joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4576d4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, 0x9908b0df
movd mm4, eax
punpckldq mm4, mm4
mov eax, 1
movd mm5, eax
punpckldq mm5, mm5
movq mm6, mm5
psllq mm6, 0x1f
movq mm7, mm6
psubd mm7, mm5
lea esi, [0x60e08c]
add esi, 0x388
mov edi, esi
add edi, 0x634
mov ecx, 0xffffff8f
movq mm0, qword [esi + ecx*8]
pand mm0, mm6
movq mm1, qword [esi + ecx*8 + 4]
movq mm2, qword [edi + ecx*8]
pand mm1, mm7
por mm0, mm1
movq mm3, mm1
psrld mm0, 1
pand mm3, mm5
pxor mm2, mm0
psubd mm3, mm5
movq mm0, qword [esi + ecx*8 + 8]
pandn mm3, mm4
movq mm1, qword [esi + ecx*8 + 0xc]
pxor mm3, mm2
movq mm2, qword [edi + ecx*8 + 8]
pand mm0, mm6
movq qword [esi + ecx*8], mm3
pand mm1, mm7
inc ecx
jne 0x457729
mov eax, dword [esi]
mov ebx, dword [esi + 4]
and eax, 0x80000000
and ebx, 0x7fffffff
mov edx, dword [edi]
or eax, ebx
shr eax, 1
or ebx, 0xfffffffe
xor eax, edx
add ebx, 1
xor eax, 0x9908b0df
and ebx, 0x9908b0df
xor ebx, eax
mov dword [esi], ebx
lea esi, [0x60e08c]
mov eax, dword [esi]
add esi, 0x9c0
mov dword [esi], eax
mov edi, esi
sub edi, 0x38c
add esi, 4
add edi, 4
mov ecx, 0xffffff39
movq mm0, qword [esi + ecx*8]
pand mm0, mm6
movq mm1, qword [esi + ecx*8 + 4]
movq mm2, qword [edi + ecx*8]
pand mm1, mm7
por mm0, mm1
movq mm3, mm1
psrld mm0, 1
pand mm3, mm5
pxor mm2, mm0
psubd mm3, mm5
movq mm0, qword [esi + ecx*8 + 8]
pandn mm3, mm4
movq mm1, qword [esi + ecx*8 + 0xc]
pxor mm3, mm2
movq mm2, qword [edi + ecx*8 + 8]
pand mm0, mm6
movq qword [esi + ecx*8], mm3
pand mm1, mm7
inc ecx
jne 0x4577c4
push ebp
mov eax, 0x9d2c5680
movd mm6, eax
punpckldq mm6, mm6
mov eax, 0xefc60000
movd mm7, eax
punpckldq mm7, mm7
lea esi, [0x60e08c]
lea edi, [0x60ea50]
add esi, 0x9c0
add edi, 0x9c0
mov ecx, 0xfffffec8
movq mm0, qword [esi + ecx*8]
movq mm1, mm0
psrld mm0, 0xb
pxor mm0, mm1
movq mm2, qword [esi + ecx*8 + 8]
movq mm1, mm0
pslld mm0, 7
movq mm3, mm2
psrld mm2, 0xb
pand mm0, mm6
pxor mm2, mm3
pxor mm0, mm1
movq mm3, mm2
pslld mm2, 7
movq mm1, mm0
pslld mm0, 0xf
pand mm2, mm6
pand mm0, mm7
pxor mm2, mm3
pxor mm0, mm1
movq mm3, mm2
pslld mm2, 0xf
movq mm1, mm0
pand mm2, mm7
psrld mm0, 0x12
pxor mm2, mm3
pxor mm1, mm0
movq mm0, qword [esi + ecx*8 + 0x10]
movq mm3, mm2
movq qword [edi + ecx*8], mm1
psrld mm2, 0x12
movq mm1, mm0
pxor mm3, mm2
movq mm2, qword [esi + ecx*8 + 0x18]
psrld mm0, 0xb
movq qword [edi + ecx*8 + 8], mm3
pxor mm0, mm1
add ecx, 2
jne 0x457840
pop ebp
emms
xor eax, eax
mov dword [0x60e088], eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4578c4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
cmp dword [0x5f0498], 0
je 0x4578dd
call fcn.004576d4
jmp 0x457a1a
lea esi, [0x60e08c]
add esi, 0x38c
mov edi, esi
add edi, 0x634
