joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5269b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.004f7380
add esp, 0x18
test eax, eax
je 0x5269d2
cmp eax, 0xffffffff
jne 0x5269d4
xor eax, eax
pop ebp
ret

Function at 0x527130
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x527dc0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x57c9d0]
mov edi, eax
add esp, 4
test edi, edi
jne 0x527ded
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x527e34
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x527e3a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x527e9b
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop word [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x527e60
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x527ec7
mov eax, dword [esi + 4]
push 1
push 0x550d7c
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x550d7d
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x527ea0
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x528880
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov dword [ebp + 8], ecx
cmp ecx, 2
jne 0x5288a9
push dword [eax + 8]
mov ebx, dword [ebp + 0x10]
mov eax, dword [esi + 0xc]
push ebx
push 1
push dword [ebp + 0xc]
call eax
jmp 0x5288df
cmp dword [esi + 8], 0
jne 0x5288ce
push 0x561b68
push dword [eax + 8]
call fcn.004ee825
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x5288ce
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
push dword [esi + 8]
mov ebx, dword [ebp + 0x10]
push ebx
push 1
push dword [ebp + 0xc]
call fcn.004eeb09
mov edi, eax
add esp, 0x10
test edi, edi
je 0x5288ec
cmp edi, ebx
jbe 0x52890a
cmp dword [ebp + 8], 2
je 0x528904
push dword [esi + 8]
call fcn.004ee8b2
add esp, 4
mov dword [esi + 8], 0
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40787f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42bc40]
jne 0x407889
repz ret
jmp fcn.0040c0db

Function at 0x40ad17
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405ab0
and dword [ebp - 4], 0
cmp dword [0x4307fc], 0
mov ebx, eax
jne 0x40adc8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40ae79
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40ae79
push eax
call fcn.00405a3e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4307fc], eax
call esi
push eax
call fcn.00405a3e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x430800], eax
call esi
push eax
call fcn.00405a3e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x430804], eax
call esi
push eax
call fcn.00405a3e
pop ecx
mov dword [0x43080c], eax
test eax, eax
je 0x40adc8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405a3e
pop ecx
mov dword [0x430808], eax
mov eax, dword [0x430808]
cmp eax, ebx
je 0x40ae20
cmp dword [0x43080c], ebx
je 0x40ae20
push eax
call fcn.00405ab9
push dword [0x43080c]
mov esi, eax
call fcn.00405ab9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40ae20
test edi, edi
je 0x40ae20
call esi
test eax, eax
je 0x40ae17
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40ae17
test byte [ebp - 0xc], 1
jne 0x40ae20
or dword [ebp + 0x10], 0x200000
jmp 0x40ae59
mov eax, dword [0x430800]
cmp eax, ebx
je 0x40ae59
push eax
call fcn.00405ab9
pop ecx
test eax, eax
je 0x40ae59
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40ae59
mov eax, dword [0x430804]
cmp eax, ebx
je 0x40ae59
push eax
call fcn.00405ab9
pop ecx
test eax, eax
je 0x40ae59
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4307fc]
call fcn.00405ab9
pop ecx
test eax, eax
je 0x40ae79
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40ae7b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40327f
Capabilities:
Terminate process

