 0x64
push eax
lea eax, [esp + 0x90]
push eax
call fcn.00461880
lea ecx, [esp + 0x1fc]
push 0x64
push ecx
lea edi, [esp + 0x9c]
call fcn.0047c610
add esp, 0x14
test eax, eax
je 0x47c89e
cmp byte [esp + 0x24], 0
je 0x47c862
lea edx, [esp + 0x24]
push edx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jge 0x47c89e
lea eax, [esp + 0x24]
lea esi, [esp + 0x88]
mov ecx, eax
mov edx, 0x64
sub esi, ecx
lea ecx, [edx + 0x7fffff9a]
test ecx, ecx
je 0x47c891
mov cl, byte [esi + eax]
test cl, cl
je 0x47c891
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x47c876
jmp 0x47c895
test edx, edx
jne 0x47c896
dec eax
mov byte [eax], 0
mov esi, 0x104
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0xc]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x100]
push ecx
inc ebx
push ebx
push edx
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x47c7c0
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
cmp byte [esp + 0x1c], 0
je 0x47c921
mov edx, dword [esp + 0x2f8]
lea ecx, [esp + 0x1c]
push ecx
push edx
push edi
call fcn.0047bc90
xor ecx, ecx
test eax, eax
setge cl
pop edi
mov eax, ecx
mov ecx, dword [esp + 0x2e8]
xor ecx, esp
call fcn.00461862
add esp, 0x2ec
ret
mov ecx, dword [esp + 0x2ec]
pop edi
xor ecx, esp
xor eax, eax
call fcn.00461862
add esp, 0x2ec
ret
Function at 0x47cb90
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x50c
mov eax, dword [0x4a30f8]
xor eax, esp
mov dword [esp + 0x508], eax
push ebp
mov ebp, dword [esp + 0x514]
test edi, edi
je 0x47cd0d
cmp ebp, 0x20
jb 0x47cd0d
push 0x400
lea eax, [esp + 0x110]
push 0
push eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0x400
call fcn.00461880
add esp, 0xc
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x110]
push edx
lea eax, [esp + 0x10]
push eax
push 0x490f64
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x47cd0d
lea eax, [esp + 0x10c]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47cc20
sub eax, edx
cmp eax, 0x40
jne 0x47cd0d
push ebx
lea edx, [eax + 0x40]
push esi
lea eax, [esp + 0x14]
lea esi, [esp + 0x114]
mov ecx, eax
sub esi, ecx
lea ecx, [edx - 0x60]
test ecx, ecx
je 0x47cc5e
mov cl, byte [esi + eax]
test cl, cl
je 0x47cc5e
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x47cc46
jmp 0x47cc62
test edx, edx
jne 0x47cc63
dec eax
mov byte [eax], 0
lea eax, [esp + 0x94]
lea edx, [esp + 0x134]
mov ecx, eax
mov esi, 0x80
sub edx, ecx
lea ecx, [ecx]
lea ecx, [esi + 0x7fffff7e]
test ecx, ecx
je 0x47cc9b
mov cl, byte [edx + eax]
test cl, cl
je 0x47cc9b
mov byte [eax], cl
inc eax
sub esi, 1
jne 0x47cc80
jmp 0x47cc9f
test esi, esi
jne 0x47cca0
dec eax
push 0x400
lea edx, [esp + 0x118]
push 0
push edx
mov byte [eax], 0
call fcn.00461880
push 0x400
lea ebx, [esp + 0x124]
lea ecx, [esp + 0x24]
call fcn.0047bd90
add esp, 0x10
lea eax, [esp + 0x94]
push eax
mov ecx, ebx
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
pop esi
pop ebx
test eax, eax
jne 0x47cd0d
lea edx, [esp + 0xc]
push edx
push ebp
push edi
call fcn.0047bc90
neg eax
sbb eax, eax
inc eax
pop ebp
mov ecx, dword [esp + 0x508]
xor ecx, esp
call fcn.00461862
add esp, 0x50c
ret
mov ecx, dword [esp + 0x50c]
pop ebp
xor ecx, esp
xor eax, eax
call fcn.00461862
add esp, 0x50c
ret

