joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405680
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
cmp dword [edi], 0
jne 0x405697
mov dword [edi], esi
cmp dword [edi + 4], 0
jne 0x4056a4
mov dword [edi + 4], 0x400
mov eax, dword [edi + 8]
or eax, dword [edi + 0xc]
jne 0x4056c3
mov eax, dword [0x451a10]
inc eax
mov dword [0x451a10], eax
mov eax, dword [0x451a10]
cdq
mov dword [edi + 8], eax
mov dword [edi + 0xc], edx
lea eax, [esi + 0xe0]
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0xcc], 0xffffffff
jne 0x4056ec
mov ecx, esi
call fcn.00405610
test eax, eax
jne 0x405890
push 0
push 1
push 0x44ba00
push dword [esi + 0xcc]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x405730
push str.hloop_post_event
push str._s:_hloop_post_event_failed__n
push 4
call fcn.00408d20
push eax
call fcn.004088a0
add esp, 0x10
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0xd8], 0
jne 0x40578b
mov dword [esi + 0xdc], 0
mov dword [esi + 0xd4], 0
mov dword [esi + 0xd8], 0x10
lock inc dword [0x451a14]
push 0x280
call fcn.0042dfd2
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4058a1
push 0x280
push 0
push ebx
call fcn.00429000
add esp, 0xc
mov dword [esi + 0xd0], ebx
mov ebx, dword [esi + 0xd4]
mov ecx, dword [esi + 0xd8]
cmp ebx, ecx
jne 0x405828
lea edx, [ecx + ecx]
mov eax, 0x10
test edx, edx
cmove edx, eax
lea eax, [ecx + ecx*4]
shl eax, 3
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0xd0]
lea ebx, [edx + edx*4]
mov dword [esp + 0x18], edx
shl ebx, 3
lock inc dword [0x451a14]
test eax, eax
je 0x4057d8
lock inc dword [0x451a18]
push ebx
push eax
call fcn.0042dfdd
add esp, 8
mov dword [esp + 0x14], eax
test eax, eax
jne 0x4057f4
push str.realloc_failed__n
jmp 0x4058a6
mov ecx, dword [esp + 0x10]
cmp ebx, ecx
jbe 0x405810
sub ebx, ecx
add eax, ecx
push ebx
push 0
push eax
call fcn.00429000
mov eax, dword [esp + 0x20]
add esp, 0xc
mov edx, dword [esi + 0xdc]
mov dword [esi + 0xd0], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0xd8], eax
jmp 0x40585e
mov edx, dword [esi + 0xdc]
lea eax, [edx + ebx]
cmp eax, ecx
jne 0x40585e
mov ecx, dword [esi + 0xd0]
lea eax, [ebx + ebx*4]
shl eax, 3
push eax
lea eax, [edx + edx*4]
lea eax, [ecx + eax*8]
push eax
push ecx
call fcn.00428a80
add esp, 0xc
mov dword [esi + 0xdc], 0
xor edx, edx
mov eax, dword [esi + 0xd4]
movups xmm0, xmmword [edi]
add eax, edx
lea ecx, [eax + eax*4]
mov eax, dword [esi + 0xd0]
movups xmmword [eax + ecx*8], xmm0
movups xmm0, xmmword [edi + 0x10]
movups xmmword [eax + ecx*8 + 0x10], xmm0
movq xmm0, qword [edi + 0x20]
movq qword [eax + ecx*8 + 0x20], xmm0
inc dword [esi + 0xd4]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.malloc_failed__n
push 2
call fcn.0042ae45
add esp, 4
push eax
call fcn.00408180
add esp, 8
push 0xffffffffffffffff
call fcn.0042eb1b
int3
Function at 0x406890
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
push ebx
push esi
push edi
mov edi, ecx
nop dword [eax]
inc eax
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
push dword [edi + 0x44]
push dword [edi + 0x30]
call dword [sym.imp.WS2_32.dll_accept]
mov ebx, eax
mov dword [ebp - 0xc], ebx
test ebx, ebx
js 0x4069dc
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x1c
push eax
push dword [edi + 0x40]
push ebx
call dword [sym.imp.WS2_32.dll_getsockname]
mov ecx, dword [edi]
mov edx, ebx
call fcn.00406210
mov ecx, dword [edi + 0xb4]
mov esi, eax
mov dword [esi + 0xb4], ecx
mov ecx, dword [edi + 0x14]
mov dword [esi + 0x14], ecx
mov edx, dword [edi + 0xf4]
test edx, edx
je 0x40690b
mov ecx, esi
call fcn.00408080
cmp dword [edi + 0x28], 0x1000000
jne 0x4069ab
cmp dword [esi + 0xf8], 0
jne 0x40699c
