joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4121fa
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x412241
mov eax, dword [esi + 4]
test eax, eax
jne 0x412215
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
jmp 0x412217
add eax, edi
movsx eax, byte [eax]
push eax
call dword [sym.imp.MSVCRT.dll_isdigit]
test eax, eax
pop ecx
jne 0x41223b
mov eax, dword [esi + 4]
test eax, eax
jne 0x412234
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
jmp 0x412236
add eax, edi
cmp byte [eax], 0x2e
jne 0x412241
inc edi
cmp edi, dword [esi + 8]
jb 0x412207
cmp edi, dword [esi + 8]
mov esi, dword [esi + 4]
jb 0x41225c
test esi, esi
jne 0x412253
mov esi, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
jmp 0x41227c
test esi, esi
jne 0x412266
mov esi, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x412275
xor al, al
jmp 0x412284
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
mov al, 1
pop edi
pop esi
ret 8

Function at 0x41d746
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov byte [esi + 0x14], bl
mov ecx, dword [ebp + 8]
mov dword [esi + 0xc], ecx
lea ecx, [ebp + 8]
lea eax, [esi + 8]
push ecx
push ebx
push eax
push 0x41d968
push ebx
push ebx
mov dword [eax], esi
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x41d77e
mov dword [esi + 4], ebx
cmp dword [esi + 4], ebx
jne 0x41d78b
mov byte [esi + 0x14], 1
xor al, al
jmp 0x41d78d
mov al, 1
pop esi
pop ebx
pop ebp
ret 4

Function at 0x41de7e
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 1
pop esi
call fcn.0041db72
mov edi, dword [ebp + 8]
mov ecx, eax
mov dword [ebp + 8], 0xe
and dword [ecx + 0x134], 0
and dword [ecx + 0x130], 0
xor dword [ecx + 0x9c], edi
mov eax, dword [ebp + 8]
push 0x25
cdq
pop ebx
add dword [ebp + 8], 0xe
idiv ebx
xor dword [ecx + edx*4 + 0x9c], esi
sub edi, esi
cmp dword [ebp + 8], 0x206
lea eax, [ecx + edx*4 + 0x9c]
mov eax, esi
mov esi, edi
mov edi, eax
jl 0x41deac
mov esi, 0x3e8
call fcn.0041ddfc
dec esi
jne 0x41dedd
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x41f9e5
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.WS2_32.dll_ntohl]
push edi
mov edi, dword [ebp + 8]
push dword [edi]
call esi
push dword [edi + 4]
mov ebx, eax
call esi
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
lea edi, [ebp - 0x14]
sub eax, ecx
mov dword [ebp + 0xc], 4
mov dword [ebp - 4], eax
jmp 0x41fa1f
mov eax, dword [ebp - 4]
push dword [eax + edi]
call esi
mov dword [edi], eax
add edi, 4
dec dword [ebp + 0xc]
jne 0x41fa1c
push 0x10
xor eax, eax
pop ecx
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 8]
shr edx, 5
add edx, dword [ebp - 0x10]
sub eax, 0x61c88647
shl esi, 4
add esi, dword [ebp - 0x14]
xor edx, esi
mov esi, dword [ebp + 8]
add esi, eax
xor edx, esi
add ebx, edx
mov edx, ebx
mov esi, ebx
shr edx, 5
add edx, dword [ebp - 8]
shl esi, 4
add esi, dword [ebp - 0xc]
xor edx, esi
lea esi, [eax + ebx]
xor edx, esi
add dword [ebp + 8], edx
dec ecx
jne 0x41fa33
mov esi, dword [sym.imp.WS2_32.dll_htonl]
push ebx
call esi
mov edi, dword [ebp + 0x10]
push dword [ebp + 8]
mov dword [edi], eax
call esi
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41fd20
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.004903a4
and dword [esi + 0x10], 0
and dword [esi + 0x14], 0
and dword [esi + 0x58], 0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
pop esi
ret
Function at 0x4209ca
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.WS2_32.dll_ntohl]
push edi
mov edi, dword [ebp + 8]
