joyce8/EMBER2024-capa huggingface dataset:
Function at 0x750c50
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
push esi
mov esi, ecx
mov cx, word [esi + 0x40]
push edi
lea edi, [eax + 0x14]
mov word [edi], cx
movzx edx, word [esi + 0x44]
mov word [eax + 0x16], dx
lea ecx, [eax + 0x18]
mov ax, word [esi + 0x54]
mov word [ecx], ax
movzx edx, word [esi + 0x44]
add dx, word [esi + 0x40]
push ebx
movzx eax, dx
mov edx, 0x18
xor byte [ecx], al
mov bx, ax
shr bx, 0xf
add eax, eax
add bx, ax
movzx eax, bx
mov bx, ax
add eax, eax
shr bx, 0xf
add bx, ax
inc ecx
sub edx, 1
movzx eax, bx
jne 0x750c82
mov eax, dword [esi + 0x60]
push edi
add eax, 0x14
lea edi, [edx + 0x1c]
call fcn.00750740
pop ebx
test eax, eax
jne 0x750cc0
pop edi
pop esi
pop ecx
ret
cmp dword [esi + 0x6c], 0
je 0x750ccd
mov byte [esp + 0xb], 0xfa
jmp 0x750cd4
mov cl, byte [esi + 0x50]
mov byte [esp + 0xb], cl
mov eax, dword [esi + 0x5c]
lea edx, [esp + 0xb]
push edx
mov edi, 1
call fcn.00750740
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
pop ecx
ret
Function at 0x7520b0
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x220
mov eax, dword [0x69bc80]
xor eax, esp
mov dword [esp + 0x21c], eax
push esi
mov esi, dword [esp + 0x228]
push 0x100
lea eax, [esp + 0x124]
push eax
call sub.WSOCK32.dll_gethostname
cmp eax, 0xffffffff
jne 0x7520fd
xor al, al
pop esi
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.007562ca
add esp, 0x220
ret 4
lea ecx, [esp + 0x120]
push ecx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x7520e3
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
push ebx
mov ebx, dword [eax]
push 1
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x14], 0x10c
call fcn.0074e9f0
test eax, eax
jne 0x75214c
mov edx, dword [esp + 0x18]
test edx, edx
jle 0x75214c
lea ecx, [esp + 0x1c]
nop
cmp dword [ecx], ebx
je 0x752153
inc eax
add ecx, 0x18
cmp eax, edx
jl 0x752140
xor al, al
jmp 0x752217
lea eax, [eax + eax*2]
mov ecx, dword [esp + eax*8 + 0x24]
test ecx, ecx
je 0x75214c
mov edx, ebx
shr edx, 0x18
mov byte [esp + 8], dl
mov eax, ebx
shr eax, 0x10
mov byte [esp + 9], al
movzx eax, byte [esi + 7]
mov byte [esp + 0xc], al
movzx eax, byte [esi + 5]
mov edx, ebx
shr edx, 8
mov byte [esp + 0xa], dl
movzx edx, byte [esi + 6]
mov byte [esp + 0xd], dl
movzx edx, byte [esi + 4]
mov byte [esp + 0xe], al
mov eax, dword [esi + 4]
and eax, ecx
mov byte [esp + 0xf], dl
mov edx, eax
shr edx, 0x18
mov byte [esp + 0x10], dl
mov edx, eax
shr edx, 0x10
mov byte [esp + 0x11], dl
not ecx
mov edx, eax
mov byte [esp + 0x13], al
mov eax, ecx
shr edx, 8
shr ecx, 0x18
mov byte [esp + 0x12], dl
mov byte [esp + 0x14], cl
mov edx, eax
mov ecx, eax
shr edx, 0x10
shr ecx, 8
mov byte [esp + 0x15], dl
mov edx, dword [esp + 0xc]
mov byte [esp + 0x16], cl
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x17], al
mov eax, dword [esp + 0x14]
or eax, ecx
push edi
mov byte [esp + 0xf], bl
cmp edx, ecx
jbe 0x752207
cmp edx, eax
jae 0x752205
mov edi, dword [esp + 0xc]
cmp edi, ecx
jbe 0x752205
cmp edi, eax
jb 0x75220d
cmp edx, ecx
je 0x752230
cmp edx, eax
je 0x752230
mov dword [esi + 8], 1
mov al, 1
pop edi
mov ecx, dword [esp + 0x224]
pop ebx
pop esi
xor ecx, esp
call fcn.007562ca
add esp, 0x220