mov ebx, dword [edi + 0xfc]
test ebx, ebx
jne 0x406951
mov ebx, dword [0x451a34]
test ebx, ebx
jne 0x406951
call fcn.0040ae80
or dword [edi + 0x24], 0x8000
mov ebx, eax
mov dword [edi + 0xfc], ebx
test ebx, ebx
je 0x4069d5
push 0xd4
call fcn.0042dfd2
add esp, 4
mov dword [ebp - 8], eax
test eax, eax
je 0x4069ce
push eax
call fcn.0040dc20
add esp, 4
lea ecx, [ebx + 0x2e4]
mov ebx, dword [ebp - 8]
push ecx
push ebx
call fcn.0040e180
push 0
push 0x40af90
push 0x40af50
push dword [ebp - 0xc]
push ebx
call fcn.0040e0b0
add esp, 0x1c
mov dword [esi + 0xf8], ebx
push esi
mov dword [esi + 0x28], 0x1000000
call fcn.00406710
jmp 0x4069b8
mov eax, dword [esi + 0xb4]
test eax, eax
je 0x4069bb
push esi
call eax
add esp, 4
mov eax, dword [ebp - 0x10]
cmp eax, 3
jl 0x4068a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, 0x412
jmp 0x406a01
mov esi, 0x411
jmp 0x406a01
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
je 0x406a4c
cmp esi, 0x2714
je 0x406a4c
push str.accept
call fcn.0042e457
add esp, 4
push 0
push pe_nt_image_headers32
push 0x451ae0
mov eax, esi
mov dword [edi + 0x34], esi
cdq
push 0
xor eax, edx
sub eax, edx
push eax
push 0
push 0x12ff
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push dword [edi + 0x34]
push 0x451ae0
push dword [edi + 0x30]
push str.nio_accept
push str._s:_listenfd_d_accept_error:__s:_d_n
push 4
call fcn.00408d20
push eax
call fcn.004088a0
add esp, 0x1c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406a60
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 4], 0x1c
lea eax, [ebp - 4]
push eax
push dword [esi + 0x44]
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jns 0x406a8a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x406aff
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x1c
push eax
push dword [esi + 0x40]
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_getsockname]
cmp dword [esi + 0x28], 0x1000000
jne 0x406b7c
mov eax, dword [esi + 0xf8]
test eax, eax
jne 0x406b5a
mov eax, dword [esi + 0xfc]
test eax, eax
jne 0x406aec
mov eax, dword [0x451a34]
test eax, eax
jne 0x406aec
call fcn.0040ae80
or dword [esi + 0x24], 0x8000
mov dword [esi + 0xfc], eax
test eax, eax
jne 0x406aec
mov eax, 0x411
jmp 0x406aff
mov edx, dword [esi + 0x30]
mov ecx, eax
call fcn.0040afd0
test eax, eax
jne 0x406b54
mov eax, 0x412
push 0
push pe_nt_image_headers32
mov dword [esi + 0x34], eax
push 0x451ae0
cdq
push 0
xor eax, edx
sub eax, edx
push eax
push 0
push 0x12ff
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push dword [esi + 0x34]
push 0x451ae0
push dword [esi + 0x30]
push str.nio_connect
push str._s:_connfd_d_connect_error:__s:_d_n
push 3
call fcn.00408d20
push eax
call fcn.004088a0
add esp, 0x1c
mov ecx, esi
call fcn.004075b0
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0xf8], eax
mov ecx, dword [esi + 0x100]
test ecx, ecx
je 0x406b6e
push ecx
push eax
call fcn.0040e0d0
add esp, 8
push esi
call fcn.004067c0
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0xd8]
test ecx, ecx
je 0x406b9f
call fcn.00406090
mov dword [esi + 0xd8], 0
mov dword [esi + 0xbc], 0
or dword [esi + 0x24], 0x10
mov eax, dword [esi + 0xb8]
test eax, eax
je 0x406bb3
push esi
call eax
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x406be0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, edx
mov eax, dword [esi + 0x28]
cmp eax, 0x2000
jg 0x406c2e
je 0x406c03
cmp eax, 0x100
je 0x406c03
cmp eax, 0x1000
jne 0x406c3c
mov edx, dword [esi + 0x44]
mov eax, 0x1c
push ebx
mov ebx, 0x10
cmp word [edx], 2
cmove eax, ebx
push eax
push edx
push 0
push dword [ebp + 8]
push edi
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_sendto]
pop ebx
pop edi
pop esi
pop ebp
ret
