joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44bab6
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x18]
push ebx
push dword [eax]
lea ecx, [ebp - 0x14]
call fcn.0044a0ef
mov eax, dword [ebp - 0x14]
push ebx
push dword [ebx + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
mov dword [ebp - 8], eax
call fcn.0044a0ef
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xc]
call fcn.00459618
test al, al
jne 0x44bbf8
push esi
lea ecx, [ebp - 0xc]
call fcn.004476c6
add eax, 4
push eax
push dword [eax + 0x10]
lea ecx, [ebp - 0x2c]
call fcn.00448e3c
lea ecx, [ebp - 0xc]
call fcn.004476c6
add eax, 4
push eax
push dword [eax + 0xc]
lea ecx, [ebp - 0x1c]
call fcn.00448e3c
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
push eax
call fcn.00448012
add esp, 0xc
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], eax
call fcn.004476c6
add eax, 4
push eax
push dword [eax + 0x10]
lea ecx, [ebp - 0x34]
call fcn.00448e3c
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x24]
call fcn.00459618
test al, al
jne 0x44bbcf
lea ecx, [ebp - 0xc]
call fcn.004476c6
mov ecx, dword [eax + 0x14]
sub ecx, dword [eax + 0x10]
add eax, 4
sar ecx, 1
cmp ecx, 0xa
ja 0x44bb9a
cmp dword [ebp + 0x10], 0
jne 0x44bb9a
mov dword [ebp - 4], 1
jmp 0x44bbcf
lea ecx, [ebp - 0xc]
call fcn.004476c6
push dword [eax]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x44bbcf
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0xc]
call fcn.00448e6e
push ebx
push dword [ebx + 0x18]
lea ecx, [ebp - 0x14]
call fcn.0044a0ef
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xc]
call fcn.00459618
test al, al
je 0x44baff
pop esi
mov eax, dword [ebp - 4]
pop ebx
leave
ret 0xc
Function at 0x44e69b
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x84dfc0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov byte [ebp - 0x1c], 0
lea edi, [ebp - 0x1b]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov byte [ebp - 0xc], 0
lea edi, [ebp - 0xb]
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xc]
push 7
push eax
mov esi, ecx
call fcn.00471ed1
pop ecx
pop ecx
test eax, eax
jne 0x44e726
push 8
pop ecx
push str.cloudeconfig.ini
mov byte [ebp - 0x40], al
push 0x21
lea edi, [ebp - 0x3f]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x40]
push eax
push 0x80bb84
push str.devicekey
push str.Config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x40]
lea edi, [esi + 0x36c]
push eax
mov ecx, edi
call fcn.0041c280
cmp dword [esi + 0x380], 0
jne 0x44e766
push edi
call fcn.0047230b
pop ecx
jmp 0x44e766
movzx eax, byte [ebp - 7]
push eax
movzx eax, byte [ebp - 8]
push eax
movzx eax, byte [ebp - 9]
push eax
movzx eax, byte [ebp - 0xa]
push eax
movzx eax, byte [ebp - 0xb]
push eax
movzx eax, byte [ebp - 0xc]
push eax
push str._02x_02x_02x_02x_02x_02x
lea eax, [ebp - 0x1c]
push 0xd
push eax
call fcn.0048dede
add esp, 0x24
lea eax, [ebp - 0x1c]
push eax
lea ecx, [esi + 0x36c]
call fcn.0041c280
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0048d1f2
leave
ret
Function at 0x45220b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push esi
push edi
xor eax, eax
push eax
push eax
push 1
push eax
mov edi, ecx
call ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [esi + 4], eax
test eax, eax
jne 0x452261
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
call fcn.005be2b0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push str.thread.entry_event
push eax
call fcn.004520a2
pop ecx
pop ecx
xor eax, eax
push eax
push eax
push 1
push eax
call ebx
mov dword [edi + 8], eax
mov dword [esi + 8], eax