Function at 0x47cd30
Capabilities:
Set registry value

Disassembly:
sub esp, 0x188
mov eax, dword [0x4a30f8]
xor eax, esp
mov dword [esp + 0x184], eax
push ebx
push esi
push 0x80
lea eax, [esp + 0xc]
push 0
push eax
mov esi, ecx
call fcn.00461880
push 0x80
lea ebx, [esp + 0x18]
mov ecx, esi
call fcn.0047bd90
lea eax, [esp + 0x98]
mov ecx, eax
add esp, 0x10
mov edx, 0x104
sub esi, ecx
lea esp, [esp]
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x47cd9b
mov cl, byte [esi + eax]
test cl, cl
je 0x47cd9b
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x47cd80
jmp 0x47cd9f
test edx, edx
jne 0x47cda0
dec eax
lea edx, [esp + 8]
push edx
mov byte [eax], 0
push 0x104
lea eax, [esp + 0x90]
push eax
call fcn.0047bd00
lea eax, [esp + 0x88]
pop esi
lea edx, [eax + 1]
pop ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47cdc6
sub eax, edx
push eax
lea ecx, [esp + 0x84]
push ecx
push 1
push 0x490f64
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ecx, dword [esp + 0x184]
xor ecx, esp
call fcn.00461862
add esp, 0x188
ret
Function at 0x1df4437
Capabilities:
Encode data using xor

Disassembly:
pushfd
add ecx, 1
bt bp, si
push dword [esp]
clc
test ah, ah
call fcn.01705f41
jbe 0x1defd07
push eax
adc ah, byte [ecx]
push ebx
xor dword [edx], ecx
add eax, 0x7ddebd2e
mov ch, byte [ecx]
push ds
lodsd eax, dword [esi]
mov ch, byte [ecx]
push es
mov ch, 0x96
inc ebp
push cs
mov al, 3
mov al, 0x8b
sub byte [ebx], cl
imul eax, dword [edi - 0x6910f044], 0xffffffe4
test dword [ecx - 0x12], esp
pushfd
dec esi
or al, dh
inc ebp
test byte [ecx + 0x26d356e5], dh
fistp word [eax]
inc edi
lds eax, [0xf3d71c58]
xor al, 0xb2
xor ebx, ecx
sti
sbb ch, byte [0x2dbc2dbc]
dec edx
mov dword [0xde0369bc], eax
popal
movsb byte es:[edi], byte [esi]
mov ecx, ecx
dec edi
mov ss, esi
add eax, 0x14f0e991
std
adc al, 0x2f
xchg ebx, eax
cmp edi, dword [edi + ebp*4 - 0x58]
sub eax, ecx
cmp dword [ebp - 0x2e474478], edx
mov esp, 0xba4d9743
arpl word [edi], si
jno 0x1defd54
lodsd eax, dword [esi]
and eax, 0x9ea15f9c
insw word es:[edi], dx
shr dword [edi - 0xe], cl
pushfd
sub edi, ecx
in al, 0xa6
out 0x29, eax
aam 0x7a
push ebp
xchg dword [edi + 0x743171ee], edx
in al, dx
adc dword [ebx - 0x1c], esp
inc edx
iretd
mov byte [ecx], al
pushfd
jmp 0x1defd31

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x401010
Capabilities:
Encrypt data using blowfish

