joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100981e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, ecx
push esi
push edi
cmp dword [eax + 0x34], 0xa
jae 0x10098243
nop word [eax + eax]
mov esi, dword [eax]
cmp esi, 8
jae 0x1009821d
mov edi, dword [eax + 8]
cmp edi, dword [eax + 0xc]
je 0x1009830b
movzx edx, byte [edi]
mov ecx, 0x18
sub ecx, esi
shl edx, cl
lea ecx, [edi + 1]
or dword [eax + 4], edx
add esi, 8
mov dword [eax], esi
mov dword [eax + 8], ecx
mov edx, dword [eax + 4]
mov ecx, edx
shl ecx, 8
mov dword [eax + 4], ecx
lea ecx, [esi - 8]
mov dword [eax], ecx
mov ecx, dword [eax + 0x34]
shr edx, 0x18
mov byte [eax + ecx + 0x70d6], dl
inc dword [eax + 0x34]
cmp dword [eax + 0x34], 0xa
jb 0x100981f0
mov dword [eax + 0x70e0], 0
movzx ecx, byte [eax + 0x70dc]
shl ecx, 8
mov dword [eax + 0x70e0], ecx
movzx edx, byte [eax + 0x70dd]
or edx, ecx
shl edx, 8
mov dword [eax + 0x70e0], edx
movzx ecx, byte [eax + 0x70de]
or ecx, edx
shl ecx, 8
mov dword [eax + 0x70e0], ecx
movzx edx, byte [eax + 0x70df]
or edx, ecx
mov dword [eax + 0x70e0], edx
mov cl, byte [eax + 0x70d6]
cmp cl, 0x31
jne 0x10098310
cmp byte [eax + 0x70d7], 0x41
jne 0x10098310
cmp byte [eax + 0x70d8], 0x59
jne 0x10098310
cmp byte [eax + 0x70d9], 0x26
jne 0x10098310
cmp byte [eax + 0x70da], 0x53
jne 0x10098310
cmp byte [eax + 0x70db], 0x59
jne 0x10098310
cmp byte [eax + 0x70e8], 0
jne 0x100982df
add dword [eax + 0x70f0], 1
adc dword [eax + 0x70f4], 0
add dword [eax + 0x70f8], 1
mov byte [eax + 0x70e8], 1
adc dword [eax + 0x70fc], 0
mov ecx, dword [eax + 0x70e4]
rol ecx, 1
xor ecx, edx
mov dword [eax + 0x70e4], ecx
mov dword [eax + 0x30], 2
pop edi
xor eax, eax
pop esi
ret
cmp cl, 0x17
jne 0x100983a6
cmp byte [eax + 0x70d7], 0x72
jne 0x100983a6
cmp byte [eax + 0x70d8], 0x45
jne 0x100983a6
cmp byte [eax + 0x70d9], 0x38
jne 0x100983a6
cmp byte [eax + 0x70da], 0x50
jne 0x100983a6
cmp byte [eax + 0x70db], 0x90
jne 0x100983a6
cmp byte [eax + 0x70e8], 0
jne 0x10098361
add dword [eax + 0x70f0], 1
adc dword [eax + 0x70f4], 0
mov esi, dword [eax + 4]
mov byte [eax + 0x70e8], 1
test esi, esi
je 0x10098376
mov byte [eax + 0x70ea], 1
mov edx, dword [eax]
mov ecx, edx
and ecx, 7
mov dword [eax + 0x30], 0xb
sub edx, ecx
shl esi, cl
mov ecx, dword [eax + 0x70e0]
mov dword [eax], edx
mov dword [eax + 4], esi
cmp ecx, dword [eax + 0x70e4]
je 0x1009830b
mov byte [eax + 0x70e9], 1
pop edi
mov eax, 1
pop esi
ret
Function at 0x105180b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x10518200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x105180d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105180c2
add dl, dl
jne 0x105180e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10518134
xor eax, eax
add dl, dl
jne 0x105180ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105181d5
add dl, dl
jne 0x105180fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10518108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10518113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1051811e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1051812a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x105180cd
mov eax, 1
add dl, dl
jne 0x10518142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1051814d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10518139
sub eax, ebx
mov ebx, 1
jne 0x10518180
mov ecx, 1
add dl, dl
