joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414430
Capabilities:
Create http request
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x554495
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x5ca1c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], edx
mov ebx, ecx
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x3c], eax
movups xmmword [ebp - 0x5c], xmm0
movups xmmword [ebp - 0x4c], xmm0
push 0
push 0
push 0
push 1
push str.tinyrcon_download_file
mov dword [ebp - 4], 0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov esi, eax
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x4144af
push eax
call edi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x40], eax
test esi, esi
je 0x4145b6
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
push 0
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x18], 0
push eax
push 0x414000
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x414534
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x3e8
push esi
call edi
cmp eax, 0x102
jne 0x41452e
push 0xffffffffffffffff
push esi
call edi
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp dword [ebp - 0x18], 0
je 0x4145af
lea eax, [ebp - 0x38]
push eax
push 0x2a
push str.3Failed_to_download_file_1_3from_5
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x34]
call fcn.00419720
add esp, 0xc
push 1
push ecx
mov byte [ebp - 4], 1
lea edx, [ebp - 0x34]
cmp dword [ebp - 0x20], 0xf
push 1
cmova edx, dword [ebp - 0x34]
push 1
push ecx
mov ecx, dword [0x5de260]
call fcn.004dbe00
mov ecx, dword [ebp - 0x20]
add esp, 0x14
cmp ecx, 0xf
jbe 0x4145a8
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41459e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4145f1
push ecx
push edx
call fcn.00524a57
add esp, 8
mov esi, dword [ebp - 0x5c]
xor bl, bl
jmp 0x4145b8
mov esi, dword [ebp - 0x5c]
mov bl, 1
jmp 0x4145b8
xor bl, bl
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x4145cc
push eax
call edi
mov esi, dword [ebp - 0x5c]
mov dword [ebp - 0x58], 0
test esi, esi
je 0x4145d3
push esi
call edi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0052450f
mov esp, ebp
pop ebp
ret
call fcn.0053ce3a
int3
Function at 0x415040
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x415072
jl 0x415065
test ecx, ecx
jne 0x415072
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x415132
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.00417490
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x4150de
jg 0x41509d
test esi, esi
je 0x4150de
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x4150b5
mov eax, dword [esp + 0x10]
jl 0x4150af
cmp eax, esi
jae 0x4150b5
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.005323e0
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x4150ff
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x41511b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x415084
jl 0x41511b
test ecx, ecx
jne 0x415084
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov esi, dword [ebp + 0x10]
sbb esi, edx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x415170
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x415170
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push dword [esp + 0x14]
call fcn.005323e0
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [esp + 0x18], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x4151d9
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x415196
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x4151c4
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.0053c464
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x4151d9
cmp edi, eax
ja 0x4151a2
test edi, edi
je 0x4151d9
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.0053c464
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x415a00
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a4
mov eax, dword [0x5ca1c0]
xor eax, esp
mov dword [esp + 0x1a0], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, 1
lock xadd dword [0x5dc08c], eax
inc eax
mov ebx, 0x5dc090
cmp eax, 1
jne 0x415a46
lea eax, [esp + 0x18]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [ebx], eax
cmp byte [ebp + 8], 0
je 0x415a56
xor esi, esi
lock xadd dword [ebx], esi
test esi, esi
jne 0x415a6f
mov ecx, dword [esp + 0x1ac]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0052450f
mov esp, ebp
pop ebp
ret 4
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x5dc05c]
cmp eax, dword [ecx + 4]
jle 0x415ab4
push 0x5dc05c
call fcn.0052459e
add esp, 4
cmp dword [0x5dc05c], 0xffffffff
jne 0x415ab4
push 0x56a9d0
call fcn.00524a42
add esp, 4
push 0x5dc05c
call fcn.0052454d
add esp, 4
mov edx, str.winsock
mov dword [esp + 0x10], esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0x5caca8
call fcn.0040ea50
int3

Function at 0x417d50
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x554770
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5ca1c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.00524602
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00522199
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.00417cf0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41a2b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x41a2e1
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x41a2d0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x42a4e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x5ca1c0]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push 0
push 0
push 1
push 0
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
mov dword [edi + 4], esi
test esi, esi
jne 0x42a587
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [edi]
mov ecx, edi
push 1
mov dword [esp + 0x14], eax
call dword [edx]
mov eax, dword fs:[0x2c]
mov ecx, dword [0x5dc05c]
mov edx, dword [eax]
cmp ecx, dword [edx + 4]
jle 0x42a56f
push 0x5dc05c
call fcn.0052459e
add esp, 4
cmp dword [0x5dc05c], 0xffffffff
jne 0x42a56f
push 0x56a9d0
call fcn.00524a42
add esp, 4
push 0x5dc05c
call fcn.0052454d
add esp, 4
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x5caca8
test eax, eax
jne 0x42a6e7
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebx + 8], eax
mov dword [edi + 8], eax
cmp dword [ebx + 8], 0
jne 0x42a611
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [edi]
mov ecx, edi
push 1
mov dword [esp + 0x14], eax
call dword [edx]
mov eax, dword fs:[0x2c]
mov ecx, dword [0x5dc05c]
mov edx, dword [eax]
cmp ecx, dword [edx + 4]
jle 0x42a5f9
push 0x5dc05c
call fcn.0052459e
add esp, 4
cmp dword [0x5dc05c], 0xffffffff
jne 0x42a5f9
push 0x56a9d0
call fcn.00524a42
add esp, 4
push 0x5dc05c
call fcn.0052454d
add esp, 4
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x5caca8
test eax, eax
jne 0x42a6f5
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push 0
push edi
push 0x42a720
push 0
push 0
call fcn.0053d0a9
add esp, 0x18
mov dword [ebx + 4], eax
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x42a6c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [edi]
mov ecx, edi
push 1
mov dword [esp + 0x14], eax
call dword [edx]
test esi, esi
je 0x42a65c
push esi
call ebx
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 8]
test eax, eax
je 0x42a66a
push eax
call ebx
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x5dc05c]
cmp eax, dword [ecx + 4]
jle 0x42a6af
push 0x5dc05c
call fcn.0052459e
add esp, 4
cmp dword [0x5dc05c], 0xffffffff
jne 0x42a6af
push 0x56a9d0
call fcn.00524a42
add esp, 4
push 0x5dc05c
call fcn.0052454d
add esp, 4
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0x5caca8
test eax, eax
jne 0x42a703
test esi, esi
je 0x42a6d3
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call ebx
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0052450f
mov esp, ebp
pop ebp
ret 8
mov edx, str.thread.entry_event
lea ecx, [esp + 0x10]
call fcn.0040ea50
mov edx, str.thread.exit_event
lea ecx, [esp + 0x10]
call fcn.0040ea50
mov edx, str.thread
lea ecx, [esp + 0x18]
call fcn.0040ea50
int3
Function at 0x42a870
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5551ee
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x18
mov eax, dword [0x5ca1c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [ebx + 8]
mov dword [ebp - 0x24], esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.asio::detail::win_iocp_io_context.0
mov dword [esi + 0x14], 0
lea edi, [esi + 0x18]
mov dword [esi + 0x1c], 0
mov dword [edi], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
call fcn.0042b4f0
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x38]
mov dword [esi + 0x34], 0
call fcn.0042a040
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0xffffffff
mov dword [esi + 0x60], 0
push 0xffffffffffffffff
push 0
push 0
push 0xffffffffffffffff
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [esi + 0x14], eax
test eax, eax
jne 0x42a9ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x5dc05c]
cmp eax, dword [ecx + 4]
jle 0x42a9b5
push 0x5dc05c
call fcn.0052459e
add esp, 4
cmp dword [0x5dc05c], 0xffffffff
jne 0x42a9b5
push 0x56a9d0
call fcn.00524a42
add esp, 4
push 0x5dc05c
call fcn.0052454d
add esp, 4
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 0x5caca8
test edi, edi
jne 0x42aa68
lea edi, [esi + 0x18]
cmp byte [ebx + 0x10], 0
je 0x42aa46
lock inc dword [edi]
push 0xc
call fcn.00524602
mov edi, eax
add esp, 4
mov dword [ebp - 0x20], edi
mov byte [ebp - 4], 7
xorps xmm0, xmm0
movq qword [edi], xmm0
mov dword [edi + 8], 0
push 0x10
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.00524602
mov dword [ebp - 0x18], eax
xorps xmm0, xmm0
push eax
mov ecx, edi
movups xmmword [eax], xmm0
mov dword [eax], vtable.asio::detail::win_thread::func_struct_asio::detail::win_iocp_io_context::thread_function_.0
mov dword [eax + 0xc], esi
call fcn.0042a4e0
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x42aa43
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc
push dword [ebp - 0x20]
call fcn.00524a57
add esp, 8
mov dword [esi + 0x60], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0052450f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
mov edx, str.iocp
lea ecx, [ebp - 0x1c]
call fcn.0040ea50
int3
Function at 0x42aa80
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x555220
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x5ca1c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
cmp dword [esi + 0x60], 0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], vtable.asio::detail::win_iocp_io_context.0
je 0x42ab40
call fcn.0042af20
mov ebx, dword [esi + 0x60]
push 0xffffffffffffffff
push 0
mov eax, dword [ebx + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [ebx + 8]
call edi
xor eax, eax
mov ecx, 0x5dc088
lock xadd dword [ecx], eax
mov ecx, dword [ebx + 4]
push 0
push ecx
test eax, eax
je 0x42ab0c
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x42ab22
push method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_56
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, dword [esi + 0x60]
test ebx, ebx
je 0x42ab39
push dword [ebx + 4]
call edi
push 0xc
push ebx
call fcn.00524a57
add esp, 8
mov dword [esi + 0x60], 0
lea ecx, [esi + 0x54]
call fcn.00415960
lea eax, [esi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [esi + 0x30]
test eax, eax
je 0x42ab5c
push eax
call edi
mov ebx, dword [esi + 0x2c]
test ebx, ebx
je 0x42ab73
push dword [ebx + 4]
call edi
push 0xc
push ebx
call fcn.00524a57
add esp, 8
mov eax, dword [esi + 0x14]
test eax, eax
je 0x42ab7d
push eax
call edi
test byte [ebp + 8], 1
mov dword [esi], vtable.asio::execution_context::service.0
je 0x42ab94
push 0x64
push esi
call fcn.00524a57
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052450f
mov esp, ebp
pop ebp
ret 4
Function at 0x42b7a0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5ca1c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x14], edx
push edi
mov edi, dword [ebp + 0xc]
cmp ebx, 0xffffffff
je 0x42b8a9
cmp byte [ebp + 8], 0
je 0x42b807
mov al, byte [edx]
test al, 8
je 0x42b807
or al, 8
mov dword [ebp - 0xc], 0x5cacb0
push 4
mov byte [edx], al
xor ecx, ecx
lea eax, [ebp - 8]
mov dword [ebp - 8], ecx
push eax
push 0x80
push 0xffff
push ebx
mov dword [ebp - 0x10], ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea ecx, [ebp - 0x10]
setne dl
call fcn.0042b730
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov esi, eax
mov ecx, edi
test esi, esi
setne dl
call fcn.0042b730
test esi, esi
je 0x42b896
push 0x2733
lea ecx, [ebp - 0x10]
call fcn.00433520
mov eax, dword [edi + 4]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0xc]
cmp ecx, dword [eax + 4]
jne 0x42b842
mov eax, dword [edi]
cmp eax, dword [ebp - 0x10]
je 0x42b864
push 0x4d5
lea ecx, [ebp - 0x10]
call fcn.00433520
mov eax, dword [edi + 4]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0xc]
cmp ecx, dword [eax + 4]
jne 0x42b896
mov eax, dword [edi]
cmp eax, dword [ebp - 0x10]
jne 0x42b896
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x8004667e
push ebx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [ebp - 0x14]
push ebx
and byte [eax], 0xfc
call dword [sym.imp.WS2_32.dll_closesocket]
mov esi, eax
mov ecx, edi
test esi, esi
setne dl
call fcn.0042b730
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052450f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052450f
mov esp, ebp
pop ebp
ret
Function at 0x42bef0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x5ca1c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
push 1
push 0
push 0
push dword [ebp + 8]
push edx
push ebx
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov edi, eax
mov ecx, esi
cmp edi, 0xffffffff
sete dl
call fcn.0042b730
cmp edi, 0xffffffff
jne 0x42bf40
or eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052450f
mov esp, ebp
pop ebp
ret
cmp ebx, 0x17
jne 0x42bf5d
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x1b
push 0x29
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052450f
mov esp, ebp
pop ebp
ret

Function at 0x42c240
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x5ca1c0]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push 0
push 0
lea eax, [esp + 0x17]
mov byte [esp + 0x17], 0
push 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
push eax
push 1
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 1
push eax
push dword [ecx + 4]
mov dword [esp + 0x2c], 0
call dword [sym.imp.WS2_32.dll_WSASend]
mov eax, dword fs:[0x2c]
mov esi, dword [eax]
mov eax, dword [0x5dc05c]
cmp eax, dword [esi + 4]
jle 0x42c2d2
push 0x5dc05c
call fcn.0052459e
add esp, 4
cmp dword [0x5dc05c], 0xffffffff
jne 0x42c2d2
push 0x56a9d0
call fcn.00524a42
add esp, 4
push 0x5dc05c
call fcn.0052454d
add esp, 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp + 8], 0x5caca8
cmp eax, 0x40
je 0x42c2ec
cmp eax, 0x4d2
jne 0x42c329
mov eax, dword [0x5dc05c]
cmp eax, dword [esi + 4]
jle 0x42c329
push 0x5dc05c
call fcn.0052459e
add esp, 4
cmp dword [0x5dc05c], 0xffffffff
jne 0x42c329
push 0x56a9d0
call fcn.00524a42
add esp, 4
push 0x5dc05c
call fcn.0052454d
add esp, 4
mov ecx, dword [esp + 0x1c]
pop esi
xor ecx, esp
call fcn.0052450f
mov esp, ebp
pop ebp
ret
Function at 0x432fd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, ecx
mov dword [ebp - 0x20], edi
cmp eax, ebx
jne 0x432ff1
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [eax + 0x1c], 0xf
lea edx, [eax + 8]
mov ecx, dword [edi + 4]
mov dword [ebp - 0x18], ecx
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x14], ecx
mov ecx, dword [eax + 4]
mov eax, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jbe 0x433011
mov edx, dword [edx]
xor ecx, ecx
push esi
mov esi, 0x811c9dc5
test eax, eax
je 0x433034
mov ebx, eax
nop
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x433020
mov ebx, dword [ebp + 0xc]
mov eax, dword [edi + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, esi
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov edx, eax
mov dword [ebp - 0x10], ecx
mov esi, dword [eax]
call fcn.00434ed0
dec dword [edi + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0xc]
je 0x433082
mov dword [ebp - 0x1c], esi
cmp esi, ebx
je 0x433091
mov edx, esi
mov esi, dword [esi]
call fcn.00434ed0
dec dword [edi + 8]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x1c], eax
jne 0x433064
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp dword [ebp - 0x10], eax
jne 0x4330b1
mov eax, dword [ebp - 0x18]
mov dword [ecx], eax
jmp 0x4330b4
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x10], eax
jne 0x43309e
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
mov dword [ecx + 4], eax
cmp esi, ebx
je 0x43309e
nop dword [eax + eax]
cmp dword [esi + 0x1c], 0xf
lea edx, [esi + 8]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x1c], esi
mov dword [ebp + 8], eax
jbe 0x4330d4
mov edx, dword [edx]
xor ecx, ecx
mov ebx, 0x811c9dc5
test eax, eax
je 0x4330f6
mov edi, dword [ebp + 8]
movzx eax, byte [edx + ecx]
inc ecx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp ecx, edi
jb 0x4330e2
mov edi, dword [ebp - 0x20]
mov eax, dword [edi + 0x18]
mov edx, esi
mov ecx, dword [ebp - 0x14]
and eax, ebx
mov ebx, dword [ecx + eax*8 + 4]
mov esi, dword [esi]
mov dword [ebp - 0x10], ebx
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
call fcn.00434ed0
dec dword [edi + 8]
cmp dword [ebp - 0x1c], ebx
je 0x43313a
nop dword [eax]
mov eax, dword [ebp + 0xc]
mov ebx, esi
cmp esi, eax
je 0x433163
mov edx, esi
mov esi, dword [esi]
call fcn.00434ed0
dec dword [edi + 8]
cmp ebx, dword [ebp - 0x10]
jne 0x433120
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], eax
cmp esi, ebx
jne 0x4330c0
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8