joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52ad50
Capabilities:
Check for software breakpoints

Disassembly:
cmp dword [esi + 0x14], 0xcc
je 0x52ad73
mov eax, dword [esi + 0x1a8]
push esi
call dword [eax]
mov dword [esi + 0x8c], 0
mov dword [esi + 0x14], 0xcc
mov ecx, dword [esi + 0x1a8]
mov eax, dword [ecx + 8]
test eax, eax
je 0x52ad99
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x30
call dword [eax]
mov edx, dword [esi + 0x1a8]
mov eax, dword [edx + 8]
test eax, eax
jne 0x52ad80
mov edx, dword [esi + 0x44]
xor eax, eax
test edx, edx
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov eax, 1
ret

Function at 0x52ae50
Capabilities:
Check for software breakpoints

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x52ae87
push esi
call fcn.0055cc10
mov eax, dword [esi + 0x40]
test eax, eax
je 0x52ae80
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
pop ebp
ret 4
mov dword [esi + 0x14], 0xcb
mov ecx, dword [esi + 0x14]
cmp ecx, 0xcb
jne 0x52af06
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x52aef0
nop
mov eax, dword [esi + 8]
test eax, eax
je 0x52aeaa
push esi
call dword [eax]
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
test eax, eax
je 0x52aee9
cmp eax, 2
je 0x52aef0
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x52aea0
cmp eax, 3
je 0x52aecd
cmp eax, 1
jne 0x52aea0
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
cmp eax, dword [ecx + 8]
jl 0x52aea0
mov eax, dword [ecx + 8]
mov edx, dword [esi + 0x144]
add eax, edx
mov dword [ecx + 8], eax
jmp 0x52aea0
xor eax, eax
pop esi
pop ebp
ret 4
mov eax, dword [esi + 0x94]
mov dword [esi + 0x9c], eax
call fcn.0052ad50
pop esi
pop ebp
ret 4
cmp ecx, 0xcc
je 0x52af1d
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
push esi
mov dword [eax + 0x18], ecx
call dword [eax]
call fcn.0052ad50
pop esi
pop ebp
ret 4

Function at 0x53172d
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
lea eax, [ebp - 0x24]
mov esi, ecx
and dword [esi], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp + 0xc]
and dword [esi + 8], 0
and dword [esi + 0xc], 0
and dword [esi + 0x10], 0
mov dword [esi + 4], ecx
lea eax, [ecx + eax - 1]
dec ecx
not ecx
and eax, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
mov dword [esi + 4], eax
jne 0x531772
mov ecx, 0x100000
lea ecx, [eax + ecx - 1]
dec eax
not eax
and ecx, eax
mov dword [esi + 0x14], ecx
mov eax, esi
pop esi
leave
ret 8
Function at 0x55e096
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x55e0a5
xor eax, eax
jmp 0x55e188
mov eax, dword [esp + 0xc]
cmp eax, 8
push ebx
push esi
mov esi, dword [esp + 0xc]
not esi
mov ecx, 0xff
jb 0x55e168
push edi
mov edi, eax
shr edi, 3
xor ebx, ebx
mov bl, byte [edx]
sub eax, 8
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x5af1c0]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x5af1c0]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x5af1c0]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x5af1c0]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x5af1c0]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x5af1c0]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x5af1c0]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x5af1c0]
inc edx
dec edi
jne 0x55e0c5
pop edi
test eax, eax
je 0x55e182