jne 0x10518166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10518171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1051815d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105180cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10518197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x105181a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1051818e
cmp eax, 0x7d00
jae 0x105181c5
cmp eax, 0x500
jb 0x105181c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105180cd
cmp eax, 0x7f
ja 0x105181c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x105180cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x105181f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x105180cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40273a
Capabilities:
Terminate process

Disassembly:
call section..text
push 0
push 0x406018
push 0x406014
call fcn.00402d64
push 0
push 0x406020
push 0x40601c
call fcn.00402d64
add esp, 0x18
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x403402
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x406a44]
test eax, eax
je 0x40341b
call eax
test eax, eax
jne 0x40341b
push 0xfffffffffffffffe
jmp 0x403435
push 1
push 0x406010
push 0x406008
call fcn.00402d64
add esp, 0xc
test eax, eax
je 0x40343b
push 0xfffffffffffffffd
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
push 0
push 0x406004
push section..data
call fcn.00402d64
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
test esi, esi
jne 0x403461
mov esi, 0x405bd1
mov cl, 0x20
jmp 0x40346a
cmp al, 0x20
ja 0x403474
inc esi
mov al, byte [esi]
test al, al
jne 0x403465
cmp al, 0x20
jbe 0x40348b
mov al, byte [esi]
cmp al, 0x22
jne 0x40347d
xor cl, 0x20
inc esi
mov al, byte [esi]
cmp al, cl
ja 0x403476
jmp 0x40348b
cmp al, cl
ja 0x403491
inc esi
mov al, byte [esi]
test al, al
jne 0x403486
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test eax, 0xa0d0a0d
sub eax, 0x54524357
sub eax, 0xa0d0a0d
test byte [ebp - 0x18], 1
je 0x4034ba
movzx eax, word [ebp - 0x14]
jmp 0x4034bd
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.0040273a
pop ecx
pop esi
leave
ret

Function at 0x4034f8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x406391], eax
push 0
push dword [ebp + 8]
push 0
push 0
push 0
push 0x80000000
push 0xfffffc18
push 0xfffffc18
push 0xcf0000
push 0x4068a0
push 0x406908
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x403542
xor eax, eax
jmp 0x403559
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
inc eax
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x403ba7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x403bdf
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 4], 0x103
jne 0x403bd2
xor al, al
jmp 0x403c03
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 4], 0
lea eax, [ebp - 4]
push eax
push 0x10000
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x10]
push 0
call fcn.0042b88c
add esp, 0x18
mov dword [esi + 4], eax
test eax, eax
setne al
pop esi
leave
ret 0xc

Function at 0x403d07
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
test ecx, ecx
je 0x403d70
test edx, edx
je 0x403d70
cmp dword [ebp + 8], 0
je 0x403d70
cmp dword [ebp + 0x10], 0
je 0x403d70
cmp dword [ebp + 0x14], 0
je 0x403d70
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0x20106
push ebx
push edx
push ecx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403d6b
push esi
push dword [ebp + 0x14]
xor esi, esi
push dword [ebp + 0x10]
inc esi
push esi
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
test eax, eax
movzx ebx, bl