cmp dword [edi + 8], 0
jne 0x4522a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
mov dword [ebp - 0x10], ebx
call fcn.005be2b0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push str.thread.exit_event
push eax
call fcn.004520a2
pop ecx
pop ecx
lea eax, [ebp - 8]
push eax
xor ebx, ebx
push ebx
push esi
push 0x446f09
push dword [ebp + 0xc]
mov dword [ebp - 8], ebx
push ebx
call fcn.0048e0cb
add esp, 0x18
cmp eax, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 4], eax
jne 0x45230e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
cmp dword [ebp - 4], 0
je 0x4522e6
push dword [ebp - 4]
call ebx
mov edi, dword [edi + 8]
test edi, edi
je 0x4522f0
push edi
call ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
call fcn.005be2b0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push str.thread
push eax
call fcn.004520a2
pop ecx
pop ecx
cmp dword [ebp - 4], 0
je 0x452324
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 4]
call ebx
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x45243d
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
push 0xffffffffffffffff
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00452429
push 0
push dword [esi + 4]
test al, al
je 0x452480
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x452496
push method.boost::asio::execution_context::service.virtual_8
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
leave
ret
Function at 0x454c54
Capabilities:
List tcp connections and listeners

Disassembly:
push 0x88
mov eax, 0x75fe93
call fcn.0048d201
mov ecx, dword [ebp + 8]
call fcn.004528a9
xor esi, esi
push esi
push 5
push 2
push 1
lea eax, [ebp - 0x14]
push eax
push esi
mov dword [ebp - 0x14], esi
call sub.IPHLPAPI.DLL_GetExtendedTcpTable
lea ecx, [ebp - 0x48]
mov edi, eax
call fcn.004808a4
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x28], eax
cmp edi, 0x7a
jne 0x454dd3
push dword [ebp - 0x14]
call fcn.00481e79
pop ecx
push esi
push 5
push 2
mov ebx, eax
push 1
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.IPHLPAPI.DLL_GetExtendedTcpTable
mov dword [ebp - 0x10], esi
cmp dword [ebx], esi
jbe 0x454dcc
lea esi, [ebx + 0x18]
cmp dword [esi - 0x14], 2
jne 0x454dbb
mov eax, dword [ebp - 0x28]
cmp eax, dword [esi]
je 0x454dbb
movzx eax, word [esi - 0xc]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov edi, dword [esi]
mov ecx, dword [ebp + 8]
movzx eax, ax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x88]
push eax
mov dword [ebp - 0x24], edi
call fcn.0044bc54
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx + 0x18]
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.0044a0ef
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x20]
call fcn.00459618
test al, al
je 0x454da5
lea ecx, [ebp - 0x48]
call fcn.0044bcb8
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x48]
call fcn.00451484
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x64], edi
call fcn.0044fe93
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 1
call fcn.004504cf
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x94]
push eax
mov byte [ebp - 4], 2
call fcn.0045417e
lea ecx, [ebp - 0x7c]
call fcn.0044ce11
push dword [ebp - 0x7c]
call fcn.00481e6e
pop ecx
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0
call fcn.0044ce11
push dword [ebp - 0x60]
call fcn.00481e6e
pop ecx
jmp 0x454dbb
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
call fcn.004476c6
mov ecx, eax
add ecx, 4
call fcn.00451484
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add esi, 0x18
cmp eax, dword [ebx]
jb 0x454cca
push ebx