xor ebx, ebx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x5af1c0]
inc edx
dec eax
jne 0x55e16c
mov eax, esi
pop esi
not eax
pop ebx
ret 0xc
Function at 0x55e329
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebx + 0x24]
push esi
mov dword [ebp - 8], edx
push edi
mov ecx, dword [ebx + 0x64]
mov eax, dword [ebx + 0x34]
mov esi, dword [ebx + 0x6c]
sub eax, ecx
sub eax, esi
mov dword [ebp - 4], eax
jne 0x55e355
test ecx, ecx
jne 0x55e35f
test esi, esi
jne 0x55e35f
mov eax, edx
jmp 0x55e3d0
cmp eax, 0xffffffff
jne 0x55e35f
push 0xfffffffffffffffe
pop eax
jmp 0x55e3d0
mov esi, dword [ebx + 0x24]
lea esi, [edx + esi - 0x106]
cmp ecx, esi
jb 0x55e3d0
mov edi, dword [ebx + 0x30]
mov ecx, edx
mov eax, ecx
shr ecx, 2
lea esi, [edi + edx]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x3c]
sub dword [ebx + 0x68], edx
sub dword [ebx + 0x64], edx
sub dword [ebx + 0x54], edx
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx esi, word [eax]
mov edi, esi
sub edi, edx
cmp esi, edx
sbb esi, esi
not esi
and esi, edi
dec ecx
mov word [eax], si
jne 0x55e395
mov eax, dword [ebx + 0x38]
mov esi, edx
lea eax, [eax + edx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edi, ecx
sub edi, edx
cmp ecx, edx
sbb ecx, ecx
not ecx
and ecx, edi
dec esi
mov word [eax], cx
jne 0x55e3b4
mov eax, dword [ebp - 4]
add eax, edx
mov esi, dword [ebx]
cmp dword [esi + 4], 0
mov dword [ebp - 0xc], esi
je 0x55e47d
mov edi, dword [ebx + 0x6c]
add edi, dword [ebx + 0x64]
mov ecx, dword [esi + 4]
add edi, dword [ebx + 0x30]
cmp ecx, eax
mov dword [ebp - 4], ecx
jbe 0x55e3f5
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x55e3ff
xor ecx, ecx
jmp 0x55e43e
sub ecx, dword [ebp - 4]
mov eax, dword [esi + 0x1c]
mov dword [esi + 4], ecx
cmp dword [eax + 0x18], 0
jne 0x55e421
push dword [ebp - 4]
push dword [esi]
push dword [esi + 0x30]
call fcn.00584983
mov edx, dword [ebp - 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebp - 4]
mov esi, dword [esi]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
mov eax, dword [ebp - 0xc]
add dword [eax], ecx
add dword [eax + 8], ecx
add dword [ebx + 0x6c], ecx
mov edi, dword [ebx + 0x6c]
cmp edi, 3
jb 0x55e469
mov eax, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [ebx + 0x50]
mov dword [ebx + 0x40], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp edi, 0x106
jae 0x55e47d
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x55e337
pop edi
pop esi
leave
ret
Function at 0x58cc94
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebp
push ebx
push esi
mov dword [esp], eax
test eax, eax
je 0x58cd41
mov esi, eax
mov edx, dword [esi]
xor eax, eax
mov byte [edx + 0x16], al
mov ecx, dword [esi]
mov byte [ecx + 0x17], al
mov ebx, dword [esi]
mov byte [ebx + 0x18], al
mov ebp, dword [esi]
mov byte [ebp + 0x19], al
mov ebp, dword [esi + 4]
test ebp, ebp
jle 0x58cceb
mov eax, esi
mov edx, dword [eax]
xor ecx, ecx
xor ebx, ebx
movzx esi, byte [edx + ebx]
mov edi, ecx
shl edi, 8
shr ecx, 0x18
xor ecx, esi
mov eax, ecx
mov ecx, edi
xor ecx, dword [eax*4 + 0x5b3c60]
inc ebx
cmp ebx, ebp
jl 0x58cccb
jmp 0x58ccf1
mov eax, esi
mov edx, dword [eax]
xor ecx, ecx
mov eax, dword [esp]
mov edi, dword [eax + 0xc]
test edi, edi
jle 0x58cd1f
mov ebp, dword [eax + 8]
xor esi, esi
movzx eax, byte [ebp + esi]
