joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481765
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x48179d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0047f807
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0047f7df
jmp 0x4817a9
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x482f60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x482fa2
call fcn.00489283
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x482fa2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x482f99
xor eax, eax
jmp 0x482faa
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00482fb0
pop edi
pop esi
pop ebx
ret 4

Function at 0x4897b3
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4897e1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4897ff
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00489719
jmp 0x4897ff
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4897ff
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00489719
test edi, edi
mov eax, edi
jne 0x4897e9
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401240
Capabilities:
Get geographical location

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
mov byte [esp + 6], 0
mov byte [esp + 7], 0
je 0x40135c
cmp byte [esi], 0
je 0x40135c
lea eax, [esp + 7]
push eax
lea ecx, [esp + 0xa]
push ecx
push str.country_c_c
push esi
call fcn.00422fc4
add esp, 0x10
cmp eax, 2
jne 0x401281
add esi, 0xa
cmp byte [esi], 0x20
jne 0x40128e
mov al, byte [esi + 1]
inc esi
cmp al, 0x20
je 0x401286
push ebx
mov ebx, esi
lea ecx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x401294
push ebp
sub ebx, ecx
push edi
lea edi, [ebx + 8]
push edi
call fcn.00422fb2
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x4012c5
push edi
push str.Hum..._could_not_malloc__u_bytes..._n
call fcn.0040ce60
add esp, 8
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret
mov ecx, ebx
mov edx, ecx
shr ecx, 2
mov word [ebp + 6], bx
mov byte [ebp], 0xe3
mov byte [ebp + 5], 0x38
lea edi, [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add ebx, 3
push 0x45b790
mov dword [ebp + 1], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x469a40]
mov esi, dword [eax*4 + 0x469a44]
mov cl, byte [esp + 0x12]
mov dl, byte [esp + 0x13]
mov dword [eax*4 + 0x469a44], ebp
add ebx, 5
mov dword [eax*4 + 0x469a84], ebx
mov byte [eax*2 + 0x469ac4], cl
mov byte [eax*2 + 0x469ac5], dl
inc eax
and eax, reloc.WS2_32.dll_ntohs
jns 0x401335
dec eax
or eax, 0xfffffff0
inc eax
push 0x45b790
mov dword [0x469a40], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x4012bf
push esi
call fcn.00422e9a
add esp, 4
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret
push str.Usage_:_m__countryxx__message_n
call fcn.0040ce60
add esp, 4
pop esi
pop ecx
ret
Function at 0x402090
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x40c
mov eax, dword [0x45a7c0]
mov dword [esp + 0x408], eax
mov eax, dword [esp + 0x414]
cmp byte [eax], 0
je 0x402125
push eax
lea eax, [esp + 4]
push eax
call fcn.0040fea0
mov edx, dword [esp + 0x418]
add esp, 8
push 0
push eax
lea ecx, [esp + 8]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x4020ec
or eax, 0xffffffff
mov ecx, dword [esp + 0x408]
call fcn.004233fe
add esp, 0x40c
ret
mov ecx, dword [0x462bb0]
mov edx, dword [0x462bb4]
add ecx, eax
mov eax, dword [0x462b54]
mov dword [0x462bb0], ecx