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x40
push ebx
push ebp
mov ebp, ecx
mov ebx, dword [esp + 0x50]
mov ecx, dword [eax]
cmp ebx, 1
mov dword [ebp], ecx
mov edx, dword [eax + 4]
mov dword [ebp + 4], edx
mov ecx, dword [eax]
mov dword [ebp + 8], ecx
mov edx, dword [eax + 4]
mov dword [ebp + 0xc], edx
jb 0x40115b
cmp ebx, 0x38
jbe 0x401048
mov ebx, 0x38
mov ecx, ebx
push esi
mov esi, dword [esp + 0x50]
mov eax, ecx
push edi
lea edi, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [ebp + 0x10]
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x12
mov esi, 0x4141e8
mov edi, edx
mov dword [esp + 0x58], 0x12
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp + 0x58]
mov ecx, 0x400
mov esi, 0x414230
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x18]
mov esi, edx
xor edx, edx
mov dword [esp + 0x5c], 4
mov edi, edx
xor edx, edx
mov dl, byte [ecx]
shl edi, 8
or edx, edi
inc ecx
inc eax
cmp eax, ebx
jne 0x4010b3
xor eax, eax
lea ecx, [esp + 0x18]
mov edi, dword [esp + 0x5c]
dec edi
mov dword [esp + 0x5c], edi
jne 0x40109c
mov edi, dword [esi]
add esi, 4
xor edi, edx
mov edx, dword [esp + 0x58]
mov dword [esi - 4], edi
dec edx
mov dword [esp + 0x58], edx
jne 0x401092
xor edi, edi
lea esi, [ebp + 0x10]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebp
call fcn.00401170
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esi], edx
add esi, 4
inc edi
mov dword [esi], eax
inc edi
add esi, 4
cmp edi, 0x12
jb 0x4010e0
lea eax, [ebp + 0x58]
mov dword [esp + 0x5c], 4
mov ebx, eax
xor edi, edi
mov esi, ebx
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebp
call fcn.00401170
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esi], edx
add esi, 4
inc edi
mov dword [esi], eax
inc edi
add esi, 4
cmp edi, 0x100
jl 0x401116
mov eax, dword [esp + 0x5c]
add ebx, 0x400
dec eax
mov dword [esp + 0x5c], eax
jne 0x401112
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc
mov eax, ebp
pop ebp
pop ebx
add esp, 0x40
ret 0xc
Function at 0x401dd0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x401e08
mov ax, word [esp]
cmp al, 1
jne 0x401e02
xor ecx, ecx
mov cl, ah
cmp cl, al
jne 0x401e02
add esp, 0x190
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor al, al
add esp, 0x190
ret

Function at 0x401e30
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ebx
push esi
push edi
push eax
push ecx
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
call fcn.00401ed0
mov eax, dword [esp + 0x24]
add esp, 0x14
xor esi, esi
test eax, eax
jbe 0x401e9a
mov edi, dword [esp + 0x18]
mov ebx, dword [sym.imp.WS2_32.dll_send]
mov edx, dword [esp + 0xc]
sub eax, esi
push 0
push eax
lea eax, [esi + edx]
push eax
push edi
call ebx
cmp eax, 0xffffffff
je 0x401eb0
add esi, eax
mov eax, dword [esp + 0x10]
cmp esi, eax
jb 0x401e7b
lea edx, [esp + 0xc]
push edx
call sym.MPSVC1.exe_mp110036_0019
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 8
ret
lea ecx, [esp + 0xc]
push ecx
call sym.MPSVC1.exe_mp110036_0019
add esp, 4
mov eax, 0xe
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x402040
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
test eax, eax
push edi
mov dword [esp + 0x10], 0
jne 0x40205d
mov ebp, dword [esp + 0x20]
mov ebx, ebp
jmp 0x40207d
mov ecx, dword [esp + 0x20]
mov eax, ecx
shr eax, 3
lea edx, [eax*8]
cmp edx, ecx
jae 0x402072
inc eax
mov ebp, dword [esp + 0x20]
lea ebx, [eax*8]
lea esi, [ebx + 1]
push esi
call fcn.004071e0
mov edi, eax
add esp, 4
test edi, edi
mov dword [esp + 0x10], edi
jne 0x40209e
pop edi
pop esi
pop ebp
mov eax, 5
pop ebx
pop ecx
ret
mov ecx, esi
xor eax, eax
mov edx, ecx
xor esi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
test ebx, ebx
rep stosb byte es:[edi], al
jbe 0x4020e5
mov edi, dword [esp + 0x18]
mov ebp, dword [sym.imp.WS2_32.dll_recv]
mov ecx, dword [esp + 0x10]
mov eax, ebx
sub eax, esi
push 0
lea edx, [esi + ecx]
push eax
push edx
push edi
call ebp
cmp eax, 0xffffffff
je 0x4020fc
test eax, eax
je 0x4020fc
add esi, eax
cmp esi, ebx
jb 0x4020c0
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x402114
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00402190
add esp, 4
jmp 0x402126
lea eax, [esp + 0x10]
push eax
call sym.MPSVC1.exe_mp110036_0019
add esp, 4
mov eax, 7
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x10]
push 0
push ebx
push eax
mov ecx, 0x41e7b8
call fcn.00401b70
mov edx, dword [esp + 0x1c]
mov ecx, ebp
mov esi, ecx
xor eax, eax
mov edi, dword [edx]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [edx]
mov esi, dword [esp + 0x10]
mov ecx, ebp
lea eax, [esp + 0x10]
mov edx, ecx
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sym.MPSVC1.exe_mp110036_0019
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4021b0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
mov esi, dword [esp + 0x1c]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov word [esp + 4], 2
mov cx, word [esi]
mov dword [esp + 0xc], eax
push ecx
mov dword [esp + 0x14], eax
call dword [sym.imp.WS2_32.dll_htons]
add esi, 8
mov word [esp + 6], ax
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0
push 1
push 2
mov dword [esp + 0x14], eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, dword [esp + 0x18]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x40220f
mov eax, 2
pop esi
add esp, 0x10
ret
push 0x1388
push eax
call fcn.00402690
add esp, 8
test eax, eax
jne 0x402238
mov eax, dword [esi]
lea edx, [esp + 4]
push 0x10
push edx
push eax
call dword [sym.imp.WS2_32.dll_connect]
neg eax
sbb eax, eax
and eax, 0xc
pop esi
add esp, 0x10
ret
Function at 0x402690
Capabilities:
Set socket configuration