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
xor ecx, eax
mov eax, ecx
mov ecx, ebx
xor ecx, dword [eax*4 + 0x5b3c60]
inc esi
cmp esi, edi
jl 0x58cd00
mov esi, dword [esp]
mov byte [edx + 0x16], cl
mov ebp, dword [esi]
mov eax, ecx
shr eax, 8
mov byte [ebp + 0x17], al
mov ebx, dword [esi]
mov edx, ecx
shr edx, 0x10
mov byte [ebx + 0x18], dl
mov edi, dword [esi]
shr ecx, 0x18
mov byte [edi + 0x19], cl
pop ecx
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x425100
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42512d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42512d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x421740
Capabilities:
Encode data using xor

Disassembly:
xor dl, dl
mov dl, byte [edi]
xor dl, bl
mov byte [edi], dl
inc edi
cmp edi, ecx
jne fcn.00421740
ret
Function at 0x411c60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4fa6b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, ecx
lea eax, [esp + 0x2c]
push edi
mov edi, dword [esp + 0x30]
lea ecx, [esp + 0xc]
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x38], edi
call fcn.0040b280
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x411cb2
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 8
push ebx
lea edx, [esp + 0xc]
push ebp
lea eax, [esp + 0x20]
push edx
push eax
mov ecx, esi
mov dword [esp + 0x18], edi
call fcn.0040b280
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 8]
lea ebx, [ecx + 8]
sub eax, edx
sar eax, 1
mov edi, eax
jne 0x411ce2
xor esi, esi
jmp 0x411cf0
lea edx, [edi + edi]
push edx
call fcn.00412710
add esp, 4
mov esi, eax
mov eax, dword [ebx + 4]
mov ebx, dword [ebx]
sub eax, ebx
lea edi, [esi + edi*2]
sar eax, 1
shl eax, 1
mov ebp, eax
mov dword [esp + 0x14], esi
push ebp
push ebx
push esi
mov dword [esp + 0x28], edi
call fcn.004ee100
lea ebx, [esi + ebp]
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x48]
xor ebp, ebp
push eax
mov dword [esp + 0x40], ebp
call fcn.004ed8fc
sub ebx, esi
sar ebx, 1
push ebx
call fcn.004c12b0
sub edi, esi
add esp, 0x14
xor ebx, ebx
mov dword [esp + 0x30], 0xffffffff
mov bx, word [esi + eax*2]
sar edi, 1
je 0x411d80
lea eax, [edi + edi]
cmp eax, 0x80
jbe 0x411d5d
push esi
call fcn.004eda9c
add esp, 4
jmp 0x411d80
add eax, 7
mov ecx, 0x56e86c
shr eax, 3
lea edi, [eax*4 + 0x56e828]
call fcn.0040b0b0
mov ecx, dword [edi]
mov dword [esi], ecx
mov dword [edi], esi
mov dword [0x56e86c], ebp
mov ecx, dword [esp + 0x28]
mov eax, ebx
pop ebp
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 8
Function at 0x418100
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4fa99b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor eax, eax
push edi
mov al, byte [esi]
lea eax, [eax + eax*2]
mov ax, word [eax*4 + 0x51a0b8]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov eax, dword [eax + esi]
push eax
call sub.WSOCK32.dll_ntohl
mov edi, eax
xor eax, eax
mov al, byte [esi]
lea ecx, [eax + eax*2]
mov ax, word [ecx*4 + 0x51a0b8]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov ax, word [eax + esi + 4]
push eax
call sub.WSOCK32.dll_ntohs
mov ebx, eax
xor eax, eax
mov al, byte [esi]
lea edx, [eax + eax*2]
mov ax, word [edx*4 + 0x51a0b8]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov ax, word [eax + esi + 6]
push eax