mov ecx, 0xffffff1d
mov eax, dword [esi + ecx*4]
mov ebx, dword [esi + ecx*4 + 4]
and eax, 0x80000000
and ebx, 0x7fffffff
mov edx, dword [edi + ecx*4]
or eax, ebx
shr eax, 1
or ebx, 0xfffffffe
xor eax, edx
add ebx, 1
xor eax, 0x9908b0df
and ebx, 0x9908b0df
xor ebx, eax
mov eax, dword [esi + ecx*4 + 4]
mov dword [esi + ecx*4], ebx
mov ebx, dword [esi + ecx*4 + 8]
inc ecx
jne 0x4578fd
lea esi, [0x60e08c]
mov eax, dword [esi]
add esi, 0x9c0
mov dword [esi], eax
mov edi, esi
sub edi, 0x38c
mov ecx, 0xfffffe73
mov eax, dword [esi + ecx*4]
mov ebx, dword [esi + ecx*4 + 4]
and eax, 0x80000000
and ebx, 0x7fffffff
mov edx, dword [edi + ecx*4]
or eax, ebx
shr eax, 1
or ebx, 0xfffffffe
xor eax, edx
add ebx, 1
xor eax, 0x9908b0df
and ebx, 0x9908b0df
xor ebx, eax
mov eax, dword [esi + ecx*4 + 4]
mov dword [esi + ecx*4], ebx
mov ebx, dword [esi + ecx*4 + 8]
inc ecx
jne 0x457959
push ebp
lea esi, [0x60e08c]
lea edi, [0x60ea50]
add esi, 0x9c0
add edi, 0x9c0
mov ecx, 0xfffffec8
mov eax, dword [esi + ecx*8]
mov edx, dword [esi + ecx*8 + 4]
mov ebx, eax
shr eax, 0xb
mov ebp, edx
shr edx, 0xb
xor eax, ebx
xor edx, ebp
mov ebx, eax
shl eax, 7
mov ebp, edx
shl edx, 7
and eax, 0x9d2c5680
and edx, 0x9d2c5680
xor eax, ebx
xor edx, ebp
mov ebx, eax
shl eax, 0xf
mov ebp, edx
shl edx, 0xf
and eax, 0xefc60000
and edx, 0xefc60000
xor eax, ebx
xor edx, ebp
mov ebx, eax
shr eax, 0x12
mov ebp, edx
shr edx, 0x12
xor eax, ebx
xor edx, ebp
mov dword [edi + ecx*8], eax
mov dword [edi + ecx*8 + 4], edx
mov eax, dword [esi + ecx*8 + 8]
inc ecx
jne 0x4579b2
pop ebp
xor eax, eax
mov dword [0x60e088], eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x457f90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov edx, dword [ebp + 8]
mov dword [ebp - 4], edx
mov ecx, 0xc
mov eax, dword [ebp + 0x10]
cdq
idiv ecx
mov dword [ebp + 0x10], edx
mov edi, dword [ebp - 4]
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp - 8]
cmp eax, 0xc
jb 0x45800d
mov eax, dword [ebp + 0x10]
cmp eax, 0
je 0x457fe6
mov edx, dword [ebp - 8]
mov bl, byte [eax + esi]
xor byte [edi], bl
inc eax
inc edi
dec edx
cmp eax, 0xc
jb 0x457fcc
xor ecx, ecx
mov dword [ebp + 0x10], ecx
mov dword [ebp - 8], edx
cmp edx, 0xc
jb 0x45800d
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 0xc
div ecx
mov dword [ebp - 8], edx
mov ecx, eax
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov edx, dword [esi + 8]
xor dword [edi], eax
xor dword [edi + 4], ebx
xor dword [edi + 8], edx
add edi, 0xc
dec ecx
jne 0x457fff
mov edx, dword [ebp - 8]
cmp edx, 0
je 0x458029
mov eax, dword [ebp + 0x10]
mov bl, byte [eax + esi]
xor byte [edi], bl
inc eax
cmp eax, 0xc
jne 0x458025
xor eax, eax
inc edi
dec edx
jne 0x458018
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x45a310
