joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441f60
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5105de
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x55ca98]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov edx, dword [edi + 4]
sub edx, dword [edi]
mov eax, dword [ebx + 4]
add edx, 4
sub eax, dword [ebx]
add eax, edx
push eax
call dword [sym.imp.WS2_32.dll_htonl]
mov esi, eax
mov eax, dword [ebp + 8]
push 4
mov ecx, eax
mov dword [ebp + 0xc], esi
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
call fcn.004086f0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov dword [eax], esi
add eax, 4
mov dword [edx + 4], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
sub eax, ecx
mov dword [ebp - 4], 0
push eax
push ecx
push dword [edx]
mov ecx, edx
mov dword [ebp - 0x14], 3
call fcn.0043a870
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
mov ebx, dword [ebp + 8]
sub eax, ecx
push eax
push ecx
mov ecx, ebx
push dword [ebx + 4]
call fcn.0043a870
mov eax, dword [ebx + 4]
xor edi, edi
xor esi, esi
sub eax, dword [ebx]
je 0x4420b8
nop dword [eax]
mov eax, dword [ebx + 4]
mov ecx, 0x40
mov edx, dword [ebx]
sub eax, edi
sub eax, edx
cmp eax, ecx
push 0
cmovb ecx, eax
lea eax, [edx + edi]
push ecx
push eax
mov eax, dword [ebp - 0x10]
push dword [eax + 0x28]
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x4420a9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274c
je 0x44208a
cmp eax, 0x2714
je 0x4420a6
sub eax, 4
je 0x4420a6
sub eax, 7
je 0x44208a
sub eax, 0x7f
je 0x44208a
mov eax, esi
inc esi
cmp eax, 4
jg 0x4420d3
jmp 0x442030
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x4420ce
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test al, al
je 0x442030
push str.Reconnection_required
jmp 0x4420d8
mov eax, dword [ebp + 0xc]
add edi, eax
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
cmp edi, eax
jb 0x442030
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
push str.Error_in_write
lea ecx, [ebp - 0x20]
call fcn.004292f0
push 0x552104
lea eax, [ebp - 0x20]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x4420f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
xor ecx, ecx
xor esi, esi
mov dword [ebp - 4], ecx
mov edx, dword [edi + 4]
mov eax, edx
mov edi, dword [edi]
sub eax, edi
je 0x4421a5
mov eax, dword [ebp + 8]
push 0
mov edx, dword [eax]
mov eax, dword [eax + 4]
sub eax, edx
sub eax, ecx
mov ecx, 0x40
cmp eax, ecx
cmovb ecx, eax
mov eax, dword [ebp - 4]
push ecx
add eax, edx
push eax
push dword [ebx + 0x28]
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
test edi, edi
jg 0x442189
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274c
je 0x442172
cmp eax, 0x2714
je 0x442189
sub eax, 4
je 0x442189
sub eax, 7
je 0x442172
sub eax, 0x7f
je 0x442172
mov eax, esi
inc esi
cmp eax, 4
jg 0x4421be
mov ecx, dword [ebp - 4]
jmp 0x442114
mov ecx, dword [ebx + 0x24]
test ecx, ecx
je 0x4421b9
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test al, al
jne 0x4421b2
mov ecx, dword [ebp - 4]
jmp 0x442114
mov ecx, dword [ebp - 4]
add ecx, edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [edi + 4]
mov eax, edx
mov edi, dword [edi]
sub eax, edi
cmp ecx, eax
jb 0x442114
sub edx, edi
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.Reconnection_required
jmp 0x4421c3
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
push str.Error_in_write
lea ecx, [ebp - 0x10]
call fcn.004292f0
push 0x552104
