joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10028b30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.10055700
mov eax, dword [0x1006d258]
xor eax, ebp
mov dword [ebp - 0x18], eax
push 0x100627b4
push 1
push 0x100627b8
push 1
push str.ksnetcomm.reader
push 0x10071118
call fcn.100122f0
add esp, 0x18
push 0
push 1
mov eax, dword [0x100b844c]
push eax
mov ecx, dword [0x100b8458]
push ecx
push 0x100b8450
call fcn.1002c200
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10028b93
mov eax, dword [ebp - 4]
jmp 0x10028d21
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call sym.ksnetcomm.dll_ReaderAsyncCardData
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10028bc3
push 0x100b8450
call fcn.1002c7e0
mov eax, dword [ebp - 4]
jmp 0x10028d21
mov eax, dword [ebp + 0x18]
push eax
call fcn.100481ab
add esp, 4
add eax, 1
imul eax, eax, 0x3e8
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0xc]
jae 0x10028cf0
mov byte [ebp - 0x11], 0
push 0x1000
push 0
lea edx, [ebp - 0x1018]
push edx
call fcn.1004e3d0
add esp, 0xc
lea eax, [ebp - 0x1018]
push eax
lea ecx, [ebp - 0x11]
push ecx
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 8]
push edx
call fcn.10028280
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jg 0x10028c4f
push 0x100b8450
call fcn.1002c7e0
mov eax, dword [ebp - 4]
jmp 0x10028d21
movzx eax, byte [ebp - 0x11]
cmp eax, 0xd2
je 0x10028c84
movzx ecx, byte [ebp - 0x11]
cmp ecx, 0xd5
je 0x10028c84
movzx edx, byte [ebp - 0x11]
cmp edx, 0xd8
je 0x10028c84
movzx eax, byte [ebp - 0x11]
cmp eax, 0x59
je 0x10028c84
movzx ecx, byte [ebp - 0x11]
cmp ecx, 0x56
jne 0x10028ca8
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x1018]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1004ec60
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
mov byte [edx], 0
jmp 0x10028cf0
movzx eax, byte [ebp - 0x11]
cmp eax, 0xd6
jne 0x10028cb5
jmp 0x10028cd5
push 0x100627c8
push 1
push 0x100627d8
push 1
push str.ksnetcomm.reader
push 0x10071118
call fcn.100122f0
add esp, 0x18
push 0x1000
push 0
lea ecx, [ebp - 0x1018]
push ecx
call fcn.1004e3d0
add esp, 0xc
jmp 0x10028beb
push 0x100b8450
call fcn.1002c7e0
mov edx, dword [ebp - 4]
push edx
push 0x100627e8
push 1
push 0x100627f4
push 1
push str.ksnetcomm.reader
push 0x10071118
call fcn.100122f0
add esp, 0x1c
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.10048168
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10029b90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.10055700
mov eax, dword [0x1006d258]
xor eax, ebp
mov dword [ebp - 0x18], eax
push 0x10062b4c
push 1
push 0x10062b50
push 1
push str.ksnetcomm.reader
push 0x10071118
call fcn.100122f0
add esp, 0x18
push 0
push 1
mov eax, dword [0x100b844c]
push eax
mov ecx, dword [0x100b8458]
push ecx
push 0x100b8450
call fcn.1002c200
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10029bf3
mov eax, dword [ebp - 4]
jmp 0x10029d45
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call sym.ksnetcomm.dll_ReaderAsyncKeyInCardData
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10029c23
push 0x100b8450
call fcn.1002c7e0
mov eax, dword [ebp - 4]
jmp 0x10029d45
mov eax, dword [ebp + 0x18]
push eax
call fcn.100481ab
add esp, 4
add eax, 1
imul eax, eax, 0x3e8
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0xc]
jae 0x10029d14
mov byte [ebp - 0x11], 0
push 0x1000
push 0
lea edx, [ebp - 0x1018]
push edx
call fcn.1004e3d0
add esp, 0xc
lea eax, [ebp - 0x1018]
push eax
lea ecx, [ebp - 0x11]
push ecx
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 8]
push edx
call fcn.10028280
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jg 0x10029caf
push 0x100b8450
call fcn.1002c7e0
mov eax, dword [ebp - 4]
jmp 0x10029d45
cmp dword [ebp - 4], 0
jle 0x10029cd9
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x1018]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1004ec60
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
mov byte [eax], 0
jmp 0x10029d14
push 0x10062b64
push 1
push 0x10062b74
push 1
push str.ksnetcomm.reader
push 0x10071118
call fcn.100122f0
add esp, 0x18
push 0x1000
push 0
lea ecx, [ebp - 0x1018]
push ecx
call fcn.1004e3d0
add esp, 0xc
jmp 0x10029c4b
push 0x100b8450
call fcn.1002c7e0
mov edx, dword [ebp - 4]
push edx
push 0x10062b88
push 1
push 0x10062b94
push 1
push str.ksnetcomm.reader
push 0x10071118
call fcn.100122f0
add esp, 0x1c
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.10048168
mov esp, ebp
pop ebp
ret 0x14
Function at 0x1002ac60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x1006d258]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