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, 0x610578
add esp, 0xffffff68
cmp dword [ebx + 0xd44], 1
je 0x45a32e
cmp dword [ebx + 0x530], 1
jne 0x45a338
mov eax, 1
jmp 0x45a532
cmp dword [ebx + 0xd48], 1
jne 0x45a4ca
push esp
call fcn.004606b0
pop ecx
push 0x5f0ae2
lea edx, [ebx + 0xd4c]
push edx
call fcn.0045e850
add esp, 8
push 0xa
lea ecx, [esp + 0x1c]
push ecx
mov eax, dword [esp + 8]
push eax
call fcn.0045ed14
add esp, 0xc
lea edx, [esp + 0x18]
push edx
lea ecx, [ebx + 0xd4c]
push ecx
call fcn.0045e878
add esp, 8
push 0x5f0ae6
lea eax, [ebx + 0xd4c]
push eax
call fcn.0045e878
add esp, 8
push 0xa
lea edx, [esp + 0x1c]
push edx
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0045ed14
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea edx, [ebx + 0xd4c]
push edx
call fcn.0045e878
add esp, 8
push 0x5f0ae8
lea ecx, [ebx + 0xd4c]
push ecx
call fcn.0045e878
add esp, 8
push 0xa
lea eax, [esp + 0x1c]
push eax
mov edx, dword [esp + 0x10]
push edx
call fcn.0045ed14
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
lea eax, [ebx + 0xd4c]
push eax
call fcn.0045e878
add esp, 8
push 0x5f0aea
lea edx, [ebx + 0xd4c]
push edx
call fcn.0045e878
add esp, 8
push 0xa
lea ecx, [esp + 0x1c]
push ecx
mov eax, dword [esp + 0x14]
push eax
call fcn.0045ed14
add esp, 0xc
lea edx, [esp + 0x18]
push edx
lea ecx, [ebx + 0xd4c]
push ecx
call fcn.0045e878
add esp, 8
push 0x5f0aec
lea eax, [ebx + 0xd4c]
push eax
call fcn.0045e878
add esp, 8
push 0xa
lea edx, [esp + 0x1c]
push edx
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0045ed14
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea edx, [ebx + 0xd4c]
push edx
call fcn.0045e878
add esp, 8
push 0x5f0aee
lea ecx, [ebx + 0xd4c]
push ecx
call fcn.0045e878
add esp, 8
push 0xa
lea eax, [esp + 0x1c]
push eax
mov edx, dword [esp + 0x1c]
push edx
call fcn.0045ed14
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
lea eax, [ebx + 0xd4c]
push eax
call fcn.0045e878
add esp, 8
push 0x5f0af0
lea edx, [ebx + 0xd4c]
push edx
call fcn.0045e878
add esp, 8
jmp 0x45a4de
push str.Log.txt
lea ecx, [ebx + 0xd4c]
push ecx
call fcn.0045e850
add esp, 8
lea eax, [ebx + 0xd4c]
push eax
call sub.KERNEL32.DLL_DeleteFileA
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
lea edx, [ebx + 0xd4c]
push edx
call sub.KERNEL32.DLL_CreateFileA
test eax, eax
je 0x45a512
push eax
call sub.KERNEL32.DLL_CloseHandle
xor ecx, ecx
mov dword [ebx + 0x5cc], ecx
xor eax, eax
mov dword [ebx + 0x5d0], eax
call sub.WINMM.DLL_timeGetTime
mov dword [ebx + 0xa9c4], eax
mov eax, 1
add esp, 0x98
pop ebx
ret
Function at 0x45bc5c
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd40
push ebx
push esi
push edi
lea edi, [ebp - 0x2c0]
cmp dword [0x62815c], 0
je 0x45bc7e
xor eax, eax