push dword [edi]
call esi
push dword [edi + 4]
mov ebx, eax
call esi
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
lea edi, [ebp - 0x14]
sub eax, ecx
mov dword [ebp + 0xc], 4
mov dword [ebp - 4], eax
jmp 0x420a04
mov eax, dword [ebp - 4]
push dword [eax + edi]
call esi
mov dword [edi], eax
add edi, 4
dec dword [ebp + 0xc]
jne 0x420a01
push 0xd
xor eax, eax
pop ecx
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 8]
shr edx, 5
add edx, dword [ebp - 0x10]
sub eax, 0x61c88647
shl esi, 4
add esi, dword [ebp - 0x14]
xor edx, esi
mov esi, dword [ebp + 8]
add esi, eax
xor edx, esi
add ebx, edx
mov edx, ebx
mov esi, ebx
shr edx, 5
add edx, dword [ebp - 8]
shl esi, 4
add esi, dword [ebp - 0xc]
xor edx, esi
lea esi, [eax + ebx]
xor edx, esi
add dword [ebp + 8], edx
dec ecx
jne 0x420a18
mov esi, dword [sym.imp.WS2_32.dll_htonl]
push ebx
call esi
mov edi, dword [ebp + 0x10]
push dword [ebp + 8]
mov dword [edi], eax
call esi
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x420d0c
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.WS2_32.dll_ntohl]
push edi
mov edi, dword [ebp + 8]
push dword [edi]
call esi
push dword [edi + 4]
mov dword [ebp + 8], eax
call esi
mov ebx, eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
lea edi, [ebp - 0x14]
sub eax, ecx
mov dword [ebp + 0xc], 4
mov dword [ebp - 4], eax
jmp 0x420d46
mov eax, dword [ebp - 4]
push dword [eax + edi]
call esi
mov dword [edi], eax
add edi, 4
dec dword [ebp + 0xc]
jne 0x420d43
push 0x10
mov eax, 0xe3779b90
pop ecx
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 8]
shr edx, 5
add edx, dword [ebp - 8]
shl esi, 4
add esi, dword [ebp - 0xc]
xor edx, esi
mov esi, dword [ebp + 8]
add esi, eax
xor edx, esi
sub ebx, edx
mov edx, ebx
mov esi, ebx
shr edx, 5
add edx, dword [ebp - 0x10]
shl esi, 4
add esi, dword [ebp - 0x14]
xor edx, esi
lea esi, [eax + ebx]
xor edx, esi
add eax, 0x61c88647
sub dword [ebp + 8], edx
dec ecx
jne 0x420d5d
push dword [ebp + 8]
mov esi, dword [sym.imp.WS2_32.dll_htonl]
call esi
mov edi, dword [ebp + 0x10]
push ebx
mov dword [edi], eax
call esi
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x421005
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.WS2_32.dll_ntohl]
push edi
mov edi, dword [ebp + 8]
push dword [edi]
call esi
push dword [edi + 4]
mov dword [ebp + 8], eax
call esi
mov ebx, eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
lea edi, [ebp - 0x14]
sub eax, ecx
mov dword [ebp + 0xc], 4
mov dword [ebp - 4], eax
jmp 0x42103f
mov eax, dword [ebp - 4]
push dword [eax + edi]
call esi
mov dword [edi], eax
add edi, 4
dec dword [ebp + 0xc]
jne 0x42103c
push 5
mov eax, 0xf1bbcdc8
pop edx
mov ecx, 0x61c88647
sub eax, ecx
dec edx
jne 0x42105b
push 0xd
pop edx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 8]
shr esi, 5
add esi, dword [ebp - 8]
shl edi, 4
add edi, dword [ebp - 0xc]
xor esi, edi
mov edi, dword [ebp + 8]
add edi, eax
xor esi, edi
sub ebx, esi
mov esi, ebx
mov edi, ebx
shr esi, 5
add esi, dword [ebp - 0x10]
shl edi, 4
add edi, dword [ebp - 0x14]
xor esi, edi
lea edi, [eax + ebx]
xor esi, edi
add eax, ecx
sub dword [ebp + 8], esi
dec edx
jne 0x421063
push dword [ebp + 8]
mov esi, dword [sym.imp.WS2_32.dll_htonl]
call esi
mov edi, dword [ebp + 0x10]
push ebx
mov dword [edi], eax
call esi
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x423412
Capabilities:
Resolve dns

Disassembly:
mov ax, word [esp + 8]
push esi
mov esi, ecx
and dword [esi], 0
mov word [esi + 4], ax
