joyce8/EMBER2024-capa huggingface dataset:
Function at 0x623ddb66
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x10]
mov dword [esp + 8], edx
mov dword [esp + 4], 0x8004667e
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_ioctlsocket]
call eax
sub esp, 0xc
cmp eax, 0xffffffff
jne 0x623ddbc2
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.fcntl__d__F_GETFL_
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.libevent_2_1_6.dll_event_sock_warn
mov eax, 0xffffffff
jmp 0x623ddbc7
mov eax, 0
mov ecx, dword [ebp - 0xc]
xor ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x623ddbd7
call sym.___stack_chk_fail
leave
ret

Function at 0x623ddcdf
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jns 0x623ddd47
mov eax, dword [ebp + 0xc]
movzx eax, word [eax]
movzx eax, ax
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_socket]
call eax
sub esp, 0xc
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
js 0x623dddbf
mov dword [ebp - 0x10], 1
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
call sym.libevent_2_1_6.dll_evutil_make_socket_nonblocking
test eax, eax
js 0x623dddc2
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.WS2_32.dll_connect]
call eax
sub esp, 0xc
test eax, eax
jns 0x623dddb8
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
call sym.libevent_2_1_6.dll_evutil_socket_geterror
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x623ddda1
cmp dword [ebp - 0xc], 0x2714
je 0x623ddda1
cmp dword [ebp - 0xc], 0x2734
je 0x623ddda1
cmp dword [ebp - 0xc], 0x2726
jne 0x623ddda8
mov eax, 0
jmp 0x623ddde7
cmp dword [ebp - 0xc], 0x274d
jne 0x623dddc5
mov eax, 2
jmp 0x623ddde7
mov eax, 1
jmp 0x623ddde7
nop
jmp 0x623dddc6
nop
jmp 0x623dddc6
nop
cmp dword [ebp - 0x10], 0
je 0x623ddde2
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
call sym.libevent_2_1_6.dll_evutil_closesocket
mov eax, dword [ebp + 8]
mov dword [eax], 0xffffffff
mov eax, 0xffffffff
leave
ret
Function at 0x623deea9
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x48], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
cmp dword [ebp - 0x44], 0
je 0x623def01
mov dword [esp + 8], 0x20
mov eax, dword [ebp - 0x44]
mov dword [esp + 4], eax
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call sym._memcpy
jmp 0x623def23
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call sym.libevent_2_1_6.dll_evutil_adjust_hints_for_addrconfig_
lea eax, [ebp - 0x38]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x48]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x2c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x40]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call sym.libevent_2_1_6.dll_evutil_getaddrinfo_common_
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xfffea06e
je 0x623def69
mov eax, dword [ebp - 0x30]
jmp 0x623df065
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_gethostbyname]
call eax
sub esp, 4
mov dword [ebp - 0x34], eax
mov eax, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x34], 0
jne 0x623defdf
cmp dword [ebp - 0x30], 0x2afc
je 0x623defd5
cmp dword [ebp - 0x30], 0x2afc
jg 0x623defc1
cmp dword [ebp - 0x30], 0x2af9
je 0x623defcb
cmp dword [ebp - 0x30], 0x2afa
jne 0x623defc1
mov eax, 0xfffffc7a
jmp 0x623df065
mov eax, 0xfffffc78
jmp 0x623df065
mov eax, 0xfffffc74
jmp 0x623df065
mov eax, 0xfffffc75
jmp 0x623df065
mov eax, dword [ebp - 0x34]
movzx eax, word [eax + 8]
movsx edx, ax
mov eax, dword [ebp - 0x28]
cmp edx, eax
je 0x623deffe
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x623deffe
mov eax, 0xfffffc74
jmp 0x623df065
mov eax, dword [ebp - 0x34]
movzx eax, word [eax + 0xa]
test ax, ax
jne 0x623df011
mov eax, 0xfffffc75
jmp 0x623df065
mov eax, dword [ebp - 0x34]
movzx eax, word [eax + 8]
cmp ax, 2
je 0x623df032
mov eax, dword [ebp - 0x34]
movzx eax, word [eax + 8]
cmp ax, 0x17
je 0x623df032
mov eax, 0xfffffc77
jmp 0x623df065
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x2c]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sym._addrinfo_from_hostent
mov edx, dword [ebp - 0x48]
mov dword [edx], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
test eax, eax
jne 0x623df060
mov eax, 0xfffffc76
jmp 0x623df065
mov eax, 0
mov ecx, dword [ebp - 0xc]
xor ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x623df075
call sym.___stack_chk_fail
leave
ret
Function at 0x623df2fb
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 0x10
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
imul eax, eax, 0x85ebca6b
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 0xd
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
imul eax, eax, 0xc2b2ae35
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shr eax, 0x10
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret

Function at 0x623e13b6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x134
mov eax, dword [ebp + 8]
mov dword [ebp - 0x11c], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [esp + 4], 0x104
lea eax, [ebp - 0x110]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
call eax
sub esp, 8
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
je 0x623e141d
mov eax, dword [ebp - 0x11c]
mov dword [esp], eax
call sym._strlen
mov edx, dword [ebp - 0x114]
add eax, edx
add eax, 2
cmp eax, 0x103
jbe 0x623e1424
mov eax, 0
jmp 0x623e1479
lea eax, [ebp - 0x110]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x110]
add eax, edx
mov word [eax], 0x5c
mov eax, dword [ebp - 0x11c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sym._strcat
lea eax, [ebp - 0x110]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov edi, dword [ebp - 0xc]
xor edi, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x623e1489
call sym.___stack_chk_fail
mov edi, dword [ebp - 4]
leave
ret

Function at 0x623e179e
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov eax, dword [0x624111f0]
test eax, eax
jne 0x623e180b
mov dword [esp + 0x10], 0xf0000000
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x624111f4
mov eax, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
call eax
sub esp, 0x14
test eax, eax
jne 0x623e1801
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
cmp eax, 0x80090016
je 0x623e1801
mov eax, 0xffffffff
jmp 0x623e186c
mov dword [0x624111f0], 1
mov eax, dword [0x624111f4]
lea edx, [ebp - 0x2c]
mov dword [esp + 8], edx
mov dword [esp + 4], 0x20
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
call eax
sub esp, 0xc
test eax, eax
jne 0x623e1837
mov eax, 0xffffffff
jmp 0x623e186c
mov dword [esp + 4], 0x20
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call sym._arc4_addrandom
mov dword [esp + 4], 0x20
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call sym.libevent_2_1_6.dll_evutil_memclear_
mov dword [0x624111ec], 1
mov eax, 0
mov ecx, dword [ebp - 0xc]
xor ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x623e187c
call sym.___stack_chk_fail
leave
ret
Function at 0x623e2378
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x38], 0
je 0x623e23b8
mov eax, dword [ebp - 0x38]
movzx eax, word [eax]
movzx eax, ax
jmp 0x623e23bd
mov eax, 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0x4000001
cmp dword [ebp + 0x18], 0
jne 0x623e23d7
mov eax, 0
jmp 0x623e2529
mov eax, dword [ebp + 0x14]
and eax, 4
test eax, eax
je 0x623e23ec
mov eax, dword [ebp - 0x1c]
or eax, 0x80000000
mov dword [ebp - 0x1c], eax
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym.libevent_2_1_6.dll_evutil_socket_
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x623e2419
mov eax, 0
jmp 0x623e2529
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x10], 4
lea edx, [ebp - 0x20]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 8
mov dword [esp + 4], 0xffff
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_setsockopt]
call eax
sub esp, 0x14
test eax, eax
js 0x623e2509
mov eax, dword [ebp + 0x14]
and eax, 8
test eax, eax
je 0x623e246d
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym.libevent_2_1_6.dll_evutil_make_listen_socket_reuseable
test eax, eax
js 0x623e250c
mov eax, dword [ebp + 0x14]
and eax, 0x80
test eax, eax
je 0x623e248c
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym.libevent_2_1_6.dll_evutil_make_listen_socket_reuseable_port
test eax, eax
js 0x623e250f
mov eax, dword [ebp + 0x14]
and eax, 0x40
test eax, eax
je 0x623e24a5
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym.libevent_2_1_6.dll_evutil_make_tcp_listen_socket_deferred
test eax, eax
js 0x623e2512
cmp dword [ebp - 0x38], 0
je 0x623e24cd
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 0x20]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x38]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_bind]
call eax
sub esp, 0xc
test eax, eax
js 0x623e2515
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sym.libevent_2_1_6.dll_evconnlistener_new
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x623e2518
mov eax, dword [ebp - 0x10]
jmp 0x623e2529
nop
jmp 0x623e2519
nop
jmp 0x623e2519
nop
jmp 0x623e2519
nop
jmp 0x623e2519
nop
jmp 0x623e2519
nop
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym.libevent_2_1_6.dll_evutil_closesocket
mov eax, 0
mov ecx, dword [ebp - 0xc]
xor ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x623e2539
call sym.___stack_chk_fail
leave
ret
Function at 0x623e3c4f
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x623e3c8a
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x623e3c71
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x623e3c82
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x623e3c8c
inc edi
add eax, 0x28
cmp edi, esi
jb 0x623e3c67
xor eax, eax
pop edi
pop esi
ret

Function at 0x623e3e98
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc edi
push es
cmp ax, bx
jbe 0x623e3e69
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x623e3e63
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x623e3e54
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov ah, 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.623e3c0f
and al, 0xa8
test bh, al
lea eax, [ebp - 0x58]
push eax
call fcn.623e3c1f
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.623e3bd4
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x623e3efd
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.623e3c0f
pop dword [eax + 0x458df818]
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x623e3f9f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
invalid
inc ebp

Function at 0x623e4f30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x6da], 0x2c
and byte [ebp - 0x6d9], 0
mov byte [ebp - 0x6d8], 0x81
mov byte [ebp - 0x6d7], 0xb6
mov byte [ebp - 0x6d6], 0xb2
mov byte [ebp - 0x6d5], 0xb7
mov byte [ebp - 0x6d4], 0x95
mov byte [ebp - 0x6d3], 0xba
mov byte [ebp - 0x6d2], 0xbf
mov byte [ebp - 0x6d1], 0xb6
mov byte [ebp - 0x6d0], 0xd3
call fcn.623e3c0f
pop ebp
dec edx
jnp 0x623e4ffa
lea eax, [ebp - 0x6dc]
push eax
invalid
mov ebp, esp
Function at 0x623e5708
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 1
pop eax
test eax, eax
je 0x623e5cb5
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x623e578a
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0
mov byte [ebp - 0x778], 0xb8
mov byte [ebp - 0x777], 0xc1
mov byte [ebp - 0x776], 0xa7
mov byte [ebp - 0x775], 0xab
mov byte [ebp - 0x774], 0x89
mov byte [ebp - 0x773], 0x94
mov byte [ebp - 0x772], 0x9c
mov byte [ebp - 0x771], 0x89
mov byte [ebp - 0x770], 0x9a
mov byte [ebp - 0x76f], 0x96
mov byte [ebp - 0x76e], 0xdb
mov byte [ebp - 0x76d], 0xbd
mov byte [ebp - 0x76c], 0x92
mov byte [ebp - 0x76b], 0x97
mov byte [ebp - 0x76a], 0x9e
mov byte [ebp - 0x769], 0x88
mov byte [ebp - 0x768], 0xa7
mov byte [ebp - 0x767], 0xb8
mov byte [ebp - 0x766], 0x94
mov byte [ebp - 0x765], 0x96
clc
invalid
call dword [esi - 0x7637a3a]
invalid
call dword [esi - 0x7627a3a]
invalid
call dword [esi + eax*8 - 0x7617b]
call dword [ebp - 0x7607a3a]
invalid
invalid
fcmovnb st(0), st(6)
test dword [eax - 0x42000008], esp
mov byte [ebp - 0x75f], 0x92
mov eax, dword [0x92fffff8]
mov byte [ebp - 0x75e], 0x97
mov byte [ebp - 0x75d], 0x9e
mov byte [ebp - 0x75c], 0x88
mov byte [ebp - 0x75b], 0xa7
mov byte [ebp - 0x75a], 0xa8
mov byte [ebp - 0x759], 0x82
mov byte [ebp - 0x758], 0x88
mov byte [ebp - 0x757], 0x8f
mov byte [ebp - 0x756], 0x9e
mov byte [ebp - 0x755], 0x96
mov byte [ebp - 0x754], 0xa7
mov byte [ebp - 0x753], 0x88
mov byte [ebp - 0x752], 0x82
mov byte [ebp - 0x751], 0x96
xchg esi, eax
mov byte [ebp - 0x750], 0x88
mov byte [ebp - 0x74f], 0x89
mov byte [ebp - 0x74e], 0x8d
mov byte [ebp - 0x74d], 0xd5
mov byte [ebp - 0x74c], 0x9f
mov byte [ebp - 0x74b], 0x97
invalid
invalid
Function at 0x623e685c
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._upcast_connect
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xf8]
test eax, eax
je 0x623e68a2
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xf8]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym.libevent_2_1_6.dll_evthreadimpl_lock_lock_
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0xc8]
and eax, 8
test al, al
sete al
movzx eax, al
test eax, eax
je 0x623e68ef
mov dword [esp + 0x14], str.connect_complete
mov dword [esp + 0x10], str.bev_a__bev.connecting
mov dword [esp + 0xc], 0x1a4
mov dword [esp + 8], str.bufferevent_async.c
mov dword [esp + 4], 0x6240b6a4
mov dword [esp], 0xdeaddead
call sym._event_errx
mov eax, dword [ebp - 0x18]
movzx edx, byte [eax + 0xc8]
and edx, 0xfffffff7
mov byte [eax + 0xc8], dl
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x88]
mov dword [esp], eax
call sym.libevent_2_1_6.dll_evbuffer_overlapped_get_fd_
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x7010
mov dword [esp + 4], 0xffff
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_setsockopt]
call eax
sub esp, 0x14
cmp dword [ebp + 0x14], 0
je 0x623e6959
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym.libevent_2_1_6.dll_bufferevent_async_set_connected_
jmp 0x623e696b
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._bev_async_set_wsa_error
cmp dword [ebp + 0x14], 0
je 0x623e6978
mov eax, pe_nt_image_headers32
jmp 0x623e697d
mov eax, 0x20
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym.libevent_2_1_6.dll_bufferevent_run_eventcb_
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [esp], eax
call sym.libevent_2_1_6.dll_event_base_del_virtual_
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym.libevent_2_1_6.dll_bufferevent_decref_and_unlock_
nop
leave
ret
Function at 0x623e7914
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], sym._evthread_win32_lock_create
mov dword [ebp - 0x18], sym._evthread_win32_lock_free
mov dword [ebp - 0x14], sym._evthread_win32_lock
mov dword [ebp - 0x10], sym._evthread_win32_unlock
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x34], sym._evthread_win32_cond_alloc
mov dword [ebp - 0x30], sym._evthread_win32_cond_free
mov dword [ebp - 0x2c], sym._evthread_win32_cond_signal
mov dword [ebp - 0x28], sym._evthread_win32_cond_wait
lea eax, [ebp - 0x24]
mov dword [esp], eax
call sym.libevent_2_1_6.dll_evthread_set_lock_callbacks
mov dword [esp], sym._evthread_win32_get_id
call sym.libevent_2_1_6.dll_evthread_set_id_callback
lea eax, [ebp - 0x38]
mov dword [esp], eax
call sym.libevent_2_1_6.dll_evthread_set_condition_callbacks
mov eax, 0
mov edx, dword [ebp - 0xc]
xor edx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x623e79a8
call sym.___stack_chk_fail
leave
ret
Function at 0x623e7a73
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [ebp + 0xc]
mov word [ebp - 0x8c], ax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x90], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x74], eax
mov dword [esp + 8], 0x5c
mov dword [esp + 4], 0
lea eax, [ebp - 0x68]
mov dword [esp], eax
call sym._memset
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x62411260
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0xffffffff
jne 0x623e7b31
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.libevent_2_1_6.dll_evutil_socket_geterror
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0x2733
je 0x623e7b74
cmp dword [ebp - 0x6c], 0x2714
je 0x623e7b74
mov dword [esp + 0xc], str.evsig_cb
mov dword [esp + 8], str._s:_recv
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 1
call sym.libevent_2_1_6.dll_event_sock_err
cmp dword [ebp - 0x70], 0
je 0x623e7b77
mov dword [ebp - 0x78], 0
jmp 0x623e7b67
mov eax, dword [ebp - 0x78]
add eax, 0x62411260
movzx eax, byte [eax]
mov byte [ebp - 0x79], al
cmp byte [ebp - 0x79], 0x16
ja 0x623e7b63
movzx eax, byte [ebp - 0x79]
mov edx, dword [ebp + eax*4 - 0x68]
add edx, 1
mov dword [ebp + eax*4 - 0x68], edx
add dword [ebp - 0x78], 1
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x70]
jl 0x623e7b40
jmp 0x623e7abd
nop
jmp 0x623e7b78
nop
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x110]
test eax, eax
je 0x623e7b9e
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym.libevent_2_1_6.dll_evthreadimpl_lock_lock_
mov dword [ebp - 0x78], 0
jmp 0x623e7bd3
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0x68]
test eax, eax
je 0x623e7bcf
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0x68]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x78]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x74]
mov dword [esp], eax
call sym.libevent_2_1_6.dll_evmap_signal_active_
add dword [ebp - 0x78], 1
cmp dword [ebp - 0x78], 0x16
jle 0x623e7ba7
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x110]
test eax, eax
je 0x623e7bff
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym.libevent_2_1_6.dll_evthreadimpl_lock_unlock_
nop
mov eax, dword [ebp - 0xc]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x623e7c10
call sym.___stack_chk_fail
leave
ret
Function at 0x623e81fa
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0xc], eax
xor eax, eax
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call eax
mov dword [ebp - 0x10], eax
mov eax, dword [0x62411244]
test eax, eax
jne 0x623e8246
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.evsig_handler
mov dword [esp], str._s:_received_signal__d__but_have_no_base_configured
call sym.libevent_2_1_6.dll_event_warnx
jmp 0x623e82a6
mov dword [esp + 4], sym._evsig_handler
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._signal
mov eax, dword [ebp + 8]
mov byte [ebp - 0x15], al
mov eax, dword [0x62407280]
mov edx, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
lea eax, [ebp - 0x15]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov edx, dword [ebp - 0x14]
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_WSASetLastError]
call eax
sub esp, 4
mov eax, dword [ebp - 0xc]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
je 0x623e82b6
call sym.___stack_chk_fail
leave
ret