lea eax, [ebp - 0x10]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x450040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
movzx eax, ax
push esi
mov esi, eax
mov dword [ebp - 4], eax
push edi
shr esi, 8
xor eax, eax
xor edi, edi
mov dword [ebp - 8], esi
cmp dword [ebp + 0x10], eax
jbe 0x4500a0
mov ebx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
movzx ecx, word [ecx + edi*2]
mov edx, ecx
movzx ecx, cl
shr edx, 8
add edx, eax
cmp esi, ecx
jb 0x4500a0
jne 0x450098
cmp eax, edx
jge 0x450098
mov ecx, dword [ebp + 8]
movzx esi, cl
movzx ecx, byte [eax + ebx]
cmp cx, si
je 0x4500c8
inc eax
cmp eax, edx
jl 0x450087
mov esi, dword [ebp - 8]
inc edi
mov eax, edx
cmp edi, dword [ebp + 0x10]
jb 0x450066
mov edi, dword [ebp + 0x1c]
xor eax, eax
mov bl, 1
test edi, edi
je 0x4500e0
mov esi, dword [ebp + 0x18]
nop
movzx ecx, byte [eax + esi]
test cl, cl
jns 0x4500d1
movzx edx, byte [eax + esi + 1]
inc eax
and ecx, 0x7f
shl ecx, 8
or edx, ecx
jmp 0x4500d3
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, ecx
sub dword [ebp - 4], edx
js 0x4500e0
inc eax
xor bl, 1
cmp eax, edi
jb 0x4500b0
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x452b30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov ebx, dword [eax + 4]
push edi
mov edi, dword [eax]
sub ebx, edi
mov edx, dword [esi + 0xcc]
lea eax, [esi + 0xc8]
mov dword [ebp - 4], ebx
test edx, edx
je 0x452bd5
mov ecx, edx
nop word [eax + eax]
test ebx, ebx
je 0x452bb9
mov eax, dword [esi + 0xc4]
mov ecx, 0x20
sub ecx, edx
dec ebx
shr eax, cl
mov ecx, 0x20
xor byte [edi], al
mov edx, dword [esi + 0xcc]
sub ecx, edx
movzx eax, byte [edi]
add edx, 0xfffffff8
shl eax, cl
inc edi
xor dword [esi + 0xc8], eax
mov ecx, edx
mov dword [esi + 0xcc], edx
mov dword [ebp - 4], ebx
test edx, edx
jne 0x452b60
push dword [esi + 0xc8]
lea eax, [esi + 0xc8]
mov ecx, esi
mov dword [ebp + 8], eax
call fcn.00453350
jmp 0x452bd8
lea eax, [esi + 0xc8]
mov dword [ebp + 8], eax
test ecx, ecx
jne 0x452d0d
push dword [eax]
mov ecx, esi
call fcn.00453350
jmp 0x452bd8
mov dword [ebp + 8], eax
mov eax, ebx
and eax, 0xfffffffc
add eax, edi
mov dword [ebp - 8], eax
cmp edi, eax
jae 0x452cae
mov ebx, eax
nop dword [eax]
mov ecx, esi
call fcn.00452a30
movzx edx, byte [edi + 3]
movzx eax, byte [edi + 2]
mov ecx, dword [esi + 0x48]
xor ecx, dword [esi + 0x7c]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [edi]
shl edx, 8
or edx, eax
mov eax, dword [esi + 0x44]
xor edx, dword [esi + 0xc4]
xor ecx, edx
xor ecx, dword [esi + 0x40]
mov dword [esi + 0x40], eax
mov eax, dword [esi + 0x48]
mov dword [esi + 0x44], eax
mov eax, dword [esi + 0x4c]
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x50]
mov dword [esi + 0x4c], eax
mov eax, dword [esi + 0x54]
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x58]
mov dword [esi + 0x54], eax
mov eax, dword [esi + 0x5c]
mov dword [esi + 0x58], eax
mov eax, dword [esi + 0x60]
mov dword [esi + 0x5c], eax
mov eax, dword [esi + 0x64]
mov dword [esi + 0x60], eax
mov eax, dword [esi + 0x68]
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x6c]
mov dword [esi + 0x68], eax
mov eax, dword [esi + 0x70]
mov dword [esi + 0x6c], eax
mov eax, dword [esi + 0x74]
mov dword [esi + 0x70], eax
mov eax, dword [esi + 0x78]
mov dword [esi + 0x74], eax
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x78], eax
mov eax, edx
xor dword [esi + 0x34], edx
shr eax, 0x18
mov dword [esi + 0x7c], ecx
mov byte [edi + 3], al
mov eax, edx
shr eax, 0x10
mov byte [edi + 2], al
mov eax, edx