mov eax, dword [esp + 8]
mov eax, dword [eax + 4]
test eax, eax
jne 0x423431
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x423445
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, esi
pop esi
ret 8

Function at 0x423e48
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Initialize winsock library

Disassembly:
mov eax, 0x4933ea
call fcn.004903c0
sub esp, 0x194
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 0x10], esi
lea eax, [esi + 8]
mov dword [esi + 4], 0x49a5f0
push eax
call edi
mov al, byte [ebp + 0xb]
lea ecx, [esi + 0x20]
xor ebx, ebx
mov byte [ecx], al
mov al, byte [ebp + 0xb]
mov dword [ebp - 4], ebx
mov byte [ecx + 1], al
mov byte [ecx + 8], bl
call fcn.00424c69
mov al, byte [ebp + 0xb]
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
mov byte [ecx], al
mov al, byte [ebp + 0xb]
mov byte [ecx + 1], al
mov byte [ecx + 8], bl
call fcn.00424c69
mov al, byte [ebp + 0xb]
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 2
mov byte [ecx], al
mov al, byte [ebp + 0xb]
mov byte [ecx + 1], al
mov byte [ecx + 8], bl
call fcn.00424c69
mov dword [esi + 0x35c], ebx
mov byte [esi + 0x360], bl
mov cl, byte [ebp + 0xb]
lea eax, [esi + 0x364]
mov byte [eax], cl
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov cl, byte [ebp + 0xb]
lea eax, [esi + 0x374]
mov byte [eax], cl
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov cl, byte [ebp + 0xb]
lea eax, [esi + 0x384]
mov byte [eax], cl
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
lea eax, [esi + 0x394]
mov dword [eax], 0x49a5f0
add eax, 4
push eax
call edi
mov al, byte [ebp + 0xb]
lea ecx, [esi + 0x3b0]
mov byte [ebp - 4], 7
mov byte [ecx], al
mov al, byte [ebp + 0xb]
mov byte [ecx + 1], al
mov byte [ecx + 8], bl
call fcn.00424fd4
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 8
mov dword [esi + 0x3c0], eax
mov eax, dword [eax + 0x10]
add eax, 2
lea ecx, [esi + 0x3c4]
push eax
call fcn.00424649
mov byte [esi + 0x3d4], bl
lea edi, [esi + 0x3d8]
mov eax, 0x425417
mov dword [edi + 0x10], esi
mov dword [edi + 4], ebx
mov dword [edi + 0x14], eax
mov byte [edi + 0x18], 1
mov dword [edi], 0x49a818
lea eax, [ebp - 0x1a0]
mov byte [ebp - 4], 0xa
push eax
push 0x101
mov byte [esi + 0x3f4], bl
mov dword [esi], 0x49a814
mov dword [esi + 0x50], ebx
mov dword [esi + 0x154], ebx
mov dword [esi + 0x258], ebx
call dword [sym.imp.WS2_32.dll_WSAStartup]
push ebx
mov ecx, edi
call fcn.004246c5
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4246c5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov byte [esi + 0x18], bl
mov ecx, dword [ebp + 8]
mov dword [esi + 0xc], ecx
lea ecx, [ebp + 8]
lea eax, [esi + 8]
push ecx
push ebx
push eax
push 0x424961
push ebx
push ebx
mov dword [eax], esi
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x4246fd
mov dword [esi + 4], ebx
cmp dword [esi + 4], ebx
jne 0x42470a
mov byte [esi + 0x18], 1
xor al, al
jmp 0x42470c
mov al, 1
pop esi
pop ebx
pop ebp
ret 4

Function at 0x42552b
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ax, word [ebp + 0xc]
push esi
mov word [ebp - 0xe], ax
mov eax, dword [ebp + 8]
push 1
mov word [ebp - 0x10], 2
mov dword [ebp - 0xc], eax
call fcn.0042559c
cmp byte [ebp + 0x14], 0
pop ecx
mov esi, eax
je 0x425572
lea eax, [ebp + 0x14]
mov dword [ebp + 0x14], 1
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x425586
push dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push eax
push esi
call fcn.004255f8
add esp, 0xc
test al, al