cmove ebx, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
leave
ret
xor al, al
leave
ret

Function at 0x403e35
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x403ea7
cmp dword [ebp + 0x10], 4
jb 0x403ea7
xor ebx, ebx
mov dword [esi], ebx
test ecx, ecx
je 0x403ea7
test edx, edx
je 0x403ea7
cmp dword [ebp + 8], ebx
je 0x403ea7
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
push eax
mov eax, dword [ebp + 0x14]
or eax, 0x20019
mov dword [ebp - 4], ebx
push eax
push ebx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403ea3
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0xc]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
cmove ebx, edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0x403ea9
xor al, al
pop esi
pop ebx
leave
ret
Function at 0x404599
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
push esi
push edi
mov dword [ebp - 0x10], eax
cmp dword [eax + 4], 0xffffffff
je 0x40463b
cmp dword [ebp + 8], 0
je 0x40463b
cmp dword [ebp + 0x10], 0
ja 0x4045c6
cmp dword [ebp + 0xc], 1
jb 0x40463b
xorps xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
and dword [ebp - 8], 0
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
sub ecx, esi
sbb eax, edi
test eax, eax
jb 0x4045f9
ja 0x4045f0
cmp ecx, 0xfffffff
jbe 0x4045f9
mov eax, 0xfffffff
mov ecx, esi
jmp 0x404600
mov eax, dword [ebp + 0xc]
mov ecx, esi
sub eax, ecx
push 0
lea edx, [ebp - 8]
push edx
push eax
mov eax, dword [ebp + 8]
add eax, ecx
push eax
mov eax, dword [ebp - 0x10]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x404635
cmp dword [ebp - 8], 0
je 0x404635
add esi, dword [ebp - 8]
adc edi, 0
cmp edi, dword [ebp + 0x10]
jb 0x4045d4
ja 0x404635
cmp esi, dword [ebp + 0xc]
jb 0x4045d4
mov eax, esi
mov edx, edi
jmp 0x40463f
xor eax, eax
xor edx, edx
pop edi
pop esi
leave
ret 0xc

Function at 0x404770
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor esi, esi
mov ebp, ecx
and dword [esp + 0x10], esi
mov ebx, edx
push edi
xor edi, edi
test ebp, ebp
je 0x4048a0
mov edx, dword [esp + 0x20]
test edx, edx
je 0x4048a0
mov eax, dword [esp + 0x24]
cmp eax, 9
jb 0x4048a0
mov byte [edx], 0
test ebx, ebx
je 0x404897
add eax, 0xfffffff8
mov dword [esp + 0x18], eax
cmp esi, eax
jae 0x404897
mov ch, byte [edi + ebp]
inc edi
cmp edi, ebx
jb 0x4047d8
xor al, al
mov dword [esp + 0x14], 2
xor cl, cl
mov byte [esp + 0x11], cl
jmp 0x4047f6
mov al, byte [edi + ebp]
inc edi
mov byte [esp + 0x11], al
mov cl, al
cmp edi, ebx
jae 0x4047ec
mov al, byte [edi + ebp]
inc edi
jmp 0x4047f6
xor al, al
mov dword [esp + 0x14], 1
mov byte [esp + 0x12], al
and cl, 0xf
shr al, 6
shl cl, 2
or cl, al
movzx eax, ch
shr eax, 2
and ch, 3
shl ch, 4
mov byte [esp + 0x13], cl
movzx ecx, ch
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edx], al
movzx eax, byte [esp + 0x11]
shr eax, 4
or ecx, eax
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edx + 1], al
add esi, 2
mov eax, dword [esp + 0x14]
sub eax, 0
je 0x404868
sub eax, 1
je 0x404853
sub eax, 1
jne 0x40488b
mov word [esi + edx], 0x3d3d
jmp 0x404888
movzx eax, byte [esp + 0x13]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edx], al
mov byte [esi + edx + 1], 0x3d
jmp 0x404888
movzx eax, byte [esp + 0x13]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edx], al
movzx eax, byte [esp + 0x12]
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edx + 1], al
add esi, 2
mov eax, dword [esp + 0x18]
cmp edi, ebx
jb 0x4047b6
mov byte [esi + edx], 0