cmp eax, 0x100000
je 0x406c65
cmp eax, 0x1000000
je 0x406c4f
push dword [ebp + 8]
push edi
push dword [esi + 0x30]
call fcn.004334dc
add esp, 0xc
pop edi
pop esi
pop ebp
ret
push dword [ebp + 8]
push edi
push dword [esi + 0xf8]
call fcn.0040fe90
add esp, 0xc
pop edi
pop esi
pop ebp
ret
push 0
push dword [ebp + 8]
push edi
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_send]
pop edi
pop esi
pop ebp
ret
Function at 0x406fa0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov edx, 0x1c
push ebx
push esi
push edi
mov edi, ecx
mov ecx, 0x10
mov esi, dword [edi + 0x44]
cmp word [esi], 2
cmove edx, ecx
push edx
push esi
push dword [edi + 0x30]
call dword [sym.imp.WS2_32.dll_connect]
mov ebx, eax
test ebx, ebx
jns 0x40703c
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2733
je 0x407082
push str.connect
call fcn.0042e457
add esp, 4
call esi
mov ecx, dword [edi]
lea edx, [esp + 0x10]
xorps xmm0, xmm0
mov dword [edi + 0x34], eax
mov eax, dword [edi + 0x2c]
movlpd qword [esp + 0x10], xmm0
movlpd qword [esp + 0x18], xmm0
movlpd qword [esp + 0x2c], xmm0
mov dword [esp + 0x34], 0
mov dword [esp + 0x20], 0x406420
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], eax
call fcn.00405680
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
jne 0x407082
mov eax, dword [edi + 0x2c]
lea edx, [esp + 0x10]
mov ecx, dword [edi]
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
movlpd qword [esp + 0x18], xmm0
movlpd qword [esp + 0x2c], xmm0
mov dword [esp + 0x34], 0
mov dword [esp + 0x20], 0x406bc0
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], eax
call fcn.00405680
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0xbc]
mov ecx, 0x2710
test eax, eax
mov edx, 0x4065d0
push 1
cmovne ecx, eax
push ecx
mov ecx, dword [edi]
call fcn.00405ea0
mov dword [edi + 0xd8], eax
add esp, 8
mov dword [eax + 0x18], edi
mov eax, dword [edi + 0x24]
or eax, 0x80
cmp dword [edi + 0x30], 3
mov dword [edi + 0x24], eax
jge 0x4070c8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [edi]
test al, 2
jne 0x407104
mov eax, dword [0x451a10]
inc eax
mov dword [0x451a10], eax
mov eax, dword [0x451a10]
cdq
mov dword [edi + 8], eax
mov eax, dword [edi + 0x24]
mov dword [edi + 0xc], edx
mov dword [edi + 0x10], 0x406df0
test al, 2
jne 0x4070fe
or eax, 2
mov dword [edi + 0x24], eax
mov eax, dword [edi]
inc dword [eax + 0x40]
inc dword [esi + 0xb8]
test byte [edi + 0x24], 8
jne 0x407111
mov ecx, edi
call fcn.004079a0
test byte [edi + 0x38], 4
mov dword [edi + 0x10], 0x406df0
jne 0x407131
mov edx, dword [edi + 0x30]
mov ecx, esi
push 4
call fcn.00409220
add esp, 4
or dword [edi + 0x38], 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, edx
test esi, esi
je 0x40849b
movzx edx, byte [ebp + 0x10]
mov ebx, esi
mov dword [ebp + 8], ebx
sub edi, ecx
mov ebx, dword [ebp + 0xc]
nop
mov eax, edx
lea ecx, [ecx + 1]
and eax, 3
inc edx
mov al, byte [eax + ebx]
xor al, byte [edi + ecx - 1]
mov byte [ecx - 1], al
sub esi, 1
jne 0x408480
mov ebx, dword [ebp + 8]
add bl, byte [ebp + 0x10]
pop edi
and bl, 3
pop esi
mov al, bl
pop ebx
pop ebp
ret

Function at 0x408f50
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov eax, edx
xor esi, esi
push edi
xor edi, edi
mov dword [ebp - 4], eax
mov ebx, ecx
test eax, eax
je 0x408ffb
nop word [eax + eax]
mov eax, 0xaaaaaaab
mov ecx, edi
mul edi
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
sub ecx, 0
je 0x408fdd
sub ecx, 1
je 0x408fc3
sub ecx, 1
jne 0x408ff1
movzx ecx, byte [edi + ebx - 1]
movzx eax, byte [edi + ebx]
and ecx, 0xf
shr eax, 6
movzx eax, byte [eax + ecx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov ecx, dword [ebp + 8]
mov byte [esi + ecx], al