call fcn.00481e6e
pop ecx
lea ecx, [ebp - 0x48]
call fcn.0044ce11
push dword [ebp - 0x48]
call fcn.00481e6e
pop ecx
call fcn.0048d2d9
ret 4
Function at 0x461362
Capabilities:
Read .ini file

Disassembly:
push ebp
sub esp, 0x224
lea ebp, [esp - 4]
mov eax, dword [0x84dfc0]
xor eax, ebp
mov dword [ebp + 0x224], eax
push 0x20
mov eax, 0x76112d
call fcn.0048d201
mov esi, dword [ebp + 0x230]
xor ebx, ebx
push ebx
lea ecx, [ebp]
mov dword [ebp + 0x18], 7
call fcn.0044757b
or edi, 0xffffffff
mov dword [ebp - 4], ebx
cmp dword [esi + 0x14], ebx
jne 0x46141c
push 0x207
lea eax, [ebp + 0x1d]
push ebx
push eax
mov byte [ebp + 0x1c], bl
call fcn.0048d310
lea eax, [ebp + 0x1c]
push eax
call fcn.0046031d
add esp, 0x10
test al, al
je 0x461427
sub esp, 0x1c
lea eax, [ebp + 0x1c]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.0041c2b0
lea eax, [ebp - 0x2c]
push eax
call fcn.004611cc
add esp, 0x20
push edi
push ebx
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 1
call fcn.0044bcf3
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.00449c25
push str.yjs_config.ini
lea ecx, [ebp]
call fcn.00460ce5
push edi
push ebx
lea eax, [ebp]
push eax
mov ecx, esi
jmp 0x461422
push edi
push ebx
push esi
lea ecx, [ebp]
call fcn.0044bcf3
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x461433
lea eax, [ebp + 4]
push eax
push edi
push str.LogLevel
push 0x78a25c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, ebx
jge 0x461479
push ebx
push 1
lea ecx, [ebp]
call fcn.00449c25
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.0048d1f2
add ebp, 0x228
leave
ret
mov edi, eax
jmp 0x461449

Function at 0x4614c0
Capabilities:
Create directory
Get common file path

Disassembly:
push 0x228
mov eax, 0x76118d
call fcn.0048d26a
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
xor edi, edi
lea eax, [ebp - 0x216]
push edi
push eax
mov esi, ecx
call fcn.0048d310
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, 1
jl 0x46155f
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x234]
call fcn.0044d9a5
push 0xffffffffffffffff
push edi
add esi, 4
push eax
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.0044bcf3
or dword [ebp - 4], 0xffffffff
push edi
push 1
lea ecx, [ebp - 0x234]
call fcn.00449c25
push str.yjs_log
mov ecx, esi
call fcn.00460ce5
cmp dword [esi + 0x18], 8
jb 0x461554
mov esi, dword [esi + 4]
jmp 0x461557
add esi, 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call fcn.0048d2ed
ret
Function at 0x461eb2
Capabilities:
Delete file

Disassembly:
push ebp
sub esp, 0x54
lea ebp, [esp - 4]
mov eax, dword [0x84dfc0]
xor eax, ebp
mov dword [ebp + 0x54], eax
push 0x88
mov eax, 0x7613f8
call fcn.0048d201
mov edi, dword [ebp + 0x60]
mov esi, ecx
lea eax, [esi + 4]
push eax
lea ecx, [ebp + 4]
call fcn.0044cc3f
xor ebx, ebx
push 0x80be84
lea ecx, [ebp + 4]
mov dword [ebp - 4], ebx
call fcn.00460ce5
push 0xffffffffffffffff
push ebx
lea eax, [esi + 0x20]
push eax
lea ecx, [ebp + 4]
call fcn.0046080b
lea eax, [esi + 0x40]
push eax
mov dword [ebp], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp edi, ebx
je 0x461fec
lea eax, [ebp + 4]
push eax
mov ecx, esi
call fcn.00461d56
cmp eax, 0x1388000
jle 0x461f3f
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x461f38
lea eax, [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x31
lea eax, [ebp + 0x21]
push ebx
push eax
mov byte [ebp + 0x20], bl
call fcn.0048d310
lea eax, [ebp + 0x20]
push eax
call fcn.0046046f
mov eax, dword [ebp + 8]
add esp, 0x10
cmp dword [ebp + 0x1c], 8
jae 0x461f66
lea eax, [ebp + 8]
push 1
push 0x40
push 8
push eax