lea eax, [esi + 1]
jmp 0x4048a2
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x404b24
Capabilities:
Decrypt data via sspi

Disassembly:
sub esp, 0x40
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x1374]
test ecx, ecx
je 0x404d1c
mov edi, dword [esi + 0x1378]
test edi, edi
je 0x404d1c
mov eax, dword [esi + 0x1380]
xorps xmm0, xmm0
sub edi, eax
movlpd qword [esp + 0x34], xmm0
xor ebx, ebx
movlpd qword [esp + 0x40], xmm0
inc ebx
mov dword [esp + 0x20], edi
lea ebp, [eax + ecx]
mov dword [esp + 0x24], ebx
xor eax, eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], eax
lea eax, [esi + 0x134c]
push eax
mov dword [esp + 0x1c], 4
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esi + 0x1364]
push eax
call dword [sym.imp.Secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x404ce4
cmp eax, 0x90317
jne 0x404c19
cmp dword [esi + 8], 0xffffffff
mov eax, dword [esi + 0x1380]
mov dword [esi + 0x1378], eax
je 0x404c57
push str.tls___socket_closed_in_decrypt_message
lea ecx, [esi + 0x228]
mov edx, 0xff
call fcn.00403ead
push 2
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_shutdown]
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 8], 0xffffffff
jmp 0x404c57
cmp eax, 0x80090308
jne 0x404c37
push str.tls___invalid_token_in_decrypt_message
lea ecx, [esi + 0x228]
mov edx, 0xff
call fcn.00403ead
jmp 0x404c55
test eax, eax
je 0x404c69
push eax
push str.tls___decrypt_message_failed___d_status
lea eax, [esi + 0x228]
push 0xff
push eax
call fcn.00403ccb
add esp, 0x10
xor bl, bl
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
jmp 0x404d1e
push 4
lea edi, [esp + 0x24]
pop ebp
cmp dword [edi + 4], ebx
jne 0x404c97
push dword [edi]
mov eax, dword [esi + 0x1374]
push dword [edi + 8]
add eax, dword [esi + 0x1380]
push eax
call fcn.0041d610
mov eax, dword [edi]
add esp, 0xc
add dword [esi + 0x1380], eax
add edi, 0xc
sub ebp, 1
jne 0x404c70
push 5
pop eax
cmp dword [esp + 0x24], eax
jne 0x404cb2
lea edi, [esp + 0x20]
lea eax, [esp + 0x28]
jmp 0x404ce0
cmp dword [esp + 0x30], eax
jne 0x404cc2
lea edi, [esp + 0x2c]
lea eax, [esp + 0x34]
jmp 0x404ce0
cmp dword [esp + 0x3c], eax
jne 0x404cd2
lea edi, [esp + 0x38]
lea eax, [esp + 0x40]
jmp 0x404ce0
cmp dword [esp + 0x48], eax
jne 0x404d18
lea edi, [esp + 0x44]
lea eax, [esp + 0x4c]
mov ebp, dword [eax]
mov edi, dword [edi]
test edi, edi
je 0x404cff
mov eax, dword [esi + 0x1374]
add eax, dword [esi + 0x1380]
push edi
push ebp
push eax
call fcn.0041d610
add esp, 0xc
mov ecx, dword [esi + 0x1380]
lea eax, [esi + 0x134c]
add ecx, edi
mov dword [esi + 0x1378], ecx
jmp 0x404c5b
xor edi, edi
jmp 0x404cff
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
Function at 0x404fdc
Capabilities:
Encrypt data via sspi

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x50]
mov esi, ecx
test edi, edi
je 0x4050b9
mov ecx, dword [esi + 0x138c]
mov edx, dword [esi + 0x1388]
lea eax, [edx + ecx]
cmp dword [esp + 0x54], eax
jb 0x4050b9
mov ebp, dword [esp + 0x58]
lea eax, [edx + edi]
mov dword [esp + 0x30], eax
xor ebx, ebx
mov eax, dword [esp + 0x54]
sub eax, edx
mov dword [esp + 0x40], ebx
sub eax, ecx
mov dword [ebp], ebx
mov dword [esp + 0x28], eax
mov eax, edi
sub eax, ecx
mov dword [esp + 0x48], ebx
add eax, dword [esp + 0x54]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x10], ebx
lea ebx, [esi + 0x134c]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x1c]
push ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], 7
