joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409f00
Capabilities:
Resolve dns

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [esp + 0x5c]
mov dword [eax], 0
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
sub esp, 0x10
mov edi, eax
test eax, eax
jne 0x40a08d
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0x18], 0
xor ebp, ebp
test ebx, ebx
je 0x40a0e4
mov dword [esp + 0x1c], eax
lea esi, [esi]
mov eax, dword [ebx + 4]
cmp eax, 2
je 0x40a0a0
mov edi, 0x1c
cmp eax, 0x17
jne 0x40a060
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x40a060
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x40a060
cmp eax, edi
jb 0x40a060
mov dword [esp], 0x20
call dword [0x45e814]
mov esi, eax
test eax, eax
je 0x40a0bf
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
mov edx, dword [ebx + 8]
mov dword [esp + 0x14], eax
mov eax, dword [ebx]
mov dword [esi + 4], ecx
mov dword [esi], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], edi
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
mov dword [esp], edi
call dword [0x45e814]
mov dword [esi + 0x18], eax
test eax, eax
je 0x40a0b6
mov edx, dword [ebx + 0x18]
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + edi - 4]
mov dword [eax + edi - 4], ecx
lea ecx, [eax + 4]
and ecx, 0xfffffffc
mov dword [esp + 0x14], ebx
sub eax, ecx
add edi, eax
sub edx, eax
xor eax, eax
and edi, 0xfffffffc
mov ebx, dword [edx + eax]
mov dword [ecx + eax], ebx
add eax, 4
cmp eax, edi
jb 0x40a01d
mov ebx, dword [esp + 0x14]
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x40a045
mov dword [esp], eax
call dword [0x45e808]
mov dword [esi + 0x14], eax
test eax, eax
je 0x40a0aa
mov eax, dword [esp + 0x18]
test ebp, ebp
cmove ebp, esi
test eax, eax
je 0x40a055
mov dword [eax + 0x1c], esi
mov dword [esp + 0x18], esi
lea esi, [esi]
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
jne 0x409f60
mov eax, dword [esp + 0x2c]
mov edi, dword [esp + 0x1c]
test eax, eax
je 0x40a083
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
sub esp, 4
test ebp, ebp
je 0x40a0e4
mov eax, dword [esp + 0x5c]
mov dword [eax], ebp
add esp, 0x3c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, 0x10
jmp 0x409f7a
mov eax, dword [esi + 0x18]
mov dword [esp], eax
call dword [0x45e810]
mov dword [esp], esi
call dword [0x45e810]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x40a0d3
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
sub esp, 4
mov dword [esp], ebp
mov edi, 8
xor ebp, ebp
call sym._Curl_freeaddrinfo
jmp 0x40a087
mov dword [esp], 0x2af9
mov edi, 0x2af9
xor ebp, ebp
call dword [sym.imp.WS2_32.dll_WSASetLastError]
sub esp, 4
jmp 0x40a087
Function at 0x40a5e0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x2c
xor eax, eax
mov edx, dword [esp + 0x34]
mov dword [esp + 4], 0x8004667e
test edx, edx
setne al
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
sub esp, 0xc
add esp, 0x2c
ret
Function at 0x40d5f0
Capabilities:
Get common file path

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov dword [esp], str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
test eax, eax
je 0x40d770
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
mov dword [esp + 4], str.LoadLibraryExA
call esi
sub esp, 8
mov edi, eax
mov eax, dword [esp + 0x40]
mov dword [esp + 4], 0x461168
mov dword [esp], eax
call sym._strpbrk
mov ebx, eax
test eax, eax
je 0x40d670
test edi, edi
je 0x40d698
mov dword [esp + 8], 8
mov eax, dword [esp + 0x40]
mov dword [esp + 4], 0
mov dword [esp], eax
call edi
sub esp, 0xc
mov ebx, eax
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
test edi, edi
je 0x40d6b8
mov dword [esp + 4], str.AddDllDirectory
mov dword [esp], ebp
call esi
sub esp, 8
test eax, eax
je 0x40d6b8
mov dword [esp + 8], 0x800
jmp 0x40d64f
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
sub esp, 4
mov ebx, eax
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [esp], 0
call esi
sub esp, 8
mov ebp, eax
test eax, eax
je 0x40d770
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call sym._strlen
lea eax, [ebp + eax + 1]
mov dword [esp], eax
call dword [0x45e814]
mov ecx, eax
test eax, eax
je 0x40d760
mov dword [esp + 4], ebp
mov dword [esp], eax
mov dword [esp + 0x1c], eax
call esi
sub esp, 8
test eax, eax
mov ecx, dword [esp + 0x1c]
je 0x40d760
mov dword [esp], ecx
call sym._strlen
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x40]
mov byte [ecx + eax], 0x5c
lea eax, [ecx + eax + 1]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcpy
test edi, edi
mov ecx, dword [esp + 0x1c]
je 0x40d77c
mov dword [esp], ecx
mov dword [esp + 8], 8
mov dword [esp + 4], 0
call edi
sub esp, 0xc
mov ebx, eax
mov ecx, dword [esp + 0x1c]
lea esi, [esi]
mov dword [esp], ecx
call dword [0x45e810]
jmp 0x40d665
add esp, 0x2c
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ecx
mov dword [esp + 0x1c], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
sub esp, 4
mov ebx, eax
mov ecx, dword [esp + 0x1c]
jmp 0x40d760
Function at 0x40d8c0
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 8
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov ebp, dword [esp + 0x24]
mov edi, dword [edx + 0x64]
cmp dword [edx + 0x60], edi
jae 0x40daa7
mov dword [esp + 4], ebp
mov ecx, dword [edx + 0x5c]
xor edi, edi
jmp 0x40d9b8
cmp esi, 1
jbe 0x40d9cc
movzx ecx, word [0x461628]
sub esi, 2
lea ebx, [eax + 2]
add edi, 2
mov word [eax], cx
mov dword [edx + 0x5c], 0
cmp esi, 3
jbe 0x40d9cc
mov ecx, dword [edx + 0x60]
mov eax, dword [edx + 0x64]
sub eax, ecx
cmp eax, 2
jbe 0x40d9e0
movsx eax, byte [edx + ecx + 0x68]
movzx ebp, byte [edx + ecx + 0x69]
add edi, 4
sub esi, 4
shl eax, 8
movzx eax, ax
or eax, ebp
lea ebp, [ecx + 3]
mov dword [edx + 0x60], ebp
shl eax, 8
movzx ecx, byte [edx + ecx + 0x6a]
mov ebp, eax
or ecx, eax
shr ebp, 0x12
mov dword [esp], ecx
shr eax, 0xc
movzx ecx, byte [ebp + 0x461580]
and eax, 0x3f
mov byte [ebx], cl
movzx eax, byte [eax + 0x461580]
mov ecx, dword [esp]
mov byte [ebx + 1], al
mov eax, ecx
and ecx, 0x3f
sar eax, 6
movzx ecx, byte [ecx + 0x461580]
and eax, 0x3f
movzx eax, byte [eax + 0x461580]
mov byte [ebx + 3], cl
mov byte [ebx + 2], al
lea eax, [ebx + 4]
mov ebx, dword [edx + 0x5c]
lea ecx, [ebx + 4]
mov ebx, dword [edx + 0x64]
mov dword [edx + 0x5c], ecx
cmp dword [edx + 0x60], ebx
jae 0x40da90
cmp ecx, 0x48
ja 0x40d8f8
mov ebx, eax
cmp esi, 3
ja 0x40d924
add esp, 8
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [esp + 4]
cmp esi, 3
jbe 0x40d9cc
mov eax, ebp
test al, al
je 0x40d9cc
mov eax, 0x3d3d
mov word [ebx + 2], ax
mov esi, dword [edx + 0x60]
mov eax, dword [edx + 0x64]
sub eax, esi
cmp eax, 1
je 0x40daa0
cmp eax, 2
jne 0x40d9cc
movsx ecx, byte [edx + esi + 0x69]
shl ecx, 8
movzx ecx, cx
movsx eax, byte [edx + esi + 0x68]
movzx esi, word [0x46162a]
shl eax, 0x10
and eax, 0xff0000
or ecx, eax
shr eax, 0x12
mov ebp, ecx
mov ecx, esi
mov cl, byte [eax + 0x461580]
mov eax, ebp
sar eax, 0xc
mov esi, ecx
and eax, 0x3f
mov ecx, esi
mov ch, byte [eax + 0x461580]
mov word [ebx], cx
mov eax, dword [edx + 0x60]
add eax, 1
mov dword [edx + 0x60], eax