ret 4
mov dword [esi + 8], 0
xor al, al
jmp 0x752216

Function at 0x752240
Capabilities:
Resolve dns

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [0x7cd238]
xor ebx, ebx
xor al, al
mov byte [esp + 0xb], al
cmp esi, ebx
je 0x75228b
cmp byte [esi + 0xc], bl
lea eax, [esi + 0xc]
je 0x752281
push eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call sub.WSOCK32.dll_gethostbyname
cmp eax, ebx
je 0x752281
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push esi
mov dword [esi + 4], edx
call fcn.007520b0
or byte [esp + 0xb], al
mov esi, dword [esi]
cmp esi, ebx
jne 0x752255
mov al, byte [esp + 0xb]
pop esi
pop ebx
pop ecx
ret
Function at 0x752290
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x20
mov eax, dword [0x69bc80]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
xor ebx, ebx
cmp dword [0x7cc44c], ebx
jne 0x752482
mov eax, dword [0x7cd238]
push ebp
push esi
cmp eax, 0x69ba4c
je 0x7522d1
cmp eax, ebx
je 0x7522d1
nop
mov esi, dword [eax]
push eax
call fcn.00756594
add esp, 4
mov eax, esi
cmp esi, ebx
jne 0x7522c0
mov esi, 1
push 0x100
mov dword [0x7cd238], ebx
mov dword [0x7cc44c], esi
mov byte [0x7cc450], bl
call fcn.00758067
mov ebp, eax
add esp, 4
cmp ebp, ebx
je 0x752454
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], 0x7cd238
push edi
lea esp, [esp]
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea ecx, [esp + 0x24]
push 0x6a73f0
push ecx
mov dword [esp + 0x1c], ebx
call esi
push 0x69d075
push 0x6a508c
push ebp
call esi
push 0xff
push ebp
lea edx, [esp + 0x40]
push edx
push 9
call fcn.00753c70
add esp, 0x28
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], ebp
call fcn.0074f230
mov ecx, dword [esp + 0x10]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x752364
sub eax, esi
mov edi, eax
lea eax, [edi + ecx - 1]
cmp eax, ecx
jbe 0x75238f
mov dl, byte [eax]
cmp dl, 0x20
je 0x752383
cmp dl, 9
jne 0x75238f
mov byte [eax], bl
mov ecx, dword [esp + 0x10]
dec eax
dec edi
cmp eax, ecx
ja 0x752377
cmp edi, ebx
je 0x75244a
push ecx
call sub.WSOCK32.dll_inet_addr
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
jne 0x7523d9
mov eax, dword [esp + 0x10]
mov ecx, 0x6a73e0
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x7523d0
cmp dl, bl
je 0x7523cc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x7523d0
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x7523b0
xor eax, eax
jmp 0x7523d5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x7523db
xor edi, edi
lea ecx, [edi + 0xd]
push ecx
call fcn.00758067
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x75244a
mov dword [esi + 8], ebx
cmp edi, ebx
je 0x75241f
mov edx, dword [esp + 0x10]
inc edi
push edi
push edx
lea eax, [esi + 0xc]
push eax
call fcn.00756630
mov edx, dword [esp + 0x24]
add esp, 0xc
inc dword [esp + 0x14]
mov dword [esi + 4], ebx
mov dword [esi], ebx
mov dword [edx], esi
mov dword [esp + 0x18], esi
jmp 0x752310
mov ecx, dword [esp + 0x1c]
push esi
mov dword [esi + 4], ecx
mov byte [esi + 0xc], bl
call fcn.007520b0
mov edx, dword [esp + 0x18]
or byte [0x7cc450], al
inc dword [esp + 0x14]
mov dword [esi], ebx
mov dword [edx], esi
mov dword [esp + 0x18], esi
jmp 0x752310
push ebp
call fcn.00756594
add esp, 4
pop edi