jmp 0x45be76
push 0x5f10ea
call fcn.0045bc3c
pop ecx
call fcn.0045bc4c
lea edx, [ebp - 0x190]
push edx
push 0x101
call sub.WSOCK32.DLL_WSAStartup
test eax, eax
je 0x45bcb6
push str.WinSock.DLL
call fcn.0045bc3c
pop ecx
or eax, 0xffffffff
jmp 0x45be76
mov dl, byte [ebp - 0x190]
and dl, 0xff
cmp dl, 1
jne 0x45bcd3
movzx ecx, word [ebp - 0x190]
shr ecx, 8
cmp cl, 1
je 0x45bceb
call sub.WSOCK32.DLL_WSACleanup
push str.Winsock.DLL
call fcn.0045bc3c
pop ecx
or eax, 0xffffffff
jmp 0x45be76
push 4
push 0
push 0x628164
call fcn.0045ea68
add esp, 0xc
push 0x100
lea edx, [ebp - 0x290]
push edx
call sub.WSOCK32.DLL_gethostname
test eax, eax
jne 0x45bd4a
lea ecx, [ebp - 0x290]
push ecx
call sub.WSOCK32.DLL_gethostbyname
mov ebx, eax
test eax, eax
je 0x45bd4a
mov edx, dword [ebx + 0xc]
mov eax, dword [edx]
mov dl, byte [eax]
mov byte [0x628164], dl
mov cl, byte [eax + 1]
mov byte [0x628165], cl
mov dl, byte [eax + 2]
mov byte [0x628166], dl
mov al, byte [eax + 3]
mov byte [0x628167], al
push 0x4004
push 0
push 0x624130
call fcn.0045ea68
add esp, 0xc
mov dword [0x628160], 0x1000
mov dword [0x62815c], 1
mov ecx, dword [ebp + 8]
mov dword [0x62816c], ecx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov esi, eax
mov ebx, str.WinSockProc
push 0x30
push 0
push edi
call fcn.0045ea68
xor eax, eax
xor edx, edx
mov dword [edi + 4], eax
xor ecx, ecx
mov dword [edi + 8], 0x460784
mov dword [edi + 0xc], edx
mov dword [edi + 0x10], ecx
add esp, 0xc
xor eax, eax
mov dword [edi + 0x14], esi
mov dword [edi + 0x18], eax
push 0x7f00
push 0
call sub.USER32.DLL_LoadCursorA
mov dword [edi + 0x1c], eax
push 5
call sub.GDI32.DLL_GetStockObject
mov dword [edi + 0x20], eax
xor edx, edx
mov dword [edi + 0x24], edx
mov dword [edi + 0x28], ebx
mov dword [edi], 0x30
xor ecx, ecx
mov dword [edi + 0x2c], ecx
push edi
call sub.USER32.DLL_RegisterClassExA
test ax, ax
jne 0x45bdfb
push 0x5f115a
call fcn.0045df78
pop ecx
or eax, 0xffffffff
jmp 0x45be76
push 0
push esi
push 0
cmp dword [0x62816c], 0
je 0x45be11
mov edx, dword [0x62816c]
jmp 0x45be17
mov edx, dword [0x610a90]
push edx
push 0
push 0
push 0
push 0
push 0x60000000
push ebx
push ebx
push 0x20
call sub.USER32.DLL_CreateWindowExA
mov edi, eax
mov dword [0x628170], edi
test edi, edi
jne 0x45be4a
push 0x5f1196
call fcn.0045df78
pop ecx
or eax, 0xffffffff
jmp 0x45be76
xor edx, edx
mov dword [0x62817c], edx
push 0x628144
push 0x628134
call fcn.00461fb0
add esp, 8
call fcn.0045bc54
push 0x5f11cc
call fcn.0045bc3c
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45bfcc
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor edx, edx
cmp dword [0x62815c], 0
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], edx
jne 0x45bfee
or eax, 0xffffffff
jmp 0x45c1d9
test eax, 0x80000000
jne 0x45c037
mov ecx, eax
and ecx, 0x78000000
cmp ecx, 0x48000000
jne 0x45c037
mov edx, eax
and edx, 0xffff
cmp edx, 0x1001
jge 0x45c037
mov ecx, eax
and ecx, 0xffff
mov ebx, dword [ecx*4 + 0x624130]
test ebx, ebx
je 0x45c037
mov edx, dword [ebx + 0x20]
shl edx, 0x10
and eax, 0x7ff0000
cmp edx, eax
je 0x45c03f
or eax, 0xffffffff
jmp 0x45c1d9
cmp dword [0x5f0740], 1
jne 0x45c050
or eax, 0xffffffff
jmp 0x45c1d9
mov dword [0x5f0740], 1
push 0
call fcn.004606f4
pop ecx
cmp dword [ebx], 0
jne 0x45c07e
push 0x5f148a
call fcn.0045df78
pop ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x45c1cf
cmp dword [ebx + 4], 1
jne 0x45c09b
push 0x5f14c2
call fcn.0045df78
pop ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x45c1cf
cmp dword [ebx + 0x18], 1
jne 0x45c1cf
cmp dword [ebx + 0x28], 0
jne 0x45c120
push 2
lea edi, [ebx + 0x28]
push 4
push edi
mov eax, dword [ebx + 0x24]
push eax
call sub.WSOCK32.DLL_recv
mov esi, eax
test esi, esi
jl 0x45c1cf
cmp esi, 4
jl 0x45c1cf
push 0
push 4
push edi
mov eax, dword [ebx + 0x24]
push eax
call sub.WSOCK32.DLL_recv
mov esi, eax
cmp esi, 4
jl 0x45c1cf
mov eax, dword [ebx + 0x28]
push eax
lea edx, [ebx + 0x2c]
push edx
call fcn.0045c604
add esp, 8
test eax, eax
jge 0x45c120
mov ecx, dword [ebx + 0x28]
push ecx
push 0x5f1504
call fcn.0045e1bc
mov dword [ebx + 4], 1
mov dword [ebp - 4], 0xffffffff
add esp, 8
jmp 0x45c1cf
lea edi, [ebx + 0x2c]
push edi
call fcn.0046148c
pop ecx
mov eax, dword [edi + 8]
mov ecx, eax
mov edx, dword [edi + 0x10]
add ecx, dword [ebx + 0x28]
cmp edx, ecx
jge 0x45c191
push 0
sub edx, eax
push edx
mov edx, dword [edi]
add edx, eax
push edx
mov eax, dword [ebx + 0x24]
push eax
call sub.WSOCK32.DLL_recv
mov esi, eax
test esi, esi
jl 0x45c1cf
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 8]
cmp esi, eax
jge 0x45c161
add dword [edi + 8], esi
jmp 0x45c1af
mov dword [ebp - 8], esi
push 0
mov edx, dword [ebx + 0x28]
sub edx, dword [ebp - 8]
push edx
mov ecx, dword [edi]
push ecx
mov eax, dword [ebx + 0x24]
push eax
call sub.WSOCK32.DLL_recv
mov esi, eax
test esi, esi
jge 0x45c189
mov esi, dword [ebp - 8]
xor eax, eax
mov dword [edi + 8], eax
jmp 0x45c1af
mov dword [edi + 8], esi
add esi, dword [ebp - 8]
jmp 0x45c1af
push 0
mov edx, dword [ebx + 0x28]
push edx
mov ecx, dword [edi]
add ecx, dword [edi + 8]
push ecx
mov eax, dword [ebx + 0x24]
push eax
call sub.WSOCK32.DLL_recv
mov esi, eax
test esi, esi
jl 0x45c1cf
add dword [edi + 8], esi
add dword [edi + 0xc], esi
sub dword [ebx + 0x28], esi
push 0
call fcn.004606f4
pop ecx
test eax, eax
jne 0x45c1cf
test esi, esi
jle 0x45c1cf
cmp dword [ebx + 0x28], 0
je 0x45c0a5
xor eax, eax
mov dword [0x5f0740], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x45df78
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcf0