lea ecx, [ebp - 0x94]
call fcn.00461a15
mov byte [ebp - 4], 1
cmp dword [ebp - 0x44], ebx
je 0x461fca
push 0x78a2dc
push edi
mov eax, 0x78a2d8
push eax
push dword [esi + 0x3c]
push eax
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp - 0x94]
push eax
call fcn.00461aa9
pop ecx
pop ecx
push eax
call fcn.00461aa9
pop ecx
pop ecx
mov ecx, eax
call fcn.00461dd3
push eax
call fcn.00461aa9
pop ecx
pop ecx
push eax
call fcn.00461aa9
pop ecx
pop ecx
push eax
call fcn.00461aa9
pop ecx
pop ecx
lea ecx, [ebp - 0x94]
call fcn.00461808
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], bl
call fcn.004616fa
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebx
push 1
lea ecx, [ebp + 4]
call fcn.00449c25
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x54]
xor ecx, ebp
call fcn.0048d1f2
add ebp, 0x58
leave
ret 4
Function at 0x462016
Capabilities:
Delete file

Disassembly:
push ebp
sub esp, 0x74
lea ebp, [esp - 4]
mov eax, dword [0x84dfc0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push 0x88
mov eax, 0x76143b
call fcn.0048d201
mov edi, dword [ebp + 0x80]
mov esi, ecx
lea eax, [esi + 4]
push eax
lea ecx, [ebp + 0x24]
call fcn.0044cc3f
xor ebx, ebx
push 0x80be84
lea ecx, [ebp + 0x24]
mov dword [ebp - 4], ebx
call fcn.00460ce5
push 0xffffffffffffffff
push ebx
lea eax, [esi + 0x20]
push eax
lea ecx, [ebp + 0x24]
call fcn.0046080b
lea eax, [esi + 0x40]
push eax
mov dword [ebp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp edi, ebx
je 0x462180
lea eax, [ebp + 0x24]
push eax
mov ecx, esi
call fcn.00461d56
cmp eax, 0x1388000
jle 0x4620a6
cmp dword [ebp + 0x3c], 8
mov eax, dword [ebp + 0x28]
jae 0x46209f
lea eax, [ebp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x31
lea eax, [ebp + 0x41]
push ebx
push eax
mov byte [ebp + 0x40], bl
call fcn.0048d310
lea eax, [ebp + 0x40]
push eax
call fcn.0046046f
mov eax, dword [ebp + 0x28]
add esp, 0x10
cmp dword [ebp + 0x3c], 8
jae 0x4620cd
lea eax, [ebp + 0x28]
push 1
push 0x40
push 8
push eax
lea ecx, [ebp - 0x94]
call fcn.00461a15
mov byte [ebp - 4], 1
cmp dword [ebp - 0x44], ebx
je 0x46215e
push 0x78a2dc
sub esp, 0x1c
mov ecx, esp
mov dword [ebp + 0x1c], esp
push edi
call fcn.0044d9a5
lea eax, [ebp]
push eax
call fcn.0046129c
add esp, 0x20
push eax
mov eax, 0x78a2d8
push eax
push dword [esi + 0x3c]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp - 0x94]
push eax
call fcn.00461aa9
pop ecx
pop ecx
push eax
call fcn.00461aa9
pop ecx
pop ecx
mov ecx, eax
call fcn.00461dd3
push eax
call fcn.00461aa9
pop ecx
pop ecx
push eax
call fcn.00461bed
pop ecx
pop ecx
push eax
call fcn.00461aa9
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp]
mov byte [ebp - 4], 1
call fcn.0041c8f0
lea ecx, [ebp - 0x94]
call fcn.00461808
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], bl
call fcn.004616fa
push dword [ebp + 0x20]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebx
push 1
lea ecx, [ebp + 0x24]
call fcn.00449c25
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
call fcn.0048d1f2
add ebp, 0x78
leave
ret 4

Function at 0x4625f6
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
movzx eax, byte [ecx + 0x5c]
and eax, 0x800000ff
jns 0x462608
dec eax
or eax, 0xffffff00
inc eax
mov edx, dword [esp + 4]
xor ecx, ecx
cmp edx, ecx
je 0x462622
cmp dword [esp + 8], ecx
jbe 0x462622
xor byte [ecx + edx], al
inc ecx
cmp ecx, dword [esp + 8]
jb 0x462618
ret 8
Function at 0x4629c1
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x118
cmp eax, 0xffffffff
jne 0x4629e4
mov ecx, dword [ebp + 0x14]
push 0x2719
call fcn.00447afc
or eax, 0xffffffff
leave
ret
xor ecx, ecx
mov dword [ebp - 0x114], eax
mov al, byte [ebp + 0xc]
push ebx
inc ecx
push esi
and al, cl
push edi
mov dword [ebp - 0x118], ecx
mov byte [ebp - 1], al
je 0x462a0a
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
jmp 0x462a27
mov eax, dword [ebp + 0x10]
xor ebx, ebx
cmp eax, ebx
jl 0x462a2c
cdq
mov ecx, 0x3e8
idiv ecx
imul edx, edx, 0x3e8
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
lea edi, [ebp - 0xc]
jmp 0x462a2e
xor edi, edi
push ebx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov esi, dword [ebp + 0x14]
push esi
push edi
push ebx
lea eax, [ebp - 0x118]
push eax
mov eax, dword [ebp + 8]
push ebx
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
push eax
call fcn.00447b15
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
jne 0x462a8d
cmp byte [ebp - 1], bl
je 0x462a76
mov ebx, 0x2733
call fcn.005be2b0
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 0xc]
jmp 0x462a84
mov dword [ebp - 0x14], ebx
call fcn.005be2b0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esi], ecx
jmp 0x462a96
jle 0x462a99
call fcn.005be2b0
mov dword [esi], ebx
mov dword [esi + 4], eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x462db6
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
xor ebx, ebx
cmp byte [ebp + 0x18], bl
je 0x462dd5
push ebx
push ebx
jmp 0x462e3a
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp eax, 0xffffffff
jne 0x462de7
push ebx
push 0x2719
jmp 0x462e3a
mov ecx, dword [ebp + 0x14]
push edi
push ebx
push dword [ebp + 0x1c]
mov dword [ebp + 8], ecx
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp + 0x18]
push ecx
push dword [ebp + 0x10]
mov dword [ebp + 0x18], ebx
push dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_WSARecv]
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x462e1e
mov eax, 0x2746
jmp 0x462e2a
cmp eax, 0x4d2
jne 0x462e2a
mov eax, 0x274d
cmp edi, ebx
pop edi
je 0x462e47
cmp eax, 0x3e5
je 0x462e47
push dword [ebp + 0x18]
push eax
push dword [ebp + 0x1c]
mov ecx, dword [esi + 4]
call fcn.00462c67
jmp 0x462e52
push dword [ebp + 0x1c]
mov ecx, dword [esi + 4]
call fcn.00462c00
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x46d2eb
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0xffffffff
jne 0x46d306
mov ecx, dword [ebp + 0x14]
push 0x2719
call fcn.00447afc
xor al, al
leave
ret
cmp byte [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
jne 0x46d326
test byte [ebx], 1
je 0x46d326
mov ecx, dword [ebp + 0x14]
push 0x2726
call fcn.00447afc
xor al, al
jmp 0x46d37e
push esi
push edi
xor edi, edi
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov esi, dword [ebp + 0x14]
xor eax, eax
cmp byte [ebp + 0x10], al
push esi
setne al
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0x8004667e
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push eax
call fcn.00447b15
pop ecx
pop ecx
test eax, eax
jl 0x46d37a
call fcn.005be2b0
cmp byte [ebp + 0x10], 0
mov dword [esi], edi
mov dword [esi + 4], eax
je 0x46d373
or byte [ebx], 2
jmp 0x46d376
and byte [ebx], 0xfd
mov al, 1
jmp 0x46d37c
xor al, al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x46d381
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0xffffffff
jne 0x46d39c
mov ecx, dword [ebp + 0x14]
push 0x2719
call fcn.00447afc
or eax, 0xffffffff
pop ebp
ret
push ebx
push esi
push edi
xor edi, edi
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_connect]
mov esi, dword [ebp + 0x14]
push esi
push eax
call fcn.00447b15
mov ebx, eax
pop ecx
pop ecx
cmp ebx, edi
jne 0x46d3d3
call fcn.005be2b0
mov dword [esi], edi
mov dword [esi + 4], eax
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x46d6e2
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
cmp dword [ebp + 0xc], edi
jne 0x46d738
cmp dword [ebp + 0x10], edi
jne 0x46d738
cmp dword [ebp + 0x14], edi
jne 0x46d738
mov ecx, dword [ebp + 0x18]
cmp ecx, edi
je 0x46d756
mov eax, dword [ecx + 4]
cdq
mov esi, 0x3e8
idiv esi
mov ecx, dword [ecx]
imul ecx, ecx, 0x3e8
add eax, ecx
jne 0x46d71e
inc eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
call fcn.005be2b0
mov ecx, dword [ebp + 0x1c]
mov dword [ecx + 4], eax
mov dword [ecx], esi
xor eax, eax
jmp 0x46d789
mov ecx, dword [ebp + 0x18]
cmp ecx, edi
je 0x46d756
cmp dword [ecx], edi
jne 0x46d756
mov eax, dword [ecx + 4]
cmp eax, edi
jle 0x46d756
mov edx, 0x3e8
cmp eax, edx
jge 0x46d756
mov dword [ecx + 4], edx
mov esi, dword [ebp + 0x1c]
push ebx
push esi
push ecx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_select]
push eax
call fcn.00447b15
mov ebx, eax
cmp ebx, edi
pop ecx
pop ecx
jl 0x46d786
call fcn.005be2b0
mov dword [esi], edi
mov dword [esi + 4], eax
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x4704e6
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x5118]
mov eax, 0x5118
call fcn.00490990
push 0xffffffffffffffff
push 0x763033
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x84dfc0]
xor eax, ebp
mov dword [ebp + 0x5114], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x5120]
movzx eax, word [esi + 2]
mov ebx, ecx
xor ecx, ecx
cmp cx, ax
jne 0x47067a
push str._agent_server_Yjs_Register_Def_node_success__connect_Sec_node.
push 5
call fcn.004618b4
push eax
call fcn.004621aa
add esp, 0xc
lea ecx, [ebx + 0x118]
call fcn.004527d0
lea eax, [esi + 8]
mov dword [ebp - 0x10], eax
xor ecx, ecx
xor byte [ecx + eax], 8
inc ecx
cmp ecx, 8
jl 0x470562
push 0x5010
lea eax, [ebp]
push 0
push eax
call fcn.0048d310
and dword [ebp + 0xc], 0
add esp, 0xc
push 4
pop eax
mov word [ebp + 8], ax
xor eax, eax
inc eax
push 3
mov ecx, ebx
mov dword [ebp], 0x4b594a53
mov dword [ebp + 4], 0x48
mov word [ebp + 0xa], ax
call fcn.0046d17a
push 8
pop ecx
push 8
lea esi, [ebx + 0x4d]
lea edi, [ebp + 0x10]
rep movsd dword es:[edi], dword [esi]
pop ecx
push 8
push dword [ebp - 0x10]
mov dword [ebx + 0x57e4], eax
lea eax, [ebp + 0x5010]
lea esi, [ebx + 0x2c]
lea edi, [ebp + 0x30]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00478bf8
push 0x40
lea eax, [ebp + 0x10]
push eax
push eax
lea eax, [ebp + 0x5010]
push eax
call fcn.00478c72
mov eax, dword [ebp + 4]
add esp, 0x1c
add eax, 8
push eax
lea eax, [ebp]
push eax
mov ecx, ebx
call fcn.0046ee69
push 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x10], 3
call fcn.0044ae0c
lea esi, [ebx + 0x118]
push eax
mov ecx, esi
call fcn.00456680
mov eax, dword [0x860764]
movzx eax, byte [eax]
push eax
push ecx
push ecx
mov eax, esp
mov dword [ebp - 0x10], esp
push eax
mov ecx, ebx
mov edi, 0x470014
call fcn.0046e482
xor eax, eax
push eax
lea eax, [ebp - 0x20]
push edi
push eax
call fcn.00469201
add esp, 0x18
and dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.004642e0
mov ecx, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x470669
call fcn.0044832a
push 4
mov ecx, ebx
call fcn.0046d17a
mov dword [ebx + 0x57e4], eax
jmp 0x4706a3
xor ecx, ecx
inc ecx
cmp cx, ax
jne 0x4706a3
push 5
mov ecx, ebx
call fcn.0046d17a
lea ecx, [ebx + 0x118]
mov dword [ebx + 0x57e4], eax
call fcn.004527d0
mov ecx, ebx
call fcn.00470399
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x5114]
xor ecx, ebp
call fcn.0048d1f2
add ebp, 0x5118
leave
ret 4