pop esi
pop ebp
cmp dword [0x7cd238], ebx
je 0x752478
call fcn.00752240
mov al, byte [0x7cc450]
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.007562ca
add esp, 0x20
ret
mov dword [0x7cd238], 0x69ba4c
mov ecx, dword [esp + 0x20]
mov al, byte [0x7cc450]
pop ebx
xor ecx, esp
call fcn.007562ca
add esp, 0x20
ret
Function at 0x7524a0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x18
mov eax, dword [0x69bc80]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
xor ebp, ebp
push ebp
push 1
push 2
call sub.WSOCK32.dll_socket
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x7524d8
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.007562ca
add esp, 0x18
ret 0x10
push esi
push 4
lea eax, [esp + 0x10]
push eax
push 1
push 6
push ebx
mov dword [esp + 0x20], 1
call sub.WSOCK32.dll_setsockopt
xor eax, eax
push 0x10
lea edx, [esp + 0x14]
push edx
mov ecx, 2
mov dword [esp + 0x18], eax
push ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov word [esp + 0x1c], cx
call sub.WSOCK32.dll_bind
cmp eax, 0xffffffff
je 0x752585
push 0x64
call fcn.0074ee20
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x752585
push edi
push 0x64
push 0
push ebp
call fcn.00755e40
mov ecx, dword [esp + 0x3c]
mov esi, dword [esp + 0x38]
mov dword [ebp + 4], ebx
mov eax, dword [0x7cc438]
mov dword [ebp], eax
mov eax, dword [esp + 0x44]
mov dword [0x7cc438], ebp
mov dword [ebp + 0x3c], ecx
lea edi, [ebp + 0xc]
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
xor esi, esi
add esp, 0xc
mov dword [ebp + 0x24], esi
mov dword [ebp + 0x60], esi
pop edi
cmp eax, esi
je 0x7525c0
push eax
call fcn.0074ee20
add esp, 4
mov dword [ebp + 0x60], eax
cmp eax, esi
jne 0x7525ae
push ebx
call sub.WSOCK32.dll_closesocket
test ebp, ebp
jne 0x752598
push ebp
call fcn.00756594
add esp, 4
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.007562ca
add esp, 0x18
ret 0x10
mov ecx, dword [esp + 0x30]
mov edx, eax
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x7525b4
jmp 0x7525d7
push 2
call fcn.0074ee20
mov dword [ebp + 0x60], eax
mov byte [eax], 0
mov edx, dword [ebp + 0x60]
add esp, 4
mov byte [edx + 1], 0
mov ecx, dword [esp + 0x20]
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.007562ca
add esp, 0x18
ret 0x10

Function at 0x752660
Capabilities:
Connect socket

Disassembly:
sub esp, 0x14
mov eax, dword [0x69bc80]
xor eax, esp
mov dword [esp + 0x10], eax
movzx edx, word [0x7cc440]
xor eax, eax
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [esi + 0x54]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov eax, 2
push edx
mov word [esp + 8], ax
mov dword [esp + 0xc], ecx
call sub.WSOCK32.dll_htons
mov ecx, dword [esi + 4]
mov word [esp + 6], ax
push 0x10
lea eax, [esp + 8]
push eax
push ecx
call sub.WSOCK32.dll_connect
pop esi
test eax, eax
jge 0x7526da
mov dword [0x69b9c4], 0x69
xor eax, eax
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.007562ca
add esp, 0x14
ret 4
mov ecx, dword [esp + 0x10]
xor ecx, esp
mov eax, 1
call fcn.007562ca
add esp, 0x14
ret 4
Function at 0x7526f0
Capabilities:
Get hostname

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov esi, eax
xor ebx, ebx
xor edi, edi
test esi, esi
jne 0x75271a
push ebp
call fcn.0074ee20
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x752718
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov esi, ebx
push ebp
push esi
call sub.WSOCK32.dll_gethostname
cmp eax, 0xffffffff
je 0x75273c
mov eax, esi
lea edx, [eax + 1]
jmp 0x752730
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x752730
sub eax, edx
lea edi, [eax + 1]
push ebx
call fcn.00756594
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x752750
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x128
mov eax, dword [0x69bc80]
xor eax, esp
mov dword [esp + 0x124], eax
mov eax, dword [esp + 0x130]
mov ecx, dword [0x69ba48]
push ebx
mov ebx, dword [esp + 0x130]
push esi
mov dword [esp + 0xc], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], 1
lea ebx, [ebx]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, ebx
sub ecx, eax
jns 0x75279e
xor ecx, ecx
cmp dword [0x7cc434], 0
jne 0x752846
imul ecx, ecx, 0x3e8
lea edx, [esp + 0x10]
push edx
push 0
push 0
lea eax, [esp + 0x24]
push eax
push 0x40
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], ecx
call sub.WSOCK32.dll_select
cmp eax, 1
jl 0x752846
mov esi, dword [0x7cc43c]
mov eax, dword [0x69ba48]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x120]
push edx
push 0
push 0x7fff
push esi
push eax
mov dword [esp + 0x20], 0x10
call sub.WSOCK32.dll_recvfrom
cmp eax, 0xffffffff
je 0x752846
test byte [esi + 1], 0x80
je 0x752790
cmp byte [esi + 6], 0x12
jne 0x752790
mov eax, dword [esp + 0xc]
test eax, eax
je 0x75282b
mov ecx, dword [esp + 0x120]
mov dword [eax], ecx
mov eax, esi
mov ecx, dword [esp + 0x12c]
pop esi
pop ebx
xor ecx, esp
call fcn.007562ca
add esp, 0x128
ret 8
xor eax, eax
jmp 0x75282d
Function at 0x752890
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x110
mov eax, dword [0x7cc43c]
push ebx
push ebp
mov ebp, dword [esp + 0x124]
push esi
imul ebp, ebp, 0x3e8
push edi
mov dword [esp + 0x10], 1
mov edi, eax
mov ebx, eax
mov esi, 0x7fff
lea ecx, [ecx]
mov eax, dword [esp + 0x124]
mov ecx, dword [eax + 4]
lea edx, [esp + 0x14]
push edx
push 0
push 0
lea eax, [esp + 0x28]
push eax
push 0x40
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], ebp
call sub.WSOCK32.dll_select
cmp eax, 1
jl 0x752950
mov ecx, dword [esp + 0x124]
mov edx, dword [ecx + 4]
push 0
push esi
push ebx
push edx
call sub.WSOCK32.dll_recv
test eax, eax
je 0x752969
cmp eax, 0xffffffff
je 0x752982
cmp dword [esp + 0x10], 0
je 0x752943
cmp byte [edi], 0xb2
jne 0x7528c0
mov cl, byte [esp + 0x128]
cmp byte [edi + 6], cl
jne 0x7528c0
test byte [edi + 1], 0x80
je 0x7528c0
movzx esi, word [edi + 2]
mov dword [esp + 0x10], 0
cmp esi, eax
jbe 0x75299b
sub esi, eax
add ebx, eax
jmp 0x7528c0
pop edi
pop esi
pop ebp
mov dword [0x69b9c4], 0x63
xor eax, eax
pop ebx
add esp, 0x110
ret 0xc
pop edi
pop esi
pop ebp
mov dword [0x69b9c4], 0x65
xor eax, eax
pop ebx
add esp, 0x110
ret 0xc
pop edi
pop esi
pop ebp
mov dword [0x69b9c4], 0x62
xor eax, eax
pop ebx
add esp, 0x110
ret 0xc
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 0xc
Function at 0x7529b0
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x69bc80]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push esi
push 0x100
xor ebx, ebx
lea eax, [esp + 0x10]
push ebx
push eax