jne 0x425597
cmp esi, 0xffffffff
je 0x425592
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
jmp 0x425599
mov eax, esi
pop esi
leave
ret

Function at 0x42559c
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
push ebx
je 0x4255ac
push 0x11
push 2
jmp 0x4255b0
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4255f3
push esi
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
push edi
lea eax, [ebp + 8]
push 4
push eax
mov edi, 0xffff
push 0x1002
push edi
push ebx
mov dword [ebp + 8], 0x10000
call esi
lea eax, [ebp + 8]
push 4
push eax
push 0x1001
push edi
push ebx
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x425784
Capabilities:
Set socket configuration

Disassembly:
mov eax, 0x493574
call fcn.004903c0
push ecx
push ecx
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14], esi
mov dword [esi + 4], eax
mov edi, dword [ebp + 0xc]
mov dl, byte [ebp + 0xf]
xor ecx, ecx
lea eax, [esi + 0x58c]
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], ecx
mov byte [esi + 0x14], 0xfe
mov word [esi + 0x15], cx
mov dword [ebp - 4], ecx
mov byte [eax], dl
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dl, byte [ebp + 0xf]
lea eax, [esi + 0x59c]
mov byte [eax], dl
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
cmp edi, 0xffffffff
mov byte [ebp - 4], 2
mov dword [esi], 0x49a898
je 0x425848
lea eax, [ebp - 0x10]
push ebx
push eax
push 0x8004667e
push edi
mov dword [ebp - 0x10], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
lea eax, [ebp + 8]
push 4
push eax
mov ebx, 0xffff
push 0x1002
push ebx
push edi
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [esi + 0x10], 2
mov dword [ebp + 8], 0x10000
call edi
lea eax, [ebp + 8]
push 4
push eax
push 0x1001
push ebx
push dword [ebp + 0xc]
call edi
mov ecx, dword [esi + 4]
push esi
push dword [esi + 0xc]
call fcn.00427613
pop ebx
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 8

Function at 0x425881
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, ecx
push 0
call fcn.0042559c
pop ecx
mov dword [ebx + 0xc], eax
lea ecx, [ebp - 4]
mov dword [ebp - 4], 1
push ecx
push 0x8004667e
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x425907
mov eax, dword [ebp + 8]
push esi
push edi
lea esi, [ebp - 0x14]
mov cx, word [eax + 4]
mov eax, dword [eax]
lea edi, [ebp - 0x24]
mov word [ebp - 0x14], 2
mov word [ebp - 0x12], cx
mov dword [ebp - 0x10], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x24]
push 0x10
movsd dword es:[edi], dword [esi]
push eax
push dword [ebx + 0xc]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.WS2_32.dll_connect]
mov ecx, dword [ebx + 4]
push ebx
push dword [ebx + 0xc]
mov dword [ebx + 0x10], 1
call fcn.00427672
mov ecx, dword [ebx + 4]
push ebx
push dword [ebx + 0xc]
call fcn.004276d1
pop edi
mov al, 1
pop esi
jmp 0x42591c
mov eax, dword [ebx + 0xc]
cmp eax, 0xffffffff
je 0x425916
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
or dword [ebx + 0xc], 0xffffffff
xor al, al
pop ebx
leave
ret 4
Function at 0x425991
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x10], 2
jne 0x425a04
mov eax, dword [esi + 0x590]
test eax, eax
je 0x4259b0
mov ecx, dword [esi + 0x594]
sub ecx, eax
jne 0x425a04
mov eax, dword [esi + 0xc]
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x4259cd
push 0
push ebx
push edi
push eax
call dword [sym.imp.WS2_32.dll_send]
jmp 0x4259d0
or eax, 0xffffffff
cmp eax, ebx
je 0x425a00
test eax, eax
jle 0x425a04
cmp eax, ebx
jge 0x425a04
lea ecx, [edi + ebx]
add eax, edi
push ecx
push eax
push dword [esi + 0x594]
lea ecx, [esi + 0x58c]
call fcn.00406c4e
mov ecx, dword [esi + 4]
push esi
push dword [esi + 0xc]
call fcn.00427672
mov al, 1
jmp 0x425a06
xor al, al
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x425992
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x10], 2
jne 0x425a04
mov eax, dword [esi + 0x590]
test eax, eax
je 0x4259b0
mov ecx, dword [esi + 0x594]
sub ecx, eax
jne 0x425a04
mov eax, dword [esi + 0xc]
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x4259cd
push 0
push ebx
push edi
push eax
call dword [sym.imp.WS2_32.dll_send]
jmp 0x4259d0
or eax, 0xffffffff
cmp eax, ebx
je 0x425a00
test eax, eax
jle 0x425a04
cmp eax, ebx
jge 0x425a04
lea ecx, [edi + ebx]
add eax, edi
push ecx
push eax
push dword [esi + 0x594]
lea ecx, [esi + 0x58c]
call fcn.00406c4e
mov ecx, dword [esi + 4]
push esi
push dword [esi + 0xc]
call fcn.00427672
mov al, 1
jmp 0x425a06
xor al, al
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x425bad
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
push 2
pop ecx
mov eax, dword [esi + 0x10]
cmp eax, ecx
jne 0x425c73
mov eax, dword [esi + 0x590]
lea edi, [esi + 0x58c]
test eax, eax
je 0x425c65
mov ecx, dword [edi + 8]
sub ecx, eax
je 0x425c65
mov ecx, eax
test ecx, ecx
je 0x425bed
mov eax, dword [edi + 8]
sub eax, ecx
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x590]
cmp ecx, 0xffffffff
je 0x425c08
push 0
push eax
push edx
push ecx
call dword [sym.imp.WS2_32.dll_send]
jmp 0x425c0b
or eax, 0xffffffff
mov edx, dword [edi + 4]
test edx, edx
jne 0x425c16
xor ecx, ecx
jmp 0x425c1b
mov ecx, dword [edi + 8]
sub ecx, edx
cmp eax, ecx
jne 0x425c3e
mov ecx, dword [esi + 4]
push esi
push dword [esi + 0xc]
call fcn.0042778a
and byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 0
mov ecx, edi
call fcn.00412d13
jmp 0x425ca0
test eax, eax
jle 0x425ca0
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x425ca0
mov edx, dword [edi + 8]
sub edx, ecx
cmp eax, edx
jae 0x425ca0
mov esi, dword [esi + 0x590]
mov ecx, edi
add eax, esi
push eax
push esi
call fcn.00413beb
jmp 0x425ca0
mov ecx, dword [esi + 4]
push esi
push dword [esi + 0xc]
call fcn.0042778a
jmp 0x425ca0
cmp eax, 1
jne 0x425ca0
push esi
mov dword [esi + 0x10], ecx
push dword [esi + 0xc]
mov ecx, dword [esi + 4]
call fcn.0042778a
mov ecx, dword [esi + 4]
push esi
push dword [esi + 0xc]
call fcn.00427613
push 0
push 1
push 1
mov ecx, esi
call fcn.0042701e
pop edi
pop esi
leave
ret 4
Function at 0x4270a7
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov eax, dword [edi + 4]
test eax, eax
jne 0x4270bd
xor esi, esi
jmp 0x4270c2
mov esi, dword [edi + 8]
sub esi, eax
and byte [ebp + 0xb], 0
lea eax, [ebp + 0xb]
push eax
lea eax, [esi + 0x578]
push eax
mov ecx, edi
call fcn.00412d13
mov ecx, dword [ebx + 0xc]
mov eax, dword [edi + 4]
cmp ecx, 0xffffffff
je 0x4270f6
push 0
add eax, esi
push 0x578
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
jmp 0x4270f9
or eax, 0xffffffff
test eax, eax
jle 0x427106
cmp eax, 0x578
jne 0x42710f
test eax, eax
je 0x42713c
cmp eax, 0xffffffff
je 0x427121
jmp 0x4270b2
push dword [edi + 8]
add eax, esi
add eax, dword [edi + 4]
mov ecx, edi
push eax
call fcn.00413beb
jmp 0x42715d
push dword [edi + 8]
add esi, dword [edi + 4]
mov ecx, edi
push esi
call fcn.00413beb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x42715d
cmp dword [ebx + 0x10], 2
jne 0x427156
xor eax, eax
push 0
cmp byte [ebp + 0xc], al
mov ecx, ebx
setne al
push eax
push 2
call fcn.0042701e
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc]
mov ecx, dword [edi + 4]
test ecx, ecx
jne 0x427168
xor eax, eax
jmp 0x42716d
mov eax, dword [edi + 8]
sub eax, ecx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x42732a
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, 0x493718
call fcn.004903c0
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov eax, dword [esi + 4]
add eax, 0x3c4
mov ebx, dword [eax + 0xc]
imul ebx, ebx, 0x587
add ebx, dword [eax + 8]
mov eax, dword [esi + 0x5ac]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [esi + 0x5c0]
push ecx
push 0
lea edi, [esi + 0x5f0]
push 0x583
push edi
push eax
mov dword [ebp - 0x14], 0x10
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp eax, 0xa
mov dword [ebp - 0x14], eax
jbe 0x4273df
cmp byte [edi], 0
jne 0x4273df
cmp byte [edi + 1], 0
jne 0x4273df
cmp byte [edi + 2], 0
jne 0x4273df
cmp byte [edi + 3], 1
jne 0x4273df
add eax, 0xfffffff6
push eax
lea eax, [edi + 0xa]
push eax
call fcn.004273fb
pop ecx
test eax, eax
pop ecx
je 0x4273df
mov dword [ebp - 0x18], eax
mov ecx, dword [edi + 4]
and dword [ebp - 4], 0
mov dword [ebx + 9], ecx
mov di, word [edi + 8]
mov word [ebx + 0xd], di
and byte [ebx + 8], 0
lea edi, [ebx + 0xf]
mov ecx, 0x15e
mov esi, eax
mov dword [ebx], 3
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x10]
push ebx
call fcn.00427079
or dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10]
cmp dword [ebp - 0x14], 0x583
je 0x427345
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x428a9a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x1c], edi
je 0x428ab3
push 5
call fcn.00428b9a
jmp 0x428b1f
lea ebx, [esi + 0x24]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0xc], edi
jne 0x428ad4
push 3
mov ecx, esi
call fcn.00428b9a
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x428b1f
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.00428ba4
test al, al
je 0x428b1f
lea eax, [ebp - 4]
mov dword [esi + 0x1c], 1
push eax
push edi
push esi
push 0x428e76
push edi
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
cmp eax, edi
mov dword [esi + 0x40], eax
jne 0x428b23
push 4
mov ecx, esi
call fcn.00428b9a
mov dword [esi + 0x1c], edi
xor al, al
jmp 0x428b25
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x428ba4
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
call fcn.00428c3b
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0x3c], eax
je 0x428c24
mov eax, dword [ebp + 8]
push edi
mov dword [ebp - 0xc], eax
mov ax, word [ebp + 0xc]
mov word [ebp - 0xe], ax
mov word [ebp - 0x10], 2
xor edi, edi
lea eax, [ebp - 0x10]
push 0x10
push eax
push dword [esi + 0x3c]
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x428c0c
push dword [ebp - 0xe]
call dword [sym.imp.WS2_32.dll_ntohs]
inc eax
push eax
call dword [sym.imp.WS2_32.dll_htons]
inc edi
mov word [ebp - 0xe], ax
cmp edi, 0x64
jb 0x428bdd
cmp edi, 0x64
pop edi
jb 0x428c2d
push 2
mov ecx, esi
call fcn.00428b9a
mov ecx, esi
call fcn.00428c3b
jmp 0x428c2d
push 1
mov ecx, esi
call fcn.00428b9a
xor eax, eax
cmp dword [esi + 0x3c], 0xffffffff
pop esi
setne al
leave
ret 8

Function at 0x42a1a4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
push esi
or eax, 0xffffffff
mov esi, edx
dec edx
test esi, esi
je 0x42a1d7
push edi
inc edx
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x49ad74]
xor eax, esi
inc ecx
dec edx
jne 0x42a1b9
pop edi
not eax
pop esi
ret