shr eax, 8
mov byte [edi + 1], al
mov byte [edi], dl
add edi, 4
cmp edi, ebx
jb 0x452bf0
mov ebx, dword [ebp - 4]
and ebx, 3
je 0x452d0d
mov ecx, esi
call fcn.00452a30
mov eax, dword [ebp + 8]
mov edx, 0x20
mov dword [esi + 0xcc], 0x20
mov dword [eax], 0
test ebx, ebx
je 0x452d0d
mov eax, dword [esi + 0xc4]
mov ecx, 0x20
sub ecx, edx
dec ebx
shr eax, cl
mov ecx, 0x20
xor byte [edi], al
mov edx, dword [esi + 0xcc]
sub ecx, edx
movzx eax, byte [edi]
add edx, 0xfffffff8
shl eax, cl
inc edi
mov ecx, dword [ebp + 8]
mov dword [esi + 0xcc], edx
xor dword [ecx], eax
test edx, edx
jne 0x452cd2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x452d20
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x10
nop dword [eax + eax]
mov esi, dword [ecx + 0x34]
xor esi, dword [ecx + 0xc0]
xor esi, dword [ecx + 0x30]
mov edi, dword [ecx]
mov edx, esi
shr edx, 2
or edx, esi
ror edi, 0x1f
shr edx, 0x19
lea eax, [esi*4]
or eax, esi
shl eax, 5
or edx, eax
xor esi, edx
mov eax, esi
shr eax, 3
or eax, esi
shr eax, 0xa
lea edx, [esi*8]
or edx, esi
shl edx, 0x13
or edx, eax
mov eax, dword [ecx + 4]
mov dword [ecx], eax
xor edi, edx
mov eax, dword [ecx + 8]
xor edi, esi
mov dword [ecx + 4], eax
mov eax, dword [ecx + 0xc]
mov dword [ecx + 8], eax
mov eax, dword [ecx + 0x10]
mov dword [ecx + 0xc], eax
mov eax, dword [ecx + 0x14]
mov dword [ecx + 0x10], eax
mov eax, dword [ecx + 0x18]
mov dword [ecx + 0x14], eax
mov eax, dword [ecx + 0x1c]
mov dword [ecx + 0x18], eax
mov eax, dword [ecx + 0x20]
mov dword [ecx + 0x1c], eax
mov eax, dword [ecx + 0x24]
mov dword [ecx + 0x20], eax
mov eax, dword [ecx + 0x28]
mov dword [ecx + 0x24], eax
mov eax, dword [ecx + 0x2c]
mov dword [ecx + 0x28], eax
mov eax, dword [ecx + 0x30]
mov dword [ecx + 0x2c], eax
mov eax, dword [ecx + 0x34]
mov dword [ecx + 0x30], eax
mov eax, dword [ecx + 0x38]
mov dword [ecx + 0x34], eax
mov eax, dword [ecx + 0x3c]
mov dword [ecx + 0x38], eax
mov esi, dword [ecx + 8]
xor esi, edi
mov dword [ecx + 0x3c], edi
mov edx, esi
mov eax, esi
shr edx, 0xf
shl eax, 0xf
or edx, esi
or eax, esi
shr edx, 0xa
shl eax, 7
or edx, eax
xor esi, edx
mov edx, esi
mov eax, esi
shr edx, 0xe
shl eax, 0xe
or edx, esi
or eax, esi
shr edx, 0xd
shl eax, 5
or edx, eax
mov eax, dword [ecx + 0x30]
xor edx, esi
xor dword [ecx], edx
xor eax, edx
xor eax, dword [ecx + 0x20]
mov dword [ecx + 0xc4], eax
sub ebx, 1
jne 0x452d30
pop edi
pop esi
pop ebx
ret
Function at 0x452e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov ebx, dword [eax + 4]
push edi
mov edi, dword [eax]
sub ebx, edi
mov eax, dword [esi + 0xcc]
lea edx, [esi + 0xc8]
mov dword [ebp - 4], ebx
lea ecx, [esi + 0xc4]
mov dword [ebp - 8], edx
mov dword [ebp + 8], ecx
test eax, eax
je 0x452eb3
mov ecx, eax
test ebx, ebx
je 0x452e9d
mov ecx, 0x20
dec ebx
sub ecx, eax
movzx eax, byte [edi]
shl eax, cl
xor dword [esi + 0xc8], eax
mov eax, dword [esi + 0xc4]
shr eax, cl
xor byte [edi], al
inc edi
mov eax, dword [esi + 0xcc]
add eax, 0xfffffff8
mov dword [esi + 0xcc], eax
mov ecx, eax
test eax, eax
jne 0x452e66
mov dword [ebp - 4], ebx
test ecx, ecx
jne 0x452fe1
push dword [edx]
mov ecx, esi
call fcn.00453350
jmp 0x452eb9
mov dword [ebp + 8], ecx
mov dword [ebp - 8], edx
mov eax, ebx
and eax, 0xfffffffc
add eax, edi
mov dword [ebp - 0xc], eax
cmp edi, eax
jae 0x452f8d
mov ebx, eax
nop dword [eax]
mov ecx, esi
call fcn.00452a30
movzx edx, byte [edi + 3]
movzx eax, byte [edi + 2]
mov ecx, dword [esi + 0x40]