mov ecx, dword [0x462b50]
adc edx, 0
add ecx, 1
adc eax, 0
mov dword [0x462bb4], edx
mov dword [0x462b50], ecx
mov dword [0x462b54], eax
mov ecx, dword [esp + 0x408]
xor eax, eax
call fcn.004233fe
add esp, 0x40c
ret

Function at 0x402140
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
sub esp, 0x484
mov eax, dword [0x45a7c0]
mov dword [esp + 0x480], eax
mov eax, dword [esp + 0x494]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402160
push ebx
push ebp
sub eax, edx
push esi
mov esi, eax
lea eax, [esp + 0xc]
push edi
push eax
call fcn.004011e0
mov ebp, dword [esp + 0x4a4]
mov edx, dword [esp + 0x4a0]
push esi
lea ecx, [esp + 0x18]
push ecx
push ebp
push edx
lea eax, [esp + 0xa4]
push str.HTTP_1.1__d__s_r_nDate:__s_r_nServer:_eserver_17.1_r_nAccept_Ranges:_bytes_r_nContent_Type:_text_html_r_nContent_Length:__lu_r_n_r_n
push eax
call fcn.00422d02
mov edi, dword [esp + 0x4b4]
mov edx, dword [edi + 0xdc]
mov ebx, dword [sym.imp.WS2_32.dll_send]
add esp, 0x1c
push 0
push eax
lea ecx, [esp + 0x98]
push ecx
push edx
call ebx
test esi, esi
je 0x4021dd
mov eax, dword [esp + 0x4a4]
mov ecx, dword [edi + 0xdc]
push 0
push esi
push eax
push ecx
call ebx
mov ecx, dword [0x462de4]
mov eax, dword [0x466450]
inc ecx
test eax, eax
mov dword [0x462de4], ecx
je 0x40221b
mov edx, dword [edi + 0xd8]
push edx
lea eax, [esp + 0x14]
push eax
call fcn.0041fa90
mov ecx, dword [esp + 0x4a4]
push eax
push ebp
push ecx
push str.http_send_status__d__s___s_n
call fcn.0040ce60
add esp, 0x18
mov edx, dword [edi + 0xd8]
push edx
push str.HTTP
call fcn.00415d40
mov ecx, dword [esp + 0x498]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
call fcn.004233fe
add esp, 0x484
ret
Function at 0x402960
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov ebx, dword [ebp + 0xe8]
push esi
xor esi, esi
cmp ebx, esi
push edi
jne 0x402999
push 0x45a180
call fcn.0041f570
mov ebx, eax
add esp, 4
cmp ebx, esi
je 0x402a7d
mov dword [ebp + 0xe8], ebx
mov dword [ebx + 0xc], esi
mov dword [ebx + 8], esi
jmp 0x4029d5
mov edx, dword [ebx + 8]
cmp edx, esi
je 0x4029d5
mov eax, dword [ebx + 0xc]
cmp eax, 0x5f8
jbe 0x4029d5
sub eax, edx
js 0x402a7d
mov ecx, eax
lea esi, [edx + ebx + 0x10]
mov edx, ecx
shr ecx, 2
lea edi, [ebx + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], 0
xor esi, esi
mov eax, dword [ebx + 0xc]
push esi
mov ecx, 0xbf0
sub ecx, eax
push ecx
lea edx, [eax + ebx + 0x10]
mov eax, dword [ebp + 0xdc]
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, esi
jle 0x402a44
mov ecx, dword [ebp + 0xf8]
add dword [ebp + 0xf4], eax
inc ecx
mov dword [ebp + 0xf8], ecx
mov ecx, dword [0x462e18]
mov dword [ebp + 0xec], ecx
mov dword [ebp + 0xf0], esi
add dword [ebx + 0xc], eax
mov ecx, dword [0x462bb8]
cdq
add ecx, eax
mov eax, dword [0x462bbc]
pop edi
pop esi
adc eax, edx
pop ebp
mov dword [0x462bbc], eax
mov dword [0x462bb8], ecx
mov eax, 1
pop ebx
ret
je 0x402a76
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2733
jne 0x402a76
mov edx, dword [ebx + 0xc]
cmp edx, dword [ebx + 8]
jne 0x402a6f
push ebx
push 0x45a180
call fcn.0041f5e0
add esp, 8
mov dword [ebp + 0xe8], esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
or dword [ebp + 0x108], 0x20
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
Function at 0x402b20
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x204
