joyce8/EMBER2024-capa huggingface dataset:
Function at 0x616c2c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 5
push 0
push 0
dec ecx
jne 0x616c35
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov esi, eax
xor eax, eax
push ebp
push 0x616de4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x11], 0
xor edx, edx
push ebp
push 0x616d8d
push dword fs:[edx]
mov dword fs:[edx], esp
test esi, esi
je 0x616c81
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x616c7a
sub eax, 4
mov eax, dword [eax]
test eax, eax
setg al
jmp 0x616c83
xor eax, eax
test al, al
je 0x616c9a
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x616c93
sub eax, 4
mov eax, dword [eax]
test eax, eax
setg bl
jmp 0x616c9c
xor ebx, ebx
test bl, bl
je 0x616d83
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.00425d48
test al, al
je 0x616d83
mov dl, 1
mov eax, dword [ebp - 0x10]
call fcn.00425d48
test al, al
jne 0x616cd4
mov eax, dword [ebp - 0x10]
call fcn.00426740
test al, al
je 0x616d83
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x616d66
lea ecx, [ebp - 0x20]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.0042e2c0
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
pop ecx
call fcn.0040b100
lea ecx, [ebp - 0x28]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x28]
push eax
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
call fcn.0042e2c0
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 8]
pop ecx
call fcn.0040b100
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00425cb0
test al, al
je 0x616d65
mov eax, dword [ebp - 8]
call fcn.0040ae9c
push eax
mov eax, dword [ebp - 4]
call fcn.0040ae9c
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x616d65
inc dword [ebp - 0x18]
inc ebx
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
cmp ebx, eax
jl 0x616ce0
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, dword [ebp - 0x18]
sete byte [ebp - 0x11]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x616dba
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x616deb
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.0040a23c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a23c
pop eax
jmp eax

Function at 0x652d50
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
test ecx, ecx
jbe 0x652d81
dec ecx
test ecx, ecx
jb 0x652d81
inc ecx
xor ebx, ebx
movzx esi, byte [edx + ebx]
mov edi, dword [eax]
and edi, 0xff
xor esi, edi
mov esi, dword [esi*4 + 0x71b038]
mov edi, dword [eax]
shr edi, 8
xor esi, edi
mov dword [eax], esi
inc ebx
dec ecx
jne 0x652d5f
pop edi
pop esi
pop ebx
ret
Function at 0x654f78
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6550c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x710aa0]
mov edx, dword [eax]
call dword [edx]
xor eax, eax
push ebp
push 0x65509f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x710aac], 0
jne 0x655072
mov dword [0x710aac], 0x104
mov eax, dword [0x710aa8]
test eax, eax
je 0x654fee
cmp word [eax], 0
je 0x654fee
lea eax, [ebp - 4]
mov edx, dword [0x710aa8]
call fcn.0040aefc
mov eax, dword [ebp - 4]
sub eax, 0xa
movzx esi, word [eax]
jmp 0x654ff2
mov si, 2
movzx eax, si
imul dword [0x710aac]
call fcn.00407294
mov dword [0x710aa8], eax
mov eax, dword [0x710aa8]
push eax
mov eax, dword [0x710aac]
push eax
call sub.kernel32.dll_GetTempPathW
mov dword [0x710aac], eax
mov eax, ebx
mov ecx, dword [0x710aac]
mov edx, dword [0x710aa8]
call fcn.0040a374
mov eax, dword [ebx]
call fcn.00654f5c
mov eax, dword [ebx]
call fcn.00655d94
test al, al
jne 0x655085
mov eax, dword [ebx]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, 0x654f54
call fcn.004106d8
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x41d180]
call fcn.0042ca4c
call fcn.004098d4
jmp 0x655085
mov eax, ebx
mov ecx, dword [0x710aac]
mov edx, dword [0x710aa8]
call fcn.0040a374
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6550a6
mov eax, dword [0x710aa0]
mov edx, dword [eax]
call dword [edx + 4]
pop eax
jmp eax
Function at 0x655a14
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
xor eax, eax
mov dword [esi], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 0x14]
push eax
mov eax, edi
call fcn.0040ae9c
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
seta byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x655afc
mov eax, ebx
call fcn.00407294
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x655af5
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
mov eax, edi
call fcn.0040ae9c
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x655add
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x655b0c
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x655add
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
mov edx, eax
shr edx, 0x10
mov dword [esi], edx
and eax, 0xffff
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
mov edx, eax
shr edx, 0x10
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edx
and eax, 0xffff
mov edx, dword [ebp + 8]
mov dword [edx], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x655afc
mov eax, dword [ebp - 0xc]
call fcn.004072b0
pop eax
jmp eax
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x655b10
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov eax, edi
mov edx, dword [0x713c1c]
mov edx, dword [edx]
call fcn.0040a5cc
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.0040ae9c
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jbe 0x655bf1
mov eax, ebx
call fcn.00407294
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x655bea
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, esi
call fcn.0040ae9c
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x655bd2
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x655bf8
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x655ba3
mov ecx, dword [ebp - 8]
dec ecx
mov eax, edi
mov edx, dword [ebp - 0x10]
call fcn.0040a374
jmp 0x655bd2
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x655c40
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x655bd2
mov eax, dword [ebp - 0x14]
test byte [eax + 0x1c], 1
je 0x655bd2
mov eax, edi
mov edx, 0x655c50
call fcn.0040a5cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x655bf1
mov eax, dword [ebp - 4]
call fcn.004072b0
pop eax
jmp eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x658a84
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x658be2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x71763c]
call fcn.0040db1c
mov ebx, eax
push 0xa
push 0x658bf0
push ebx
call sub.kernel32.dll_FindResourceW
mov edi, eax
test edi, edi
jne 0x658b30
mov eax, esi
call fcn.00658a1c
mov eax, dword [esi]
test eax, eax
je 0x658ad3
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
dec ebx
cmp ebx, 2
jl 0x658bb7
lea eax, [ebp - 0x10]
mov edx, dword [esi]
movzx edx, word [edx + ebx*2 - 2]
call fcn.0040aebc
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
mov edx, dword [esi]
movzx edx, word [edx + ebx*2 - 2]
call fcn.0040aebc
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.004243ac
mov edx, dword [ebp - 0x14]
pop eax
call fcn.0040b298
jne 0x658b25
mov edx, esi
mov ecx, ebx
mov eax, 0x658c20
call fcn.0040b374
dec ebx
cmp ebx, 1
jne 0x658adf
jmp 0x658bb7
push edi
push ebx
call sub.kernel32.dll_LoadResource
test eax, eax
je 0x658bb2
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x658bab
push edi
push ebx
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x404cf0]
call fcn.0040d280
add esp, 4
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, ebx
call fcn.004077e0
xor eax, eax
mov dword [ebp - 0xc], eax
call fcn.004320cc
mov ecx, eax
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004315c0
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x658b9a
sub ebx, 4
mov ebx, dword [ebx]
push ebx
push esi
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.00431f74
jmp 0x658bb7
call fcn.0042f4e8
jmp 0x658bb7
call fcn.0042f4e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x658be9
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040a23c
lea eax, [ebp - 4]
mov edx, dword [0x404cf0]
call fcn.0040d3a4
pop eax
jmp eax
Function at 0x65d64c
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x65d8bc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x71b44c
xor ecx, ecx
mov edx, 0x10
call fcn.00407e64
mov eax, dword [0x71320c]
movzx eax, byte [eax]
xor al, 1
mov byte [ebp - 9], al
mov byte [ebp - 0xa], 0
cmp byte [ebp - 9], 0
jne 0x65d770
lea eax, [ebp - 0x20]
call fcn.0065d5d8
mov eax, dword [ebp - 0x20]
call fcn.0040ae9c
push eax
push 0
push 4
call sub.kernel32.dll_OpenFileMappingW
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x65d770
xor eax, eax
push ebp
push 0x65d769
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x65d750
xor eax, eax
push ebp
push 0x65d749
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x71b44c
mov eax, dword [ebp - 8]
mov ecx, 0x10
call fcn.004077e0
cmp dword [0x71b44c], 0
je 0x65d727
cmp dword [0x71b450], 0
je 0x65d727
cmp dword [0x71b454], 0
je 0x65d727
cmp dword [0x71b458], 0
jne 0x65d72b
xor eax, eax
jmp 0x65d72d
mov al, 1
mov byte [ebp - 0xa], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65d750
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_UnmapViewOfFile
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65d770
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
cmp byte [ebp - 0xa], 0
jne 0x65d85c
mov eax, dword [0x710af4]
call fcn.00407294
mov dword [0x710b48], eax
mov eax, 0x710b54
mov edx, dword [0x713c1c]
mov edx, dword [edx]
call fcn.0040a5cc
cmp byte [ebp - 9], 0
je 0x65d85c
lea eax, [ebp - 0x24]
call fcn.0065d5d8
mov eax, dword [ebp - 0x24]
call fcn.0040ae9c
push eax
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingW
mov dword [0x710b58], eax
cmp dword [0x710b58], 0
je 0x65d85c
push 0
push 0
push 0
push 2
mov eax, dword [0x710b58]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x65d85c
xor eax, eax
push ebp
push 0x65d855
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
xor ecx, ecx
mov edx, 0x10
call fcn.00407e64
mov dword [ebp - 0x1c], fcn.0065a09c
mov dword [ebp - 0x18], 0x659e3c
mov dword [ebp - 0x14], 0x659ff0
mov dword [ebp - 0x10], 0x65ab14
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x1c]
mov ecx, 0x10
call fcn.004077e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65d85c
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_UnmapViewOfFile
pop eax
jmp eax
cmp byte [ebp - 9], 0
je 0x65d883
cmp dword [0x710b58], 0
je 0x65d877
mov eax, 0x65d8d4
call fcn.00659e88
jmp 0x65d89f
mov eax, 0x65d928
call fcn.00659e88
jmp 0x65d89f
cmp byte [ebp - 0xa], 0
je 0x65d895
mov eax, 0x65d984
call fcn.00659e88
jmp 0x65d89f
mov eax, 0x65d9d8
call fcn.00659e88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x65d8c3
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.0040a23c
pop eax
jmp eax
Function at 0x662218
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
push 0
call sub.ws2_32.dll_select
test eax, eax
setg byte [ebp - 9]
cmp byte [ebp - 9], 0
je 0x6622e4
mov esi, ebx
dec esi
test esi, esi
jl 0x6622e4
inc esi
xor edi, edi
mov edx, dword [ebp - 4]
add edx, edi
mov eax, dword [ebp + 0x10]
mov eax, dword [eax - 4]
call fcn.0049f5ec
mov ebx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
push ebx
call sub.ws2_32.dll___WSAFDIsSet
test eax, eax
setne al
test al, al
je 0x6622b6
push 2
push 1
lea eax, [ebp - 0xa]
push eax
push ebx
call sub.ws2_32.dll_recv
dec eax
jne 0x6622a7
mov eax, dword [ebp + 0x10]
mov eax, dword [eax - 8]
mov edx, ebx
call fcn.0049f468
jmp 0x6622dc
mov eax, dword [ebp + 0x10]
mov eax, dword [eax - 0xc]
mov edx, ebx
call fcn.0049f468
jmp 0x6622dc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
push ebx
call sub.ws2_32.dll___WSAFDIsSet
test eax, eax
setne al
test al, al
je 0x6622dc
mov eax, dword [ebp + 0x10]
mov eax, dword [eax - 0xc]
mov edx, ebx
call fcn.0049f468
inc edi
dec esi
jne 0x66225c
movzx eax, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x662e70
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x662f39
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x28]
cmp eax, 0xffffffff
setne bl
test bl, bl
je 0x662f21
lea edx, [ebp - 3]
push edx
push 0
lea edx, [ebp - 2]
xor ecx, ecx
call dword [0x710b94]
test al, al
je 0x662eb9
cmp byte [ebp - 3], 0
je 0x662ebd
xor ebx, ebx
jmp 0x662ebf
mov bl, 1
test byte [ebp - 2], bl
je 0x662ed9
push 2
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [esi + 0x28]
push eax
call sub.ws2_32.dll_recv
dec eax
sete bl
test bl, bl
jne 0x662f21
lea eax, [ebp - 8]
push eax
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
movzx eax, word [esi + 0x10]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x18]
mov ecx, 1
mov eax, 0x662f54
call fcn.00426c18
mov edx, dword [ebp - 8]
mov ecx, 0x662f94
mov eax, 7
call fcn.0065b098
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x662f40
lea eax, [ebp - 8]
call fcn.0040a1dc
pop eax
jmp eax
Function at 0x663abc
Capabilities:
Set socket configuration

Disassembly:
push ebx
push ecx
mov ebx, eax
xor eax, eax
mov dword [ebx + 0x34], eax
mov eax, dword [ebx + 0x30]
call fcn.004072b0
xor eax, eax
mov dword [ebx + 0x30], eax
mov eax, dword [ebx + 0x28]
cmp eax, 0xffffffff
je 0x663b17
cmp byte [ebx + 0x14], 0
je 0x663b08
mov word [esp], 1
movzx edx, word [ebx + 0x16]
mov word [esp + 2], dx
push 4
lea edx, [esp + 4]
push edx
push 0x80
push 0xffff
push eax
call sub.ws2_32.dll_setsockopt
jmp 0x663b10
push 2
push eax
call sub.ws2_32.dll_shutdown
mov eax, ebx
call fcn.00662fd0
pop edx
pop ebx
ret

Function at 0x663b1c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, eax
xor eax, eax
push ebp
push 0x663c05
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [esi + 0x34], 0
jbe 0x663b46
mov bl, 1
jmp 0x663bed
mov eax, dword [esi + 0x28]
cmp eax, 0xffffffff
jne 0x663b55
xor ebx, ebx
jmp 0x663bed
xor ebx, ebx
mov byte [ebp - 2], 0
lea ecx, [ebp - 4]
push ecx
push edx
lea edx, [ebp - 3]
xor ecx, ecx
call dword [0x710b94]
test al, al
je 0x663b9d
cmp byte [ebp - 4], 0
jne 0x663b9d
cmp byte [ebp - 3], 0
je 0x663b99
push 2
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [esi + 0x28]
push eax
call sub.ws2_32.dll_recv
dec eax
jne 0x663b93
mov bl, 1
jmp 0x663ba1
mov byte [ebp - 2], 1
jmp 0x663ba1
xor ebx, ebx
jmp 0x663ba1
mov byte [ebp - 2], 1
cmp byte [ebp - 2], 0
je 0x663bed
lea eax, [ebp - 8]
push eax
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
movzx eax, word [esi + 0x10]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x18]
mov ecx, 1
mov eax, 0x663c20
call fcn.00426c18
mov edx, dword [ebp - 8]
mov ecx, 0x663c60
mov eax, 7
call fcn.0065b098
xor ebx, ebx
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x663c0c
lea eax, [ebp - 8]
call fcn.0040a1dc
pop eax
jmp eax
Function at 0x663d5c
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x663f0d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x18]
test al, al
je 0x663ef5
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x1001
push 0xffff
mov eax, dword [esi + 0x28]
push eax
call sub.ws2_32.dll_getsockopt
test eax, eax
jne 0x663edd
cmp edi, dword [ebp - 0x10]
jle 0x663edd
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x1001
push 0xffff
mov eax, dword [esi + 0x28]
push eax
call sub.ws2_32.dll_setsockopt
jmp 0x663edd
mov byte [ebp - 0x15], 0
mov byte [ebp - 0x16], 0
mov eax, dword [esi + 0x28]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x16]
push eax
push 0x5dc
lea ecx, [ebp - 0x15]
xor edx, edx
mov eax, dword [ebp - 0x1c]
call dword [0x710b94]
mov byte [ebp - 0x1d], al
movzx ebx, byte [ebp - 0x1d]
test byte [ebp - 0x15], bl
je 0x663e6e
cmp byte [ebp - 0x16], 0
jne 0x663e6e
push 0
push edi
mov eax, dword [ebp - 4]
push eax
mov eax, dword [esi + 0x28]
push eax
call sub.ws2_32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x663e50
sub edi, dword [ebp - 8]
mov eax, dword [ebp - 8]
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cdq
add dword [esi + 0x38], eax
adc dword [esi + 0x3c], edx
jmp 0x663e83
cmp dword [ebp - 8], 0
jge 0x663e5f
mov dword [ebp - 0xc], 0xb
jmp 0x663e83
inc dword [ebp - 0xc]
push 0x5dc
call sub.kernel32.dll_Sleep
jmp 0x663e83
xor bl, 1
or bl, byte [ebp - 0x16]
je 0x663e79
inc dword [ebp - 0xc]
push 0x5dc
call sub.kernel32.dll_Sleep
cmp dword [ebp - 0xc], 0xa
jle 0x663edd
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
lea eax, [ebp - 0x28]
push eax
push 0
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0x11
movzx eax, word [esi + 0x10]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
lea edx, [ebp - 0x3c]
mov ecx, 1
mov eax, 0x663f2c
call fcn.00426c18
mov edx, dword [ebp - 0x2c]
mov ecx, 0x663f6c
mov eax, 7
call fcn.0065b0b0
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x10]
test edi, edi
jle 0x663ef0
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x18]
test al, al
jne 0x663deb
test edi, edi
setle bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x663f14
lea eax, [ebp - 0x2c]
call fcn.0040a1dc
pop eax
jmp eax
Function at 0x689d5c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x71b890], 0
jne 0x689d73
call fcn.00689d18
mov eax, edi
dec eax
test eax, eax
jl 0x689d9b
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x71b490]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x689d7d
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x68ce18
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x68ce49
dec al
je 0x68ce84
dec al
je 0x68cec8
dec al
je 0x68cf3a
jmp 0x68cfd5
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x68cfd5
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x68ce59
jmp 0x68cfd5
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x68cfd5
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
movzx ecx, al
mov ecx, dword [ebx + ecx*4 + 0x40]
add dl, byte [ecx + esi]
and dl, 0xff
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x68ce94
jmp 0x68cfd5
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x68cfd5
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
jbe 0x68cefb
xor edx, edx
mov dword [esp + 4], edx
jmp 0x68cf10
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov ebp, dword [ebx + edx*4 + 0x40]
movzx edx, byte [ebp + esi]
add eax, dword [esp + 4]
sar eax, 1
jns 0x68cf28
adc eax, 0
add dl, al
and dl, 0xff
mov byte [ebp + esi], dl
inc esi
dec edi
jne 0x68ced8
jmp 0x68cfd5
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x68cfd5
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, dword [ebx + 0x24]
mov ecx, esi
dec ecx
cmp edx, ecx
ja 0x68cfa1
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 8], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 8]
push eax
movzx eax, byte [esp + 8]
pop edx
call fcn.00689da4
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [esp]
and al, 0xff
mov byte [edx + esi], al
inc esi
dec edi
jne 0x68cf56
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x697d78
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x697dc9
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x697db0
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x697da0
jmp 0x697dc9
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x697db1
pop ebx
mov esp, ebp
pop ebp
ret