call sub.WSOCK32.dll_ntohs
mov ebp, eax
xor eax, eax
mov al, byte [esi]
lea eax, [eax + eax*2]
mov ax, word [eax*4 + 0x51a0b8]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov ax, word [eax + esi + 8]
push eax
call sub.WSOCK32.dll_ntohs
mov dword [esp + 0x1c], eax
xor eax, eax
mov al, byte [esi]
lea ecx, [eax + eax*2]
mov ax, word [ecx*4 + 0x51a0b8]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov ax, word [eax + esi + 0xa]
push eax
call sub.WSOCK32.dll_ntohs
mov dword [esp + 0x18], eax
xor eax, eax
mov al, byte [esi]
lea edx, [eax + eax*2]
mov ax, word [edx*4 + 0x51a0b8]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov ax, word [eax + esi + 0xc]
push eax
call sub.WSOCK32.dll_ntohs
mov dword [esp + 0x14], eax
xor eax, eax
mov al, byte [esi]
lea eax, [eax + eax*2]
mov ax, word [eax*4 + 0x51a0b8]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov ax, word [eax + esi + 0xe]
push eax
call sub.WSOCK32.dll_ntohs
mov dword [esp + 0x10], eax
xor eax, eax
mov al, byte [esi]
lea ecx, [eax + eax*2]
mov ax, word [ecx*4 + 0x51a0b8]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov ax, word [eax + esi + 0x10]
push eax
call sub.WSOCK32.dll_ntohs
push edi
mov dword [esp + 0x38], eax
call fcn.004cbc20
mov esi, eax
add esp, 4
mov ecx, esi
mov edx, dword [esi]
call dword [edx + 0x74]
test eax, eax
je 0x418306
cmp bx, 0x139d
jb 0x418306
push 0x134
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
mov dword [esp + 0x2c], 0
je 0x4182f1
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x28]
push edx
push ecx
push ebp
and ebx, 0xffff
push esi
push ebx
push 0
push 0
mov ecx, eax
call fcn.00451f30
jmp 0x4182f3
xor eax, eax
push 1
push 0
mov ecx, eax
mov dword [esp + 0x34], 0xffffffff
call fcn.0046af30
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x424c50
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4fad7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, dword [esp + 0x2c]
xor eax, eax
push edi
mov al, byte [esi]
lea eax, [eax + eax*2]
mov ax, word [eax*4 + 0x51a0b8]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov eax, dword [eax + esi]
push eax
call sub.WSOCK32.dll_ntohl
mov ebx, eax
xor eax, eax
mov al, byte [esi]
lea ecx, [eax + eax*2]
mov ax, word [ecx*4 + 0x51a0b8]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov ax, word [eax + esi + 4]
push eax
call sub.WSOCK32.dll_ntohs
mov ebp, eax
xor eax, eax
mov al, byte [esi]
lea edx, [eax + eax*2]
mov ax, word [edx*4 + 0x51a0b8]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov ax, word [eax + esi + 6]
push eax
call sub.WSOCK32.dll_ntohs
xor ecx, ecx
mov cl, byte [esi]
lea ecx, [ecx + ecx*2]
mov cx, word [ecx*4 + 0x51a0b8]
and cx, 0x8000
mov dx, cx
neg dx
sbb edx, edx
and eax, 0xffff
and edx, 2
add eax, 8
inc edx
mov edi, eax
mov ax, cx
and edx, 0xffff
neg ax
sbb eax, eax
lea edx, [edx + esi + 8]
and eax, 2
mov dword [esp + 0x18], edx
inc eax
and eax, 0xffff
add eax, edi
inc edi
mov al, byte [eax + esi]
mov byte [esp + 0x14], al
mov ax, cx
neg ax
sbb eax, eax
and eax, 2
inc eax
and eax, 0xffff
add eax, edi
inc edi
neg cx
mov dl, byte [eax + esi]
sbb ecx, ecx
mov byte [esp + 0x10], dl
and ecx, 2
inc ecx
and ecx, 0xffff
add ecx, edi
mov ecx, dword [ecx + esi]
push ecx
call sub.WSOCK32.dll_ntohl
mov dword [esp + 0x30], eax
xor eax, eax
mov al, byte [esi]
add edi, 4
lea eax, [eax + eax*2]
mov ax, word [eax*4 + 0x51a0b8]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
add eax, edi
mov ax, word [eax + esi]
push eax
call sub.WSOCK32.dll_ntohs
xor eax, eax
add edi, 2
mov al, byte [esi]
push 0xb0
lea ecx, [eax + eax*2]
mov ax, word [ecx*4 + 0x51a0b8]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
add eax, edi
add eax, esi
mov esi, eax
call fcn.004ed8ee
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov dword [esp + 0x28], 0
je 0x424e0f
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x10]
push esi
push edx
mov edx, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push ecx
push ebp
push ebx
mov ecx, eax
call fcn.00494580
jmp 0x424e11
xor eax, eax
push 1
push 0
mov ecx, eax
mov dword [esp + 0x30], 0xffffffff
call fcn.0046af30
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x42c320
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov ecx, dword [esp + 0xc]
push 0
mov edx, dword [esi + 4]
push eax
push ecx
push edx
mov bl, 1
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
jne 0x42c35b
call sub.WSOCK32.dll_WSAGetLastError
push eax
mov dword [esi + 0x41c], eax
call fcn.0042c520
add esp, 4
xor al, al
pop esi
pop ebx
ret 8
mov al, bl
pop esi
pop ebx
ret 8

Function at 0x42c370
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov esi, ecx
push 0
push 0x400
mov ecx, dword [esi + 4]
lea eax, [esi + 0x18]
push eax
push ecx
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x42c3a9
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
mov dword [esi + 0x41c], eax
je 0x42c3a7
push eax
call fcn.0042c520
add esp, 4
xor eax, eax
pop esi
ret

Function at 0x42c3b0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
sub esp, 8
push esi
mov esi, ecx
push 0
push 1
push 2
mov dword [esi], 0x501950
mov dword [esi + 4], 0xffffffff
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x42c3ea
call sub.WSOCK32.dll_WSAGetLastError
push eax
mov dword [esi + 0x41c], eax
call fcn.0042c520
add esp, 4
mov eax, dword [esp + 0x10]
push eax
call sub.WSOCK32.dll_htonl
mov ecx, dword [esp + 0x14]
mov dword [esi + 0xc], eax
push ecx
call sub.WSOCK32.dll_htons
lea edx, [esp + 4]
push 4
mov word [esi + 0xa], ax
mov eax, dword [esi + 4]
push edx
push 4
push 0xffff
push eax
mov dword [esp + 0x18], 1
call sub.WSOCK32.dll_setsockopt
mov edx, dword [esi + 4]
lea ecx, [esp + 8]
push ecx
push 0x8004667e
push edx
mov word [esi + 8], 2
mov dword [esp + 0x14], 1
call sub.WSOCK32.dll_ioctlsocket
mov dword [esi], 0x501954
mov eax, esi
pop esi
add esp, 8
ret 8

Function at 0x42c4a0
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov esi, ecx
push 0x10
mov bl, 1
mov ecx, dword [esi + 4]
lea eax, [esi + 8]
push eax
push ecx
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x42c519
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2734
mov dword [esi + 0x41c], eax
je 0x42c4fa
cmp eax, 0x2733
je 0x42c4fa
cmp eax, 0x2748
je 0x42c4fa
cmp eax, 0x2726
je 0x42c4fa
push eax
call fcn.0042c520
mov edx, dword [esi + 4]
add esp, 4
push edx
call sub.WSOCK32.dll_closesocket
mov dword [esi + 4], 0xffffffff
mov esi, dword [esi + 0x41c]
xor al, al
cmp esi, 0x2748
jne 0x42c50c
mov al, 1
cmp esi, 0x2726
jne 0x42c51b
pop esi
mov al, 1
pop ebx
ret
mov al, bl
pop esi
pop ebx
ret
Function at 0x42c930
Capabilities:
Get hostname
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x4fb01a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x104
push esi
mov esi, ecx
push edi
push str.CSocket::CSocket___begin._n
mov dword [esp + 0xc], esi
mov dword [esi], 0x501958
call fcn.004de1f0
add esp, 4
mov dword [esi + 4], 0xffffffff
push 0x413ce0
push 0x413c60
push 2
lea eax, [esi + 8]
xor edi, edi
push 0x38
push eax
mov dword [esp + 0x128], edi
call fcn.004ee90e
push 0x42b530
push 0x42b0f0
push 2
lea ecx, [esi + 0x78]
push 0x1c
push ecx
mov byte [esp + 0x128], 1
call fcn.004ee90e
push fcn.00402d20
push 0x42b800
push 2
lea edx, [esi + 0xb0]
push 0xc
push edx
mov byte [esp + 0x128], 2
call fcn.004ee90e
mov dword [esi], 0x50195c
push str.GroupedPackets::GroupedPackets__:_begin._n
mov dword [esp + 0x118], 3
call fcn.004de1f0
add esp, 4
mov dword [esi + 0x30118], edi
mov dword [esi + 0x30114], edi
mov dword [esi + 0x3011c], edi
lea ecx, [esi + 0x30120]
mov byte [esp + 0x114], 4
call fcn.004d94a0
push str.CClientSock::CClientSock__:_begin._n
mov byte [esp + 0x118], 5
mov dword [esi], 0x501960
call fcn.004de1f0
add esp, 4
lea eax, [esp + 0xc]
mov dword [esi + 0xc8], edi
mov dword [esi + 0xd4], edi
push pe_nt_image_headers32
push eax
mov dword [esi + 0x100dc], edi
mov dword [esi + 0x100e0], edi
mov dword [esi + 0x3010c], edi
mov dword [esi + 0x30108], edi
mov dword [esi + 0x300e8], edi
mov dword [esi + 0x300e4], edi
mov dword [esi + 0x30100], edi
call sub.WSOCK32.dll_gethostname
lea ecx, [esp + 0xc]
push ecx
call sub.WSOCK32.dll_gethostbyname
cmp eax, edi
je 0x42ca8e
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
call sub.WSOCK32.dll_ntohl
jmp 0x42ca90
xor eax, eax
mov dword [esi + 0x30104], eax
call fcn.0042d840
mov ecx, dword [esp + 0x10c]
xor edx, edx
mov dword [esi + 0xd0], edi
mov dword [esi + 0x300ec], edx
mov dword [esi + 0x300f0], edx
mov eax, esi
mov dword [esi + 0x300f4], edx
pop edi
mov dword [esi + 0x300f8], edx
pop esi
mov dword fs:[0], ecx
add esp, 0x110
ret
Function at 0x42cbe0
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
push ebx
mov ecx, dword [0xcf38a8]
push esi
test ecx, ecx
push edi
je 0x42cccb
mov edi, dword [eax + 0x300e8]
mov edx, dword [esp + 0x14]
lea ecx, [edi + edx]
cmp ecx, 0x10000
jg 0x42cccb
mov ecx, dword [eax + 0x300fc]
test ecx, ecx
je 0x42ccaa
mov ecx, dword [eax + 0xd4]
test ecx, ecx
mov ecx, edx
jne 0x42ccac
dec edx
test ecx, ecx
je 0x42cccb
mov ebx, dword [esp + 0x10]
push ebp
lea ebp, [edx + 1]
mov dl, byte [eax + 0x300ec]
mov cl, byte [ebx]
xor dl, cl
mov ecx, dword [eax + 0x300e8]
mov byte [ecx + eax + 0x200e4], dl
mov edi, dword [eax + 0x300e8]
mov edx, dword [eax + 0x300ec]
mov ecx, dword [eax + 0x300f0]
inc edi
mov esi, ecx
mov dword [eax + 0x300e8], edi
mov edi, edx
shl edi, 0x1f
shr ecx, 1
or ecx, edi
inc ebx
xor ecx, 0x2de3addc
shl esi, 0x1f
shr ecx, 1
shr edx, 1
or ecx, edi
or edx, esi
xor ecx, 0x2de3addd
xor edx, 0xa3e5227f
dec ebp
mov dword [eax + 0x300f0], ecx
mov dword [eax + 0x300ec], edx
jne 0x42cc3b
pop ebp
pop edi
pop esi
pop ebx
ret 8
mov ecx, edx
mov esi, dword [esp + 0x10]
mov ebx, ecx
lea edi, [edi + eax + 0x200e4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add dword [eax + 0x300e8], edx
pop edi
pop esi
pop ebx
ret 8