Disassembly:
sub esp, 4
cmp dword [esp + 8], 2
push ebx
push esi
push edi
push ebp
je 0x4032b2
push str.addresses_cannot_be_specified_for_this_type
push str.PARSE_ERROR:__s_n
call dword [sym.imp.MSVCRT20.dll_printf]
add esp, 8
push 1
call dword [sym.imp.MSVCRT20.dll_exit]
add esp, 4
xor eax, eax
jmp 0x40336b
push 0x10
call dword [sym.imp.MSVCRT20.dll_malloc]
mov ebx, dword [esp + 0x20]
add esp, 4
mov esi, eax
mov edi, dword [sym.imp.MSVCRT20.dll_strchr]
push 0x2f
push ebx
call edi
add esp, 8
test eax, eax
je 0x4032e2
inc eax
push eax
call dword [sym.imp.MSVCRT20.dll_atoi]
add esp, 4
jmp 0x4032e7
mov eax, 0x20
xor edx, edx
test eax, eax
mov dword [esp + 0x10], edx
jle 0x403301
mov edx, eax
mov ecx, dword [esp + 0x10]
add ecx, ecx
inc ecx
dec eax
mov dword [esp + 0x10], ecx
jne 0x4032f3
cmp edx, 0x20
jge 0x403314
mov eax, 0x20
sub eax, edx
shl dword [esp + 0x10], 1
dec eax
jne 0x40330d
lea eax, [esp + 0x10]
push 4
push eax
mov ebp, 4
push esi
call sub.MSVCRT20.dll_memcpy
mov dword [esp + 0x1c], 0
add esp, 0xc
push ebx
call dword [sym.imp.MSVCRT20.dll_atoi]
mov ecx, dword [esp + 0x14]
add esp, 4
shl ecx, 8
push 0x2e
add eax, ecx
push ebx
mov dword [esp + 0x18], eax
call edi
add esp, 8
lea ebx, [eax + 1]
dec ebp
jne 0x403331
lea eax, [esp + 0x10]
push 4
push eax
lea ecx, [esi + 4]
push ecx
call sub.MSVCRT20.dll_memcpy
add esp, 0xc
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x40483d
Capabilities:
Read file on windows
Terminate process

Disassembly:
push ebx
push esi
push edi
push ebp
push 4
call sub.MSVCRT20.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x40485f
mov ecx, eax
call fcn.004064aa
mov esi, dword [esp + 0x14]
mov dword [esi + 0x48], eax
jmp 0x40486a
mov esi, dword [esp + 0x14]
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 1
mov dword [esi + 0x30], 0x3c
mov dword [esi + 0x34], 0x438
xor edx, edx
mov dword [esi], edx
mov dword [esi + 4], edx
mov dword [esi + 0x2c], edx
mov dword [esi + 0x38], edx
lea ecx, [esi + 8]
mov dword [esi + 0x3c], edx
mov eax, 4
mov dword [esi + 0x40], edx
mov dword [esi + 0x4c], edx
mov dword [esi + 0x28], edx
mov dword [ecx], edx
add ecx, 4
dec eax
mov dword [ecx + 0xc], edx
jne 0x4048a0
mov eax, dword [esp + 0x18]
push 0x41e478
test eax, eax
je 0x4048bb
push eax
jmp 0x4048c0
push str.._antinat.xml
call dword [sym.imp.MSVCRT20.dll_fopen]
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x4048d6
xor eax, eax
jmp 0x4049b0
push 2
mov edi, dword [sym.imp.MSVCRT20.dll_fseek]
push 0
push ebx
call edi
add esp, 0xc
push ebx
call dword [sym.imp.MSVCRT20.dll_ftell]
add esp, 4
mov ebp, eax
push 0
push 0
push ebx
call edi
add esp, 0xc
push ebp
call dword [sym.imp.MSVCRT20.dll_malloc]
add esp, 4
mov edi, eax
test edi, edi
push ebx
jne 0x40491d
call dword [sym.imp.MSVCRT20.dll_fclose]
add esp, 4
xor eax, eax
jmp 0x4049b0
push ebp
push 1
push edi
call dword [sym.imp.MSVCRT20.dll_fread]
add esp, 0x10
test eax, eax
jne 0x404946
push edi
call dword [sym.imp.MSVCRT20.dll_free]
add esp, 4
push ebx
call dword [sym.imp.MSVCRT20.dll_fclose]
add esp, 4
xor eax, eax
jmp 0x4049b0
push ebx
call dword [sym.imp.MSVCRT20.dll_fclose]
add esp, 4
push 0
call fcn.004073f7
add esp, 4
mov dword [0x41b050], eax
push 0x40483c
push 0x4043fd
push eax
call fcn.00407949
add esp, 0xc
mov eax, dword [0x41b050]
push esi
push eax
call fcn.00407934
add esp, 8
mov eax, dword [0x41b050]
push 1
push ebp
push edi
push eax
call fcn.0040795c
add esp, 0x10
mov eax, dword [0x41b050]
push eax
call fcn.004077ef
add esp, 4
push edi
call dword [sym.imp.MSVCRT20.dll_free]
add esp, 4
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4053d6
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov esi, ecx
push ebp
xor ebx, ebx
lea ebp, [esi + 0x14]
push ebx
mov ecx, ebp
lea edi, [esi + 0x3c]
call fcn.00405067
push ebx
lea ecx, [esi + 0x28]
call fcn.00405067
push ebx
mov ecx, edi
call fcn.00405067
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov dword [esi], ecx
mov dword [esi + 0x58], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
call fcn.004070b6
mov ebx, eax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x14]
push ecx
mov dword [esp + 0x14], 0x10
push eax
push ebx
call sub.WSOCK32.dll_getpeername
test eax, eax
jne 0x40544e
lea eax, [esp + 0x14]
mov ecx, ebp
push eax
call fcn.004052c9
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push ebx
call sub.WSOCK32.dll_getsockname
test eax, eax
jne 0x40546e
lea eax, [esp + 0x14]
mov ecx, edi
push eax
call fcn.004052c9
xor eax, eax
pop ebp
pop edi
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret 8

Function at 0x405630
Capabilities:
Resolve dns

Disassembly:
push esi
push edi
mov esi, ecx
mov ecx, dword [0x41b064]
call fcn.004064c8
push dword [esp + 0xc]
call sub.WSOCK32.dll_gethostbyname
mov edi, eax
test edi, edi
jne 0x40565d
mov ecx, dword [0x41b064]
call fcn.004064d3
xor eax, eax
jmp 0x40568d
movsx eax, word [edi + 8]
add esi, 0x28
push eax
mov ecx, esi
call fcn.0040535d
movsx ecx, word [edi + 0xa]
mov eax, dword [edi + 0xc]
push ecx
mov ecx, esi
push dword [eax]
call fcn.00405370
mov ecx, dword [0x41b064]
call fcn.004064d3
mov eax, 1
pop edi
pop esi
ret 4
Function at 0x405859
Capabilities:
Get socket status
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov eax, 0x8114
mov ebp, esp
call fcn.0041acd8
push ebx
push esi
push edi
mov esi, ecx
mov ecx, dword [ecx]
call fcn.004070b6
push dword [esi + 0x58]
mov edi, eax
call fcn.00404d4d
add esp, 4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.MSVCRT20.dll_time]
add esp, 4
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
cmp dword [ebp - 8], 0
jle 0x4058e0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.MSVCRT20.dll_time]
add esp, 4
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x10], eax
mov eax, 0
je 0x4058c9
mov eax, dword [esi + 0x50]
mov ecx, dword [ebp - 0xc]
add eax, dword [esi + 0x54]
sub ecx, dword [ebp - 0x10]
sub edx, edx
div ecx
cmp dword [ebp - 8], eax
jg 0x4058e0
cdq
idiv dword [ebp - 8]
inc eax
imul eax, eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], edi
inc dword [ebp - 0x114]
cmp dword [ebp - 0x114], 0x40
jae 0x405912
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x110], ebx
inc dword [ebp - 0x114]
mov eax, edi
cmp edi, ebx
ja 0x40591a
mov eax, ebx
push 0
lea ecx, [ebp - 0x114]
push 0
inc eax
push 0
push ecx
push eax
call sub.WSOCK32.dll_select
lea ecx, [ebp - 0x114]
push ecx
push edi
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x40597b
push 0
lea eax, [ebp - 0x8114]
push 0x7fff
push eax
push edi
call sub.WSOCK32.dll_recv
test eax, eax
jg 0x405960
mov dword [ebp - 4], 1
jmp 0x40597b
push 0
lea ecx, [ebp - 0x8114]
push eax
add dword [esi + 0x50], eax
mov byte [ebp + eax - 0x8114], 0
push ecx
push ebx
call sub.WSOCK32.dll_send
lea eax, [ebp - 0x114]
push eax
push ebx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x4059c8
push 0
lea eax, [ebp - 0x8114]
push 0x7fff
push eax
push ebx
call sub.WSOCK32.dll_recv
test eax, eax
jg 0x4059ad
mov dword [ebp - 4], 1
jmp 0x4059c8
push 0
lea ecx, [ebp - 0x8114]
push eax
add dword [esi + 0x54], eax
mov byte [ebp + eax - 0x8114], 0
push ecx
push edi
call sub.WSOCK32.dll_send
cmp dword [ebp - 4], 0
je 0x405899
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x405abb
Capabilities:
Terminate process