xor eax, eax
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 8]
push edx
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x10c]
mov dword [ebp - 8], eax
cmp ebx, 0xff
jbe 0x45dfba
push 0xffffffffffffffff
push 0
add ebx, ebx
push ebx
call fcn.0045e2c4
add esp, 0xc
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov byte [edx], 0
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 8]
push 0xa
push edi
call fcn.0045e954
add esp, 8
mov ebx, eax
jmp 0x45e008
mov eax, ebx
sub eax, edi
push eax
push edi
push esi
call fcn.0045eac4
mov edx, ebx
add esp, 0xc
sub edx, edi
lea edi, [ebx + 1]
add esi, edx
mov byte [esi], 0xd
mov byte [esi + 1], 0xa
mov byte [esi + 2], 0
push 0xa
push edi
add esi, 2
call fcn.0045e954
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x45e01a
cmp ebx, dword [ebp + 8]
je 0x45dfd5
movsx eax, byte [ebx - 1]
cmp eax, 0xd
jne 0x45dfd5
push edi
push esi
call fcn.0045e850
add esp, 8
mov edx, dword [ebp - 8]
mov dword [ebp + 8], edx
cmp dword [0x610aa8], 0
jne 0x45e196
cmp dword [0x6112bc], 0
jne 0x45e19f
cmp byte [0x610fb8], 0
je 0x45e19f
lea ecx, [ebp - 0x210]
push ecx
call fcn.00462c14
pop ecx
push 0x610fb8
call fcn.00462c04
pop ecx
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push 0x6112c4
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test ebx, ebx
je 0x45e187
push 2
push 0
push 0
push ebx
call sub.KERNEL32.DLL_SetFilePointer
cmp dword [0x610b48], 0
jne 0x45e13e
cmp dword [0x610b4c], 0
jne 0x45e0f1
call sub.WINMM.DLL_timeGetTime
sub eax, dword [0x61af3c]
push eax
push 0x5f0afd
lea eax, [ebp - 0x310]
push eax
call fcn.00457a9c
add esp, 0xc
push 0
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 0x310]
push ecx
call sub.KERNEL32.DLL_lstrlenA
push eax
lea eax, [ebp - 0x310]
push eax
push ebx
call sub.KERNEL32.DLL_WriteFile
cmp dword [0x610b44], 0
je 0x45e13e
xor eax, eax
lea edx, [ebp - 0x310]
jmp 0x45e109
mov byte [edx], 9
inc eax
inc edx
cmp eax, dword [0x610b44]
jl 0x45e104
mov byte [ebp + eax - 0x310], 0
push 0
lea ecx, [ebp - 4]
push ecx
mov eax, dword [0x610b44]
push eax
lea edx, [ebp - 0x310]
push edx
push ebx
call sub.KERNEL32.DLL_WriteFile
lea ecx, [ebp - 0x310]
push ecx
call sub.KERNEL32.DLL_OutputDebugStringA
push 0
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp + 8]
push edx
call sub.KERNEL32.DLL_lstrlenA
push eax
mov ecx, dword [ebp + 8]
push ecx
push ebx
call sub.KERNEL32.DLL_WriteFile
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
mov edx, dword [ebp + 8]
push edx
call sub.KERNEL32.DLL_lstrlenA
mov ecx, dword [ebp + 8]
movsx eax, byte [ecx + eax - 1]
cmp eax, 0xa
push ebx
setne dl
and edx, 1
mov dword [0x610b48], edx
call sub.KERNEL32.DLL_CloseHandle
lea ecx, [ebp - 0x210]
push ecx