mov dword [esp + 0x30], 1
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], 6
mov dword [esp + 0x18], 4
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
lea eax, [esp + 0x14]
push eax
push 0
lea eax, [esi + 0x1364]
push eax
call dword [sym.imp.Secur32.dll_EncryptMessage]
test eax, eax
je 0x4050c5
push str.tls___encrypt_message_failed
lea ecx, [esi + 0x228]
mov edx, 0xff
call fcn.00403ead
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 0xc
mov eax, dword [esp + 0x1c]
cmp eax, dword [esi + 0x1388]
jae 0x405100
push dword [esp + 0x28]
add eax, edi
push dword [esp + 0x34]
push eax
call fcn.0041d610
push dword [esp + 0x40]
mov eax, dword [esp + 0x38]
add eax, dword [esp + 0x2c]
push dword [esp + 0x4c]
add eax, edi
push eax
call fcn.0041d610
mov eax, dword [esp + 0x34]
add esp, 0x18
mov ecx, dword [esp + 0x34]
add ecx, dword [esp + 0x28]
add ecx, eax
push ebx
mov dword [ebp], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
jmp 0x4050bb
Function at 0x40524e
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x18
push ebx
mov ebx, ecx
push ebp
push esi
push edi
cmp dword [ebx + 8], 0xffffffff
je 0x4053c2
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4053c2
mov ebp, dword [esp + 0x34]
xor ecx, ecx
test ebp, ebp
je 0x40527a
mov dword [ebp], ecx
mov esi, dword [ebx + 0x448]
mov edi, dword [ebx + 0x44c]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
add eax, esi
mov dword [ebx + 0x450], eax
adc edx, edi
mov dword [ebx + 0x454], edx
jmp 0x405387
mov ecx, ebx
call fcn.00406360
test eax, eax
jne 0x4052da
mov ecx, ebx
call fcn.004063db
test al, al
jne 0x4053ce
push 1
jmp 0x405381
xor eax, eax
push eax
push eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x40]
push eax
push 1
lea eax, [esp + 0x34]
push eax
push dword [ebx + 8]
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
jne 0x40535e
cmp dword [esp + 0x34], 1
jne 0x40535e
mov esi, dword [ebx + 0x448]
xor ecx, ecx
mov edi, dword [ebx + 0x44c]
mov dword [esp + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
add eax, esi
mov dword [ebx + 0x450], eax
mov eax, dword [esp + 0x24]
adc edx, edi
mov dword [ebx + 0x454], edx
mov cl, byte [eax]
cmp cl, 0xd
je 0x405387
cmp cl, 0xa
je 0x4053e5
mov ecx, dword [esp + 0x30]
cmp ecx, 1
jbe 0x405387
add eax, dword [esp + 0x34]
sub ecx, dword [esp + 0x34]
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], ecx
jmp 0x405387
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp + 0x18], eax
cmp eax, 0x2733
jne 0x405394
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, 0x7d0
je 0x405394
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [ebx + 0x435], 0
je 0x4052b9
push str.raw___read_string_failed
lea ecx, [ebx + 0x228]
mov edx, 0xff
call fcn.00403ead
test ebp, ebp
je 0x4053b4
mov eax, dword [esp + 0x18]
mov dword [ebp], eax
mov eax, dword [esp + 0x2c]
mov ecx, ebx
mov byte [eax], 0
call fcn.00403b48
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
push str.raw___read_string_timeout
lea ecx, [ebx + 0x228]
mov edx, 0xff
call fcn.00403ead
jmp 0x4053c2
mov byte [eax], 0
mov esi, dword [ebx + 0x448]
mov edi, dword [ebx + 0x44c]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
add eax, esi
mov dword [ebx + 0x450], eax
mov al, 1
adc edx, edi
mov dword [ebx + 0x454], edx
jmp 0x4053c4
Function at 0x405cba
Capabilities:
Connect socket
Get socket status
Set socket configuration

Disassembly:
sub esp, 0x120
xor eax, eax
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x228]
mov word [edi], ax
cmp byte [esi + 0x435], al
je 0x405ce0
xor al, al
jmp 0x405ede
call fcn.00403b48
mov ebp, dword [esp + 0x134]
xor ebx, ebx
push 1
push ebx
push ebx
movzx eax, word [ebp]
push 6
push 1
push eax
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
jne 0x405d1c
push str.socket_create_failed
mov edx, 0xff
mov ecx, edi
call fcn.00403ead
jmp 0x405cd9
lea eax, [esi + 0x440]
cmp dword [eax], ebx
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
jbe 0x405d3e
push 4
push eax
push 0x1005
push 0xffff
push dword [esi + 8]
call ebx
lea eax, [esi + 0x444]
cmp dword [eax], 0
jbe 0x405d5b
push 4
push eax
push 0x1006
push 0xffff
push dword [esi + 8]
call ebx
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x100000
push eax
push 0x1002
push 0xffff
push dword [esi + 8]
mov dword [esp + 0x2c], 0x40000
call ebx
push 4
lea eax, [esp + 0x1c]
push eax
push 0x1001
push 0xffff
push dword [esi + 8]
call ebx
push 4
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 1
push eax
push 8
push 0xffff
push dword [esi + 8]
call ebx
mov eax, dword [esi]
xor ebx, ebx
inc ebx
mov ecx, esi
push ebx
call dword [eax + 0x1c]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], ebx
mov ebx, dword [sym.imp.WS2_32.dll_ioctlsocket]
push eax
push 0x8004667e
push dword [esi + 8]
call ebx
call fcn.00405be8
mov dword [esi + 0x470], eax
xor eax, eax
push eax
push eax
push eax
push eax
push 0x10
pop eax
push 0x1c
pop ecx
mov dword [esi + 0x474], edx
cmp word [ebp], 0x17
cmove eax, ecx
push eax
push ebp
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_WSAConnect]
cmp eax, 0xffffffff
jne 0x405ea9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x405e63
mov ecx, dword [esi + 8]
xor edx, edx
mov eax, dword [esp + 0x138]
mov dword [esp + 0x2c], ecx
mov ecx, 0x3e8
div ecx
mov dword [esp + 0x28], 1
mov dword [esp + 0x20], eax
imul eax, edx, 0x3e8
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
push eax
push 0
lea eax, [esp + 0x30]
push eax
push 0
push 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x405ea9
mov ecx, esi
call fcn.00403b48
and dword [esi + 0x470], 0
mov edx, 0xff
and dword [esi + 0x474], 0
mov ecx, edi
push str.connect_failed
call fcn.00403ead
lea eax, [esi + 0x28]
push eax
push str._s_direct_connect_failed
push str.Socket
push 0x4b9590
call fcn.0044637c
add esp, 0x10
jmp 0x405cd9
push dword [esi + 0x474]
push dword [esi + 0x470]
call fcn.00405c0f
and dword [esp + 0x18], 0
pop ecx
pop ecx
lea ecx, [esp + 0x10]
mov dword [esi + 0x470], eax
push ecx
push 0x8004667e
push dword [esi + 8]
mov dword [esi + 0x474], edx
call ebx
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x120
ret 0xc
Function at 0x406360
Capabilities:
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push esi
push edi
mov esi, ecx
xor edi, edi
inc edi
mov dword [ebp - 4], edi
cmp dword [esi + 8], 0xffffffff
je 0x4063d4
lea ecx, [ebp - 4]
push ecx
push 0x4004667f
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x40639a
mov ecx, esi
call fcn.00403b48
mov eax, edi
jmp 0x4063d7
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4063d7
mov eax, dword [esi + 8]
xor ecx, ecx
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0xc]
push eax
push ecx
push ecx
lea eax, [ebp - 0x110]
mov dword [ebp - 0x110], edi
push eax
push ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x3e8
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x406396
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret