joyce8/EMBER2024-capa huggingface dataset:
Function at 0x631b57be
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], 0xa
call fcn.631f9faf
mov dword [esp + 4], 0x633c8f37
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcr100.dll_fopen
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x631b57fd
mov dword [esp], 0xa
call fcn.631fa002
jmp 0x631b5964
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcr100.dll_fseek
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcr100.dll_ftell
mov dword [ebp - 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcr100.dll_fseek
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcr100.dll_malloc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcr100.dll_fread
mov edx, eax
mov eax, dword [ebp - 0x10]
cmp edx, eax
je 0x631b588d
mov dword [esp + 4], str.Short_read_in_FS_Copyfiles___n
mov dword [esp], 0
call fcn.63181eb4
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcr100.dll_fclose
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.631b5a98
test eax, eax
je 0x631b58c3
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcr100.dll_free
mov dword [esp], 0xa
call fcn.631fa002
jmp 0x631b5964
mov dword [esp + 4], 0x633c8f34
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcr100.dll_fopen
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x631b58f8
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcr100.dll_free
mov dword [esp], 0xa
call fcn.631fa002
jmp 0x631b5964
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcr100.dll_fwrite
mov edx, eax
mov eax, dword [ebp - 0x10]
cmp edx, eax
je 0x631b5942
mov dword [esp], 0xa
call fcn.631fa002
mov dword [esp + 4], str.Short_write_in_FS_Copyfiles___n
mov dword [esp], 0
call fcn.63181eb4
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcr100.dll_fclose
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcr100.dll_free
mov dword [esp], 0xa
call fcn.631fa002
leave
ret
Function at 0x631b5d1a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 0x10], 0
jne 0x631b5d2d
mov eax, 0
jmp 0x631b5da2
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
jmp 0x631b5d99
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcr100.dll_fread
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x631b5d73
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0xc]
jmp 0x631b5da2
cmp dword [ebp - 0x18], 0xffffffff
jne 0x631b5d8d
mov dword [esp + 4], str.FS_ReadOSPath:__1_bytes_read
mov dword [esp], 0
call fcn.63181eb4
mov eax, dword [ebp - 0x18]
sub dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 0
jne 0x631b5d3b
mov eax, dword [ebp + 0xc]
leave
ret

Function at 0x631b7349
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
call fcn.631b6f56
test eax, eax
jne 0x631b736c
mov dword [esp + 4], str.Filesystem_call_made_without_initialization
mov dword [esp], 0
call fcn.63181eb4
cmp dword [ebp + 0x10], 0
jne 0x631b737c
mov eax, 0
jmp 0x631b7459
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.631b4a35
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0
jmp 0x631b7429
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcr100.dll_fwrite
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x631b73fc
cmp dword [ebp - 0x14], 0
jne 0x631b73e1
mov dword [ebp - 0x14], 1
jmp 0x631b73fc
mov dword [esp + 4], str.FS_Write:_0_bytes_written_n
mov dword [esp], 0xa
call fcn.631a9790
mov eax, 0
jmp 0x631b7459
cmp dword [ebp - 0x20], 0xffffffff
jne 0x631b741d
mov dword [esp + 4], str.FS_Write:__1_bytes_written_n
mov dword [esp], 0xa
call fcn.631a9790
mov eax, 0
jmp 0x631b7459
mov eax, dword [ebp - 0x20]
sub dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 0
jne 0x631b73a2
mov edx, dword [0x633a7a6c]
mov eax, dword [ebp + 0x10]
imul eax, eax, 0x11c
add eax, edx
mov eax, dword [eax + 8]
test eax, eax
je 0x631b7456
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.msvcr100.dll_fflush
mov eax, dword [ebp + 0xc]
leave
ret
Function at 0x631bce34
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], 0
jmp 0x631bce78
mov eax, dword [ebp - 4]
shr eax, 8
mov ecx, eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, edx
movzx eax, byte [eax]
movzx edx, al
mov eax, dword [ebp - 4]
movzx eax, al
xor eax, edx
mov eax, dword [eax*4 + 0x633a7da0]
xor eax, ecx
mov dword [ebp - 4], eax
add dword [ebp - 8], 1
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jl 0x631bce4a
mov eax, dword [ebp - 4]
not eax
leave
ret

Function at 0x631bd905
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
lea eax, [ebp - 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x18]
mov dword [esp], eax
call fcn.631bd37d
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x631bd949
mov eax, 0
jmp 0x631bd9b5
mov dword [esp + 4], 0x633c9960
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.631bac33
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x631bd977
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcr100.dll_free
mov eax, 0
jmp 0x631bd9b5
mov eax, dword [ebp - 0x14]
mov edx, eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcr100.dll_fwrite
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcr100.dll_fclose
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcr100.dll_free
mov eax, 1
leave
ret
Function at 0x631e1289
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2028
call fcn.6337fa50
sub esp, eax
cmp dword [ebp + 8], 0
je 0x631e12a4
cmp dword [ebp + 0xc], 0
jne 0x631e12ae
mov eax, 0x633ce92a
jmp 0x631e13c7
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcr100.dll_strlen
cmp eax, 0x1fff
jbe 0x631e12de
mov dword [esp + 4], str.Error:_Info_ValueForKey:_oversize_infostring
mov dword [esp], 1
call fcn.631a9790
mov eax, 0x633ce92a
jmp 0x631e13c7
mov eax, dword [0x67574660]
xor eax, 1
mov dword [0x67574660], eax
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x5c
jne 0x631e12f9
add dword [ebp + 8], 1
lea eax, [ebp - 0x200c]
mov dword [ebp - 0xc], eax
jmp 0x631e132f
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
test al, al
jne 0x631e1318
mov eax, 0x633ce92a
jmp 0x631e13c7
mov edx, dword [ebp + 8]
lea eax, [edx + 1]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0xc]
lea ecx, [eax + 1]
mov dword [ebp - 0xc], ecx
movzx edx, byte [edx]
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x5c
jne 0x631e1304
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
add dword [ebp + 8], 1
mov eax, dword [0x67574660]
shl eax, 0xd
add eax, 0x67574680
mov dword [ebp - 0xc], eax
jmp 0x631e136c
mov edx, dword [ebp + 8]
lea eax, [edx + 1]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0xc]
lea ecx, [eax + 1]
mov dword [ebp - 0xc], ecx
movzx edx, byte [edx]
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x5c
je 0x631e1380
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
test al, al
jne 0x631e1355
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
lea eax, [ebp - 0x200c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.631e078c
test eax, eax
jne 0x631e13ae
mov eax, dword [0x67574660]
shl eax, 0xd
add eax, 0x67574680
jmp 0x631e13c7
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
test al, al
je 0x631e13c1
add dword [ebp + 8], 1
jmp 0x631e12f9
nop
mov eax, 0x633ce92a
leave
ret

Function at 0x631e3cb6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.631e390c
test eax, eax
jne 0x631e3cd2
mov eax, 0
jmp 0x631e3d4c
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 8]
test al, al
je 0x631e3ce2
call fcn.631ffc20
mov eax, dword [ebp + 8]
call fcn.63182148
test al, al
jne 0x631e3d19
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
je 0x631e3d12
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_DestroyWindow]
call eax
sub esp, 4
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov eax, 0
jmp 0x631e3d4c
mov eax, 0xcc9a400
mov dword [eax + 0x2c70], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 4], 5