call fcn.00462c04
pop ecx
jmp 0x45e19f
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
cmp dword [ebp - 0xc], 0
je 0x45e1af
mov edx, dword [ebp - 0xc]
push edx
call fcn.0045e400
pop ecx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4607e4
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
cmp dword [0x62815c], 0
jne 0x460811
cmp dword [0x610ae0], 1
je 0x46080c
push 0
call fcn.0045bc5c
pop ecx
jmp 0x460811
or eax, 0xffffffff
jmp 0x46087f
push esi
call sub.WSOCK32.DLL_inet_addr
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x46082f
push 2
push 4
lea edx, [ebp - 4]
push edx
call sub.WSOCK32.DLL_gethostbyaddr
jmp 0x460835
push esi
call sub.WSOCK32.DLL_gethostbyname
test eax, eax
jne 0x46083e
or eax, 0xffffffff
jmp 0x46087f
cmp word [eax + 8], 2
jne 0x46084c
cmp word [eax + 0xa], 4
je 0x460853
mov eax, 0xfffffffe
jmp 0x46087f
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov dl, byte [ecx]
mov byte [ebx], dl
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov cl, byte [edx + 1]
mov byte [ebx + 1], cl
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov dl, byte [ecx + 2]
mov byte [ebx + 2], dl
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov al, byte [ecx + 3]
mov byte [ebx + 3], al
xor eax, eax
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x461158
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], 0
mov esi, dword [ebp + 8]
jge 0x461171
or eax, 0xffffffff
jmp 0x46126b
test esi, 0x80000000
jne 0x4611bd
mov edx, esi
and edx, 0x78000000
cmp edx, 0x48000000
jne 0x4611bd
mov ecx, esi
and ecx, 0xffff
cmp ecx, 0x1001
jge 0x4611bd
mov eax, esi
and eax, 0xffff
mov ebx, dword [eax*4 + 0x624130]
test ebx, ebx
je 0x4611bd
mov edx, dword [ebx + 0x20]
mov ecx, esi
shl edx, 0x10
and ecx, 0x7ff0000
cmp edx, ecx
je 0x4611c5
or eax, 0xffffffff
jmp 0x46126b
cmp dword [0x62815c], 0
jne 0x4611d6
or eax, 0xffffffff
jmp 0x46126b
push 0
call fcn.004606f4
pop ecx
cmp dword [ebx], 0
jne 0x4611f3
push 0x5f17d8
call fcn.0045df78
pop ecx
or edi, 0xffffffff
jmp 0x461269
cmp dword [ebx + 4], 1
jne 0x461209
push 0x5f1811
call fcn.0045df78
pop ecx
or edi, 0xffffffff
jmp 0x461269
push esi
call fcn.0045bfcc
pop ecx
test eax, eax
jge 0x461219
or edi, 0xffffffff
jmp 0x461269
cmp dword [ebx + 0x18], 0
jne 0x461238
push 0
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebx + 0x24]
push ecx
call sub.WSOCK32.DLL_recv
mov edi, eax
jmp 0x461269
lea eax, [ebx + 0x2c]
push eax
call fcn.0045c5e8
pop ecx
cmp eax, dword [ebp + 0x10]
jge 0x46124c
or edi, 0xffffffff
jmp 0x461269
push 0
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 0xc]
push edx
add ebx, 0x2c
push ebx
call fcn.0045c550
add esp, 0x10
push esi
call fcn.0045bfcc
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x461270