call fcn.00755e40
add esp, 0xc
push 0xff
lea ecx, [esp + 0x10]
push ecx
push 0x6a4960
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, ebx
je 0x752b34
cmp esi, 0x20
jae 0x752b34
mov ecx, 0x6a4958
lea eax, [esp + 0xc]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x752a30
cmp dl, bl
je 0x752a2c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x752a30
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x752a10
xor eax, eax
jmp 0x752a35
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x752b34
mov ecx, 0x6a4950
lea eax, [esp + 0xc]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x752a66
cmp dl, bl
je 0x752a62
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x752a66
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x752a46
xor eax, eax
jmp 0x752a6b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x752b34
push 8
lea edx, [esp + 0x10]
push 0x6a4944
push edx
call fcn.00757db0
add esp, 0xc
test eax, eax
jne 0x752aef
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
push 0x6a4938
push ecx
mov dword [esp + 0x14], ebx
call fcn.007597c8
add esp, 0xc
cmp eax, 1
jne 0x752acd
mov edx, dword [esp + 8]
lea eax, [edx + 1]
and eax, 0x800000ff
jns 0x752ac0
dec eax
or eax, 0xffffff00
inc eax
movzx ax, byte [eax + 0x69ba60]
movzx ebx, ax
jmp 0x752b0f
xor eax, eax
cmp esi, ebx
jbe 0x752b16
movsx ecx, byte [esp + eax + 0xc]
movzx edx, bx
xor ecx, edx
movzx cx, byte [ecx + 0x69ba60]
inc eax
movzx ebx, cx
cmp eax, esi
jb 0x752ad3
jmp 0x752b0f
xor eax, eax
cmp esi, ebx
jbe 0x752b16
movsx edx, byte [esp + eax + 0xc]
movzx ecx, bx
xor edx, ecx
movzx dx, byte [edx + 0x69ba60]
inc eax
movzx ebx, dx
cmp eax, esi
jb 0x752af5
xor eax, eax
cmp ax, bx
jne 0x752b1b
mov ebx, 0xff
pop esi
mov al, bl
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.007562ca
add esp, 0x108
ret
mov ecx, dword [esp + 0x10c]
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.007562ca
add esp, 0x108
ret
Function at 0x752f00
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x18
mov eax, dword [0x69bc80]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
mov eax, dword [esi + 8]
push 0
and eax, 0xfffffffd
push 1
or eax, 1
push 2
mov dword [esi + 8], eax
call sub.WSOCK32.dll_socket
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x752fa4
push 4
lea ecx, [esp + 8]
push ecx
push 1
push 6
push eax
mov dword [esp + 0x18], 1
call sub.WSOCK32.dll_setsockopt
mov ecx, dword [esi + 4]
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
push 0x10
lea eax, [esp + 0xc]
push eax
mov edx, 2
push ecx
mov word [esp + 0x14], dx
call sub.WSOCK32.dll_bind
cmp eax, 0xffffffff
je 0x752fa4
or dword [esi + 0xc], 8
test dword [esi + 0x3c], 0x200000
movzx eax, word [esi + 0x44]
je 0x752f91
movzx eax, word [esi + 0x1e]
push 0
push 0
push 0
push eax
push 0
push esi
call fcn.00752b50
test eax, eax
jne 0x752fc6
mov dword [0x69b9c4], 0x63
or dword [esi + 8], 2
xor eax, eax
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.007562ca
add esp, 0x18
ret 4
mov edx, dword [0x69b9e0]
mov ecx, dword [esp + 0x18]
pop esi
mov dword [edx + 0x14], eax
xor ecx, esp
mov eax, 1
call fcn.007562ca
add esp, 0x18
ret 4

Function at 0x7532a0
Capabilities:
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