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [esp + 0x10]
push 4
push eax
push 0x1006
push 0xffff
push esi
call edi
cmp eax, 0xffffffff
jne 0x4026bd
pop edi
mov eax, 0x1a
pop esi
ret
lea ecx, [esp + 0x10]
push 4
push ecx
push 0x1005
push 0xffff
push esi
call edi
inc eax
pop edi
neg eax
sbb eax, eax
pop esi
and al, 0xe6
add eax, 0x1a
ret

Function at 0x4027a0
Capabilities:
Encrypt data using rc6

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, eax
mov ecx, eax
mov edx, eax
and edi, 0x1000
shr ecx, 0x10
shl edx, 0x10
and eax, 1
or edi, ecx
or edx, eax
lea eax, [esi + 4]
shr edi, 8
shl edx, 8
or edi, edx
mov dword [eax], 0xb7e15163
mov ecx, 0x23
mov edx, dword [eax]
add eax, 4
sub edx, 0x61c88647
dec ecx
mov dword [eax], edx
jne 0x4027da
xor edx, edx
xor ebp, ebp
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], 0x6c
push 3
mov ecx, esi
lea ebx, [edx + 1]
call fcn.00402870
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esi + ebx*4]
mov ecx, esi
add eax, edx
add eax, ebp
push eax
call fcn.004028a0
mov ecx, dword [esp + 0x18]
mov ebp, eax
mov dword [esi + ebx*4], eax
lea eax, [ecx + ebp]
mov ecx, esi
push eax
mov dword [esp + 0x1c], eax
call fcn.00402870
mov edx, dword [esp + 0x18]
push eax
add edx, edi
mov ecx, esi
push edx
call fcn.004028a0
mov edi, eax
mov eax, ebx
xor edx, edx
mov ecx, 0x24
div ecx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], edi
dec eax
mov dword [esp + 0x10], eax
jne 0x4027fa
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x4028e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
fldln2
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
fld qword [0x415240]
push edi
mov edi, ecx
fyl2x
mov eax, dword [edi + 0x8c]
mov ecx, dword [esi]
sub ecx, eax
mov eax, dword [esi + 8]
mov dword [esi], ecx
mov ecx, dword [edi + 0x90]
sub eax, ecx
mov dword [esi + 8], eax
fldln2
fld qword [0x415238]
fyl2x
fdivp st(1)
call fcn.004076b4
mov dword [esp + 0x1c], eax
lea ebx, [edi + 0x88]
mov dword [esp + 0x10], 0x10
mov edx, dword [esi + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 4]
mov dword [esi + 0xc], edx
mov edx, dword [esi]
mov dword [esi], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 8], ecx
push eax
mov ecx, edi
mov dword [esi + 4], edx
mov ebp, edx
call fcn.00402870
lea ecx, [ebp + ebp + 1]
push eax
imul ecx, ebp
push ecx
mov ecx, edi
call fcn.004028a0
mov edx, dword [esi + 0xc]
mov ebp, eax
mov eax, dword [esp + 0x1c]
mov ecx, edi
push eax
mov dword [esp + 0x18], edx
call fcn.00402870
push eax
mov eax, dword [esp + 0x18]
lea ecx, [eax + eax + 1]
imul ecx, eax
push ecx
mov ecx, edi
call fcn.004028a0
push eax
mov ecx, edi
mov dword [esp + 0x18], eax
call fcn.00402870
mov edx, dword [esi]
mov ecx, dword [ebx - 4]
sub edx, ecx
push eax
push edx
mov ecx, edi
call fcn.004028c0
xor eax, ebp
push ebp
mov ecx, edi
mov dword [esi], eax
call fcn.00402870
mov ecx, dword [ebx]
push eax
mov eax, dword [esi + 8]
sub eax, ecx
mov ecx, edi
push eax
call fcn.004028c0
mov edx, dword [esp + 0x14]
sub ebx, 8
xor eax, edx
mov dword [esi + 8], eax
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
jne 0x402934
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
mov eax, dword [esi + 0xc]
sub edx, ecx
mov dword [esi + 4], edx
mov edx, dword [edi + 8]
sub eax, edx
pop edi
mov dword [esi + 0xc], eax
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
Function at 0x402a10
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
fldln2
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
fld qword [0x415240]
push edi
mov edi, ecx
fyl2x
mov eax, dword [edi + 4]
mov ecx, dword [esi + 4]
add ecx, eax
mov eax, dword [esi + 0xc]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 8]
add eax, ecx
mov dword [esi + 0xc], eax
fldln2
fld qword [0x415238]
fyl2x
fdivp st(1)
call fcn.004076b4
mov dword [esp + 0x1c], eax
lea ebx, [edi + 0x10]
mov dword [esp + 0x10], 0x10
mov edx, dword [esp + 0x1c]
mov ebp, dword [esi + 4]
push edx
mov ecx, edi
call fcn.00402870
push eax
lea eax, [ebp + ebp + 1]
imul eax, ebp
push eax
mov ecx, edi
call fcn.004028a0
mov ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
push edx
mov ecx, edi
mov ebp, eax
call fcn.00402870
push eax
mov eax, dword [esp + 0x18]
lea ecx, [eax + eax + 1]
imul ecx, eax
push ecx
mov ecx, edi
call fcn.004028a0
push eax
mov ecx, edi
mov dword [esp + 0x18], eax
call fcn.00402870
mov edx, dword [esi]
push eax
xor edx, ebp
mov ecx, edi
push edx
call fcn.004028a0
mov ecx, dword [ebx - 4]
push ebp
add eax, ecx
mov ecx, edi
mov dword [esi], eax
call fcn.00402870
mov ecx, dword [esp + 0x14]
push eax
mov eax, dword [esi + 8]
xor eax, ecx
mov ecx, edi
push eax
call fcn.004028a0
mov edx, dword [ebx]
mov ecx, dword [esi + 4]
add eax, edx
add ebx, 8
mov dword [esi + 8], eax
mov eax, dword [esi]
mov edx, dword [esi + 8]
mov dword [esi], ecx
mov ecx, dword [esi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 4], edx
dec eax
mov dword [esi + 8], ecx
mov dword [esp + 0x10], eax
jne 0x402a5d
mov edx, dword [edi + 0x8c]
mov ebx, dword [esi]
add ebx, edx
mov dword [esi], ebx
mov eax, dword [edi + 0x90]
add ecx, eax
pop edi
mov dword [esi + 8], ecx
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4

Function at 0x403220
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x14]
push eax
push 0x208
push esi
push str.NULL
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push str.NULL
push esi
call fcn.0040f380
add esp, 8
neg eax
sbb eax, eax
pop esi
and al, 0xec
add eax, 0x14
ret