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor edi, edi
test esi, 0x80000000
jne 0x4612c6
mov eax, esi
and eax, 0x78000000
cmp eax, 0x48000000
jne 0x4612c6
mov edx, esi
and edx, 0xffff
cmp edx, 0x1001
jge 0x4612c6
mov ecx, esi
and ecx, 0xffff
mov ebx, dword [ecx*4 + 0x624130]
test ebx, ebx
je 0x4612c6
mov eax, dword [ebx + 0x20]
mov edx, esi
shl eax, 0x10
and edx, 0x7ff0000
cmp eax, edx
je 0x4612ce
or eax, 0xffffffff
jmp 0x461374
cmp dword [0x62815c], 0
jne 0x4612df
or eax, 0xffffffff
jmp 0x461374
push 0
call fcn.004606f4
pop ecx
cmp dword [ebx], 0
jne 0x4612fc
push 0x5f1854
call fcn.0045df78
pop ecx
or edi, 0xffffffff
jmp 0x461372
cmp dword [ebx + 4], 1
jne 0x461312
push 0x5f1893
call fcn.0045df78
pop ecx
or edi, 0xffffffff
jmp 0x461372
push esi
call fcn.0045bfcc
pop ecx
test eax, eax
jge 0x461322
or edi, 0xffffffff
jmp 0x461372
cmp dword [ebx + 0x18], 0
jne 0x461341
push 2
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebx + 0x24]
push ecx
call sub.WSOCK32.DLL_recv
mov edi, eax
jmp 0x461372
lea eax, [ebx + 0x2c]
push eax
call fcn.0045c5e8
pop ecx
cmp eax, dword [ebp + 0x10]
jge 0x461355
or edi, 0xffffffff
jmp 0x461372
push 1
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 0xc]
push edx
add ebx, 0x2c
push ebx
call fcn.0045c550
add esp, 0x10
push esi
call fcn.0045bfcc
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x46137c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor edi, edi
cmp dword [0x62815c], 0
jne 0x461398
or eax, 0xffffffff
jmp 0x461487
test esi, 0x80000000
jne 0x4613e4
mov edx, esi
and edx, 0x78000000
cmp edx, 0x48000000
jne 0x4613e4
mov ecx, esi
and ecx, 0xffff
cmp ecx, 0x1001
jge 0x4613e4
mov eax, esi
and eax, 0xffff
mov ebx, dword [eax*4 + 0x624130]
test ebx, ebx
je 0x4613e4
mov edx, dword [ebx + 0x20]
mov ecx, esi
shl edx, 0x10
and ecx, 0x7ff0000
cmp edx, ecx
je 0x4613ec
or eax, 0xffffffff
jmp 0x461487
push 0
call fcn.004606f4
pop ecx
cmp dword [ebx], 0
jne 0x461409
push 0x5f18dc
call fcn.0045df78
pop ecx
or edi, 0xffffffff
jmp 0x461485
cmp dword [ebx + 4], 1
jne 0x46141f
push 0x5f1915
call fcn.0045df78
pop ecx
or edi, 0xffffffff
jmp 0x461485
cmp dword [ebx + 8], 0
jne 0x46142a
or edi, 0xffffffff
jmp 0x461485
push esi
call fcn.0045c1e0
cmp dword [ebx + 0x18], 0
pop ecx
jne 0x461450
push 0
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebx + 0x24]
push ecx
call sub.WSOCK32.DLL_send
mov edi, eax
jmp 0x461485
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 0xc]
push edx
add ebx, 0x40
push ebx
call fcn.0045c4b4
add esp, 0xc
test eax, eax
jge 0x46147e
mov eax, dword [ebp + 0x10]
push eax
push 0x5f1958
call fcn.0045e1bc
add esp, 8
or edi, 0xffffffff
jmp 0x461485
push esi
call fcn.0045c1e0
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret