joyce8/EMBER2024-capa huggingface dataset:
Function at 0x581d20
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
movzx eax, word [edi + 6]
cdq
mov esi, eax
add esi, ecx
mov ecx, edx
push edx
adc ecx, dword [ebp - 4]
sub esi, 1
push eax
sbb ecx, 0
push ecx
push esi
call fcn.0058c810
test edx, edx
jl 0x581d67
jg 0x581d61
test eax, eax
je 0x581d67
sub eax, 1
sbb edx, 0
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x581d70
mov dword [ecx], edx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x581d79
mov dword [ecx], eax
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x581d86
movzx eax, word [edi + 6]
mov dword [ecx], eax
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x581da0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, dword [ebp + 0x18]
push 0xffffffffffffffff
mov dword [ebp - 4], 0
movzx esi, word [edi + 6]
push dword [edi + 0x28]
imul esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 0xc]
movzx eax, word [edi + 6]
push dword [ebp + 8]
cdq
push edx
push eax
call fcn.0058c440
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], eax
push ecx
push eax
push dword [edi + 0x24]
mov dword [ebp - 8], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x581dfc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x581e34
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 0x18]
push 0
push eax
push esi
push ebx
push dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x581e33
mov eax, dword [ebp + 0x18]
cmp eax, esi
jae 0x581e2c
sub esi, eax
add eax, ebx
push esi
push 0
push eax
call fcn.005c9220
add esp, 0xc
mov dword [ebp - 4], 1
pop ebx
push dword [edi + 0x28]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x581e50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
xor esi, esi
push 0xffffffffffffffff
movzx ebx, word [edi + 6]
push dword [edi + 0x28]
imul ebx, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 0xc]
movzx eax, word [edi + 6]
push dword [ebp + 8]
cdq
push edx
push eax
call fcn.0058c440
push esi
lea ecx, [ebp - 4]
mov dword [ebp - 8], eax
push ecx
push eax
push dword [edi + 0x24]
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x581ea7
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x581ec9
push 0
lea eax, [ebp + 0x18]
push eax
push ebx
push dword [ebp + 0x10]
push dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x581ec9
cmp dword [ebp + 0x18], ebx
mov eax, 1
cmove esi, eax
push dword [edi + 0x28]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x583840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x2c]
mov edx, dword [edi + 0x74]
mov eax, dword [edi + 0x2c]
mov ebx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub ebx, dword [edi + 0x6c]
add eax, esi
sub ebx, edx
cmp dword [edi + 0x6c], eax
jb 0x5838ea
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.005c9900
mov eax, dword [edi + 0x4c]
add esp, 0xc
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x44]
mov edi, dword [ebp - 4]
lea edx, [eax + edi*2]
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [ebp - 4], 0
sub eax, esi
cmp ecx, esi
movzx eax, ax
cmovb eax, dword [ebp - 4]
mov word [edx], ax
sub edi, 1
jne 0x583894
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x40]
mov edi, esi
lea edx, [eax + esi*2]
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [ebp - 4], 0
sub eax, esi
cmp ecx, esi
movzx eax, ax
cmovb eax, dword [ebp - 4]
mov word [edx], ax
sub edi, 1
jne 0x5838c2
mov edi, dword [ebp + 8]
add ebx, esi
mov eax, dword [edi]
mov dword [ebp - 4], eax
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x583966
mov edx, dword [edi + 0x6c]
add edx, dword [edi + 0x74]
add edx, dword [edi + 0x38]
cmp ecx, ebx
cmovbe ebx, ecx
test ebx, ebx
je 0x583921
push ebx
push dword [eax]
sub ecx, ebx
push edx
mov dword [eax + 4], ecx
call fcn.005c9900
mov eax, dword [ebp - 4]
add esp, 0xc
add dword [eax], ebx
add dword [eax + 8], ebx
mov eax, dword [edi + 0x74]
lea edx, [eax + ebx]
mov dword [ebp - 4], edx
mov dword [edi + 0x74], edx
cmp edx, 3
jb 0x583952
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
mov edx, dword [ebp - 4]
cmp edx, 0x106
jae 0x583966
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x583850
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x583fa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
test eax, eax
je 0x5840cb
mov esi, dword [eax + 0x1c]
test esi, esi
je 0x5840cb
cmp dword [eax + 0x20], 0
je 0x5840cb
cmp dword [eax + 0x24], 0
je 0x5840cb
mov dword [eax + 0x14], 0
mov dword [eax + 8], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x2c], 2
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], eax
test ecx, ecx
jns 0x584003
neg ecx
mov dword [esi + 0x18], ecx
test ecx, ecx
mov dword [esi + 0x28], 0
mov edx, 0x2a
mov eax, 0x71
cmovne eax, edx
push esi
mov dword [esi + 4], eax
call fcn.00586160
mov ecx, dword [esi + 0x2c]
add esp, 4
mov edx, dword [esi + 0x44]
lea eax, [ecx + ecx]
neg ecx
mov dword [esi + 0x3c], eax
cmp dword [0x647c20], 0
mov eax, dword [esi + 0x4c]
push eax
push edx
push ecx
je 0x584049
call fcn.00466c20
jmp 0x58404e
call fcn.00401010
mov eax, dword [esi + 0x84]
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x6064c2]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x6064c0]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x6064c4]
mov dword [esi + 0x90], eax
movzx eax, word [ecx*4 + 0x6064c6]
mov dword [esi + 0x7c], eax
xor eax, eax
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
pop ebp
ret 4
mov eax, 0xfffffffe
pop esi
pop ebp
ret 4
Function at 0x58b120
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
call fcn.0058a910
mov ecx, esi
call fcn.0058a830
mov ecx, esi
call fcn.0058a830
mov eax, dword [ebp + 8]
push esi
push 0
push 0x58af40
mov dword [esi + 0x1d8], eax
call fcn.005d21c2
add esp, 0xc
cmp eax, 0xffffffff
je 0x58b191
mov ecx, esi
mov dword [esi + 0x1c4], 1
call fcn.0058a910
push esi
push 0
push 0x58af60
call fcn.005d21c2
add esp, 0xc
cmp eax, 0xffffffff
je 0x58b19b
mov dword [esi + 0x1d0], 1
mov eax, 1
pop esi
pop ebp
ret 4
mov dword [esi + 0x1d8], 0
mov ecx, esi
call fcn.0058a910
mov ecx, esi
call fcn.0058a830
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x58b770
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
mov ebx, ecx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x24], ebx
lea eax, [ebx + 0x1c]
mov dword [ebp - 4], esi
push eax
mov dword [ebp - 0x30], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x58b7a6
mov edi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
jmp 0x58b7b5
push 0
call fcn.005cc714
cdq
add esp, 4
mov edi, eax
mov eax, edx
sub edi, dword [ebx + 0x60]
mov ecx, dword [ebx + 0x3c]
sbb eax, dword [ebx + 0x64]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 8], edi
lea eax, [ecx - 1]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], eax
cmp dword [ebx + 0x50], esi
jne 0x58b7da
test ecx, ecx
cmovne ecx, eax
mov dword [ebp - 0x18], ecx
xor eax, eax
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x58b8ce
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x10], edx
nop
cmp ecx, dword [ebp + 0xc]
jae 0x58b8cb
mov esi, dword [ebx + 0x34]
add esi, edx
mov edx, dword [ebp - 0x1c]
cmp dword [esi + 0xc], edx
ja 0x58b8b2
jb 0x58b815
cmp dword [esi + 8], edi
jae 0x58b8b2
cmp eax, dword [ebp - 0x20]
je 0x58b81f
mov edx, dword [ebx + 0x4c]
jmp 0x58b822
mov edx, dword [ebx + 0x50]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x28], ecx
cmp dword [esi + 0x10], edx
je 0x58b8b2
xor edi, edi
mov eax, 1
cmp dword [ebx + 0x54], edi
jbe 0x58b8af
nop dword [eax]
cmp ecx, dword [ebp + 0xc]
jae 0x58b880
test edx, eax
je 0x58b878
test dword [esi + 0x10], eax
jne 0x58b878
mov edx, dword [ebx + 0x44]
xor ecx, ecx
mov ebx, dword [ebp + 8]
imul edx, edi
add edx, dword [esi]
adc ecx, dword [esi + 4]
mov dword [ebx], edx
mov edx, ebx
mov ebx, dword [ebp - 0x24]
mov dword [edx + 4], ecx
add edx, 8
mov ecx, dword [ebp - 4]
inc ecx
mov dword [ebp + 8], edx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], ecx
inc edi
add eax, eax
cmp edi, dword [ebx + 0x54]
jb 0x58b840
cmp ecx, dword [ebp - 0x28]
je 0x58b8af
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x58b89b
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
jmp 0x58b8a6
push 0
call fcn.005cc714
add esp, 4
cdq
mov ecx, dword [ebp - 4]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
add dword [ebp - 0x10], 0x20
inc esi
mov eax, esi
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0xc], esi
cmp esi, dword [ebp - 0x18]
jb 0x58b7f0
mov esi, dword [ebp - 4]
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x58ddc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x6480b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0xd0]
push edi
push eax
call fcn.0058e5e0
lea eax, [ebp - 0xd0]
push eax
push dword [ebp + 0xc]
push esi
call fcn.0058e790
lea eax, [ebp - 0x218]
mov ecx, 0x29
push eax
push dword [ebp + 0x14]
lea esi, [ebp - 0xd0]
lea edi, [ebp - 0x218]
rep movsd dword es:[edi], dword [esi]
push ebx
call fcn.0058e600
mov ecx, dword [ebp + 0x20]
mov eax, 0xcccccccd
dec ecx
add esp, 0x1c
mul ecx
mov eax, edx
shr eax, 4
add eax, 1
mov dword [ebp - 0x22c], eax
je 0x58df80
mov edx, 1
mov dword [ebp - 0x220], 0
lea ebx, [ebp - 0x2c]
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x224], ebx
mov eax, edx
mov dword [ebp - 0x1c], 0
shr eax, 0x18
lea esi, [ebp - 0x218]
mov byte [ebp - 0x18], al
lea edi, [ebp - 0x174]
mov eax, edx
mov byte [ebp - 0x15], dl
shr eax, 0x10
mov ecx, 0x29
mov byte [ebp - 0x17], al
xorps xmm0, xmm0
mov eax, edx
shr eax, 8
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0x18]
mov byte [ebp - 0x16], al
mov eax, 4
movups xmmword [ebp - 0x23c], xmm0
movups xmmword [ebp - 0x2c], xmm0
test ecx, ecx
je 0x58df2c
mov ebx, ecx
lea ecx, [ebp - 0x174]
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0058e600
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0x18]
push 0x14
push eax
call fcn.0058e6c0
movups xmm0, xmmword [ebp - 0x18]
add esp, 0x18
mov eax, 0x10
movups xmm1, xmmword [ebp - 0x23c]
pxor xmm1, xmm0
movups xmmword [ebp - 0x2c], xmm1
mov cl, byte [ebp + eax - 0x18]
xor byte [ebp + eax - 0x2c], cl
inc eax
cmp eax, 0x14
jb 0x58def3
lea esi, [ebp - 0xd0]
mov ecx, 0x29
lea edi, [ebp - 0x174]
rep movsd dword es:[edi], dword [esi]
sub ebx, 1
je 0x58df26
movups xmm0, xmmword [ebp - 0x2c]
movups xmmword [ebp - 0x23c], xmm0
jmp 0x58deb5
mov ebx, dword [ebp - 0x224]
mov edi, dword [ebp - 0x220]
xor edx, edx
mov esi, dword [ebp - 0x228]
mov ecx, edi
nop dword [eax]
cmp ecx, dword [ebp + 0x20]
jae 0x58df52
mov al, byte [ebx + ecx]
inc edx
mov byte [ecx + esi], al
inc ecx
cmp edx, 0x14
jb 0x58df40
mov edx, dword [ebp - 0x21c]
add edi, 0x14
inc edx
mov dword [ebp - 0x220], edi
sub ebx, 0x14
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x224], ebx
lea eax, [edx - 1]
cmp eax, dword [ebp - 0x22c]
jb 0x58de64
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058bb64
mov esp, ebp
pop ebp
ret

Function at 0x58e0e0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x58], 0
pop ebp
ret
Function at 0x58e970
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x5c], 0
pop ebp
ret

Function at 0x595b70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
xor ecx, ecx
push ebx
xor bl, bl
test edx, edx
je 0x595c29
push esi
mov esi, dword [ebp + 0xc]
push edi
cmp edx, 0x20
jb 0x595c03
mov eax, dword [ebp + 8]
mov edi, edx
mov ebx, esi
and edi, 0xffffffe0
xorps xmm3, xmm3
xorps xmm2, xmm2
sub ebx, eax
nop
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ebx + eax - 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
por xmm3, xmm1
movups xmm1, xmmword [esi + ecx + 0x10]
add ecx, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp ecx, edi
jb 0x595ba0
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd ebx, xmm2
cmp ecx, edx
jae 0x595c21
mov edi, dword [ebp + 8]
sub esi, edi
sub edx, ecx
lea eax, [ecx + edi]
mov cl, byte [eax + esi]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or bl, cl
sub edx, 1
jne 0x595c11
pop edi
pop esi
movzx eax, bl
pop ebx
pop ebp
ret
movzx eax, bl
pop ebx
pop ebp
ret
Function at 0x598980
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x6480b4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x6534ac], 0
mov dword [ebp - 0x230], str.getaddrinfo
mov dword [ebp - 0x22c], 0x5983d0
mov dword [ebp - 0x228], str.getnameinfo
mov dword [ebp - 0x224], 0x598740
mov dword [ebp - 0x220], str.freeaddrinfo
mov dword [ebp - 0x21c], fcn.00598380
jne 0x598b02
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x598af8
push ebx
push esi
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.005debba
push str.ws2_32
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.005dec14
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, eax
mov ebx, dword [0x648e40]
test edi, edi
je 0x598a58
push str.getaddrinfo
push edi
call ebx
test eax, eax
jne 0x598aad
push edi
call esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.005debba
push str.wship6
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.005dec14
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x598af5
push str.getaddrinfo
push edi
call ebx
test eax, eax
jne 0x598aad
push edi
call esi
jmp 0x598af5
xor esi, esi
nop
push dword [ebp + esi*8 - 0x230]
push edi
call ebx
mov dword [ebp + esi*8 - 0x22c], eax
test eax, eax
je 0x598aee
inc esi
cmp esi, 3
jl 0x598ab0
mov eax, dword [ebp - 0x22c]
mov dword [0x64827c], eax
mov eax, dword [ebp - 0x224]
mov dword [0x648284], eax
mov eax, dword [ebp - 0x21c]
mov dword [fcn.00598380], eax
jmp 0x598af5
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
mov dword [0x6534ac], 1
movzx eax, word [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, dword [eax*8 + 0x64827c]
call fcn.0058bb64
mov esp, ebp
pop ebp
ret 4
Function at 0x598b20
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x6480b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x1c]
lea eax, [ebp - 0x408]
push edi
mov edi, dword [ebp + 8]
push 0x401
push 0
push eax
mov dword [ebp - 0x820], edi
mov dword [ebp - 0x814], esi
mov dword [ebp - 0x818], 0
call fcn.005c9220
push 0x401
lea eax, [ebp - 0x80c]
push 0
push eax
call fcn.005c9220
push 0x400
push edi
lea eax, [ebp - 0x408]
push 0x401
lea ebx, [ebp - 0x80c]
mov dword [ebp - 0x81c], eax
push eax
mov dword [ebp - 0x810], ebx
call fcn.005ded30
add esp, 0x28
nop dword [eax]
nop dword [eax + eax]
push dword [ebp - 0x820]
mov edi, esi
mov dword [esi], 0
mov byte [ebx], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x598d19
cmp word [ebx + 8], 2
jne 0x598c0e
cmp word [ebx + 0xa], 4
jne 0x598c0e
mov esi, dword [ebx + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x598c0e
push dword [eax]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00598d70
mov dword [edi], eax
test eax, eax
je 0x598cbe
add esi, 4
lea edi, [eax + 0x1c]
mov eax, dword [esi]
test eax, eax
jne 0x598be8
push 0x400
push dword [ebx]
mov ebx, dword [ebp - 0x810]
push 0x401
push ebx
call fcn.005ded30
mov eax, dword [ebp - 0x814]
xor esi, esi
add esp, 0x10
cmp dword [eax], esi
jne 0x598cc8
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x598c40
sub ecx, edx
je case.0x598d29.11003
mov edi, dword [ebp - 0x81c]
mov ecx, ebx
mov eax, edi
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x598c80
test dl, dl
je 0x598c7c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x598c80
add eax, 2
add ecx, 2
test dl, dl
jne 0x598c60
xor eax, eax
jmp 0x598c85
sbb eax, eax
or eax, 1
test eax, eax
je case.0x598d29.11003
mov esi, dword [ebp - 0x818]
inc esi
mov dword [ebp - 0x818], esi
cmp esi, 0x10
je case.0x598d29.11003
mov esi, dword [ebp - 0x814]
mov eax, edi
mov dword [ebp - 0x81c], ebx
mov ebx, eax
mov dword [ebp - 0x810], ebx
jmp 0x598bb0
mov esi, 8
jmp 0x598d43
cmp dword [ebp + 0x18], esi
je 0x598d43
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x598cd2
sub ecx, edx
lea ebx, [ecx + 1]
push ebx
push 1
call fcn.005d9af7
mov edi, eax
add esp, 8
test edi, edi
je 0x598cff
push dword [ebp - 0x810]
push ebx
push edi
call fcn.005debba
add esp, 0xc
mov ecx, dword [ebp - 0x814]
mov eax, dword [ecx]
mov dword [eax + 0x14], edi
mov eax, dword [ecx]
mov ecx, 8
cmp dword [eax + 0x14], esi
cmove esi, ecx
jmp 0x598d43
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x598d29.11001
jmp dword [eax*4 + 0x598d58]
mov esi, 0x2afa
jmp 0x598d43
mov esi, 0x2afb
jmp 0x598d43
mov esi, 0x2af9
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058bb64
mov esp, ebp
pop ebp
ret 0x18
Function at 0x59a220
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x6480b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x324], eax
push esi
mov esi, dword [ebp + 0xc]
cmp ebx, 0x180
jbe 0x59a261
pop esi
mov eax, 0xffffffc8
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058bb64
mov esp, ebp
pop ebp
ret
push 0x1a0
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.005c9220
lea eax, [ebp - 0x31c]
push eax
call fcn.005b3e60
mov eax, ebx
mov byte [ebp - 0x1f1], bl
shr eax, 0x18
mov byte [ebp - 0x1f4], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0x1f3], al
mov eax, ebx
shr eax, 8
push ebx
mov byte [ebp - 0x1f2], al
lea eax, [ebp - 0x1ec]
push esi
push eax
mov byte [ebp - 0x1ed], 0x30
call fcn.005c9900
lea esi, [ebx + 0x19]
mov byte [ebp + ebx - 0x1ec], 0x80
add esp, 0x1c
mov dword [ebp - 0x328], esi
xor eax, eax
mov byte [ebp + eax - 0x64], al
inc eax
cmp eax, 0x20
jl 0x59a2d2
push 0x100
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x31c]
push eax
call fcn.005b3ea0
mov al, byte [ebp - 0x201]
add esp, 0xc
xor ebx, ebx
mov dword [ebp - 0x320], ebx
push edi
xorps xmm0, xmm0
mov edi, esi
movups xmmword [ebp - 0x14], xmm0
test esi, esi
je 0x59a36d
lea esi, [ebp - 0x204]
mov ebx, 0x10
lea eax, [ebp - 0x14]
sub esi, eax
xor eax, eax
lea edx, [ebp - 0x14]
add edx, eax
inc eax
mov cl, byte [esi + edx]
xor byte [edx], cl
cmp eax, 0x10
jl 0x59a322
add esi, ebx
mov eax, edi
cmp edi, ebx
cmovae eax, ebx
sub edi, eax
lea eax, [ebp - 0x14]
push eax
push eax
lea eax, [ebp - 0x31c]
push 1
push eax
call fcn.005b5050
add esp, 0x10
test edi, edi
jne 0x59a320
movups xmm0, xmmword [ebp - 0x14]
mov ebx, dword [ebp - 0x320]
mov al, byte [ebp - 0x201]
mov esi, dword [ebp - 0x328]
movups xmmword [ebp + ebx - 0x44], xmm0
add ebx, 0x10
inc al
mov byte [ebp - 0x201], al
mov dword [ebp - 0x320], ebx
cmp ebx, 0x30
jl 0x59a303
push 0x100
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x31c]
push eax
call fcn.005b3ea0
add esp, 0xc
mov esi, 3
pop edi
nop word [eax + eax]
lea eax, [ebp - 0x24]
push eax
push eax
lea eax, [ebp - 0x31c]
push 1
push eax
call fcn.005b5050
mov eax, dword [ebp - 0x324]
add esp, 0x10
movups xmm0, xmmword [ebp - 0x24]
movups xmmword [eax], xmm0
add eax, 0x10
mov dword [ebp - 0x324], eax
sub esi, 1
jne 0x59a3b0
lea eax, [ebp - 0x31c]
push eax
call fcn.005b3e80
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop esi
pop ebx
call fcn.0058bb64
mov esp, ebp
pop ebp
ret
Function at 0x59a410
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x6480b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x30
mov dword [ebp - 0x38], eax
lea edi, [ebp - 0x34]
mov eax, edi
push 0
push eax
call fcn.005c9220
mov edx, dword [ebp - 0x38]
mov esi, 1
add esp, 0xc
mov ebx, 3
sub esi, edx
lea eax, [edx + 0x20]
lea ecx, [edx + 0xf]
mov dword [ebp - 0x3c], eax
mov eax, ecx
add byte [eax], 1
jne 0x59a462
dec eax
lea ecx, [esi + eax]
test ecx, ecx
jg 0x59a455
push edi
push edx
lea eax, [edx + 0x20]
push 1
push eax
call fcn.005b5050
mov edx, dword [ebp - 0x38]
add esp, 0x10
add edi, 0x10
lea ecx, [edx + 0xf]
sub ebx, 1
jne 0x59a453
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x34]
pop edi
pop esi
xor ecx, ecx
sub edx, eax
pop ebx
nop dword [eax]
lea eax, [ebp - 0x34]
add eax, ecx
add ecx, 0x10
movups xmm0, xmmword [eax]
movups xmm1, xmmword [edx + eax]
pxor xmm1, xmm0
movups xmmword [eax], xmm1
cmp ecx, 0x30
jl 0x59a490
push 0x100
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x3c]
call fcn.005b3ea0
mov eax, dword [ebp - 0x38]
add esp, 0xc
movups xmm0, xmmword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
movups xmmword [eax], xmm0
xor eax, eax
call fcn.0058bb64
mov esp, ebp
pop ebp
ret