Disassembly:
push esi
mov eax, dword [0x41e498]
push edi
test eax, eax
je 0x405af2
push eax
call fcn.00404d55
add esp, 4
mov esi, eax
mov eax, dword [0x41e498]
push eax
call fcn.00404d45
mov di, ax
add esp, 4
mov eax, dword [0x41e498]
push eax
call fcn.00405011
add esp, 4
jmp 0x405af7
xor di, di
xor esi, esi
push 0x50
call dword [sym.imp.MSVCRT20.dll_malloc]
add esp, 4
mov dword [0x41e498], eax
push dword [0x41e49c]
push eax
call fcn.0040483d
add esp, 8
test eax, eax
jne 0x405b48
push 0x30
push str.Antinat
push str.Could_not_open_configuration_file.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x41e498]
push eax
call dword [sym.imp.MSVCRT20.dll_free]
add esp, 4
push 1
call dword [sym.imp.MSVCRT20.dll_exit]
add esp, 4
mov eax, dword [0x41e498]
push eax
push 0
push 3
push 0
call fcn.0040320d
add esp, 0x10
mov eax, dword [0x41e498]
push eax
call fcn.00404d45
movzx ecx, di
add esp, 4
cmp eax, ecx
jne 0x405b83
mov eax, dword [0x41e498]
push eax
call fcn.00404d55
add esp, 4
cmp eax, esi
je 0x405bc5
mov ecx, dword [0x41b060]
call fcn.004071c1
mov esi, dword [0x41e498]
push esi
call fcn.00404d55
add esp, 4
push eax
push esi
call fcn.00404d45
add esp, 4
mov ecx, dword [0x41b060]
push eax
call fcn.0040711f
test eax, eax
jne 0x405bc5
push str.Could_not_listen_on_interface_port_n
call dword [sym.imp.MSVCRT20.dll_printf]
add esp, 4
pop edi
pop esi
ret