push 0x10062e58
push 1
push 0x10062e5c
push 1
push str.ksnetcomm.reader
push 0x10071118
call fcn.100122f0
add esp, 0x18
mov dword [ebp - 4], 0x20
mov byte [ebp - 0x60], 0x7b
mov byte [ebp - 0x5f], 0x6d
mov byte [ebp - 0x5e], 0x56
mov byte [ebp - 0x5d], 0x85
mov byte [ebp - 0x5c], 0x37
mov byte [ebp - 0x5b], 0x66
mov byte [ebp - 0x5a], 0x28
mov byte [ebp - 0x59], 0x6d
mov byte [ebp - 0x58], 0x54
mov byte [ebp - 0x57], 0x60
mov byte [ebp - 0x56], 0xb
mov byte [ebp - 0x55], 0x49
mov byte [ebp - 0x54], 0xfb
mov byte [ebp - 0x53], 0xb1
mov byte [ebp - 0x52], 0xbc
mov byte [ebp - 0x51], 0xf1
mov byte [ebp - 0x50], 0
xor eax, eax
mov dword [ebp - 0x4f], eax
mov dword [ebp - 0x4b], eax
mov dword [ebp - 0x47], eax
mov dword [ebp - 0x43], eax
push 0x10
lea ecx, [ebp - 0x50]
push ecx
call fcn.10016cf0
mov byte [ebp - 0x3c], 0
xor edx, edx
mov dword [ebp - 0x3b], edx
mov dword [ebp - 0x37], edx
mov dword [ebp - 0x33], edx
mov word [ebp - 0x2f], dx
mov byte [ebp - 0x2d], dl
mov dword [ebp - 0x64], 0
jmp 0x1002ad1e
mov eax, dword [ebp - 0x64]
add eax, 1
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x10
jge 0x1002ad3f
mov ecx, dword [ebp - 0x64]
movzx edx, byte [ebp + ecx - 0x50]
mov eax, dword [ebp - 0x64]
movzx ecx, byte [ebp + eax - 0x60]
xor edx, ecx
mov eax, dword [ebp - 0x64]
mov byte [ebp + eax - 0x3c], dl
jmp 0x1002ad15
mov byte [ebp - 0x2c], 0
xor ecx, ecx
mov dword [ebp - 0x2b], ecx
mov dword [ebp - 0x27], ecx
mov dword [ebp - 0x23], ecx
mov dword [ebp - 0x1f], ecx
mov dword [ebp - 0x1b], ecx
mov dword [ebp - 0x17], ecx
mov dword [ebp - 0x13], ecx
mov dword [ebp - 0xf], ecx
xor edx, edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov byte [ebp - 0xc], dl
lea eax, [ebp - 0x2c]
push eax
push 0x10
lea ecx, [ebp - 0x3c]
push ecx
call fcn.10011000
mov ecx, 8
lea esi, [ebp - 0x2c]
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
push 0x10062e68
push 1
push 0x10062e70
push 1
push str.ksnetcomm.reader
push 0x10071118
call fcn.100122f0
add esp, 0x18
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10048168
mov esp, ebp
pop ebp
ret 4
Function at 0x1002c530
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
jne 0x1002c546
mov eax, 0xfffffffa
jmp 0x1002c626
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1002c57f
call fcn.100110d0
jmp 0x1002c626
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1002c609
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3e5
jne 0x1002c5f6
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x1002c5f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3e4
je 0x1002c5ea
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.100110d0
jmp 0x1002c626
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1002c5af
jmp 0x1002c607
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.100110d0
jmp 0x1002c626
jmp 0x1002c61a
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.100110d0
jmp 0x1002c626
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002c630
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1024
call fcn.10055700
mov eax, dword [0x1006d258]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x1002c657
mov eax, 0xfffffffa
jmp 0x1002c7c5
mov dword [ebp - 0x100c], 0
push 0x1000
push 0
lea eax, [ebp - 0x1008]
push eax
call fcn.1004e3d0
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x1020], ecx
mov dword [ebp - 0x101c], ecx
mov dword [ebp - 0x1018], ecx
mov dword [ebp - 0x1014], ecx
mov dword [ebp - 0x1010], ecx
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 0x1010], eax
cmp dword [ebp - 0x1010], 0
jne 0x1002c6be
call fcn.100110d0
jmp 0x1002c7c5
lea edx, [ebp - 0x1020]
push edx
lea eax, [ebp - 0x100c]
push eax
push 0x1000
lea ecx, [ebp - 0x1008]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1002c76e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1024], eax
cmp dword [ebp - 0x1024], 0x3e5
jne 0x1002c758
push 0
lea eax, [ebp - 0x100c]
push eax
lea ecx, [ebp - 0x1020]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x1002c756
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1024], eax
cmp dword [ebp - 0x1024], 0x3e4
je 0x1002c74c
mov eax, dword [ebp - 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.100110d0
jmp 0x1002c7c5
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1002c702
jmp 0x1002c76c
mov ecx, dword [ebp - 0x1010]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.100110d0
jmp 0x1002c7c5
jmp 0x1002c782
mov edx, dword [ebp - 0x1010]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.100110d0
jmp 0x1002c7c5
mov eax, dword [ebp - 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x100c]