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
call fcn.631fb707
mov eax, 1
leave
ret
Function at 0x631e3e5b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, 0x1024
call fcn.6337fa50
sub esp, eax
mov byte [ebp - 0x1008], 0
call fcn.631e3395
mov dword [esp + 8], str._DirectX_returned_an_unrecoverable_error_code_during_initialization___n
mov dword [esp + 4], 0x1000
lea eax, [ebp - 0x1008]
mov dword [esp], eax
call fcn.631e0866
mov dword [esp + 8], str._Initialization_also_happens_while_playing_if_DirectX_loses_a_device__n
mov dword [esp + 4], 0x1000
lea eax, [ebp - 0x1008]
mov dword [esp], eax
call fcn.631e0866
mov dword [esp + 8], str._Consult_the_readme_for_how_to_continue_from_this_problem_____________n
mov dword [esp + 4], 0x1000
lea eax, [ebp - 0x1008]
mov dword [esp], eax
call fcn.631e0866
mov dword [esp + 8], 0x633cf0f7
mov dword [esp + 4], 0x1000
lea eax, [ebp - 0x1008]
mov dword [esp], eax
call fcn.631e0866
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x1000
lea eax, [ebp - 0x1008]
mov dword [esp], eax
call fcn.631e0866
mov dword [esp + 8], 0x633cf0f7
mov dword [esp + 4], 0x1000
lea eax, [ebp - 0x1008]
mov dword [esp], eax
call fcn.631e0866
mov dword [esp], 0xb
call fcn.631f9faf
mov dword [esp], str.WIN_DIRECTX_INIT_TITLE
call fcn.631821e4
mov ebx, eax
mov eax, dword [sym.imp.USER32.dll_GetActiveWindow]
call eax
mov edx, eax
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], ebx
lea eax, [ebp - 0x1008]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
mov dword [esp + 0x14], 3
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.DocsTechHelpTech_HelpInformationDirectX.htm
mov dword [esp + 4], 0x633cf140
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.dll_ShellExecuteA]
call eax
sub esp, 0x18
mov dword [esp], 0xffffffff
call sub.msvcr100.dll_exit
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp edx, eax
jne 0x631e4009
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
cmp edx, eax
jne 0x631e3ff7
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
sub edx, eax
mov eax, edx
jmp 0x631e4017
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
sub edx, eax
mov eax, edx
jmp 0x631e4017
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
sub edx, eax
mov eax, edx
leave
ret
Function at 0x631e5d00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov edx, dword [ebp + 0xc]
add edx, edx
add edx, 1
cmp eax, edx
jae 0x631e5d2b
mov dword [0x67600c2c], 0xd
mov eax, 0
jmp 0x631e5dd0
mov dword [ebp - 0x19], 0x33323130
mov dword [ebp - 0x15], 0x37363534
mov dword [ebp - 0x11], 0x62613938
mov dword [ebp - 0xd], 0x66656463
mov byte [ebp - 9], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
jmp 0x631e5db7
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
add eax, edx
movzx eax, byte [eax]
movsx eax, al
and eax, 0xf
mov edx, dword [ebp - 8]
lea ecx, [edx + 1]
mov edx, dword [ebp + 0x10]
add edx, ecx
movzx eax, byte [ebp + eax - 0x19]
mov byte [edx], al
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
add eax, edx
movzx eax, byte [eax]
sar al, 4
movsx eax, al
and eax, 0xf
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
add edx, ecx
movzx eax, byte [ebp + eax - 0x19]
mov byte [edx], al
mov eax, dword [ebp - 8]
lea edx, [eax + 2]
mov eax, dword [ebp + 0x10]
add eax, edx
mov byte [eax], 0
add dword [ebp - 4], 1
add dword [ebp - 8], 2
mov eax, dword [ebp - 4]
cmp dword [ebp + 0xc], eax
jbe 0x631e5dcb
mov eax, dword [ebp + 0x14]
mov edx, dword [eax]
mov eax, dword [ebp - 8]
cmp edx, eax
ja 0x631e5d5b
mov eax, 1
leave
ret

Function at 0x631e8a67
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov dword [esp + 4], 0x800
lea eax, [ebp - 0x810]
mov dword [esp], eax
call fcn.631e89d4
test eax, eax
jne 0x631e8a91
mov eax, 0
jmp 0x631e8aeb
mov dword [esp + 4], 0x633d01b2
lea eax, [ebp - 0x810]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcr100.dll__wfopen]
call eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x631e8ab9
mov eax, 0
jmp 0x631e8aeb
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcr100.dll_fwrite
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcr100.dll_fclose
mov eax, dword [ebp - 0x10]
leave
ret
Function at 0x631ea067
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0x10]
movzx eax, word [eax]
cmp ax, 0x17
jne 0x631ea082
mov dword [ebp - 0xc], 0x1c
jmp 0x631ea089
mov dword [ebp - 0xc], 0x10
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_getnameinfo]
call eax
sub esp, 0x1c
test eax, eax
je 0x631ea0d6
cmp dword [ebp + 0xc], 0
jle 0x631ea0d6
mov eax, dword [ebp + 8]
mov byte [eax], 0
nop
leave
ret
Function at 0x631eb02a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 8]
cmp al, 2
jne 0x631eb042
mov eax, 1
jmp 0x631eb222
movzx eax, byte [ebp + 8]
cmp al, 4
jne 0x631eb0ab
movzx eax, byte [ebp + 0xc]
cmp al, 0xa
jne 0x631eb05c
mov eax, 1
jmp 0x631eb222
movzx eax, byte [ebp + 0xc]
cmp al, 0xac
jne 0x631eb07f
movzx eax, byte [ebp + 0xd]
movzx eax, al
and eax, 0xf0
cmp eax, 0x10
jne 0x631eb07f
mov eax, 1
jmp 0x631eb222
movzx eax, byte [ebp + 0xc]
cmp al, 0xc0
jne 0x631eb099
movzx eax, byte [ebp + 0xd]
cmp al, 0xa8
jne 0x631eb099
mov eax, 1
jmp 0x631eb222
movzx eax, byte [ebp + 0xc]
cmp al, 0x7f
jne 0x631eb0f5
mov eax, 1
jmp 0x631eb222
movzx eax, byte [ebp + 8]
cmp al, 5
jne 0x631eb0f5
movzx eax, byte [ebp + 0xc]
cmp al, 0xfe
jne 0x631eb0d8
movzx eax, byte [ebp + 0xd]
movzx eax, al
and eax, 0xc0
cmp eax, 0x80
jne 0x631eb0d8
mov eax, 1
jmp 0x631eb222
movzx eax, byte [ebp + 0xc]
movzx eax, al
and eax, 0xfe
cmp eax, 0xfc
jne 0x631eb0f5
mov eax, 1
jmp 0x631eb222
mov dword [ebp - 4], 0
jmp 0x631eb20f
mov eax, dword [ebp - 4]
imul eax, eax, 0x118
add eax, 0x6757a3d0
mov edx, dword [eax]
movzx eax, byte [ebp + 8]
movzx eax, al
cmp edx, eax
jne 0x631eb20b
movzx eax, byte [ebp + 8]
cmp al, 4
jne 0x631eb16d
mov eax, dword [ebp - 4]
imul eax, eax, 0x118
add eax, 0x10
add eax, 0x6757a3c0
add eax, 8
add eax, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
imul eax, eax, 0x118
add eax, 0x90
add eax, 0x6757a3c0
add eax, 8
add eax, 4
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 4
jmp 0x631eb1b0
mov eax, dword [ebp - 4]
imul eax, eax, 0x118
add eax, 0x10
add eax, 0x6757a3c0
add eax, 8
add eax, 8
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
imul eax, eax, 0x118
add eax, 0x90
add eax, 0x6757a3c0
add eax, 8
add eax, 8
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0x10
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
jmp 0x631eb1f6
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
add eax, edx
movzx ecx, byte [eax]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
add eax, edx
movzx eax, byte [eax]
xor ecx, eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
add eax, edx
movzx eax, byte [eax]
and eax, ecx
test al, al
je 0x631eb1f2
mov dword [ebp - 0x10], 1
jmp 0x631eb1fe
add dword [ebp - 8], 1
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jl 0x631eb1c0
cmp dword [ebp - 0x10], 0
jne 0x631eb20b
mov eax, 1
jmp 0x631eb222
add dword [ebp - 4], 1
mov eax, dword [0x6757c6c0]
cmp dword [ebp - 4], eax
jl 0x631eb101
mov eax, 0
leave
ret
Function at 0x631ec435
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x178
mov dword [ebp - 0x130], 0
mov dword [0x6757c6c0], 0
mov dword [esp + 4], 0x100
lea eax, [ebp - 0x10c]
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_gethostname]
call eax
sub esp, 8
cmp eax, 0xffffffff
je 0x631ec60c
lea eax, [ebp - 0x10c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.Hostname:__s_n
mov dword [esp], 0x1e
call fcn.631a9790
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0
lea eax, [ebp - 0x12c]
mov dword [esp], eax
call sub.msvcr100.dll_memset
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 2
lea eax, [ebp - 0x130]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x12c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
lea eax, [ebp - 0x10c]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_getaddrinfo]
call eax
sub esp, 0x10
test eax, eax
jne 0x631ec5ed
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x140]
mov dword [esp], eax
call sub.msvcr100.dll_memset
mov dword [esp + 8], 0x1c
mov dword [esp + 4], 0
lea eax, [ebp - 0x15c]
mov dword [esp], eax
call sub.msvcr100.dll_memset
mov word [ebp - 0x140], 2
mov dword [ebp - 0x13c], 0xffffffff
mov word [ebp - 0x15c], 0x17
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0xff
lea eax, [ebp - 0x15c]
add eax, 8
mov dword [esp], eax
call sub.msvcr100.dll_memset
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0xc], eax
jmp 0x631ec5e2
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
cmp eax, 2
jne 0x631ec5ae
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
lea edx, [ebp - 0x140]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0x633d0cb4
call fcn.631ec2f7
jmp 0x631ec5d9
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
cmp eax, 0x17
jne 0x631ec5d9
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
lea edx, [ebp - 0x15c]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0x633d0cb4
call fcn.631ec2f7
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x631ec581
call fcn.631eb224
mov eax, dword [ebp - 0x130]
test eax, eax
je 0x631ec60d
mov eax, dword [ebp - 0x130]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_freeaddrinfo]
call eax
sub esp, 4
jmp 0x631ec60d
nop
leave
ret

Function at 0x631ecd78
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 4], 0x6757a1c0
mov dword [esp], 0x202
mov eax, dword [sym.imp.WSOCK32.DLL_WSAStartup]
call eax
sub esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x631ecdbd
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str.WARNING:_Winsock_initialization_failed__returned__d_n
mov dword [esp], 0x1e
call fcn.631a9790
jmp 0x631ecdfb
mov dword [0x6757a350], 1
mov dword [esp + 4], str.Winsock_Initialized_n
mov dword [esp], 0x1e
call fcn.631a9790
mov dword [esp], 1
call fcn.631ecc16
mov dword [esp + 4], fcn.631ece2e
mov dword [esp], str.net_restart
call fcn.631a116c
leave
ret
Function at 0x631ed262
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 8], 0
jg 0x631ed278
mov eax, 0xffffffff
jmp 0x631ed310
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_send]
call eax
sub esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x631ed30d
mov eax, dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
call eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x631ed2c3
cmp dword [ebp - 0x10], 0x2714
jne 0x631ed2ca
mov eax, 0xffff8fff
jmp 0x631ed310
cmp dword [ebp + 0x14], 0
je 0x631ed2ed
call fcn.631e9415
mov edx, eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebp + 0x14]
mov dword [esp], eax
call fcn.631e0550
cmp dword [ebp - 0x10], 0xffffcfc7
je 0x631ed2ff
cmp dword [ebp - 0x10], 0x2746
jne 0x631ed306
mov eax, 0xffff8ffe
jmp 0x631ed310
mov eax, 0xffffffff
jmp 0x631ed310
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x631ed312
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 8], 0
jg 0x631ed328
mov eax, 0xffffffff
jmp 0x631ed3c0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x631ed3bd
mov eax, dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
call eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x631ed373
cmp dword [ebp - 0x10], 0x2714
jne 0x631ed37a
mov eax, 0xffff9000
jmp 0x631ed3c0
cmp dword [ebp + 0x14], 0
je 0x631ed39d
call fcn.631e9415
mov edx, eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebp + 0x14]
mov dword [esp], eax
call fcn.631e0550
cmp dword [ebp - 0xc], 0x2746
je 0x631ed3af
cmp dword [ebp - 0xc], 0xffffcfc7
jne 0x631ed3b6
mov eax, 0xffff8ffe
jmp 0x631ed3c0
mov eax, 0xffff8ffd
jmp 0x631ed3c0
mov eax, dword [ebp - 0xc]
leave
ret