Function at 0x405d4b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
push esi
push edi
push 0x18
mov esi, 0
call sub.MSVCRT20.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x405d72
mov ecx, eax
call fcn.0040724a
mov esi, eax
push 0x63
mov ecx, esi
call fcn.0040726a
push dword [ebp + 0x10]
mov ecx, esi
call fcn.004072d2
push 0x68
mov ecx, esi
call fcn.0040675c
test eax, eax
je 0x405dcd
push str.0.80win
lea eax, [ebp - 0x200]
push str.Antinat_version__s_n_nUsage:_antinat___h____cConfigFile____x__nNote_that__x_is_not_supported_on_Win32.
push eax
call dword [sym.imp.MSVCRT20.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x200]
push 0x30
push str.Antinat
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.MSVCRT20.dll_exit]
add esp, 4
push 0x63
mov ecx, esi
call fcn.0040673d
test eax, eax
je 0x405e13
push 0x63
mov ecx, esi
call fcn.0040673d
push eax
call sub.MSVCRT20.dll_strlen
add esp, 4
inc eax
push eax
call dword [sym.imp.MSVCRT20.dll_malloc]
mov dword [0x41e49c], eax
add esp, 4
mov edi, eax
mov ecx, esi
push 0x63
call fcn.0040673d
push eax
push edi
call sub.MSVCRT20.dll_strcpy
add esp, 8
jmp 0x405e1d
mov dword [0x41e49c], 0
mov ecx, esi
call fcn.0040663e
test esi, esi
je 0x405e38
mov ecx, esi
call fcn.004065ea
push esi
call sub.MSVCRT20.dll_void___cdecl_operator_delete_void__
add esp, 4
call fcn.00405bc8
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4064f4
Capabilities:
Create thread

Disassembly:
push esi
mov eax, dword [ecx]
mov esi, ecx
test eax, eax
je 0x406504
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi + 4]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x14]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
inc eax
pop esi
cmp eax, 1
mov eax, 0
adc eax, 0xffffffff
ret 8

Function at 0x40677b
Capabilities:
Encode data using xor

Disassembly:
push esi
mov eax, dword [ecx + 8]
mov esi, dword [esp + 8]
push edi
cmp byte [esi], 0
je 0x4067a2
movzx edi, byte [esi]
mov edx, eax
inc esi
shr edx, 2
add edi, edx
mov edx, eax
shl edx, 5
add edi, edx
xor eax, edi
cmp byte [esi], 0
jne 0x406789
sub edx, edx
div dword [ecx + 0xc]
mov esi, edx
call fcn.0040666e
mov ecx, eax
sub edx, edx
mov eax, esi
pop edi
div ecx
mov eax, edx
pop esi
ret 4

Function at 0x407064
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
mov edi, dword [esp + 0x14]
test edi, edi
jg 0x407075
xor eax, eax
jmp 0x4070ac
mov esi, dword [esp + 0x10]
push 0
mov ecx, ebx
push 0x12c
call fcn.00407232
test eax, eax
je 0x4070b2
push 0
push edi
push esi
push dword [ebx]
call sub.WSOCK32.dll_recv
add esi, eax
sub edi, eax
test edi, edi
mov byte [esi], 0
jle 0x4070a5
test eax, eax
jg 0x407079
cmp edi, 1
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
ret 8
xor eax, eax
jmp 0x4070ac

Function at 0x4070b9
Capabilities:
Set socket configuration

Disassembly:
sub esp, 4
mov word [esp], 1
lea eax, [esp]
push 4
mov word [esp + 6], 0xa
push eax
push pe_nt_image_headers32
push 0xffff
push dword [ecx]
call sub.WSOCK32.dll_setsockopt
mov eax, 1
add esp, 4
ret

Function at 0x4070eb
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, ecx
push 0
test eax, eax
jge 0x407104
push dword [esp + 0xc]
call sub.MSVCRT20.dll_strlen
add esp, 4
push eax
push dword [esp + 0x10]
push dword [esi]
call sub.WSOCK32.dll_send
test eax, eax
mov eax, 1
jge 0x40711b
xor eax, eax
pop esi
ret 8

Function at 0x40711f
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
push esi
lea eax, [ebp - 0x1a4]
mov esi, ecx
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
mov dword [ebp - 4], 1
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov ecx, esi
mov dword [esi], eax
call fcn.004070b9
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0xffff
push dword [esi]
call sub.WSOCK32.dll_setsockopt
push 0x10
lea ecx, [ebp - 0x14]
push 0
push ecx
call sub.MSVCRT20.dll_memset
mov cx, word [ebp + 8]
add esp, 0xc
mov word [ebp - 0x14], 2
push ecx
call sub.WSOCK32.dll_htons
mov word [ebp - 0x12], ax
mov ecx, dword [ebp + 0xc]
push 0x10
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x10], ecx
push dword [esi]
call sub.WSOCK32.dll_bind
test eax, eax
jge 0x4071aa
xor eax, eax
jmp 0x4071ba
push 5
push dword [esi]
call sub.WSOCK32.dll_listen
cmp eax, 1
sbb eax, eax
neg eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4071ce
Capabilities:
Get socket status

Disassembly:
push ebp
mov ecx, dword [ecx]
mov ebp, esp
sub esp, 0x10c
mov dword [ebp - 0x10c], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x108], ecx
inc dword [ebp - 0x10c]
test eax, eax
jl 0x407205
lea edx, [ebp - 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push edx
mov dword [ebp - 4], eax
jmp 0x407207
push 0
push 0
lea eax, [ebp - 0x10c]
push 0
inc ecx
push eax
push ecx
call sub.WSOCK32.dll_select
test eax, eax
jle 0x407224
mov eax, 1
jmp 0x40722c
cmp eax, 1
sbb eax, eax
and eax, 2
mov esp, ebp
pop ebp
ret 8
Function at 0x40cd20
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov ecx, dword [esp + 4]
cmp byte [ecx], al
je 0x40cd3d
imul eax, eax, 0xf4243
movzx edx, byte [ecx]
xor edx, eax
inc ecx
mov eax, edx
cmp byte [ecx], 0
jne 0x40cd2a
ret

Function at 0x41a0e0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xf0
mov ecx, 0xffffffff
sub eax, eax
push ebx
mov ebx, dword [esp + 0x100]
push esi
push edi
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
lea edx, [ecx - 1]
cmp edx, 0x40
jle 0x41a153
lea eax, [esp + 0xa4]
mov edi, ebx
push eax
call fcn.0041a2b0
add esp, 4
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0xa4]
push ecx
push ebx
push eax
call fcn.0041aaf0
lea ecx, [esp + 0x18]
lea edx, [esp + 0xb0]
add esp, 0xc
push ecx
push edx
call fcn.0041ac00
lea ebx, [esp + 0x14]
add esp, 8
mov edx, 0x10
lea edi, [esp + 0x1c]
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea edi, [esp + 0x60]
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov esi, ebx
mov ecx, edx
stosb byte es:[edi], al
shr ecx, 2
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x60]
mov esi, ebx
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor byte [esp + eax + 0x1c], 0x36
xor byte [esp + eax + 0x60], 0x5c
inc eax
cmp eax, 0x40
jl 0x41a195
lea eax, [esp + 0xa4]
push eax
call fcn.0041a2b0
lea eax, [esp + 0x20]
lea ecx, [esp + 0xa8]
add esp, 4
push 0x40
push eax
push ecx
call fcn.0041aaf0
mov ecx, dword [esp + 0x110]
mov edx, dword [esp + 0x10c]
lea eax, [esp + 0xb0]
add esp, 0xc
push ecx
push edx
push eax
call fcn.0041aaf0
lea ecx, [esp + 0x28]
lea edx, [esp + 0xb0]
add esp, 0xc
push ecx
push edx
call fcn.0041ac00
lea ecx, [esp + 0xac]
add esp, 8
push ecx
call fcn.0041a2b0
lea ecx, [esp + 0x64]
lea edx, [esp + 0xa8]
add esp, 4
push 0x40
push ecx
push edx
call fcn.0041aaf0
lea ecx, [esp + 0x28]
lea edx, [esp + 0xb0]
add esp, 0xc
push 0x10
push ecx
push edx
call fcn.0041aaf0
mov ecx, dword [esp + 0x118]
lea edx, [esp + 0xb0]
add esp, 0xc
push ecx
push edx
call fcn.0041ac00
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0xf0
ret

Function at 0x41a2b0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 0x10], ecx
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x14], ecx
ret