push ecx
lea edx, [ebp - 0x1008]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.1004ec60
add esp, 0xc
push 0x1000
push 0
lea ecx, [ebp - 0x1008]
push ecx
call fcn.1004e3d0
add esp, 0xc
mov eax, dword [ebp - 0x100c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10048168
mov esp, ebp
pop ebp
ret 8
Function at 0x1002cc30
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, 1
test eax, eax
je 0x1002cc92
push 0
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jg 0x1002cc7d
call fcn.100110e0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
jmp 0x1002cc95
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0x10]
jne 0x1002cc90
jmp 0x1002cc92
jmp 0x1002cc44
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1002cca0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1004e3d0
add esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov edx, 1
test edx, edx
je 0x1002cd14
push 0
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jg 0x1002ccff
call fcn.100110e0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
jmp 0x1002cd17
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x10]
jne 0x1002cd12
jmp 0x1002cd14
jmp 0x1002ccc6
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1002cd20
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1004e3d0
add esp, 0xc
mov dword [ebp - 4], 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jg 0x1002cd69
call fcn.100110e0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x1002cd6c
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10036e50
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret 4
Function at 0x100394f0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b8
mov eax, dword [0x1006d258]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x19c], 0
mov eax, 0x202
mov word [ebp - 0x1a8], ax
lea ecx, [ebp - 0x198]
push ecx
movzx edx, word [ebp - 0x1a8]
push edx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1003954d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x1006e82c
call fcn.1004aee7
add esp, 8
xor eax, eax
jmp 0x10039693
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0xffffffff
jne 0x10039589
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x1006e848
call fcn.1004aee7
add esp, 8
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x10039693
xor eax, eax
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x1ac], eax
mov ecx, 2
mov word [ebp - 0x1b8], cx
movzx edx, word [ebp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1b6], ax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x1b4], eax
push 0x10
lea ecx, [ebp - 0x1b8]
push ecx
mov edx, dword [ebp - 0x1a0]
push edx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1003960a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x1006e864
call fcn.1004aee7
add esp, 0x10
jmp 0x1003967a
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x1a0]
push ecx
call fcn.10039e60
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0
jne 0x10039647
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 0x1a4]
push eax
push 0x1006e894
call fcn.1004aee7
add esp, 0xc
jmp 0x1003967a
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp - 0x1a0]
push edx
call fcn.10039f00
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
jne 0x1003967a
mov eax, dword [ebp - 0x19c]
push eax
push 0x1006e8b4
call fcn.1004aee7
add esp, 8
mov ecx, dword [ebp - 0x1a0]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0x19c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10048168
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10039e60
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], str.ks_send_msg_cli
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov ecx, 1
test ecx, ecx
je 0x10039eee
push 0
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x10039ed2
call fcn.10049745
mov edx, dword [eax]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
push str.ERROR:__s_write_send__error_len:_d__:__d_n
call fcn.1004aee7
add esp, 0x10
xor eax, eax
jmp 0x10039ef1
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 0
jne 0x10039eec
jmp 0x10039eee
jmp 0x10039e88
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10039f00
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2414
call fcn.10055700
mov eax, dword [0x1006d258]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2414], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], str.ks_recv_msg_cli
push 0x2400
push 0
lea eax, [ebp - 0x2410]
push eax
call fcn.1004e3d0
add esp, 0xc
push 0
push 6
lea ecx, [ebp - 0x2410]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x2414], eax
cmp dword [ebp - 0x2414], 0
jg 0x10039f97
call fcn.10049745
mov eax, dword [eax]
push eax
mov ecx, dword [ebp - 0x2414]
push ecx
mov edx, dword [ebp - 8]
push edx
push str.ERROR:__s_read_recv__error1_len__d__errno__d__n
call fcn.1004aee7
add esp, 0x10
xor eax, eax
jmp 0x1003a09f
lea eax, [ebp - 0x2410]
push eax
call fcn.100481ab
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
add ecx, 6
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 4], 0
jne 0x10039fdc
call fcn.10049745
mov edx, dword [eax]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0x1006f178
call fcn.1004aee7
add esp, 0x10
xor eax, eax
jmp 0x1003a09f
mov edx, 1
test edx, edx
je 0x1003a085
push 0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
lea edx, [ebp + ecx - 0x2410]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x2414], eax
cmp dword [ebp - 0x2414], 0
jge 0x1003a037
call fcn.10049745
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x2414]
push edx
mov eax, dword [ebp - 8]
push eax
push str.ERROR:__s_read_recv__error3_len__d__errno__d__n
call fcn.1004aee7
add esp, 0x10
xor eax, eax
jmp 0x1003a09f
cmp dword [ebp - 0x2414], 0
jne 0x1003a064
call fcn.10049745
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x2414]
push edx
mov eax, dword [ebp - 8]
push eax
push str.ERROR:__s_read_recv_EOF
call fcn.1004aee7
add esp, 0x10
xor eax, eax
jmp 0x1003a09f
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x2414]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x2414]
mov dword [ebp - 4], edx
jne 0x1003a080
jmp 0x1003a085
jmp 0x10039fdc
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x2410]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.1004ec60
add esp, 0xc
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10048168
mov esp, ebp
pop ebp
ret 8
Function at 0x10040740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov byte [ebp - 1], 0
jmp 0x10040753
mov al, byte [ebp - 1]
add al, 1
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
cmp ecx, 4
jge 0x100407b9
mov byte [ebp - 2], 0
jmp 0x1004076b
mov dl, byte [ebp - 2]
add dl, 1
mov byte [ebp - 2], dl
movzx eax, byte [ebp - 2]
cmp eax, 4
jge 0x100407b7
movzx ecx, byte [ebp - 1]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx*4]
movzx ecx, byte [ebp - 2]
movzx edx, byte [ebp + 8]
shl edx, 2
movzx esi, byte [ebp - 1]
shl esi, 2
lea edx, [esi + edx*4]
movzx esi, byte [ebp - 2]
add esi, dword [ebp + 0x10]
movzx edx, byte [esi + edx]
movzx eax, byte [eax + ecx]
xor eax, edx
movzx ecx, byte [ebp - 2]
movzx edx, byte [ebp - 1]
mov esi, dword [ebp + 0xc]
lea edx, [esi + edx*4]
mov byte [edx + ecx], al
jmp 0x10040762
jmp 0x1004074b
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100407c0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 1], 0
jmp 0x100407d2
mov al, byte [ebp - 1]
add al, 1
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
cmp ecx, 4
jge 0x10040820
mov byte [ebp - 2], 0
jmp 0x100407ea
mov dl, byte [ebp - 2]
add dl, 1
mov byte [ebp - 2], dl
movzx eax, byte [ebp - 2]
cmp eax, 4
jge 0x1004081e
movzx ecx, byte [ebp - 2]
mov edx, dword [ebp + 8]
lea eax, [edx + ecx*4]
movzx ecx, byte [ebp - 1]
movzx edx, byte [eax + ecx]
movzx eax, byte [ebp - 2]
mov ecx, dword [ebp + 8]
lea eax, [ecx + eax*4]
movzx ecx, byte [ebp - 1]
mov dl, byte [edx + 0x1005f028]
mov byte [eax + ecx], dl
jmp 0x100407e1
jmp 0x100407ca
mov esp, ebp
pop ebp
ret 4

Function at 0x10041320
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 1], 0
jmp 0x10041332
mov al, byte [ebp - 1]
add al, 1
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
cmp ecx, 4
jge 0x10041380
mov byte [ebp - 2], 0
jmp 0x1004134a
mov dl, byte [ebp - 2]
add dl, 1
mov byte [ebp - 2], dl
movzx eax, byte [ebp - 2]
cmp eax, 4
jge 0x1004137e
movzx ecx, byte [ebp - 2]
mov edx, dword [ebp + 8]
lea eax, [edx + ecx*4]
movzx ecx, byte [ebp - 1]
movzx edx, byte [eax + ecx]
movzx eax, byte [ebp - 2]
mov ecx, dword [ebp + 8]
lea eax, [ecx + eax*4]
movzx ecx, byte [ebp - 1]
mov dl, byte [edx + 0x1005f128]
mov byte [eax + ecx], dl
jmp 0x10041341
jmp 0x1004132a
mov esp, ebp
pop ebp
ret 4

Function at 0x10041570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 1], 0
jmp 0x10041582
mov al, byte [ebp - 1]
add al, 1
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
cmp ecx, 0x10
jge 0x100415af
movzx edx, byte [ebp - 1]
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx + eax]
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
xor edx, eax
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
mov byte [ecx + eax], dl
jmp 0x1004157a
mov esp, ebp
pop ebp
ret 8