sub esp, 0x1a8
mov eax, dword [0x69bc80]
xor eax, esp
mov dword [esp + 0x1a4], eax
cmp dword [0x7cc448], 0
jne 0x7533a1
lea eax, [esp + 0x14]
push eax
push 0x101
mov dword [0x7cc448], 1
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x7533a1
push 4
push 0x7cc440
push 0x6a73fc
push 7
mov dword [0x7cc444], 1
call fcn.00753c70
add esp, 0x10
test eax, eax
je 0x753316
mov eax, dword [0x7cc440]
test eax, eax
je 0x753316
cmp eax, 0xffff
jbe 0x753320
mov dword [0x7cc440], 0x574b
push 0x7fff
call fcn.00758067
add esp, 4
mov dword [0x7cc43c], eax
test eax, eax
je 0x75339c
push 0
push 2
push 2
call sub.WSOCK32.dll_socket
mov dword [0x69ba48], eax
cmp eax, 0xffffffff
je 0x75339c
mov ecx, 2
push 4
mov word [esp + 8], cx
lea ecx, [esp + 4]
push ecx
push 0x20
push 0xffff
xor edx, edx
push eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x1c], 0
mov word [esp + 0x1a], dx
call sub.WSOCK32.dll_setsockopt
cmp eax, 0xffffffff
je 0x75339c
mov eax, dword [0x69ba48]
push 0x10
lea edx, [esp + 8]
push edx
push eax
call sub.WSOCK32.dll_bind
cmp eax, 0xffffffff
jne 0x7533a1
call fcn.00752040
mov ecx, dword [esp + 0x1a4]
xor ecx, esp
call fcn.007562ca
add esp, 0x1a8
ret
Function at 0x7533c0
Capabilities:
Get hostname
Send data
Send data on socket

Disassembly:
sub esp, 0x20
mov eax, dword [0x69bc80]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
xor edi, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], edi
call fcn.00752290
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x7533f0
sub eax, edx
push 0x100
lea ebx, [eax + 1]
call fcn.0074ee20
mov esi, eax
add esp, 4
cmp esi, edi
je 0x753439
push 0x100
push esi
call sub.WSOCK32.dll_gethostname
cmp eax, 0xffffffff
je 0x753430
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x753424
sub eax, edx
lea edi, [eax + 1]
push esi
call fcn.00756594
add esp, 4
push 0x12c
lea ebp, [edi + ebx + 0x20]
push ebp
push 0x12
mov dword [esp + 0x20], ebp
call fcn.0074f370
mov esi, eax
test esi, esi
je 0x75353c
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x34]
test eax, eax
je 0x7534b0
mov ebp, dword [eax]
mov eax, dword [0x69b9c8]
and eax, 0xe00000
and ebp, 1
or ebp, eax
call fcn.007529b0
movzx ecx, al
mov eax, dword [esp + 0x34]
shl ecx, 0x18
or ecx, ebp
mov ebp, dword [esp + 0x14]
mov dword [esi + 8], ecx
mov edx, dword [eax + 4]
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0xc], edx
mov eax, dword [eax + 8]
mov dword [esi + 0x10], eax
mov dword [esi + 0x1c], ecx
mov edx, dword [esp + 0x18]
push ebx
push edx
lea eax, [esi + 0x20]
push eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], edi
call fcn.00756630
add esp, 0xc
push edi
lea eax, [ebx + esi + 0x20]
call fcn.007526f0
mov edi, dword [0x7cd238]
test edi, edi
je 0x75353c
lea esp, [esp]
mov ecx, 2
mov word [esp + 0x1c], cx
mov eax, dword [edi + 4]
test eax, eax
je 0x753530
movzx edx, word [0x7cc440]
push edx
mov dword [esp + 0x24], eax
call sub.WSOCK32.dll_htons
mov ecx, dword [0x69ba48]
push 0x10
mov word [esp + 0x22], ax
lea eax, [esp + 0x20]
push eax
push 0
push ebp
push esi
push ecx
call sub.WSOCK32.dll_sendto
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov eax, edx
mov dword [esp + 0x10], eax
test eax, eax
je 0x75353c
mov edi, dword [edi]
test edi, edi
jne 0x7534e0
cmp dword [esp + 0x10], edi
jne 0x75354f
cmp dword [0x69b9c4], 0
jne 0x75354f
mov dword [0x69b9c4], 0x61
push esi
call fcn.00756594
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.007562ca
add esp, 0x20
ret 0xc
Function at 0x753c70
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebx, 2
cmp eax, 0xa
ja case.0x753c85.3
jmp dword [eax*4 + 0x753d90]
mov edi, 0x6a7528
jmp case.0x753c85.3
mov edi, 0x6a74f0
jmp 0x753cbb
mov edi, 0x6a74f0
jmp case.0x753c85.3
mov edi, 0x6a74bc
jmp case.0x753c85.3
mov edi, 0x6a7488
jmp 0x753cbb
mov edi, 0x6a744c
jmp 0x753cbb
mov edi, 0x6a7410
mov ebx, 3
mov eax, dword [esp + 0x24]
mov dword [esp + 0x24], eax
xor eax, eax
cmp ebx, 2
sete al
mov ebp, 0x20019
add eax, reloc.WSOCK32.dll_accept
cmp dword [0x7cd24c], 0
je 0x753ce8
mov ebp, 0x20119
lea ecx, [esp + 0x18]
push ecx
push ebp
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x753d2f
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x18]
push ecx
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x18]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x753d7b
cmp ebx, 3
jne 0x753d7b
lea edx, [esp + 0x18]
push edx
push ebp
push 0
push edi
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x753d7b
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x18]
push edx
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x18]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
neg eax
pop edi
sbb eax, eax
pop esi
not eax
and eax, dword [esp + 0x1c]
pop ebp
pop ebx
pop ecx
ret
Function at 0x753dc0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
cmp ecx, 0x30
ja case.0x753dd4.1
movzx eax, byte [ecx + 0x753efc]
jmp dword [eax*4 + 0x753eec]
mov ebp, 0x14
jmp 0x753e01
xor edx, edx
cmp byte [esp + 0x18], dl
setne dl
lea edx, [edx*8 + 8]
mov ebp, edx
jmp 0x753e01
mov ebp, 8
jmp 0x753e01
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
cmp esi, ebp
jbe 0x753e3b
mov eax, dword [esp + 0x1c]
lea edi, [eax + ebp]
mov eax, esi
sub eax, ebp
mov edx, ebp
cmp ebp, eax
jb 0x753e1c
mov edx, eax
mov eax, dword [esp + 0x1c]
test edx, edx
jbe 0x753e35
mov ecx, edx
mov bl, byte [edi]
xor byte [eax], bl
inc edi
inc eax
sub ecx, 1
jne 0x753e26
mov ecx, dword [esp + 0x14]
sub esi, edx
cmp esi, ebp
ja 0x753e10
lea eax, [ecx - 0x20]
cmp eax, 0x30
ja case.0x753e4a.33
movzx edx, byte [eax + 0x753f3c]
jmp dword [edx*4 + 0x753f30]
mov ebp, 8
jmp 0x753e6e
movzx ebp, byte [esp + 0x18]
neg ebp
sbb ebp, ebp
and ebp, 0xfffffff4
add ebp, 0x14
jmp 0x753e6e
mov ebp, 0x14
cmp esi, ebp
jae 0x753ea5
mov eax, dword [esp + 0x1c]
lea ebx, [eax + esi]
lea esp, [esp]
mov edi, ebp
sub edi, esi
cmp esi, edi
jae 0x753e8a
mov edi, esi
mov ecx, dword [esp + 0x1c]
push edi
push ecx
push ebx
call fcn.00756630
add esi, edi
add esp, 0xc
add ebx, edi
cmp esi, ebp
jb 0x753e80
mov ecx, dword [esp + 0x14]
cmp byte [esp + 0x18], 0
je 0x753ee0
cmp esi, 0x10
jae 0x753ee0
cmp ecx, 0x20
je 0x753ebb
cmp ecx, 0x30
jne 0x753ee0
mov eax, dword [esp + 0x1c]
mov edx, 0x10
sub edx, esi
push edx
add eax, esi
push 0
push eax
call fcn.00755e40
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, 0x10
pop ebx
ret 0x10
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0x10