xor ecx, dword [esi + 0x48]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [edi]
shl edx, 8
or edx, eax
mov eax, dword [esi + 0x44]
xor ecx, edx
xor ecx, dword [esi + 0x7c]
mov dword [esi + 0x40], eax
mov eax, dword [esi + 0x48]
mov dword [esi + 0x44], eax
mov eax, dword [esi + 0x4c]
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x50]
mov dword [esi + 0x4c], eax
mov eax, dword [esi + 0x54]
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x58]
mov dword [esi + 0x54], eax
mov eax, dword [esi + 0x5c]
mov dword [esi + 0x58], eax
mov eax, dword [esi + 0x60]
mov dword [esi + 0x5c], eax
mov eax, dword [esi + 0x64]
mov dword [esi + 0x60], eax
mov eax, dword [esi + 0x68]
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x6c]
mov dword [esi + 0x68], eax
mov eax, dword [esi + 0x70]
mov dword [esi + 0x6c], eax
mov eax, dword [esi + 0x74]
mov dword [esi + 0x70], eax
mov eax, dword [esi + 0x78]
mov dword [esi + 0x74], eax
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x78], eax
xor dword [esi + 0x34], edx
mov eax, dword [ebp + 8]
mov dword [esi + 0x7c], ecx
xor edx, dword [eax]
mov eax, edx
mov byte [edi], dl
shr eax, 0x18
mov byte [edi + 3], al
mov eax, edx
shr eax, 0x10
mov byte [edi + 2], al
mov eax, edx
shr eax, 8
mov byte [edi + 1], al
add edi, 4
cmp edi, ebx
jb 0x452ed0
mov ebx, dword [ebp - 4]
and ebx, 3
je 0x452fe1
mov ecx, esi
call fcn.00452a30
mov edx, dword [ebp - 8]
mov eax, 0x20
mov dword [esi + 0xcc], 0x20
mov dword [edx], 0
test ebx, ebx
je 0x452fe1
mov ecx, 0x20
dec ebx
sub ecx, eax
movzx eax, byte [edi]
shl eax, cl
xor dword [edx], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
shr eax, cl
xor byte [edi], al
inc edi
mov eax, dword [esi + 0xcc]
add eax, 0xfffffff8
mov dword [esi + 0xcc], eax
test eax, eax
jne 0x452fb1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x452ff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov ebx, dword [eax + 4]
push edi
mov edi, dword [eax]
sub ebx, edi
cmp dword [esi + 0xcc], 0
je 0x453016
push dword [esi + 0xc8]
call fcn.00453350
mov ecx, esi
call fcn.00452a30
mov eax, dword [esi + 0xcc]
lea ecx, [esi + 4]
shl eax, 3
mov edx, 4
xor eax, dword [esi + 0x34]
xor eax, 0x6996c53a
mov dword [esi + 0xcc], 0
mov dword [esi + 0x34], eax
mov eax, dword [ecx + 0x3c]
lea ecx, [ecx + 0x10]
xor dword [ecx - 0x14], eax
mov eax, dword [ecx + 0x30]
xor dword [ecx - 0x10], eax
mov eax, dword [ecx + 0x34]
xor dword [ecx - 0xc], eax
mov eax, dword [ecx + 0x38]
xor dword [ecx - 8], eax
sub edx, 1
jne 0x453043
mov ecx, esi
call fcn.00452d20
test ebx, ebx
je 0x4530d3
nop
mov ecx, esi
call fcn.00452a30
cmp ebx, 4
jb 0x4530b2
movzx eax, byte [esi + 0xc7]
mov byte [edi + 3], al
movzx eax, byte [esi + 0xc6]
mov byte [edi + 2], al
movzx eax, byte [esi + 0xc5]
mov byte [edi + 1], al
movzx eax, byte [esi + 0xc4]
mov byte [edi], al
add edi, 4
sub ebx, 4
jne 0x453070
pop edi
pop esi
pop ebx
pop ebp
ret 4
xor edx, edx
test ebx, ebx
je 0x4530d3
xor ecx, ecx
nop word [eax + eax]
mov eax, dword [esi + 0xc4]
shr eax, cl
add ecx, 8
mov byte [edx + edi], al
inc edx
cmp edx, ebx
jb 0x4530c0
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4531d0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
mov edx, dword [eax + 4]
sub edx, dword [eax]
push edi
mov ecx, edx
mov dword [ebp - 8], edx
xor edi, edi
lea esi, [ebx + 0x34]
and ecx, 0xfffffffc
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], ecx
jbe 0x45323c
nop dword [eax + eax]
mov ecx, dword [eax]
movzx eax, byte [ecx + edi + 2]
add ecx, edi
movzx edx, byte [ecx + 3]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 1]
shl edx, 8
or edx, eax
movzx eax, byte [ecx]
shl edx, 8
mov ecx, ebx
or edx, eax
xor dword [esi], edx
call fcn.00452a30
mov eax, dword [ebp + 8]
add edi, 4
cmp edi, dword [ebp - 0xc]
jb 0x453200
mov edx, dword [ebp - 8]
jmp 0x45323f
mov dword [ebp - 4], esi
cmp edi, edx
jae 0x45329f
mov eax, dword [eax]
mov esi, edx
add eax, edi
sub esi, edi
push esi
push eax
lea eax, [ebp + 8]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp esi, 4
jge 0x45326f
jae 0x453346
mov byte [ebp + esi + 8], 0
inc esi
cmp esi, 4
jl 0x45325e
movzx edx, byte [ebp + 0xb]
movzx eax, byte [ebp + 0xa]
shl edx, 8
or edx, eax
mov eax, dword [ebp + 8]
shl edx, 8
movzx ecx, ah
or edx, ecx
movzx eax, al
shl edx, 8
mov ecx, ebx
or edx, eax
xor dword [ebx + 0x34], edx
call fcn.00452a30
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor dword [esi], edx
mov ecx, ebx
call fcn.00452a30
mov eax, dword [ebx]
mov ecx, ebx
mov dword [ebx + 0x40], eax
mov eax, dword [ebx + 4]
mov dword [ebx + 0x44], eax
mov eax, dword [ebx + 8]
mov dword [ebx + 0x48], eax
mov eax, dword [ebx + 0xc]
mov dword [ebx + 0x4c], eax
mov eax, dword [ebx + 0x10]
mov dword [ebx + 0x50], eax
mov eax, dword [ebx + 0x14]
mov dword [ebx + 0x54], eax
mov eax, dword [ebx + 0x18]
mov dword [ebx + 0x58], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebx + 0x5c], eax
mov eax, dword [ebx + 0x20]
mov dword [ebx + 0x60], eax
mov eax, dword [ebx + 0x24]
mov dword [ebx + 0x64], eax
mov eax, dword [ebx + 0x28]
mov dword [ebx + 0x68], eax
mov eax, dword [ebx + 0x2c]
mov dword [ebx + 0x6c], eax
mov eax, dword [ebx + 0x30]
mov dword [ebx + 0x70], eax
mov eax, dword [ebx + 0x34]
mov dword [ebx + 0x74], eax
mov eax, dword [ebx + 0x38]
mov dword [ebx + 0x78], eax
mov eax, dword [ebx + 0x3c]
mov dword [ebx + 0x7c], eax
call fcn.00452d20
pop edi
pop esi
lea eax, [ebx + 4]
mov edx, 4
pop ebx
nop dword [eax]
mov ecx, dword [eax + 0x3c]
lea eax, [eax + 0x10]
xor dword [eax - 0x14], ecx
mov ecx, dword [eax + 0x30]
xor dword [eax - 0x10], ecx
mov ecx, dword [eax + 0x34]
xor dword [eax - 0xc], ecx
mov ecx, dword [eax + 0x38]
xor dword [eax - 8], ecx
sub edx, 1
jne 0x453320
mov esp, ebp
pop ebp
ret 4
call fcn.00509d14
int3
Function at 0x455230
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c4
mov eax, dword [0x55ca98]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c4]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4553a2
mov eax, dword [ebp - 0x1c4]
cmp al, 2
jne 0x455409
shr eax, 8
cmp al, 2
jne 0x455409
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
push 0
push 0x5635f4
call fcn.0046d7f0
add esp, 0x10
test eax, eax
jne 0x4553a2
push eax
push 0x563118
call fcn.0046c950
add esp, 8
test eax, eax
jne 0x4553a2
push eax
push 0x563114
call fcn.0046c950
add esp, 8
test eax, eax
jne 0x4553a2
lea eax, [ebp - 0x34]
push edi
push eax
call fcn.00464330
lea eax, [ebp - 0x34]
push 0x5635c0
push eax
call fcn.004642e0
push 0x5635f4
call fcn.0046dac0
xor eax, eax
mov ecx, 0xc8
mov edi, 0x55f448
rep stosd dword es:[edi], eax
push 0x5635f4
call fcn.0046dbc0
lea eax, [ebp - 0x24]
push eax
call fcn.0045ba70
lea eax, [ebp - 0x24]
push 0xc
push eax
call fcn.0045bb20
lea eax, [ebp - 0x24]
push 2
push eax
call fcn.0045bb40
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.0045bb60
lea eax, [ebp - 0x24]
push 0xa
push eax
call fcn.0045bae0
lea eax, [ebp - 0x24]
push 0x1388
push eax
call fcn.0045bac0
add esp, 0x40