mov eax, dword [0x45a7c0]
mov ecx, dword [0x4663e8]
mov edx, dword [0x4663ec]
push ebx
push ebp
mov ebp, dword [esp + 0x214]
mov dword [esp + 0x208], eax
mov eax, dword [0x4663e4]
push esi
push edi
mov edi, dword [ebp + 0x20]
mov dword [esp + 0x17], eax
mov eax, dword [0x4663f0]
shr edi, 3
mov dword [esp + 0x23], eax
mov eax, dword [0x466424]
and edi, 1
test eax, eax
mov ebx, 2
mov byte [esp + 0x10], 0xe3
mov byte [esp + 0x15], 1
mov byte [esp + 0x16], 0x10
mov dword [esp + 0x1b], ecx
mov dword [esp + 0x1f], edx
je 0x402b93
mov byte [esp + 0x1c], 0xe
mov byte [esp + 0x25], 0x6f
mov eax, dword [0x4663f4]
test eax, eax
je 0x402bce
mov esi, dword [0x4663e4]
mov edx, dword [0x4663e8]
mov ecx, dword [0x4663ec]
mov eax, dword [0x4663f0]
inc esi
inc edx
inc ecx
inc eax
mov dword [0x4663e4], esi
mov dword [0x4663e8], edx
mov dword [0x4663ec], ecx
mov dword [0x4663f0], eax
test byte [ebp + 0x1c], 2
mov ecx, dword [0x465dd4]
mov dword [esp + 0x27], ecx
mov word [esp + 0x2b], 0x1236
je 0x402bea
mov ebx, 4
mov edx, dword [0x46648c]
mov eax, edx
mov dword [esp + 0x2d], ebx
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402c00
push edi
sub eax, esi
push eax
push edx
lea edx, [esp + 0x3d]
push 1
push edx
call fcn.00419e00
mov esi, eax
push edi
push 0x3c
add esi, 0x21
lea eax, [esp + esi + 0x2c]
push 0x11
push eax
call fcn.00419ee0
add esi, eax
mov al, byte [ebp + 0x1c]
add esp, 0x24
test al, 2
je 0x402c68
push edi
push 0x6ef00
lea ecx, [esp + esi + 0x18]
push 0xfb
push ecx
call fcn.00419ee0
push edi
push 7
add esi, eax
push str.eserver
lea edx, [esp + esi + 0x2c]
push 0x55
push edx
call fcn.00419e00
add esp, 0x24
add esi, eax
test byte [ebp + 0x1c], 0x40
je 0x402c8a
mov eax, dword [ebp + 0x34]
push edi
push eax
lea ecx, [esp + esi + 0x18]
push 0x23
inc bl
push ecx
mov byte [esp + 0x3d], bl
call fcn.00419ee0
add esp, 0x10
add esi, eax
xor edx, edx
lea eax, [esp + esi + 0x10]
mov dword [eax], edx
push edx
mov word [eax + 4], dx
mov eax, dword [esp + 0x21c]
add esi, 6
push esi
lea edx, [esp + 0x18]
push edx
lea ecx, [esi - 5]
push eax
mov dword [esp + 0x21], ecx
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
cmp edi, esi
je 0x402cf4
mov eax, dword [0x466450]
test eax, eax
je 0x402cda
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push esi
push str.Could_not_send_the_Hello_to_the_client_backdoor__send_len__d____d_errno_d__n
call fcn.0040ce60
add esp, 0x10
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x200]
call fcn.004233fe
add esp, 0x204
ret
mov ecx, dword [0x462bb0]
mov eax, dword [0x462bb4]
add ecx, edi
adc eax, 0
pop edi
mov dword [0x462bb0], ecx
mov ecx, dword [esp + 0x20c]
mov dword [0x462bb4], eax
pop esi
mov byte [ebp + 0x39], 2
pop ebp
xor eax, eax
pop ebx
call fcn.004233fe
add esp, 0x204
ret
Function at 0x402d30
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0xc
mov eax, dword [0x45a7c0]
push ebx
xor ebx, ebx
push ebx
mov dword [esp + 0x10], eax
push 6
lea eax, [esp + 0xc]
push eax
push ecx
mov byte [esp + 0x14], 0xe3
mov byte [esp + 0x15], 1
mov byte [esp + 0x16], bl
mov byte [esp + 0x17], bl
mov byte [esp + 0x18], bl
mov byte [esp + 0x19], 5
call dword [sym.imp.WS2_32.dll_send]
mov eax, dword [0x462bb0]
mov edx, dword [0x462bb4]
mov ecx, dword [0x462b50]
add eax, 6
adc edx, ebx
add ecx, 1
mov dword [0x462bb0], eax
mov eax, dword [0x462b54]
adc eax, ebx
mov dword [0x462b50], ecx
mov ecx, dword [esp + 0xc]
mov dword [0x462bb4], edx
mov dword [0x462b54], eax
pop ebx
call fcn.004233fe
add esp, 0xc
ret
Function at 0x403b30
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esi + 0x148]
xor ebp, ebp
test edi, edi
je 0x403c21
jmp 0x403b50
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0xc]
mov ecx, dword [esi + 0xdc]
push 0
sub ebx, eax
push ebx
lea eax, [eax + edi + 0x10]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
xor ecx, ecx
cmp eax, ecx
jle 0x403c28
mov edx, dword [0x462bb0]
mov ebp, dword [0x462bb4]
add edx, eax
mov dword [0x462bb0], edx
adc ebp, ecx
mov dword [0x462bb4], ebp
add dword [esi + 0x154], eax
inc dword [esi + 0x158]
mov edx, dword [edi + 8]
add edx, eax
cmp eax, ebx
mov ebp, 1
mov dword [edi + 8], edx
jne 0x403c13
mov edx, dword [edi + 4]
mov eax, dword [esi + 0x14c]
mov dword [esi + 0x148], edx
mov edx, dword [esi + 0x150]
dec edx
cmp edi, eax
mov dword [esi + 0x150], edx
jne 0x403c03
mov eax, dword [esi + 0x160]
cmp eax, ecx
mov dword [esi + 0x14c], ecx
je 0x403c03
mov edx, dword [esi + 0x164]
mov dword [eax + 4], edx
mov eax, dword [esi + 0x164]
mov edx, dword [esi + 0x160]
mov dword [eax], edx
mov dword [esi + 0x160], ecx
dec dword [0x45b7b0]
push edi
push 0x45a180
call fcn.0041f5e0
add esp, 8
xor ecx, ecx
mov edi, dword [esi + 0x148]
cmp edi, ecx
jne 0x403b50
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x403c70
mov ecx, dword [esi + 0x160]
xor eax, eax
cmp ecx, eax
je 0x403c82
mov edx, dword [esi + 0x164]
mov dword [ecx + 4], edx
mov ecx, dword [esi + 0x164]
mov edx, dword [esi + 0x160]
mov dword [ecx], edx
pop edi
mov dword [esi + 0x160], eax
mov ecx, dword [0x45b7b0]
pop esi
dec ecx
pop ebp
mov dword [0x45b7b0], ecx
pop ebx
ret
mov ecx, dword [esi + 0x108]
or eax, 0xffffffff
or ecx, 0x20
mov dword [esi + 0x108], ecx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x408850
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov ebx, dword [ebp + 0x100]
push esi
xor esi, esi
cmp ebx, esi
jne 0x408888
push 0x45a180
call fcn.0041f570
mov ebx, eax
add esp, 4
cmp ebx, esi
je 0x40893b
mov dword [ebp + 0x100], ebx
mov dword [ebx + 0xc], esi
mov dword [ebx + 8], esi
jmp 0x4088c4
mov edx, dword [ebx + 8]
cmp edx, esi
je 0x4088c4
mov eax, dword [ebx + 0xc]
sub eax, edx
cmp edx, 0x5f8
ja 0x4088a1
cmp eax, 0xa
jge 0x4088c4
push edi
mov ecx, eax
lea esi, [edx + ebx + 0x10]
mov edx, ecx
shr ecx, 2
lea edi, [ebx + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], 0
pop edi
mov eax, dword [ebx + 0xc]
push 0
mov ecx, 0xbf0
sub ecx, eax
push ecx
lea edx, [eax + ebx + 0x10]
mov eax, dword [ebp + 0xe0]
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x4088fe
mov ecx, dword [0x465d84]
push ecx
push ebp
call fcn.00408390
add esp, 8
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
jge 0x408942
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2746
jne 0x408935
movzx edx, word [ebp + 0x90]
mov eax, dword [0x465d9c]
push edx
push eax
lea esi, [ebx + 0x10]
push esi
call fcn.00422d02
push esi
push ebp
call fcn.00408390
add esp, 0x14
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
inc dword [0x462df4]
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
add dword [ebx + 0xc], eax
mov ecx, dword [0x462bb8]
cdq
add ecx, eax
mov eax, dword [0x462bbc]
pop esi
adc eax, edx
pop ebp
mov dword [0x462bbc], eax
mov dword [0x462bb8], ecx
xor eax, eax
pop ebx
ret
Function at 0x408d40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x84
mov eax, dword [0x45a7c0]
push ebx
mov ebx, dword [esp + 0x8c]
mov dword [esp + 0x84], eax
push esi
jmp 0x408d60
test bl, 1
je 0x408dc3
mov eax, 1
xor esi, esi
cmp ebx, eax
mov ecx, ebx
jb 0x408d7c
sub ecx, eax
add eax, 2
inc esi
cmp ecx, eax
jae 0x408d72
mov ecx, 3
cmp esi, ecx
jbe 0x408d96
xor edx, edx
mov eax, ebx
div ecx
test edx, edx
je 0x408dc3
add ecx, 2
cmp ecx, esi
jb 0x408d85
push 4
push ebx
call fcn.0042351e
mov esi, eax
add esp, 8
test esi, esi
mov dword [esp + 0xc], esi
jne 0x408dc6
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x80]
call fcn.004233fe
add esp, 0x84
ret
inc ebx
jmp 0x408d60
push 0x4669e0
call fcn.0040f3b0
mov eax, dword [0x4669ec]
add esp, 4
test eax, eax
je 0x408eb4
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ecx, dword [0x4669f0]
xor eax, eax
test ecx, ecx
mov dword [esp + 8], eax
jbe 0x408e51
push ebp
push edi
lea ecx, [ecx]
mov ecx, dword [0x4669ec]
mov esi, dword [ecx + eax*4]
test esi, esi
je 0x408e3c
lea ecx, [ecx]
mov ecx, esi
mov edx, dword [ecx + 8]
mov eax, dword [ecx + 0xc]
xor eax, edx
xor edx, edx
div ebx
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + edx*4]
lea edi, [esi + 0x18]
mov ebp, esi
mov esi, dword [edi]
test esi, esi
mov dword [edi], ecx
mov dword [eax + edx*4], ebp
lea eax, [eax + edx*4]
jne 0x408e10
mov eax, dword [esp + 0x10]
mov ecx, dword [0x4669f0]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jb 0x408e00
mov esi, dword [esp + 0x14]
pop edi
pop ebp
mov edx, dword [0x4669ec]
push edx
call fcn.00422e9a
add esp, 4
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
push eax
call fcn.0040f260
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x58]
push edx
call fcn.0040f1f0
add esp, 0x14
push eax
mov eax, dword [0x4669f0]
push ebx
push eax
lea ecx, [esp + 0x34]
push ecx
call fcn.0040f280
add esp, 4
push eax
push str._s_File_Hash:_resizing_from__u_to__u_slots_done_in__s_s_n
call fcn.0040ce60
add esp, 0x14
mov dword [0x4669ec], esi
mov dword [0x4669f0], ebx
call fcn.00412a50
push 0x4669e0
call fcn.0040f3e0
mov ecx, dword [esp + 0x8c]
add esp, 4
pop esi
xor eax, eax
pop ebx
call fcn.004233fe
add esp, 0x84
ret

Function at 0x409b50
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, str._Kry_
mov ecx, 0x4bc
mov ebp, esi
mov dl, 0x3e
jmp 0x409b70
imul ecx, ecx, 0x41c64e6d
add ecx, 0x3039
imul ecx, ecx, 0x41c64e6d
add ecx, 0x3039
imul ecx, ecx, 0x41c64e6d
add ecx, 0x3039
movzx edx, dl
mov eax, ecx
shr eax, 0x10
xor al, dl
inc edi
mov byte [esi], al
mov dl, byte [edi]
inc esi
test dl, dl
jne 0x409b70
pop edi
mov byte [esi], dl
pop esi
mov eax, ebp
pop ebp
ret
Function at 0x412a50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x4004
call fcn.00423410
push ebx
push esi
push edi
mov ecx, 0x1000
mov esi, 0x45e200
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x1000
xor eax, eax
mov edi, 0x45e200
rep stosd dword es:[edi], eax
lea esi, [esp + 0x10]
mov edi, 0x1000
lea ebx, [ebx]
mov ecx, dword [esi]
test ecx, ecx
je 0x412acb
mov ebx, ecx
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx]
mov ebx, eax
mov eax, dword [ecx + 4]
xor eax, edx
xor edx, edx
div dword [0x4669f0]
and edx, 0xfff
mov eax, dword [edx*4 + 0x45e200]
mov dword [ecx + 0x10], eax
mov dword [edx*4 + 0x45e200], ecx
mov ecx, ebx
test ecx, ecx
jne 0x412a98
mov dword [esi], ebx
add esi, 4
dec edi
jne 0x412a90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415d20
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push 0x8004667e
push ecx
mov dword [esp + 0xc], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
pop ecx
ret
Function at 0x41d450
Capabilities:
Encode data using xor

Disassembly:
push 0x45a4e8
push str.ipfilter.srv
call fcn.00414dc0
push 0x46637c
push str.ipfilter.clnt
call fcn.00414dc0
push 0x4663a4
push str.ipfilter.slimit
call fcn.00414dc0
push 0x4663b8
push str.ipfilter.lowid
call fcn.00414dc0
push 0x4663cc
push str.ipfilter.opeers
call fcn.00414dc0
push str.ipfilter.dat
call fcn.00415460
push str.ip_to_country.csv
call fcn.00415870
push str.fakes.txt
call fcn.0040eeb0
push str.incompletes.txt
call fcn.00412560
add esp, 0x38
mov dword [esp + 4], str.known.txt
jmp fcn.00412ae0
Function at 0x421880
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov dword [esp + 0x10], 0
jmp 0x4218a0
mov eax, dword [esp + 0x18]
mov ecx, dword [0x462e08]
push 0x10
push ebp
push 0
push ebx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_sendto]
mov edi, dword [esp + 0x24]
mov esi, eax
test esi, esi
jge 0x4218ff
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
jne 0x4218dd
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0xa
mov dword [esp + 0x10], eax
jl 0x4218a0
mov ecx, dword [edi*8 + 0x462a38]
mov eax, dword [edi*8 + 0x462a3c]
add ecx, 1
adc eax, 0
mov dword [edi*8 + 0x462a38], ecx
mov dword [edi*8 + 0x462a3c], eax
mov eax, dword [edi*8 + 0x4628b8]
mov ebp, dword [edi*8 + 0x4628bc]
add eax, 1
mov dword [edi*8 + 0x4628b8], eax
lea ecx, [edi*8 + 0x462978]
adc ebp, 0
mov dword [edi*8 + 0x4628bc], ebp
mov edi, dword [ecx]
lea eax, [ebx + 0x1c]
cdq
add edi, eax
mov eax, dword [ecx + 4]
adc eax, edx
mov dword [ecx], edi
pop edi
mov dword [ecx + 4], eax
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x421b90
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x14
mov eax, dword [0x45a7c0]
push 0x8000001e
push 0x45ba80
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x11
push 2
push 2
mov dword [0x45ba98], eax
mov dword [0x45ba9c], 0
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [0x462e08], eax
jne 0x421c03
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Could_not_get_a_SOCK_DGRAM_socket._error___d_n
call fcn.0040ce60
add esp, 8
or eax, 0xffffffff
mov ecx, dword [esp + 0x10]
call fcn.004233fe
add esp, 0x14
ret
mov ecx, dword [0x465e04]
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
add ecx, 4
mov dword [esp + 8], eax
push ecx
mov dword [esp + 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [0x462e08]
mov edx, dword [0x465e10]
mov word [esp + 2], ax
push 0x10
lea eax, [esp + 4]
push eax
push ecx
mov word [esp + 0xc], 2
mov dword [esp + 0x10], edx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x421c81
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [0x465e04]
push eax
add edx, 4
push edx
push str.Could_not_bind_UDP_socket_to_port__d._error___d_n
call fcn.0040ce60
add esp, 0xc
or eax, 0xffffffff
mov ecx, dword [esp + 0x10]
call fcn.004233fe
add esp, 0x14
ret
mov ecx, dword [esp + 0x10]
xor eax, eax
call fcn.004233fe
add esp, 0x14
ret