cmp eax, dword [edx + 0x64]
je 0x40da75
mov ecx, ebp
sar ecx, 6
and ecx, 0x3f
movzx eax, byte [ecx + 0x461580]
mov byte [ebx + 2], al
add dword [edx + 0x60], 1
add dword [edx + 0x5c], 4
add edi, 4
add esp, 8
pop ebx
mov eax, edi
pop esi
pop edi
pop ebp
ret
mov ebp, dword [esp + 4]
mov ebx, eax
jmp 0x40d9e4
xor ecx, ecx
jmp 0x40da19
mov ebx, eax
xor edi, edi
jmp 0x40d9e4
Function at 0x40e010
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [esp + 0x3c]
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x40e050
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], esi
mov dword [esp + 0x3c], eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp sym._fread
mov dword [esp + 4], 0x4611a0
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sym._fopen
mov dword [ebx + 0x24], eax
test eax, eax
jne 0x40e02e
add esp, 0x1c
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4170a0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
test eax, eax
je 0x417180
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
lea eax, [esp + 0x1c]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp], 2
call sym._Curl_inet_pton
test eax, eax
je 0x4170d8
xor eax, eax
add esp, 0x30
pop ebx
pop esi
pop edi
ret
lea eax, [esp + 0x20]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp], 0x17
call sym._Curl_inet_pton
test eax, eax
jne 0x4170cc
mov dword [esp], ebx
call sym._strlen
mov dword [esp + 4], 0x2e
mov dword [esp + 8], eax
mov edi, eax
mov dword [esp], ebx
call sym._Curl_memrchr
test eax, eax
je 0x41713b
sub eax, ebx
mov dword [esp + 4], 0x2e
mov dword [esp + 8], eax
mov dword [esp], ebx
call sym._Curl_memrchr
test eax, eax
je 0x41713b
add eax, 1
mov edx, eax
sub edx, ebx
mov ebx, eax
sub edi, edx
add edi, ebx
cmp ebx, edi
jae 0x417188
mov esi, 0x1505
lea esi, cs:[esi]
nop
movsx eax, byte [ebx]
mov edx, esi
add ebx, 1
shl edx, 5
mov dword [esp], eax
add esi, edx
call sym._Curl_raw_toupper
movsx eax, al
xor esi, eax
cmp edi, ebx
jne 0x417150
add esp, 0x30
mov eax, esi
pop ebx
movzx eax, al
pop esi
pop edi
ret
xor eax, eax
ret
mov eax, 5
jmp 0x4170ce
Function at 0x41e5c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_recv]
sub esp, 0x10
cmp eax, 0xffffffff
je 0x41e600
mov edx, dword [esp + 0x2c]
mov dword [edx], eax
xor eax, eax
add esp, 0x1c
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 0x51
cmp eax, 0x2733
mov eax, 0x38
cmove eax, edx
add esp, 0x1c
ret

Function at 0x41e790
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x24
mov ebx, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov eax, dword [ebx + 0x1a8]
test eax, eax
je 0x41e800
mov dword [esp], ebx
mov dword [esp + 4], 1
call sym._Curl_set_in_callback
mov eax, dword [ebx + 0x134]
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 8], eax
call dword [ebx + 0x1a8]
mov dword [esp], ebx
mov dword [esp + 4], 0
mov esi, eax
call sym._Curl_set_in_callback
add esp, 0x24
mov eax, esi
pop ebx
pop esi
ret
cmp esi, 2
jbe 0x41e810
xor esi, esi
add esp, 0x24
mov eax, esi
pop ebx
pop esi
ret
mov eax, dword [ebx + 0x130]
mov dword [esp + 8], 1
mov dword [esp + 4], 2
mov dword [esp + 0xc], eax
lea eax, [esi + esi*2 + 0x463570]
xor esi, esi
mov dword [esp], eax
call sym._fwrite
mov eax, dword [ebx + 0x130]
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call sym._fwrite
jmp 0x41e807
Function at 0x41ea00
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov ebp, dword [edi + ebx*4 + 0x194]
shl ebx, 4
add ebx, edi
mov eax, dword [ebx + 0x1b8]
test eax, eax
je 0x41ea3d
mov esi, dword [ebx + 0x1c0]
mov ecx, dword [ebx + 0x1c4]
cmp ecx, esi
jb 0x41ea80
cmp esi, ecx
je 0x41ead8
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc], 0
mov dword [esp], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_recv]
sub esp, 0x10
mov esi, eax
mov eax, dword [esp + 0x40]
mov dword [eax], 0
cmp esi, 0xffffffff
je 0x41eb10
add esp, 0x1c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
sub esi, ecx
cmp esi, dword [esp + 0x3c]
cmova esi, dword [esp + 0x3c]
add ecx, eax
mov eax, dword [esp + 0x38]
mov dword [esp + 4], ecx
mov dword [esp + 8], esi
mov dword [esp], eax
call sym._memcpy
mov eax, dword [ebx + 0x1c4]
add eax, esi
mov dword [ebx + 0x1c4], eax
cmp eax, dword [ebx + 0x1c0]
je 0x41eb30
test esi, esi
jle 0x41ea3d
mov eax, dword [esp + 0x40]
mov dword [eax], 0
add esp, 0x1c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
xor esi, esi
mov dword [esp], eax
call dword [0x45e810]
mov dword [ebx + 0x1b8], 0
mov dword [ebx + 0x1bc], 0
mov dword [ebx + 0x1c0], 0
mov dword [ebx + 0x1c4], 0
jmp 0x41eab7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x41eb40
mov eax, dword [esp + 0x40]
mov dword [eax], 0x51
jmp 0x41ea76
mov eax, dword [ebx + 0x1b8]
jmp 0x41eada
mov dword [esp + 4], eax
mov dword [esp], edi
call sym._Curl_strerror
mov dword [esp + 4], str.Recv_failure:__s
mov dword [esp + 8], eax
mov eax, dword [edi]
mov dword [esp], eax
call sym._Curl_failf
mov eax, dword [edi]
mov dword [eax + 0x82c], ebx
mov eax, dword [esp + 0x40]
mov dword [eax], 0x38
jmp 0x41ea76
Function at 0x41ede0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x44]
mov esi, dword [esp + 0x40]
mov ebx, eax
mov edx, dword [esi + 0x28c]
mov edi, dword [esi + eax*4 + 0x194]
shl ebx, 4
add ebx, esi
mov ecx, dword [ebx + 0x1bc]
mov ebp, dword [ebx + 0x1c0]
test byte [edx + 0x40], 3
je 0x41ee22
cmp dword [esi + eax*4 + 0x1a8], sym._Curl_recv_plain
je 0x41ee98
mov eax, dword [esp + 0x4c]
mov dword [esp + 0xc], 0
mov dword [esp], edi
mov dword [esp + 8], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
mov ebx, eax
mov eax, dword [esp + 0x50]
mov dword [eax], 0
cmp ebx, 0xffffffff
je 0x41ee68
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp eax, 0x2733
jne 0x41ef24
mov eax, dword [esp + 0x50]
xor ebx, ebx
mov dword [eax], 0x51
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx + 0x1b8]
sub ecx, ebp
test eax, eax
je 0x41eeac
test ecx, ecx
je 0x41ee22
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
mov dword [esp + 0x1c], ecx
call sym._Curl_socket_check
cmp eax, 0xffffffff
je 0x41ee22
test al, 1
je 0x41ee22
mov eax, dword [ebx + 0x1b8]
mov ecx, dword [esp + 0x1c]
test eax, eax
je 0x41ef5d
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
add eax, dword [ebx + 0x1c0]
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.WS2_32.dll_recv]
sub esp, 0x10
test eax, eax
jle 0x41ee22
add dword [ebx + 0x1c0], eax
jmp 0x41ee22
mov dword [esp + 4], eax
mov dword [esp], esi
call sym._Curl_strerror
mov dword [esp + 4], str.Send_failure:__s
mov dword [esp + 8], eax
mov eax, dword [esi]
mov dword [esp], eax
call sym._Curl_failf
mov eax, dword [esi]
mov dword [eax + 0x82c], edi
mov eax, dword [esp + 0x50]
mov dword [eax], 0x37
jmp 0x41ee57
mov eax, dword [esi]
mov eax, dword [eax + 0x498]
add eax, eax
mov dword [ebx + 0x1bc], eax
mov dword [esp], eax
call dword [0x45e814]
mov ecx, dword [ebx + 0x1bc]
mov dword [ebx + 0x1c0], 0
mov dword [ebx + 0x1b8], eax
mov dword [ebx + 0x1c4], 0
test eax, eax
jne 0x41eeef
mov dword [ebx + 0x1bc], 0
jmp 0x41ee22
Function at 0x428f20
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [eax]
mov ebx, dword [edi + 0x12c]
cmp edx, 0x1f
je 0x428f40
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebp, [ebx + 0x1cb0]
lea edx, [ebx + 0x1eb0]
mov esi, eax
cmp ebp, edx
jb 0x429100
lea eax, [ebx + 0x1cb3]
mov dword [ebx + 0x1eb0], ebp
mov dword [esp + 0x18], eax
mov ecx, dword [sym.imp.WS2_32.dll_htons]
movzx eax, word [ebx + 0x1ca8]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], ecx
mov dword [esp], eax
call ecx
sub esp, 4
mov word [esp + 0x12], ax
movzx eax, word [ebx + 0x1caa]
mov ecx, dword [esp + 0x14]
mov dword [esp], eax
call ecx
sub esp, 4
mov word [esp + 0x14], ax
mov edx, dword [esp + 0x1c]
mov eax, dword [ebx + 0x1eb0]
cmp eax, edx
jae 0x429042
lea ecx, [eax + 1]
mov dword [ebx + 0x1eb0], ecx
movzx ecx, byte [esp + 0x12]
mov byte [eax], cl
mov eax, dword [ebx + 0x1eb0]
cmp eax, edx
jae 0x429042
lea ecx, [eax + 1]
mov dword [ebx + 0x1eb0], ecx
movzx ecx, word [esp + 0x12]
mov byte [eax], ch
mov eax, dword [ebx + 0x1eb0]
cmp eax, edx
jae 0x429042
lea ecx, [eax + 1]
mov dword [ebx + 0x1eb0], ecx
movzx ecx, byte [esp + 0x14]
mov byte [eax], cl
mov eax, dword [ebx + 0x1eb0]
cmp eax, edx
jae 0x429042
lea ecx, [eax + 1]
mov dword [ebx + 0x1eb0], ecx
movzx ecx, word [esp + 0x14]
mov byte [eax], ch
mov eax, dword [ebx + 0x1eb0]
cmp eax, edx
jae 0x429042
lea ecx, [eax + 1]
mov dword [ebx + 0x1eb0], ecx
mov byte [eax], 0xff
mov eax, dword [ebx + 0x1eb0]
cmp eax, edx
jae 0x429042
lea edx, [eax + 1]
mov dword [ebx + 0x1eb0], edx
mov byte [eax], 0xf0
mov eax, dword [ebx + 0x1eb0]
cmp byte [edi + 0x4e0], 0
mov dword [ebx + 0x1eb4], eax
mov dword [ebx + 0x1eb0], ebp
je 0x429071
sub eax, ebp
lea ecx, [ebx + 0x1cb2]
mov edx, 0x3e
sub eax, 2
mov dword [esp], eax
mov eax, edi
call sym._printsub.part.0
mov dword [esp + 4], ebp
mov ebp, dword [sym.imp.WS2_32.dll_send]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov eax, dword [esi + 0x194]
mov dword [esp], eax
call ebp
sub esp, 0x10
test eax, eax
js 0x429130
mov edx, dword [esp + 0x18]
mov ecx, 4
mov eax, esi
add ebx, 0x1cb7
call sym._send_telnet_data
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], ebx
mov eax, dword [esi + 0x194]
mov dword [esp], eax
call ebp
sub esp, 0x10
test eax, eax
jns 0x428f34
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp + 4], str.Sending_data_failed___d_
mov dword [esp + 8], eax
mov dword [esp], edi
call sym._Curl_failf
jmp 0x428f34
lea eax, [ebx + 0x1cb3]
mov byte [ebx + 0x1cb2], 0x1f
mov dword [esp + 0x18], eax
mov dword [ebx + 0x1eb0], eax
mov eax, 0xfffffaff
mov word [ebx + 0x1cb0], ax
jmp 0x428f66
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp + 4], str.Sending_data_failed___d_
mov dword [esp + 8], eax
mov dword [esp], edi
call sym._Curl_failf
jmp 0x4290a1
Function at 0x4295e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x2c
mov ebp, dword [eax]
lea eax, [esp + 0x1d]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x194]
mov byte [esp + 0x1d], 0xff
mov byte [esp + 0x1e], dl
mov byte [esp + 0x1f], cl
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
test eax, eax
js 0x429650
mov eax, dword [ebx]
cmp byte [eax + 0x4e0], 0
je 0x429644
mov dword [esp], edi
mov ecx, esi
mov edx, str.SENT
call sym._printoption.part.0
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp + 4], str.Sending_data_failed___d_
mov dword [esp + 8], eax
mov dword [esp], ebp
call sym._Curl_failf
jmp 0x42962a
Function at 0x42ef80
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebx
mov edx, dword [esp + 8]
mov eax, 0x1505
mov ebx, dword [esp + 0xc]
add ebx, edx
cmp edx, ebx
jae 0x42efac
lea esi, [esi]
mov ecx, eax
add edx, 1
shl ecx, 5
add eax, ecx
movsx ecx, byte [edx - 1]
xor eax, ecx
cmp ebx, edx
jne 0x42ef98
xor edx, edx
div dword [esp + 0x10]
pop ebx
mov eax, edx
ret

Function at 0x42f9b0
Capabilities:
Hash data via wincrypt

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 4]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
sub esp, 0x10
add esp, 0x1c
ret

Function at 0x42f9f0
Capabilities:
Create new key via cryptacquirecontext
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x10], 0xf0000000
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
sub esp, 0x14
test eax, eax
jne 0x42fa30
add esp, 0x28
pop ebx
ret
lea eax, [ebx + 4]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x8003
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
sub esp, 0x14
add esp, 0x28
pop ebx
ret

Function at 0x42fa70
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push esi
push ebx
sub esp, 0x34
lea ebx, [esp + 0x28]
mov dword [esp + 0x10], 0xf0000000
mov esi, dword [esp + 0x44]
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
sub esp, 0x14
test eax, eax
jne 0x42faf8
mov dword [esp], esi
call sym._strlen
mov dword [esp], eax
call sym._curlx_uztoui
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
sub esp, 0x10
mov eax, dword [esp + 0x40]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._MD5_Final
add esp, 0x34
pop ebx
pop esi
ret
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x8003
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
sub esp, 0x14
jmp 0x42faad
Function at 0x4336d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x3c
mov byte [esp + 0x17], dl
mov dword [esp + 0x28], 0x207b2928
mov dword [esp + 0x2c], 0x5d2a25
test eax, eax
je 0x433858
movzx eax, byte [eax]
test al, al
je 0x433840
mov esi, edx
mov dword [esp + 0x18], ebx
mov edx, ebx
xor ecx, ecx
mov dword [esp + 0x1c], esi
xor ebp, ebp
xor edi, edi
jmp 0x433736
cmp al, 0x22
je 0x4337b8
cmp byte [esp + 0x17], 0
je 0x4337c0
movzx eax, byte [edx + 1]
add edx, 1
test al, al
je 0x433748
cmp al, 0x5c
jne 0x433718
movzx eax, byte [edx + 1]
add edx, 1
add edi, 1
test al, al
jne 0x433736
mov eax, edi
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
or eax, ebp
jne 0x43375e
test cl, cl
je 0x433840
mov dword [esp], ebx
add edi, ebp
call sym._strlen
mov edx, eax
mov eax, esi
xor eax, 1
movzx eax, al
lea edi, [edi + eax*2]
add edi, edx
lea eax, [edi + 1]
mov dword [esp], eax
call dword [0x45e814]
test eax, eax
je 0x433858
mov ecx, esi
mov edx, eax
test cl, cl
jne 0x433812
mov byte [eax], 0x22
lea edx, [eax + 1]
mov byte [eax + edi - 1], 0x22
movzx ecx, byte [ebx]
test cl, cl
jne 0x433819
mov byte [eax + edi], 0
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
add ebp, 1
jmp 0x43372b
test cl, cl
jne 0x43372b
mov esi, edx
lea ebx, [esp + 0x28]
mov ecx, 0x28
mov edx, eax
jmp 0x4337e4
cmp al, dl
je 0x433830
add ebx, 1
mov eax, ecx
movzx ecx, byte [ebx]
test cl, cl
jne 0x4337e0
mov ebx, eax
mov eax, edx
mov edx, esi
cmp bl, al
sete cl
jmp 0x43372b
mov byte [edx], 0x5c
add edx, 1
movzx ecx, byte [ebx]
add edx, 1
add ebx, 1
mov byte [edx - 1], cl
movzx ecx, byte [ebx]
test cl, cl
je 0x4337a5
cmp cl, 0x5c
je 0x433800
cmp cl, 0x22
jne 0x433806
mov byte [edx], 0x5c
add edx, 1
jmp 0x433806
mov edx, esi
mov ecx, 1
jmp 0x43372b
mov dword [esp], ebx
call dword [0x45e808]
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x3c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret