joyce8/EMBER2024-capa huggingface dataset:
Function at 0x535340
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
push ebx
push ebp
mov ebp, dword [esp + 0x38]
mov eax, ebp
push esi
shr eax, 3
mov esi, ecx
and ebp, 7
mov dword [esp + 0x10], esi
push edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x40], ebp
je 0x53537e
sub eax, 1
mov dword [esp + 0x10], eax
jne 0x53537e
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
mov esi, dword [edx]
mov edi, dword [edx + 4]
jmp 0x5354e0
mov ebx, dword [esp + 0x3c]
test eax, eax
je 0x5354d0
mov dword [esp + 0x20], ebx
jmp 0x535394
mov esi, dword [esp + 0x14]
mov edi, dword [esi]
mov esi, dword [esi + 8]
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [esp + 0x28], ecx
movzx ebp, word [esi + edi*4 + 0x14]
movzx eax, word [esi + edi*4 + 0x10]
shl ebp, 0x10
or ebp, eax
mov dword [esp + 0x2c], edx
movzx eax, word [esi + edi*4 + 0x1c]
xor ebp, ecx
movzx ecx, word [esi + edi*4 + 0x18]
shl eax, 0x10
or eax, ecx
mov dword [esp + 0x24], edi
xor eax, edx
mov dword [esp + 0x1c], esi
lea ecx, [edi - 1]
mov dword [esp + 0x3c], ebp
xor eax, ebp
mov dword [esp + 0x18], ecx
test ecx, ecx
js 0x535475
movzx ebx, word [esi + ecx*4]
mov ecx, eax
shr ecx, 0x10
mov esi, ebx
mov bp, cx
shr esi, 8
movzx ecx, cl
xor esi, ecx
shr bp, 8
movzx ecx, bp
xor esi, ecx
movzx edx, ax
movzx ecx, bl
shr edx, 8
xor edx, ecx
movzx ebx, al
movzx ecx, al
xor ecx, edx
inc ecx
add ecx, esi
rol cl, 2
movzx edi, cl
add ebx, edi
rol bl, 2
lea ecx, [edi + esi]
rol cl, 2
movzx edx, cl
movzx ecx, bp
mov ebp, eax
inc ecx
add ecx, edx
rol cl, 2
movzx esi, cl
shl esi, 8
or esi, edx
movzx ecx, bl
shl esi, 8
or esi, edi
shl esi, 8
or esi, ecx
mov ecx, dword [esp + 0x18]
xor esi, dword [esp + 0x3c]
sub ecx, 1
mov eax, esi
mov dword [esp + 0x3c], ebp
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x18], ecx
jns 0x5353e5
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
movzx edx, word [esi + edi*4 + 0xc]
movzx ecx, word [esi + edi*4 + 8]
shl edx, 0x10
or edx, ecx
movzx ecx, word [esi + edi*4]
xor edx, eax
xor ebp, edx
movzx edx, word [esi + edi*4 + 4]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
shl edx, 0x10
or edx, ecx
mov dword [ebx + 4], ebp
xor edx, eax
mov dword [ebx], edx
mov edx, dword [esp + 0x38]
mov eax, dword [edx]
xor dword [ebx], eax
mov eax, dword [edx + 4]
xor dword [ebx + 4], eax
add ebx, 8
sub dword [esp + 0x10], 1
mov dword [esp + 0x20], ebx
mov dword [edx], esi
mov dword [edx + 4], edi
jne 0x535390
mov ebp, dword [esp + 0x40]
jmp 0x5354dc
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x38]
test ebp, ebp
je 0x535524
mov ecx, dword [ebx + 4]
mov eax, dword [ebx]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x14]
push ebx
mov dword [edx], eax
call fcn.005350d0
test ebp, ebp
je 0x535515
lea edx, [ebx + 8]
nop dword [eax + eax]
mov cl, byte [edx]
lea edx, [edx + 1]
mov al, byte [edx - 9]
xor al, cl
mov byte [edx - 1], al
mov byte [edx - 9], cl
sub ebp, 1
jne 0x535500
mov ecx, dword [esp + 0x14]
push ebx
call fcn.005350d0
xor dword [ebx], esi
xor dword [ebx + 4], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0xc
Function at 0x54f000
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 0xd0010086
jg 0x54f05f
je 0x54f059
add eax, 0x2ffefffe
cmp eax, 0xf
ja case.0x54f0e2.803471260
movzx eax, byte [eax + 0x54f778]
jmp dword [eax*4 + 0x54f754]
mov eax, 0xf9
ret
mov eax, 0xfa
ret
mov eax, 0xfb
ret
mov eax, 0xfc
ret
mov eax, 0xfd
ret
mov eax, 0xfe
ret
mov eax, 0xff
ret
mov eax, 0x100
ret
mov eax, 0x101
ret
test eax, eax
jg 0x54f164
je 0x54f161
cmp eax, 0xd01c0061
jg 0x54f0ba
je 0x54f0b4
cmp eax, 0xd0100089
jg 0x54f0a3
je 0x54f09d
cmp eax, 0xd0020001
je 0x54f097
cmp eax, 0xd0100088
jne case.0x54f0e2.803471260
mov eax, 0x103
ret
mov eax, 0x102
ret
mov eax, 0x104
ret
cmp eax, 0xd010008a
jne case.0x54f0e2.803471260
mov eax, 0x105
ret
mov eax, 0x106
ret
cmp eax, 0xdc010009
jg case.0x54f0e2.803471260
je 0x54f15b
add eax, 0x2fe3ff9e
cmp eax, 0xfe
ja case.0x54f0e2.803471260
movzx eax, byte [eax + 0x54f7d8]
jmp dword [eax*4 + 0x54f788]
mov eax, 0x107
ret
mov eax, 0x108
ret
mov eax, 0x109
ret
mov eax, 0x10a
ret
mov eax, 0x10b
ret
mov eax, 0x10c
ret
mov eax, 0x10d
ret
mov eax, 0x10e
ret
mov eax, 0x10f
ret
mov eax, 0x110
ret
mov eax, 0x111
ret
mov eax, 0x112
ret
mov eax, 0x113
ret
mov eax, 0x114
ret
mov eax, 0x115
ret
mov eax, 0x116
ret
mov eax, 0x117
ret
mov eax, pe_nt_image_headers32
ret
mov eax, 0x119
ret
mov eax, 0x11a
ret
xor eax, eax
ret
dec eax
cmp eax, 0x30b
ja case.0x54f0e2.803471260
movzx eax, byte [eax + 0x54fcbc]
jmp dword [eax*4 + 0x54f8d8]
mov eax, 0xd8ef
ret

Function at 0x551380
Capabilities:
Check for time delay via gettickcount
Query service status

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov dword [0x624c94], eax
mov eax, dword [esi + 0x14]
mov dword [0x624c90], eax
cmp dword [esi + 4], ebx
jne 0x55142b
mov ebp, dword [esp + 0x14]
mov ecx, 0x2710
mov eax, 0xcccccccd
mul dword [esi + 0x18]
shr edx, 3
cmp edx, 0x3e8
jae 0x5513cd
mov edx, 0x3e8
jmp 0x5513d6
cmp edx, 0x2710
cmova edx, ecx
push edx
mov dword [0x624c98], edx
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x624c8c
push 0x24
push esi
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x55142b
mov eax, dword [esi + 0x14]
cmp eax, dword [0x624c90]
jbe 0x551414
call edi
mov dword [0x624c94], eax
mov eax, dword [esi + 0x14]
mov dword [0x624c90], eax
jmp 0x551421
call edi
sub eax, dword [0x624c94]
cmp eax, dword [esi + 0x18]
ja 0x551432
mov ecx, 0x2710
cmp dword [esi + 4], ebx
je 0x5513b3
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
Function at 0x551440
Capabilities:
Query service status
Start service

Disassembly:
sub esp, 0x28
mov eax, dword [0x616930]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push esi
mov esi, dword [esp + 0x34]
xorps xmm0, xmm0
push 0x20000
push 0
push 0
movups xmmword [esp + 0x14], xmm0
mov dword [esp + 0x34], 0
movups xmmword [esp + 0x24], xmm0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x551491
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.005bca10
add esp, 0x28
ret
push edi
push 0x14
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x5514bd
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.005bca10
add esp, 0x28
ret
push 0x624c8c
push 0x24
lea eax, [esp + 0x14]
push eax
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x551577
mov eax, dword [esp + 0x10]
cmp eax, 4
je 0x551557
cmp eax, 1
je 0x5514f1
cmp eax, 3
jne 0x551577
push 3
lea eax, [esp + 0x10]
push eax
push edi
call fcn.00551380
add esp, 0xc
test al, al
je 0x551577
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x551557
push 2
lea eax, [esp + 0x10]
mov esi, 3
push eax
push edi
call fcn.00551380
add esp, 0xc
test al, al
jne 0x551549
nop dword [eax]
test esi, esi
jle 0x551549
push 2
lea eax, [esp + 0x10]
dec esi
push eax
push edi
call fcn.00551380
add esp, 0xc
test al, al
je 0x551530
lea eax, [esp + 0xc]
push eax
push edi
call fcn.00551360
add esp, 8
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call esi
push edi
call esi
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.005bca10
add esp, 0x28
ret
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call esi
push edi
call esi
mov ecx, dword [esp + 0x30]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005bca10
add esp, 0x28
ret
Function at 0x551eb0
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ecx
mov edx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x14]
cmp edi, 0xffffffff
jae 0x551ff4
mov ecx, dword [esp + 0x10]
cmp edi, 4
jb 0x551ff4
push ebx
push esi
mov al, byte [ecx]
test al, al
je 0x551ff2
movsx eax, al
cmp eax, 0x80
jae 0x551ff2
mov bh, byte [eax + 0x432178]
cmp bh, 0xff
je 0x551ff2
movsx eax, byte [ecx + 1]
cmp eax, 0x80
jae 0x551ff2
mov al, byte [eax + 0x432178]
mov byte [esp + 0xf], al
movsx eax, al
cmp eax, 0xffffffff
je 0x551ff2
mov bl, byte [ecx + 2]
mov byte [esp + 0x1c], bl
cmp bl, 0x3d
je 0x551f46
movsx esi, bl
cmp esi, 0x80
jae 0x551ff2
cmp byte [esi + 0x432178], 0xff
je 0x551ff2
mov bl, byte [ecx + 3]
sub edi, 4
add ecx, 4
mov byte [esp + 0xe], bl
cmp bl, 0x3d
mov bl, byte [esp + 0x1c]
je 0x551f76
movsx esi, byte [esp + 0xe]
cmp esi, 0x80
jae 0x551ff2
cmp byte [esi + 0x432178], 0xff
je 0x551ff2
sar eax, 4
and al, 3
shl bh, 2
or al, bh
mov byte [edx], al
inc edx
cmp bl, 0x3d
je 0x551fe9
movsx esi, bl
cmp esi, 0x80
jae 0x551f9c
movsx eax, byte [esi + 0x432178]
jmp 0x551f9f
or eax, 0xffffffff
mov bl, byte [esp + 0xf]
sar eax, 2
and al, 0xf
shl bl, 4
or al, bl
mov byte [edx], al
inc edx
mov al, byte [esp + 0xe]
cmp al, 0x3d
je 0x551fe9
cmp esi, 0x80
jae 0x551fc8
mov bl, byte [esi + 0x432178]
jmp 0x551fcb
or bl, 0xff
movsx eax, al
cmp eax, 0x80
jae 0x551fdd
mov al, byte [eax + 0x432178]
jmp 0x551fdf
or al, 0xff
and al, 0x3f
shl bl, 6
or al, bl
mov byte [edx], al
inc edx
cmp edi, 4
jae 0x551ed2
pop esi
pop ebx
sub edx, dword [esp + 0xc]
mov eax, edx
pop edi
pop ecx
ret
Function at 0x552000
Capabilities:
Encode data using base64

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0x18]
mov eax, 0xaaaaaaab
lea ecx, [edi + 2]
mul ecx
mov ebx, edx
shr ebx, 1
shl ebx, 2
mov dword [esp + 0x18], ebx
cmp ebx, 0xbffffffd
ja 0x552142
cmp edi, 0xfffffffd
jae 0x552142
cmp dword [esp + 0x10], ebx
jb 0x552142
mov ecx, dword [esp + 0xc]
push ebp
xor ebp, ebp
push esi
mov esi, dword [esp + 0x1c]
cmp edi, 3
jb 0x5520cc
mov eax, 0xaaaaaaab
mul edi
mov ebx, edx
shr ebx, 1
lea ebp, [ebx*4]
movzx eax, byte [esi]
sub edi, 3
shr eax, 2
movzx eax, byte [eax + 0x432130]
mov byte [ecx], al
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
and edx, 3
shr eax, 4
shl edx, 4
or edx, eax
movzx eax, byte [edx + 0x432130]
mov byte [ecx + 1], al
movzx edx, byte [esi + 1]
movzx eax, byte [esi + 2]
and edx, 0xf
shr eax, 6
shl edx, 2
or edx, eax
movzx eax, byte [edx + 0x432130]
mov byte [ecx + 2], al
movzx eax, byte [esi + 2]
add esi, 3
and eax, 0x3f
movzx eax, byte [eax + 0x432130]
mov byte [ecx + 3], al
add ecx, 4
sub ebx, 1
jne 0x552061
mov ebx, dword [esp + 0x20]
test edi, edi
je 0x55212f
movzx eax, byte [esi]
shr eax, 2
mov al, byte [eax + 0x432130]
mov byte [ecx], al
cmp edi, 1
jne 0x5520f9
movzx eax, byte [esi]
mov dl, 0x3d
and eax, 3
shl eax, 4
mov al, byte [eax + 0x432130]
mov byte [ecx + 1], al
jmp 0x552122
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
and edx, 3
shr eax, 4
shl edx, 4
or edx, eax
mov al, byte [edx + 0x432130]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
and eax, 0xf
mov dl, byte [eax*4 + 0x432130]
mov byte [ecx + 2], dl
mov byte [ecx + 3], 0x3d
add ecx, 4
add ebp, 4
lea eax, [ebx + 1]
cmp dword [esp + 0x18], eax
mov eax, ebp
jb 0x55213d
mov byte [ecx], 0
pop esi
pop ebp
pop edi
pop ebx
ret
pop edi
xor eax, eax
pop ebx
ret
Function at 0x5533e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e59bd
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x616930]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ecx]
xor esi, esi
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
cmp byte [eax + 0xd], 0
jne 0x553480
mov esi, eax
nop dword [eax + eax]
cmp dword [edi + 0x14], 0x10
mov edx, edi
mov dword [ebp - 0x14], esi
jb 0x55343d
mov edx, dword [edi]
cmp dword [esi + 0x24], 0x10
lea ecx, [esi + 0x10]
jb 0x553449
mov ecx, dword [esi + 0x10]
push dword [edi + 0x10]
push edx
push dword [esi + 0x20]
push ecx
call fcn.0045c500
shr eax, 0x1f
add esp, 0x10
test al, al
je 0x553468
mov esi, dword [esi + 8]
mov ecx, dword [ebp - 0x10]
jmp 0x55346f
mov ecx, esi
mov esi, dword [esi]
mov dword [ebp - 0x10], ecx
movzx eax, al
xor eax, 1
cmp byte [esi + 0xd], 0
mov dword [ebp - 0x20], eax
je 0x553430
mov esi, eax
cmp byte [ecx + 0xd], 0
jne 0x5534d2
cmp dword [ecx + 0x24], 0x10
lea edx, [ecx + 0x10]
jb 0x553492
mov edx, dword [ecx + 0x10]
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x55349c
mov eax, dword [edi]
push dword [ecx + 0x20]
push edx
push dword [edi + 0x10]
push eax
call fcn.0045c500
shr eax, 0x1f
add esp, 0x10
test al, al
jne 0x5534d2
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x18]
cmp dword [eax + 4], 0x4924924
je 0x55359f
mov dword [ebp - 0x24], eax
push 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0
call fcn.005bc4c7
mov edx, eax
add esp, 4
mov dword [edx + 0x20], 0
mov dword [edx + 0x24], 0
movups xmm0, xmmword [edi]
movups xmmword [edx + 0x10], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [edx + 0x20], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [edx + 0x28], 0
mov dword [edx + 0x2c], 0
mov eax, dword [edi + 0x18]
mov dword [edx + 0x28], eax
mov eax, dword [edi + 0x1c]
mov dword [edx + 0x2c], eax
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov eax, dword [edi + 0x20]
mov ecx, dword [edi + 0x24]
mov dword [edx + 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [edx + 0x34], ecx
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
mov word [edx + 0xc], 0
mov ecx, dword [ebp - 0x18]
push edx
push esi
push dword [ebp - 0x14]
call fcn.004587a0
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call fcn.00459350
int3
Function at 0x55a7b0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push 0
push dword [esp + 0x14]
mov esi, ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x55a833
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x50]
call eax
test al, al
je 0x55a7eb
mov eax, dword [esi + 0x14]
push 0
push 0
push 0x41ed20
push eax
call dword [sym.imp.WS2_32.dll_send]
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x50]
call eax
test al, al
je 0x55a824
mov eax, dword [esi + 0x14]
push 2
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
jns 0x55a819
mov dword [esi + 0xc], 0x64
and dword [esi + 8], 0xfffffffd
mov dword [esi + 0x14], 0xffffffff
call fcn.004c7330
mov dword [esi + 0xc], 0x66
or eax, 0xffffffff
pop esi
ret 0xc
Function at 0x55a840
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x124
mov eax, dword [0x616930]
xor eax, esp
mov dword [esp + 0x120], eax
mov eax, dword [esp + 0x12c]
push ebx
push ebp
mov ebx, ecx
mov dword [esp + 0x10], eax
push esi
push edi
xor esi, esi
xor ebp, ebp
mov edi, dword [ebx + 0xb8]
test edi, edi
je 0x55a9ad
push 0xfc
lea eax, [esp + 0x38]
push ebp
push eax
call fcn.005be800
add esp, 0xc
mov dword [esp + 0x14], esi
test edi, edi
jle 0x55a97a
mov ebp, dword [esp + 0x138]
mov eax, 2
mov dword [esp + 0x28], 0x1388
cmp edi, eax
mov dword [esp + 0x30], ebp
lea ecx, [ebp + 1]
mov dword [esp + 0x2c], 1
cmovb eax, edi
mov dword [esp + 0x24], eax
lea eax, [esp + 0x24]
push eax
push 0
push 0
lea eax, [esp + 0x38]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_select]
mov dword [esp + 0x10], eax
test eax, eax
jle 0x55a928
lea eax, [esp + 0x2c]
push eax
push ebp
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x55a959
push 0
push dword [esp + 0x144]
push dword [esp + 0x20]
push ebp
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
jns 0x55a972
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2746
jne 0x55a959
mov eax, dword [ebx]
mov ecx, ebx
push 1
call dword [eax + 0x10]
mov eax, 0xfffffffe
jmp 0x55a9cf
jne 0x55a959
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], 0
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 4
push eax
push 0x1007
push 0xffff
push ebp
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
js 0x55a99b
mov eax, dword [esp + 0x14]
mov edi, dword [ebx + 0xb8]
add eax, 2
mov dword [esp + 0x14], eax
cmp eax, edi
jl 0x55a89d
mov ebp, dword [esp + 0x10]
test esi, esi
jg 0x55a9cd
mov eax, dword [ebx]
mov ecx, ebx
push 1
call dword [eax + 0x10]
test esi, esi
jns 0x55a98e
mov dword [ebx + 0xc], 0x67
test ebp, ebp
jle 0x55a9c8
test esi, esi
jne 0x55a9c8
lea eax, [esi - 2]
jmp 0x55a9cf
mov eax, dword [ebx]
mov ecx, ebx
push 1
or esi, 0xffffffff
call dword [eax + 0x10]
mov ebp, dword [esp + 0x10]
jmp 0x55a987
push 0
push dword [esp + 0x144]
push eax
push dword [esp + 0x144]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
jmp 0x55a976
or eax, 0xffffffff
jmp 0x55a9cf
mov eax, esi
mov ecx, dword [esp + 0x130]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005bca10
add esp, 0x124
ret 0xc
Function at 0x561920
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
mov eax, dword [0x616930]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
push ebx
push ebp
mov ebp, dword [esp + 0x40]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x48]
shl eax, 3
movzx edx, byte [ebp]
push edi
mov dword [esp + 0x10], 7
lea ecx, [edx + 3]
add edx, edx
add ecx, ecx
xor eax, dword [esi + ecx*8]
xor ebx, dword [esi + ecx*8 + 4]
xor ecx, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x44]
shl eax, 3
xor eax, dword [esi + edx*8 + 0x38]
xor ecx, dword [esi + edx*8 + 0x3c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
nop
mov bl, byte [ebp]
movzx ecx, byte [ebp]
shr bl, 3
dec bl
shl ecx, 4
and bl, 1
shl bl, 3
movzx eax, bl
mov dword [esp + 0x24], eax
add eax, eax
lea edi, [esi + eax*8]
lea eax, [edi + 0x40]
push eax
lea eax, [esi + 0x40]
add eax, ecx
push eax
lea eax, [esi + 0x30]
add eax, ecx
push eax
call fcn.00562a90
movzx ecx, byte [ebp]
lea eax, [edi + 0x30]
push eax
shl ecx, 4
lea eax, [esi + 0x30]
add eax, ecx
push eax
lea eax, [esi + 0x20]
add eax, ecx
push eax
call fcn.00562a90
movzx ecx, byte [ebp]
lea eax, [edi + 0x20]
push eax
shl ecx, 4
lea eax, [esi + 0x20]
add eax, ecx
push eax
lea eax, [esi + 0x10]
add eax, ecx
push eax
call fcn.00562a90
movzx ecx, byte [ebp]
lea eax, [edi + 0x10]
shl ecx, 4
add ecx, esi
push eax
lea eax, [ecx + 0x10]
push eax
push ecx
call fcn.00562a90
movzx edx, byte [ebp]
mov ecx, dword [esp + 0x44]
shl edx, 4
add edx, esi
push edi
mov eax, dword [edx + 4]
xor eax, dword [esp + 0x4c]
xor ecx, dword [edx]
mov dword [esp + 0x60], eax
mov eax, dword [edx + 0xc]
xor eax, dword [esp + 0x54]
mov dword [esp + 0x68], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0x5c], ecx
mov ecx, dword [esp + 0x50]
xor ecx, dword [edx + 8]
push eax
lea eax, [edx + 0x40]
mov dword [esp + 0x68], ecx
push eax
call fcn.00562a90
add esp, 0x3c
mov byte [ebp], bl
sub dword [esp + 0x10], 1
jne 0x561980
mov ecx, dword [esp + 0x24]
mov edx, ecx
shl edx, 4
add edx, esi
lea eax, [ecx + 2]
add eax, eax
mov ecx, dword [esi + eax*8]
xor ecx, dword [edx + 0x10]
mov eax, dword [esi + eax*8 + 4]
xor eax, dword [edx + 0x14]
xor dword [edx], ecx
xor dword [edx + 4], eax
movzx edx, byte [ebp]
shl edx, 4
add edx, esi
mov ecx, dword [edx + 0x28]
xor ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x2c]
xor eax, dword [edx + 0x1c]
xor dword [edx + 8], ecx
xor dword [edx + 0xc], eax
movzx ecx, byte [ebp]
mov edi, ecx
shl edi, 4
add edi, esi
lea eax, [ecx + 4]
add eax, eax
lea edx, [ecx + 3]
add edx, edx
mov ecx, dword [esi + eax*8]
xor ecx, dword [esi + edx*8]
mov eax, dword [esi + eax*8 + 4]
xor eax, dword [esi + edx*8 + 4]
xor dword [edi], ecx
xor dword [edi + 4], eax
movzx edx, byte [ebp]
shl edx, 4
add edx, esi
pop edi
pop esi
pop ebp
mov ecx, dword [edx + 0x48]
xor ecx, dword [edx + 0x38]
mov eax, dword [edx + 0x4c]
xor eax, dword [edx + 0x3c]
xor dword [edx + 8], ecx
mov ecx, dword [esp + 0x2c]
xor dword [edx + 0xc], eax
pop ebx
xor ecx, esp
call fcn.005bca10
add esp, 0x2c
ret
Function at 0x562560
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x18]
mov bl, byte [edi]
movzx eax, byte [edi]
shr bl, 3
dec bl
and bl, 1
lea ecx, [eax + 4]
shl bl, 3
add eax, 3
movzx edx, bl
add eax, eax
add ecx, ecx
movups xmm0, xmmword [esi + eax*8]
lea eax, [edx + 4]
aesenc xmm0, xmmword [esi + ecx*8]
add eax, eax
movups xmmword [esi + eax*8], xmm0
movzx eax, byte [edi]
lea ecx, [eax + 3]
add eax, 2
add eax, eax
add ecx, ecx
movups xmm0, xmmword [esi + eax*8]
lea eax, [edx + 3]
aesenc xmm0, xmmword [esi + ecx*8]
add eax, eax
movups xmmword [esi + eax*8], xmm0
movzx eax, byte [edi]
lea ecx, [eax + 2]
inc eax
add eax, eax
add ecx, ecx
movups xmm0, xmmword [esi + eax*8]
lea eax, [edx + 2]
aesenc xmm0, xmmword [esi + ecx*8]
add eax, eax
add edx, edx
movups xmmword [esi + eax*8], xmm0
movzx eax, byte [edi]
add eax, eax
movups xmm0, xmmword [esi + eax*8]
aesenc xmm0, xmmword [esi + eax*8 + 0x10]
movups xmmword [esi + edx*8 + 0x10], xmm0
movzx ecx, byte [edi]
mov eax, ecx
add eax, eax
movups xmm1, xmmword [esi + eax*8]
mov eax, dword [esp + 0x14]
pxor xmm1, xmmword [eax]
lea eax, [ecx + 4]
add eax, eax
movups xmm0, xmmword [esi + eax*8]
aesenc xmm0, xmm1
movups xmmword [esi + edx*8], xmm0
mov byte [edi], bl
pop edi
pop esi
pop ebx
ret
Function at 0x562720
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov eax, dword [0x616930]
xor eax, esp
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], 0
lea eax, [edi + 0xf]
mov dword [esp + 0x24], 0
shr eax, 4
and edi, 0xf
mov dword [ebp + 0x10], edi
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
test eax, eax
je 0x5628aa
xor ecx, ecx
add eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x562871
mov edi, dword [esp + 0x14]
mov ecx, edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x18], eax
nop dword [eax + eax]
movups xmm1, xmmword [ecx]
mov cl, byte [edi]
movzx eax, byte [edi]
shr cl, 3
dec cl
and cl, 1
shl cl, 3
movzx edx, cl
mov byte [esp + 0xb], cl
lea ecx, [eax + 4]
add eax, 3
add ecx, ecx
add eax, eax
movups xmm0, xmmword [esi + eax*8]
lea eax, [edx + 4]
aesenc xmm0, xmmword [esi + ecx*8]
add eax, eax
movups xmmword [esi + eax*8], xmm0
movzx eax, byte [edi]
lea ecx, [eax + 3]
add eax, 2
add eax, eax
add ecx, ecx
movups xmm0, xmmword [esi + eax*8]
lea eax, [edx + 3]
aesenc xmm0, xmmword [esi + ecx*8]
add eax, eax
movups xmmword [esi + eax*8], xmm0
movzx eax, byte [edi]
lea ecx, [eax + 2]
inc eax
add eax, eax
add ecx, ecx
movups xmm0, xmmword [esi + eax*8]
lea eax, [edx + 2]
aesenc xmm0, xmmword [esi + ecx*8]
add eax, eax
add edx, edx
movups xmmword [esi + eax*8], xmm0
movzx eax, byte [edi]
add eax, eax
movups xmm0, xmmword [esi + eax*8]
aesenc xmm0, xmmword [esi + eax*8 + 0x10]
movups xmmword [esi + edx*8 + 0x10], xmm0
movzx ecx, byte [edi]
mov eax, ecx
add eax, eax
pxor xmm1, xmmword [esi + eax*8]
lea eax, [ecx + 4]
mov ecx, dword [esp + 0xc]
add eax, eax
add ecx, 0x10
sub dword [esp + 0x10], 1
mov dword [esp + 0xc], ecx
movups xmm0, xmmword [esi + eax*8]
mov al, byte [esp + 0xb]
aesenc xmm0, xmm1
movups xmmword [esi + edx*8], xmm0
mov byte [edi], al
jne 0x5627a0
mov edi, dword [ebp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
add ecx, ecx
lea eax, [edx + ecx*8]
test edi, edi
je 0x562890
push edi
push eax
lea eax, [esp + 0x28]
push eax
call fcn.005be280
movups xmm0, xmmword [esp + 0x2c]
add esp, 0xc
jmp 0x562893
movups xmm0, xmmword [eax]
push dword [esp + 0x14]
lea eax, [esp + 0x24]
movaps xmmword [esp + 0x24], xmm0
push eax
push esi
call fcn.00562560
add esp, 0xc
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor ecx, esp
call fcn.005bca10
mov esp, ebp
pop ebp
ret