lea eax, [ebp - 0x24]
push 0x64
push eax
call fcn.0045bb00
lea eax, [ebp - 0x24]
push eax
push 0x5632c0
call fcn.0045be60
add esp, 0x10
pop edi
test eax, eax
jne 0x455393
lea eax, [ebp - 0x24]
push eax
push 0x563440
call fcn.0045be60
add esp, 8
test eax, eax
jne 0x455393
lea eax, [ebp - 0x24]
push eax
push 0x563140
call fcn.0045be60
add esp, 8
test eax, eax
je 0x4553b5
mov dword [0x55f438], 0
call fcn.00454b60
mov eax, 0xffffff8b
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005091c5
mov esp, ebp
pop ebp
ret
push esi
push 0x45f4b0
call fcn.00460c60
push 0x4645d0
call fcn.00460c40
push 0x5632c0
push 0x563600
call fcn.0045c930
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4553f8
call fcn.00454b60
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005091c5
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005091c5
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov eax, 0xffffff8b
xor ecx, ebp
call fcn.005091c5
mov esp, ebp
pop ebp
ret
Function at 0x45eb90
Capabilities:
Connect socket
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x55ca98]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push esi
call fcn.0046a060
add esp, 4
cmp eax, 0xffffffff
je 0x45ec37
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.WS2_32.dll_connect]
mov dword [ebp - 0x110], 5
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x104], esi
mov dword [ebp - 0x108], 1
test eax, eax
jns 0x45ec2e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x45ec2e
lea eax, [ebp - 0x110]
push eax
push 0
lea eax, [ebp - 0x108]
push eax
push 0
lea eax, [esi + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jns 0x45ec2c
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005091c5
mov esp, ebp
pop ebp
ret
je 0x45ec19
push esi
call fcn.0046a030
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005091c5
mov esp, ebp
pop ebp
ret
Function at 0x461200
Capabilities:
Convert ip address from string
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x55ca98]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x51c558]
movq xmm0, qword [str.ShutDown]
push esi
push 0xf7
mov byte [ebp - 0xfc], al
lea eax, [ebp - 0xfb]
push 0
push eax
movq qword [ebp - 0x104], xmm0
call sub.VCRUNTIME140.dll_memset
lea esi, [ebp - 0x104]
add esp, 0xc
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x461250
mov eax, dword [0x55f774]
sub esi, ecx
sub eax, 1
jne 0x461345
push ebx
push eax
push 2
push 2
mov dword [0x55f774], 2
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4612b3
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
lea eax, [ebp - 0x204]
push 0x100
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror_s]
add esp, 0xc
xor eax, eax
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005091c5
mov esp, ebp
pop ebp
ret
cmp dword [0x55f774], 0
je 0x46133d
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 2
nop dword [eax]
lea eax, [ebp - 0x210]
mov word [ebp - 0x214], cx
push eax
push str.127.0.0.1
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
movzx eax, word [0x563110]
push eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
mov word [ebp - 0x212], ax
lea eax, [ebp - 0x214]
push eax
push 0
push esi
lea eax, [ebp - 0x104]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_sendto]
push 1
call edi
cmp dword [0x55f774], 0
je 0x46133c
push 0x3e8
call edi
cmp dword [0x55f774], 0
mov ecx, 2
jne 0x4612d0
pop edi
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.005091c5
mov esp, ebp
pop ebp
ret