movzx eax, byte [edi + ebx]
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esi + ecx + 1], al
add esi, 2
jmp 0x408ff1
movzx ecx, byte [edi + ebx - 1]
movzx eax, byte [edi + ebx]
and ecx, 3
add ecx, ecx
shr eax, 4
mov al, byte [eax + ecx*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
jmp 0x408fea
movzx eax, byte [edi + ebx]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov ecx, dword [ebp + 8]
mov byte [esi + ecx], al
inc esi
inc edi
cmp edi, dword [ebp - 4]
jb 0x408f70
dec edi
mov eax, 0xaaaaaaab
mul edi
mov ecx, edi
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
jne 0x409035
movzx ecx, byte [edi + ebx]
mov eax, dword [ebp + 8]
and ecx, 3
shl ecx, 4
pop edi
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esi + eax], cl
mov word [esi + eax + 1], 0x3d3d
lea eax, [esi + 3]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ecx, 1
jne 0x40905d
movzx eax, byte [edi + ebx]
mov ecx, dword [ebp + 8]
and eax, 0xf
pop edi
mov al, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esi + ecx], al
lea eax, [esi + 2]
mov byte [esi + ecx + 1], 0x3d
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4097a0
Capabilities:
Convert ip address from string
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a0
mov eax, dword [0x44e054]
xor eax, esp
mov dword [esp + 0x19c], eax
push esi
push edi
mov edi, edx
mov esi, ecx
test edi, edi
je 0x409887
cmp byte [edi], 0
je 0x409887
mov ecx, 1
mov edx, 0x451a30
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x4097f5
lea eax, [esp + 0x10]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
lea eax, [esi + 4]
push eax
push edi
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x409814
mov eax, 2
mov word [esi], ax
jmp 0x4098a7
lea eax, [esi + 8]
push eax
push edi
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x40982e
mov eax, 0x17
mov word [esi], ax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
push 0
push 0
push edi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x4098b6
mov edi, dword [esp + 0xc]
test edi, edi
je 0x40989a
cmp dword [edi + 0x18], eax
je 0x40989a
cmp dword [edi + 0x10], eax
je 0x40989a
mov eax, edi
nop
cmp dword [eax + 4], 2
je 0x40986f
mov eax, dword [eax + 0x1c]
test eax, eax
jne 0x409860
mov eax, edi
push dword [eax + 0x10]
push dword [eax + 0x18]
push esi
call fcn.00428a80
add esp, 0xc
push edi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
jmp 0x40989a
mov eax, 2
push 0
mov word [esi], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esi + 4], eax
movzx eax, word [esi]
cmp eax, 2
je 0x4098a7
cmp eax, 0x17
jne 0x4098b4
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 2], ax
xor eax, eax
mov ecx, dword [esp + 0x1a4]
pop edi
pop esi
xor ecx, esp
call fcn.00427b91
mov esp, ebp
pop ebp
ret
Function at 0x409980
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Initialize winsock library
Start tcp server

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1b4
mov eax, dword [0x44e054]
xor eax, esp
mov dword [esp + 0x1b0], eax
mov eax, dword [ebp + 0xc]
mov ecx, 1
push ebx
push esi
mov dword [esp + 0x10], eax
mov edx, 0x451a30
push edi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x4099c8
lea eax, [esp + 0x28]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
xorps xmm0, xmm0
mov dword [esp + 0x10], 0xffffffff
mov eax, 2
mov dword [esp + 0xc], 0x10
push 0x7f000001
or edi, 0xffffffff
movlpd qword [esp + 0x24], xmm0
mov word [esp + 0x1c], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov ebx, dword [sym.imp.WS2_32.dll_socket]
mov dword [esp + 0x1c], eax
xor eax, eax
push eax
push 1
push 2
mov word [esp + 0x26], ax
call ebx
mov esi, eax
test esi, esi
jns 0x409a21
mov eax, str.socket
jmp 0x409abf
push dword [esp + 0xc]
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jns 0x409a3f
mov eax, str.bind
jmp 0x409abf
push 1
push esi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
jns 0x409a53
mov eax, str.listen
jmp 0x409abf
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jns 0x409a6f
mov eax, str.getsockname
jmp 0x409abf
push 0
push 1
push 2
call ebx
mov edi, eax
test edi, edi
jns 0x409a84
mov eax, str.socket
jmp 0x409abf
push dword [esp + 0xc]
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x409a9f
mov eax, str.connect
jmp 0x409abf
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_accept]
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jns 0x409b02
mov eax, str.accept
push eax
call fcn.0042e457
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
add esp, 4
cmp esi, 0xffffffff
je 0x409ad6
push esi
call ebx
cmp edi, 0xffffffff
je 0x409ade
push edi
call ebx
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x409aea
push eax
call ebx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1b0]
xor ecx, esp
call fcn.00427b91
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1bc]
mov dword [eax], edi
pop edi
mov dword [eax + 4], ebx
xor eax, eax
pop esi
pop ebx
xor ecx, esp
call fcn.00427b91
mov esp, ebp
pop ebp
ret
Function at 0x4147b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x44e054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea esi, [ebp - 0x34]
mov dword [ebp - 0x38], eax
push 0x30
mov eax, esi
mov dword [ebp - 0x3c], esi
push 0
push eax
call fcn.00429000
mov edx, dword [ebp - 0x38]
mov edi, 1
add esp, 0xc
xor ebx, ebx
sub edi, edx
lea ecx, [edx + 0x20]
lea eax, [edx + 0xf]
mov dword [ebp - 0x40], ecx
add byte [eax], 1
jne 0x414800
dec eax
lea ecx, [edi + eax]
test ecx, ecx
jg 0x4147f3
push esi
push edx
lea ecx, [edx + 0x20]
push 1
push ecx
call fcn.004173c0
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x414877
mov esi, dword [ebp - 0x3c]
add ebx, 0x10
mov edx, dword [ebp - 0x38]
add esi, 0x10
mov dword [ebp - 0x3c], esi
lea eax, [edx + 0xf]
cmp ebx, 0x30
jl 0x4147f3
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x34]
xor ecx, ecx
sub edx, eax
lea eax, [ebp - 0x34]
add eax, ecx
add ecx, 0x10
movups xmm0, xmmword [eax]
movups xmm1, xmmword [edx + eax]
pxor xmm1, xmm0
movups xmmword [eax], xmm1
cmp ecx, 0x30
jl 0x414837
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x34]
push 0x100
push eax
push ecx
call fcn.00417660
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x414877
mov eax, dword [ebp - 0x38]
movups xmm0, xmmword [ebp - 0x14]
movups xmmword [eax], xmm0
lea eax, [ebp - 0x34]
push 0x30
push eax
call fcn.004153e0
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00427b91
mov esp, ebp
pop ebp
ret
Function at 0x415400
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
sub esp, 0x10
xor ecx, ecx
test edx, edx
je 0x415506
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
cmp edx, 0x40
jb 0x4154e8
lea eax, [edx - 1]
add eax, ebx
cmp edi, eax
ja 0x41543e
lea eax, [edx - 1]
add eax, edi
cmp eax, ebx
jae 0x4154e8
lea eax, [edx - 1]
add eax, esi
cmp edi, eax
ja 0x415454
lea eax, [edx - 1]
add eax, edi
cmp eax, esi
jae 0x4154e8
mov eax, edx
mov edx, esi
sub edx, ebx
and eax, 0xffffffc0
mov dword [ebp - 4], edx
mov edx, edi
sub edx, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edx
lea eax, [ebx + 0x10]
mov ebx, dword [ebp - 4]
mov edx, esi
sub edx, edi
mov dword [ebp - 0xc], edx
lea edx, [edi + 0x20]
nop word [eax + eax]
movups xmm0, xmmword [eax - 0x10]
mov edi, dword [ebp - 8]
lea eax, [eax + 0x40]
movups xmm1, xmmword [ecx + esi]
lea edx, [edx + 0x40]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x40]
movups xmmword [edx - 0x60], xmm1
movups xmm1, xmmword [ebx + eax - 0x40]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x30]
movups xmmword [edi + eax - 0x40], xmm1
mov edi, dword [ebp - 0xc]
movups xmm1, xmmword [edi + edx - 0x40]
mov edi, dword [ebp + 8]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x20]
movups xmmword [edx - 0x40], xmm1
movups xmm1, xmmword [ecx + esi + 0x30]
add ecx, 0x40
pxor xmm1, xmm0
movups xmmword [edx - 0x30], xmm1
cmp ecx, dword [ebp - 0x10]
jb 0x415480
mov edx, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
cmp ecx, edx
jae 0x415503
sub esi, ebx
lea eax, [ecx + ebx]
sub edi, ebx
sub edx, ecx
mov cl, byte [eax + esi]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
mov byte [eax + edi - 1], cl
sub edx, 1
jne 0x4154f1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416340
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push edi
xor edi, edi
test ebx, ebx
je 0x41637c
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
sub eax, esi
mov dword [ebp + 8], eax
nop word [eax + eax]
mov cl, byte [eax + esi]
lea esi, [esi + 1]
mov al, byte [esi - 1]
movzx edx, al
movzx eax, cl
xor edx, eax
mov eax, dword [ebp + 8]
or edi, edx
sub ebx, 1
jne 0x416360
pop esi
mov eax, edi
movzx ecx, di
shr eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
Function at 0x416520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 4], ecx
test ebx, ebx
je 0x4165f9
mov eax, ebx
sub eax, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], eax
nop dword [eax]
nop dword [eax + eax]
mov esi, dword [0x44eb5c]
mov edx, dword [0x44eb5c]
xor esi, ecx
xor edx, dword [ebp - 8]
mov eax, edx
xor eax, esi
sub esi, edx
shr eax, 0x1f
xor eax, dword [0x44eb5c]
mov ecx, eax
neg eax
shr ecx, 1
neg ecx
or ecx, eax
mov eax, dword [0x44eb5c]
shr ecx, 0x1f
neg ecx
xor eax, ecx
and ecx, edx
not eax
and esi, eax
mov eax, dword [0x44eb5c]
or esi, ecx
shr esi, 0x1f
xor eax, esi
lea esi, [ebx - 1]
mov ecx, eax
neg eax
shr ecx, 1
neg ecx
or ecx, eax
xor eax, eax
shr ecx, 0x1f
neg ecx
mov dword [ebp + 8], ecx
test esi, esi
je 0x4165dd
mov dl, byte [eax + edi]
mov cl, byte [eax + edi + 1]
mov ebx, dword [0x44eb5c]
xor ebx, dword [ebp + 8]
not ebx
and bl, cl
movzx ecx, byte [ebp + 8]
and cl, dl
or bl, cl
mov byte [eax + edi], bl
inc eax
cmp eax, esi
jb 0x4165b3
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
movzx eax, byte [edi + ebx - 1]
and al, cl
mov ecx, dword [ebp - 4]
inc ecx
mov byte [edi + ebx - 1], al
mov dword [ebp - 4], ecx
cmp ecx, ebx
jb 0x416550
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416dc0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, 0x443010
mov edx, edi
test eax, eax
je 0x416e41
cmp dword [0x443010], 0
je 0x416e41
mov ebx, dword [eax + 4]
cmp dword [edx + 4], ebx
jne 0x416e37
mov edx, dword [edx]
mov esi, ebx
mov eax, dword [eax + 8]
sub esi, 4
jb 0x416e02
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x416e07
add edx, 4
add eax, 4
sub esi, 4
jae 0x416df1
cmp esi, 0xfffffffc
je 0x416e4b
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x416e34
cmp esi, 0xfffffffd
je 0x416e4b
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x416e34
cmp esi, 0xfffffffe
je 0x416e4b
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x416e34
cmp esi, 0xffffffff
je 0x416e4b
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x416e4b
mov eax, dword [ebp + 8]
add edi, 0x14
mov edx, edi
cmp dword [edi], 0
jne 0x416de0
pop edi
pop esi
mov eax, 0xffffffd2
pop ebx
pop ebp
ret
test edi, edi
je 0x416e41
mov eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0x10]
pop edi
pop esi
mov dword [eax], ecx
xor eax, eax
pop ebx
pop ebp
ret