joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40729d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x419764]
jne 0x4072a7
repz ret
jmp fcn.0040a6f8

Function at 0x4104a7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419764]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040b6d9
and dword [ebp - 0x14], 0
cmp dword [0x41d0dc], 0
mov dword [ebp - 0x18], eax
jne 0x41055a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x410602
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x410602
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x41d0dc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x41d0e0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x41d0e4], eax
call edi
push eax
call esi
mov dword [0x41d0ec], eax
test eax, eax
je 0x41055a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x41d0e8], eax
mov eax, dword [0x41d0e8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4105b3
cmp dword [0x41d0ec], ecx
je 0x4105b3
push eax
call esi
push dword [0x41d0ec]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4105b3
test ebx, ebx
je 0x4105b3
call edi
test eax, eax
je 0x4105aa
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4105aa
test byte [ebp - 8], 1
jne 0x4105b3
or dword [ebp + 0x10], 0x200000
jmp 0x4105e6
mov eax, dword [0x41d0e0]
cmp eax, dword [ebp - 0x18]
je 0x4105e6
push eax
call esi
test eax, eax
je 0x4105e6
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4105e6
mov eax, dword [0x41d0e4]
cmp eax, dword [ebp - 0x18]
je 0x4105e6
push eax
call esi
test eax, eax
je 0x4105e6
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x41d0dc]
call esi
test eax, eax
je 0x410602
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x410604
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040729d
leave
ret
Function at 0x44701a
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x463e00]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00446faf
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00430590
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x447069
cmp dword [ebp - 0x1c], 5
jb 0x447081
jmp 0x44707d
cmp dword [ebp - 0x10], 1
jne 0x447081
cmp dword [ebp - 0x1c], 4
ja 0x44707d
jne 0x447081
cmp dword [ebp - 0x18], 0
jbe 0x447081
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x451d3c
call fcn.00446ea0
test eax, eax
jge 0x4470a2
mov byte [0x468908], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0043013e
add ebp, 0x78
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x432000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x403b80
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x210
push esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 4]
push eax
push 0x40ac18
push 1
push 0
push 0x40ac08
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jl 0x403c6e
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
push 0x40ac28
mov ecx, dword [eax]
push eax
call dword [ecx]
mov esi, eax
test esi, esi
jl 0x403c64
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x218]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
test eax, eax
jge 0x403bf3
push 0
push 0
push str.SetPath_failed_
call sub.MFC42.DLL_AfxMessageBox
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x220]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jge 0x403c17
push 0
push 0
push str.SetDescription_failed_
call sub.MFC42.DLL_AfxMessageBox
mov ecx, dword [esp + 0x21c]
lea eax, [esp + 0xc]
push 0x104
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push 1
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
mov esi, eax
test esi, esi
jge 0x403c5a
push 0
push 0
push str.Save_failed_
call sub.MFC42.DLL_AfxMessageBox
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
pop esi
add esp, 0x210
ret
Function at 0x407740
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [0x40f5f0]
xor edx, edx
mov dh, byte [0x40d71c]
xor eax, eax
mov dl, byte [0x40d71d]
shl edx, 8
or edx, 0xc10000f9
test ecx, 0xfffffffc
jle 0x407787
push esi
mov ecx, dword [0x40f5ec]
mov esi, dword [ecx + eax*4]
xor esi, eax
xor esi, edx
mov dword [ecx + eax*4], esi
mov ecx, dword [0x40f5f0]
inc eax
sar ecx, 2
cmp eax, ecx
jl 0x407768
pop esi
ret

Function at 0x408740
Capabilities:
Initialize winsock library

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
jne 0x40880c
lea ebx, [esi + 0x194]
xor eax, eax
mov ecx, ebx
lea edi, [esi + 4]
push edi
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dx, word [esi + 0x1a4]
push edx
call sub.WSOCK32.dll_WSAStartup
mov ebp, eax
xor ecx, ecx
xor eax, eax
cmp byte [ebx + eax], 0
je 0x408786
mov ecx, 1
inc eax
cmp eax, 0x10
jl 0x40877b
mov ebx, dword [sym.imp.MSVCRT.dll_printf]
test ecx, ecx
je 0x4087a0
push str.______Buggy_WinSock2_BETA_version_detected.__Beware._n
call ebx
add esp, 4
test ebp, ebp
je 0x4087bd
push str.Error_when_calling_WSAStartup__:_n__
call ebx
add esp, 4
mov ecx, esi
push ebp
call fcn.004084a0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov ax, word [esi + 0x1a4]
cmp word [edi], ax
je 0x408806
xor ecx, ecx
xor edx, edx
mov cl, ah
mov dl, al
and ecx, 0xff
push ecx
push edx
push str.Could_not_find_a_WinSock__d._d_API._n
call ebx
xor eax, eax
xor ecx, ecx
mov al, byte [edi + 1]
mov cl, byte [edi]
and eax, 0xff
push eax
push ecx
push str.______I_found_a_WinSock__d._d_API_instead._n
call ebx
add esp, 0x18
call sub.WSOCK32.dll_WSACleanup
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov dword [esi], 1
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x408820
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push esi
call sub.WSOCK32.dll_inet_addr
push eax
call sub.WSOCK32.dll_htonl
cmp eax, 0xffffffff
jne 0x4088cd
push esi
call sub.WSOCK32.dll_gethostbyname
mov ebx, eax
test ebx, ebx
je 0x4088cb
cmp word [ebx + 8], 2
je 0x408867
push str.Cant_use_non_AF_INET_addresses_n
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 4
xor eax, eax
pop esi
pop ebx
ret 4
mov eax, dword [ebx + 0xc]
xor esi, esi
mov eax, dword [eax]
test eax, eax
je 0x4088c4
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_printf]
push edi
xor edi, edi
mov ecx, dword [eax]
push ecx
call sub.WSOCK32.dll_htonl
mov esi, eax
mov edx, esi
mov ecx, esi
and edx, 0xff
shr eax, 8
push edx
and eax, 0xff
shr ecx, 0x10
mov edx, esi
and ecx, 0xff
push eax
push ecx
shr edx, 0x18
push edx
push esi
push str.Checking_local_IP:___X___d._d._d._d___n
call ebp
mov eax, dword [ebx + 0xc]
add edi, 4
add esp, 0x18
mov eax, dword [eax + edi]
test eax, eax
jne 0x40887c
pop edi
pop ebp
cmp esi, 0xffffffff
mov eax, esi
jne 0x4088cd
xor eax, eax
pop esi
pop ebx
ret 4
Function at 0x408a10
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push edi
lea eax, [esp + 0x14]
mov edi, ecx
push 0x100
push eax
mov dword [esp + 0x18], edi
call sub.WSOCK32.dll_gethostname
test eax, eax
je 0x408a5a
push str.____cant_gethostname__:
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 4
call sub.WSOCK32.dll_WSAGetLastError
push eax
lea ecx, [edi + 4]
call fcn.004084a0
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret
mov ebp, dword [sym.imp.MSVCRT.dll_printf]
lea ecx, [esp + 0x14]
push ecx
push str.____host_name_is__s_n
call ebp
add esp, 8
lea edx, [esp + 0x14]
push edx
call sub.WSOCK32.dll_gethostbyname
mov ebx, eax
test ebx, ebx
jne 0x408a89
pop edi
pop ebp
pop ebx
add esp, 0x10c
ret
cmp word [ebx + 8], 2
je 0x408aa6
push str.Cant_use_non_AF_INET_addresses_n
call ebp
add esp, 4
xor eax, eax
pop edi
pop ebp
pop ebx
add esp, 0x10c
ret
mov eax, dword [ebx + 0xc]
push esi
xor esi, esi
mov eax, dword [eax]
test eax, eax
je 0x408afe
xor edi, edi
mov ecx, dword [eax]
push ecx
call sub.WSOCK32.dll_htonl
mov esi, eax
mov edx, esi
mov ecx, esi
and edx, 0xff
shr eax, 8
push edx
and eax, 0xff
shr ecx, 0x10
mov edx, esi
and ecx, 0xff
push eax
push ecx
shr edx, 0x18
push edx
push esi
push str.Checking_local_IP:___X___d._d._d._d___n
call ebp
mov eax, dword [ebx + 0xc]
add edi, 4
add esp, 0x18
mov eax, dword [edi + eax]
test eax, eax
jne 0x408ab4
mov edi, dword [esp + 0x14]
lea ebx, [edi + 0x1b4]
push esi
push ebx
mov ecx, edi
call fcn.004088e0
push ebx
mov ecx, edi
call fcn.00408820
lea ecx, [esp + 0x10]
mov dword [edi + 0x1ac], eax
push ecx
mov ecx, edi
mov dword [esp + 0x14], 0
call fcn.00408fd0
push ebx
push str._______s_n
mov dword [edi + 0x1dc], eax
call ebp
add esp, 8
mov eax, 1
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x10c
ret

Function at 0x408b60
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
mov eax, 0x110c
call fcn.00409410
push ebx
push ebp
movsx ebx, word [esp + 0x111c]
mov ebp, ecx
push esi
mov esi, dword [esp + 0x111c]
mov ecx, ebx
mov eax, ecx
push edi
lea edi, [esp + 0x11c]
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x10], 0
and ecx, 3
mov dword [esp + 0x14], 0xa
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1128]
lea ecx, [esp + 0x10]
push ecx
push 0
push edx
lea eax, [esi + 1]
push 0
push eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], 1
call sub.WSOCK32.dll_select
test eax, eax
jle 0x408c0c
push 0
lea ecx, [esp + 0x120]
push ebx
push ecx
push esi
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
jne 0x408c0c
push str.windup_sendto_error:
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 4
call sub.WSOCK32.dll_WSAGetLastError
push eax
lea ecx, [ebp + 4]
call fcn.004084a0
inc dword [ebp + 0x1b0]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110c
ret 0xc
Function at 0x408c60
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
mov eax, 0x111c
call fcn.00409410
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1134]
test esi, esi
mov ebp, ecx
je 0x408d42
mov eax, dword [esp + 0x1138]
push edi
push eax
mov word [esp + 0x1c], 2
call sub.WSOCK32.dll_htons
movsx ebx, word [esp + 0x1134]
mov ecx, dword [esi]
mov esi, dword [esp + 0x1130]
mov dword [esp + 0x1c], ecx
mov ecx, ebx
mov edx, ecx
lea edi, [esp + 0x12c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov word [esp + 0x1a], ax
and ecx, 3
lea eax, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1140]
push eax
lea ecx, [esp + 0x2c]
push 0
push ecx
lea edx, [esi + 1]
push 0
push edx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x46
mov dword [esp + 0x40], esi
mov dword [esp + 0x3c], 1
call sub.WSOCK32.dll_select
test eax, eax
pop edi
jle 0x408d42
lea eax, [esp + 0x14]
push 0x10
push eax
push 0
lea ecx, [esp + 0x134]
push ebx
push ecx
push esi
call sub.WSOCK32.dll_sendto
cmp eax, 0xffffffff
jne 0x408d42
push str.windup_sendto_error:
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 4
call sub.WSOCK32.dll_WSAGetLastError
push eax
lea ecx, [ebp + 4]
call fcn.004084a0
inc dword [ebp + 0x1b0]
pop esi
pop ebp
pop ebx
add esp, 0x111c
ret 0x14

Function at 0x408d50
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10c
push ebx
push esi
mov esi, dword [esp + 0x118]
lea eax, [esp + 8]
push edi
mov ebx, ecx
push eax
push 0
lea ecx, [esp + 0x1c]
push 0
lea edx, [esi + 1]
push ecx
push edx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0xa
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 1
call sub.WSOCK32.dll_select
test eax, eax
jle 0x408e07
mov eax, dword [esp + 0x124]
mov edi, dword [esp + 0x120]
push 0
push eax
push edi
push esi
call sub.WSOCK32.dll_recv
mov esi, eax
test esi, esi
jle 0x408e07
mov byte [esi + edi], 0
call sub.WSOCK32.dll_WSAGetLastError
mov edi, eax
test edi, edi
jne 0x408dd4
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x10c
ret 0xc
cmp edi, 0x2733
jne 0x408dea
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x10c
ret 0xc
push str.winudp_recvfrom_error:
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 4
lea ecx, [ebx + 4]
push edi
call fcn.004084a0
inc dword [ebx + 0x1b0]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10c
ret 0xc

Function at 0x408e20
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push eax
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x408e36
mov eax, 0x40f604
ret 4
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
ret 4
Function at 0x408e40
Capabilities:
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll_printf]
mov ebp, ecx
push str.__opening_socket...
call edi
add esp, 4
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
jne 0x408e83
push str.__failed_to_open_socket._n
call edi
add esp, 4
call sub.WSOCK32.dll_WSAGetLastError
push eax
lea ecx, [ebp + 4]
call fcn.004084a0
lea eax, [esp + 0x10]
push 4
push eax
push 8
push 0xffff
push esi
mov dword [esp + 0x24], 1
call sub.WSOCK32.dll_setsockopt
lea ecx, [esp + 0x10]
push 4
push ecx
push 0x80
push 0xffff
push esi
mov dword [esp + 0x24], 0
call sub.WSOCK32.dll_setsockopt
mov ebx, dword [esp + 0x2c]
mov word [esp + 0x18], 2
mov dx, word [ebx]
push edx
call sub.WSOCK32.dll_htons
mov word [esp + 0x1a], ax
lea eax, [esp + 0x18]
push 0x10
push eax
push esi
mov dword [esp + 0x28], 0
call sub.WSOCK32.dll_bind
test eax, eax
je 0x408f1b
push str.__failed_to_bind_socket:
call edi
add esp, 4
call sub.WSOCK32.dll_WSAGetLastError
push eax
lea ecx, [ebp + 4]
call fcn.004084a0
push esi
call sub.WSOCK32.dll_closesocket
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x18
ret 4
mov ax, word [ebx]
test ax, ax
je 0x408f34
and eax, 0xffff
push esi
push eax
push str.__bound_to_port__d_on_socket__d_n
call edi
add esp, 0xc
cmp word [ebx], 0
jne 0x408f73
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x18]
push ecx
push edx
push esi
mov dword [esp + 0x38], 0x10
call sub.WSOCK32.dll_getsockname
test eax, eax
jne 0x408fbc
mov eax, dword [esp + 0x1a]
push eax
call sub.WSOCK32.dll_htons
mov word [ebx], ax
and eax, 0xffff
push eax
push str.__auto_configured_to_local_port__d_n
call edi
add esp, 8
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 1
push ecx
push 0x8004667e
push esi
call sub.WSOCK32.dll_ioctlsocket
push 0x40
push esi
call sub.WSOCK32.dll_listen
test eax, eax
je 0x408fc3
push str.__listen_failed:_n
call edi
add esp, 4
call sub.WSOCK32.dll_WSAGetLastError
push eax
lea ecx, [ebp + 4]
call fcn.004084a0
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x18
ret 4
push str.__failed_to_getsockname__:
jmp 0x408f9c
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x408fd0
Capabilities:
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
push 0
push 2
mov ebp, ecx
push 2
call sub.WSOCK32.dll_socket
mov ebx, dword [sym.imp.MSVCRT.dll_printf]
mov esi, eax
cmp esi, 0xffffffff
jne 0x409009
push str.__failed_to_open_socket._n
call ebx
add esp, 4
call sub.WSOCK32.dll_WSAGetLastError
push eax
lea ecx, [ebp + 4]
call fcn.004084a0
mov edi, dword [esp + 0x28]
mov word [esp + 0x14], 2
mov ax, word [edi]
push eax
call sub.WSOCK32.dll_htons
lea ecx, [esp + 0x14]
push 0x10
push ecx
push esi
mov word [esp + 0x22], ax
mov dword [esp + 0x24], 0
call sub.WSOCK32.dll_bind
test eax, eax
je 0x409066
push str.__failed_to_bind_socket:
call ebx
add esp, 4
call sub.WSOCK32.dll_WSAGetLastError
push eax
lea ecx, [ebp + 4]
call fcn.004084a0
push esi
call sub.WSOCK32.dll_closesocket
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x14
ret 4
mov ax, word [edi]
test ax, ax
je 0x40907f
and eax, 0xffff
push esi
push eax
push str.__bound_to_port__d_on_socket__d_n
call ebx
add esp, 0xc
cmp word [edi], 0
jne 0x4090be
lea edx, [esp + 0x28]
lea eax, [esp + 0x14]
push edx
push eax
push esi
mov dword [esp + 0x34], 0x10
call sub.WSOCK32.dll_getsockname
test eax, eax
jne 0x4090e2
mov ecx, dword [esp + 0x16]
push ecx
call sub.WSOCK32.dll_ntohs
mov word [edi], ax
and eax, 0xffff
push eax
push str.__auto_configured_to_local_port__d_n
call ebx
add esp, 8
lea edx, [esp + 0x10]
mov dword [esp + 0x10], 1
push edx
push 0x8004667e
push esi
call sub.WSOCK32.dll_ioctlsocket
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
push str.__failed_to_getsockname__:
call ebx
add esp, 4
call sub.WSOCK32.dll_WSAGetLastError
push eax
lea ecx, [ebp + 4]
call fcn.004084a0
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x14
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x422c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x422cb9
test eax, edx
je 0x422cbc
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x422c77
movzx eax, word [eax]
sub eax, ecx
jmp 0x422c9e
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [eax + ecx]
xor ebx, dword [edx + ecx]
jne 0x422c9f
add ecx, 4
js 0x422c8f
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x422c9c
movzx eax, word [eax + ecx]
movzx edx, word [edx + ecx]
sub eax, edx
pop ebx
pop ebx
jmp 0x422c9e
xor eax, eax
ret
test eax, eax
je 0x422cc8
test edx, edx
jne 0x422c68
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x42cb84
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0040a000
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040f8f0
mov edi, eax
cmp edi, 0x104
jbe 0x42cb2f
mov eax, edi
add eax, eax
call fcn.00406fa4
mov esi, eax
jmp 0x42cb31
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040f8f0
push esi
call fcn.00413d7c
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x42cb6a
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x42cb54
mov eax, esp
cmp esi, eax
je 0x42cb77
mov eax, esi
call fcn.00406fc0
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x42cbb0
cmp bl, 0
je 0x42cbac
cmp bl, 0x41
jl 0x42cba7
cmp bl, 0x5a
jg 0x42cba7
or bl, 0x20
xor al, bl
inc esi
jmp 0x42cb8b
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x42caf0
Function at 0x42dc5c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42dc7c
sub eax, 4
mov eax, dword [eax]
lea ebx, [edi + esi]
cmp eax, ebx
jg 0x42dc96
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42dc91
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x42dc9b
add edi, esi
mov dword [ebp - 8], edi
movzx eax, word [ebp + 0x14]
cmp ax, word [ebp + 0x10]
je 0x42dd09
xor eax, eax
mov dword [ebp - 0xc], eax
cmp esi, dword [ebp - 8]
jge 0x42dd52
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x42dcc7
inc dword [ebp - 0xc]
jmp 0x42dcdf
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x10]
jne 0x42dcdf
cmp dword [ebp - 0xc], 0
jle 0x42dcdf
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jne 0x42dd01
xor eax, eax
jmp 0x42dcfd
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x42dcfc
mov eax, esi
jmp 0x42dd55
inc eax
cmp eax, ecx
jle 0x42dce9
inc esi
cmp esi, dword [ebp - 8]
jl 0x42dcb3
jmp 0x42dd52
mov byte [ebp - 0xd], 0
cmp esi, dword [ebp - 8]
jge 0x42dd52
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x42dd2a
movzx eax, byte [ebp - 0xd]
xor al, 1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x42dd4c
xor eax, eax
jmp 0x42dd48
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x42dd47
mov eax, esi
jmp 0x42dd55
inc eax
cmp eax, ecx
jle 0x42dd34
inc esi
cmp esi, dword [ebp - 8]
jl 0x42dd12
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10