joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a2c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
cmp dword [ecx + 4], 0
je 0x43a2de
push dword [ecx + 4]
push 0
push 0
push 1
call fcn.0043a940
test eax, eax
jne 0x43a34d
mov eax, dword [esi + 8]
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [eax]
call dword [sym.imp.WS2_32.dll_recv]
mov edx, eax
mov eax, dword [esp + 0x10]
test edx, edx
jg 0x43a339
test eax, eax
je 0x43a307
mov dword [eax], 0
mov eax, dword [esi + 8]
cmp byte [eax + 0x18], 0
je 0x43a319
mov eax, 0xffffb1cb
pop esi
ret 0xc
test edx, edx
jne 0x43a326
mov eax, 0xffffb0b2
pop esi
ret 0xc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.0043a1f0
add esp, 4
pop esi
ret 0xc
test eax, eax
je 0x43a33f
mov dword [eax], edx
mov ecx, dword [esi + 8]
mov eax, edx
cdq
add dword [ecx + 0x10], eax
adc dword [ecx + 0x14], edx
xor eax, eax
pop esi
ret 0xc

Function at 0x43a480
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x1c
push edi
mov edi, ecx
mov eax, dword [edi + 4]
test eax, eax
jne 0x43a497
mov eax, 0xffffb1d7
pop edi
add esp, 0x1c
ret
push esi
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x10], 0x10
push dword [eax]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x43a51b
push dword [esp + 0x18]
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
lea ecx, [esp + 0x10]
call fcn.00438b00
lea eax, [esp + 0xc]
push eax
lea ecx, [edi + 0x14]
call fcn.00428fa0
movzx eax, byte [esp + 0x10]
mov byte [edi + 0x18], al
movzx eax, byte [esp + 0x11]
mov byte [edi + 0x19], al
movzx eax, byte [esp + 0x12]
mov byte [edi + 0x1a], al
movzx eax, byte [esp + 0x13]
mov byte [edi + 0x1b], al
mov eax, dword [esp + 0xc]
test eax, eax
je 0x43a50b
add eax, 0xfffffff8
push eax
call fcn.00447dbf
add esp, 4
push dword [esp + 0x16]
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [edi + 0x1c], eax
mov eax, dword [edi + 4]
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x18]
push ecx
push dword [eax]
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x43a599
push dword [esp + 0x18]
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
lea ecx, [esp + 0x10]
call fcn.00438b00
lea eax, [esp + 0xc]
push eax
lea ecx, [edi + 0x20]
call fcn.00428fa0
movzx eax, byte [esp + 0x10]
mov byte [edi + 0x24], al
movzx eax, byte [esp + 0x11]
mov byte [edi + 0x25], al
movzx eax, byte [esp + 0x12]
mov byte [edi + 0x26], al
movzx eax, byte [esp + 0x13]
mov byte [edi + 0x27], al
mov eax, dword [esp + 0xc]
test eax, eax
je 0x43a589
add eax, 0xfffffff8
push eax
call fcn.00447dbf
add esp, 4
push dword [esp + 0x16]
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [edi + 0x28], eax
pop esi
xor eax, eax
pop edi
add esp, 0x1c
ret
Function at 0x43a650
Capabilities:
Resolve dns

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, ecx
test esi, esi
je 0x43a73c
cmp byte [esi], 0
je 0x43a73c
lea ecx, [esp + 8]
call fcn.00438b30
push esi
lea ecx, [esp + 0xc]
call fcn.00438c80
test eax, eax
jne 0x43a69b
lea ecx, [esp + 8]
call fcn.00438c60
push eax
mov ecx, edi
call fcn.00438d20
mov esi, eax
jmp 0x43a71e
lea eax, [esp + 0x14]
push eax
push 0
push 0
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x43a6be
mov esi, 0xffffb04c
jmp 0x43a71e
mov esi, dword [esp + 0x14]
push ebx
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
xor bl, bl
lea esp, [esp]
test esi, esi
je 0x43a705
cmp dword [esi + 4], 2
jne 0x43a6fe
cmp dword [esi + 0x10], 0x10
jne 0x43a6fe
mov eax, dword [esi + 0xc]
test eax, eax
je 0x43a6ec
cmp eax, 6
jne 0x43a6fe
mov eax, dword [esi + 0x18]
push dword [eax + 4]
call ebp
push eax
mov ecx, edi
call fcn.00438d20
mov bl, 1
mov esi, dword [esi + 0x1c]
test bl, bl
je 0x43a6d0
push dword [esp + 0x1c]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
pop ebp
test bl, bl
pop ebx
jne 0x43a71c
mov esi, 0xffffb04c
jmp 0x43a71e
xor esi, esi
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x43a732
add ecx, 0xfffffff8
push ecx
call fcn.00447dbf
add esp, 4
pop edi
mov eax, esi
pop esi
add esp, 8
ret 8
pop edi
mov eax, 0xffffb04c
pop esi
add esp, 8
ret 8

Function at 0x43a850
Capabilities:
Set socket configuration

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
call fcn.00438c60
push eax
call dword [sym.imp.WS2_32.dll_htonl]
push 4
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0xc]
push 9
push 0
push dword [eax]
call dword [sym.imp.WS2_32.dll_setsockopt]
pop esi
test eax, eax
jne 0x43a885
ret 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.0043a1f0
add esp, 4
ret 4
Function at 0x43a940
Capabilities:
Get socket status

Disassembly:
sub esp, 0x324
push ebx
push esi
xor edx, edx
mov esi, ecx
push edi
mov edi, dword [esi]
mov dword [esp + 0x24], edx
cmp byte [esp + 0x334], dl
je 0x43a969
mov edx, 1
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], edx
cmp byte [esp + 0x338], 0
mov dword [esp + 0x128], 0
je 0x43a990
mov dword [esp + 0x12c], edi
mov dword [esp + 0x128], 1
cmp byte [esi + 0x19], 0
mov ebx, dword [esp + 0x340]
mov dword [esp + 0x230], edi
mov dword [esp + 0x22c], 1
je 0x43a9de
test ebx, ebx
je 0x43a9de
mov ecx, dword [esi + 0x20]
cmp ecx, edi
jle 0x43a9bc
mov edi, ecx
xor eax, eax
test edx, edx
je 0x43a9cd
cmp dword [esp + eax*4 + 0x28], ecx
je 0x43a9cd
inc eax
cmp eax, edx
jb 0x43a9c2
cmp eax, edx
jne 0x43a9de
cmp edx, 0x40
jae 0x43a9de
mov dword [esp + eax*4 + 0x28], ecx
inc dword [esp + 0x24]
cmp ebx, 0xffffffff
je 0x43aa0c
mov eax, 0x10624dd3
imul ebx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov dword [esp + 0x1c], ecx
imul ecx, ecx, 0x3e8
mov eax, ebx
sub eax, ecx
imul eax, eax, 0x3e8
mov dword [esp + 0x20], eax
lea eax, [ebx + 1]
neg eax
sbb eax, eax
lea ecx, [esp + 0x1c]
and eax, ecx
push eax
lea eax, [esp + 0x230]
push eax
lea eax, [esp + 0x130]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [edi + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp byte [esi + 0x18], 0
je 0x43aa50
pop edi
pop esi
mov eax, 0xffffb1cb
pop ebx
add esp, 0x324
ret 0x10
test eax, eax
jne 0x43aa6a
test ebx, ebx
setne al
pop edi
pop esi
pop ebx
add eax, 0xffffb1d1
add esp, 0x324
ret 0x10
cmp eax, 0xffffffff
jne 0x43aa8a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.0043a1f0
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x324
ret 0x10
cmp byte [esp + 0x334], 0
je 0x43aaa4
lea eax, [esp + 0x24]
push eax
push dword [esi]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x43aac1
cmp byte [esp + 0x338], 0
je 0x43ab1a
lea eax, [esp + 0x128]
push eax
push dword [esi]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x43ab1a
cmp byte [esp + 0x33c], 0
je 0x43ab0c
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x10]
push eax
push 0x1007
push 0xffff
push dword [esi]
mov dword [esp + 0x20], 0
mov dword [esp + 0x2c], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x43aa6f
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x43aa75
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x324
ret 0x10
lea eax, [esp + 0x22c]
push eax
push dword [esi]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x43ab7d
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push 0x1007
push 0xffff
push dword [esi]
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x43aa6f
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x43aa75
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x324
ret 0x10
pop edi
pop esi
mov eax, 0xffffb1d8
pop ebx
add esp, 0x324
ret 0x10
Function at 0x43ace0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
cmp dword [ecx + 8], 0
je 0x43acfe
push dword [ecx + 8]
push 0
push 1
push 0
call fcn.0043a940
test eax, eax
jne 0x43ad6d
mov eax, dword [esi + 8]
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [eax]
call dword [sym.imp.WS2_32.dll_send]
mov edx, eax
mov eax, dword [esp + 0x10]
test edx, edx
jg 0x43ad59
test eax, eax
je 0x43ad27
mov dword [eax], 0
mov eax, dword [esi + 8]
cmp byte [eax + 0x18], 0
je 0x43ad39
mov eax, 0xffffb1cb
pop esi
ret 0xc
test edx, edx
jne 0x43ad46
mov eax, 0xffffb050
pop esi
ret 0xc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.0043a1f0
add esp, 4
pop esi
ret 0xc
test eax, eax
je 0x43ad5f
mov dword [eax], edx
mov ecx, dword [esi + 8]
mov eax, edx
cdq
add dword [ecx + 0x10], eax
adc dword [ecx + 0x14], edx
xor eax, eax
pop esi
ret 0xc

Function at 0x43ad80
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration
Start tcp server

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_socket]
push esi
mov esi, dword [esp + 0x2c]
push edi
push 0
push 1
push 2
mov dword [esi], 0xffffffff
mov dword [esi + 4], 0xffffffff
call ebx
mov edi, eax
cmp edi, 0xffffffff
je 0x43ae7c
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov eax, 2
push 0x7f000001
mov word [esp + 0x14], ax
call dword [sym.imp.WS2_32.dll_htonl]
push 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
push 4
push 0xffff
push edi
mov dword [esp + 0x20], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x10
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x43ae7c
push 1
push edi
call dword [sym.imp.WS2_32.dll_listen]
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x14]
push eax
push edi
mov dword [esp + 0x3c], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x43ae7c
push eax
push 1
push 2
call ebx
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x43ae7c
push 0x10
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x43ae7c
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x14]
push eax
push edi
mov dword [esp + 0x3c], 0x10
call dword [sym.imp.WS2_32.dll_accept]
push edi
mov dword [esi + 4], eax
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x14
ret
push ebp
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.0043a1f0
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
add esp, 4
mov ebp, eax
cmp edi, 0xffffffff
je 0x43ae9c
push edi
call ebx
mov ecx, dword [esi]
cmp ecx, 0xffffffff
je 0x43aea6
push ecx
call ebx
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x43aeb1
push eax
call ebx
mov eax, ebp
pop ebp
pop edi
mov dword [esi + 4], 0xffffffff
mov dword [esi], 0xffffffff
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x43c924
Capabilities:
Read file on windows

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, ecx
test edx, edx
jne 0x43c934
mov eax, 0xffffb1e0
pop esi
ret 0xc
mov eax, dword [esi + 8]
push dword [eax]
push dword [esp + 0x10]
push 1
push edx
call fcn.0044ab2c
add esp, 0x10
test eax, eax
je 0x43c95c
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x43c956
mov dword [ecx], eax
xor eax, eax
pop esi
ret 0xc
mov eax, dword [esi + 8]
push dword [eax]
call fcn.0044a757
add esp, 4
test eax, eax
mov eax, dword [esp + 0x10]
je 0x43c984
test eax, eax
je 0x43c97b
mov dword [eax], 0
mov eax, 0xffffb0b2
pop esi
ret 0xc
test eax, eax
je 0x43c98e
mov dword [eax], 0
call fcn.0044a4aa
push dword [eax]
call fcn.0043c6f0
add esp, 4
pop esi
ret 0xc
Function at 0x43cbd0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x258
push ebx
push esi
push edi
call fcn.004109e0
mov eax, dword [ebp + 8]
test eax, eax
je 0x43cdca
cmp byte [eax], 0
je 0x43cdca
push eax
lea ecx, [ebp - 4]
call fcn.00428ee0
push 0
push 0x46ba08
lea ecx, [ebp - 4]
call fcn.004295a0
test al, al
jne 0x43cc42
push 0
push 0x4618d8
lea ecx, [ebp - 4]
call fcn.004295a0
test al, al
jne 0x43cc42
xor eax, eax
lea esp, [esp]
inc eax
cmp byte [eax + 0x46ba14], 0
jne 0x43cc30
push eax
push 0x46ba14
jmp 0x43cc54
xor eax, eax
inc eax
cmp byte [eax + 0x463678], 0
jne 0x43cc44
push eax
push 0x463678
lea ecx, [ebp - 4]
call fcn.00429210
mov esi, dword [ebp - 4]
test esi, esi
jne 0x43cc68
mov esi, 0x4b4542
mov ecx, esi
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43cc70
sub ecx, edx
lea edi, [ecx + 1]
cmp edi, 0x3fffffff
jle 0x43cc88
xor eax, eax
jmp 0x43cca2
lea eax, [edi + edi]
call fcn.0044bd90
mov eax, esp
push 0xfde9
push edi
push esi
push eax
call fcn.0043cb90
add esp, 0x10
lea ecx, [ebp - 0x258]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x43ccce
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0043cde0
add esp, 4
mov esi, eax
jmp 0x43cda8
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
xor ebx, ebx
jmp 0x43cce0
lea eax, [ebp - 0x258]
push eax
call fcn.0043cf50
add esp, 4
test al, al
je 0x43cd6b
test edi, edi
je 0x43ccfa
dec edi
jmp 0x43cd6b
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 2
cmp eax, 0x3fffffff
jle 0x43cd15
xor eax, eax
jmp 0x43cd3a
lea esi, [eax + eax]
mov eax, esi
call fcn.0044bd90
mov eax, esp
push 0xfde9
push esi
lea ecx, [ebp - 0x22c]
push ecx
push eax
call fcn.0043d280
mov esi, dword [ebp + 0x14]
add esp, 0x10
push eax
lea ecx, [ebp + 8]
call fcn.00428ee0
mov ecx, dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
call fcn.00416450
mov eax, dword [ebp + 8]
test eax, eax
je 0x43cd62
add eax, 0xfffffff8
push eax
call fcn.00447dbf
add esp, 4
test esi, esi
je 0x43cd6b
inc ebx
cmp ebx, esi
je 0x43cda6
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x43cce0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, 0x12
je 0x43cda6
push esi
call fcn.0043cde0
add esp, 4
mov esi, eax
jmp 0x43cda8
xor esi, esi
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x43cdbb
add ecx, 0xfffffff8
push ecx
call fcn.00447dbf
add esp, 4
mov eax, esi
lea esp, [ebp - 0x264]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0xffffb1e0
lea esp, [ebp - 0x264]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43d1a0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
test esi, esi
je 0x43d1f4
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43d1b2
sub ecx, edx
lea ebx, [ecx + 1]
cmp ebx, 0x3fffffff
jg 0x43d1f4
lea eax, [ebx + ebx]
call fcn.0044bd90
mov edi, esp
test edi, edi
je 0x43d1f4
push ebx
push edi
push 0xffffffffffffffff
xor eax, eax
push esi
push eax
push 0xfde9
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
neg esi
sbb esi, esi
and esi, edi
jmp 0x43d1f6
xor esi, esi
mov edi, dword [ebp + 8]
test edi, edi
je 0x43d245
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43d202
sub ecx, edx
lea eax, [ecx + 1]
mov dword [ebp + 0xc], eax
cmp eax, 0x3fffffff
jg 0x43d245
add eax, eax
call fcn.0044bd90
mov ebx, esp
test ebx, ebx
je 0x43d245
push dword [ebp + 0xc]
xor eax, eax
push ebx
push 0xffffffffffffffff
push edi
push eax
push 0xfde9
mov word [ebx], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb eax, eax
and eax, ebx
jmp 0x43d247
xor eax, eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x43d26a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0043cde0
add esp, 4
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
xor eax, eax
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x43e1e3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x43e390
push eax
call fcn.004408a0
add esp, 4
cmp eax, 0xffffffff
je 0x43e390
push edi
push dword [esp + 0x40]
push dword [esi + 8]
call fcn.004407f0
mov edi, eax
add esp, 8
test edi, edi
jne 0x43e226
pop edi
mov eax, 0xffffb1db
pop esi
add esp, 0x30
ret 8
push ebx
push 0
push edi
call fcn.00440450
mov esi, dword [esp + 0x48]
add esp, 8
mov ecx, esi
push eax
call fcn.00428fd0
push 1
push edi
call fcn.00440450
add esp, 8
lea ecx, [esi + 4]
push eax
call fcn.00428fd0
push 2
push edi
call fcn.00440450
add esp, 8
lea ecx, [esi + 8]
push eax
call fcn.00428fd0
push 3
push edi
call fcn.00440450
add esp, 8
lea ecx, [esi + 0xc]
push eax
call fcn.00428fd0
push 4
push edi
call fcn.00440450
add esp, 8
lea ecx, [esi + 0x10]
push eax
call fcn.00428fd0
push 5
push edi
call fcn.00440450
add esp, 8
lea ecx, [esi + 0x14]
push eax
call fcn.00428fd0
lea eax, [esi + 0x18]
push eax
lea eax, [esi + 0x2c]
push eax
push edi
call fcn.004404a0
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x1c]
push eax
push edi
call fcn.00440550
mov eax, dword [esp + 0x24]
mov dword [esi + 0x3c], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x40], eax
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x44], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x48], eax
mov eax, dword [esp + 0x34]
mov dword [esi + 0x4c], eax
mov eax, dword [esp + 0x38]
mov dword [esi + 0x50], eax
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x5c], eax
mov eax, dword [esp + 0x40]
mov dword [esi + 0x60], eax
mov eax, dword [esp + 0x44]
mov dword [esi + 0x64], eax
mov eax, dword [esp + 0x48]
mov dword [esi + 0x68], eax
mov eax, dword [esp + 0x4c]
add esp, 0x18
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x6c], eax
mov eax, dword [esp + 0x38]
lea ebx, [esi + 0x7c]
mov ecx, ebx
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
call fcn.004109e0
xor esi, esi
push esi
push edi
call fcn.00440510
add esp, 8
test eax, eax
je 0x43e385
lea ecx, [ecx]
push eax
lea ecx, [esp + 0x48]
call fcn.00428ee0
push eax
mov ecx, ebx
call fcn.00416450
mov eax, dword [esp + 0x44]
test eax, eax
je 0x43e376
add eax, 0xfffffff8
push eax
call fcn.00447dbf
add esp, 4
inc esi
push esi
push edi
call fcn.00440510
add esp, 8
test eax, eax
jne 0x43e350
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x30
ret 8
mov eax, 0xffffb1d7
pop esi
add esp, 0x30
ret 8

Function at 0x43ec30
Capabilities:
Print debug messages

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [esp + 4]
push 0x46bb54
call fcn.0044bdd1
add esp, 8
ret

Function at 0x43f660
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0
jne 0x43f693
push 0x13c
push 1
call fcn.0044be7d
push eax
mov dword [esi + 0x14], eax
call fcn.00443790
mov eax, dword [esi + 0x14]
add esp, 0xc
add eax, 0x58
pop esi
mov dword [esp + 4], eax
jmp fcn.00442d60
pop esi
ret
Function at 0x43fb80
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 0x200
mov eax, ecx
push ebx
push ebp
push dword [esp + 0x220]
cdq
sub eax, edx
mov edx, dword [esp + 0x210]
mov ebp, eax
lea eax, [esp + 0x10c]
push eax
push dword [esp + 0x220]
sar ebp, 1
push dword [esp + 0x220]
and ecx, 1
lea ebx, [edx + ebp]
add ebp, ecx
push ebp
push edx
call fcn.0043f9d0
push dword [esp + 0x238]
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x238]
push dword [esp + 0x238]
push ebp
push ebx
call fcn.0043faa0
mov ebx, dword [esp + 0x250]
add esp, 0x30
xor eax, eax
test ebx, ebx
jle 0x43fc14
mov edx, dword [esp + 0x21c]
mov cl, byte [esp + eax + 8]
xor cl, byte [esp + eax + 0x108]
inc eax
mov byte [eax + edx - 1], cl
cmp eax, ebx
jl 0x43fc00
pop ebp
pop ebx
add esp, 0x200
ret

Function at 0x4420e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
lea ebx, [eax + 0x14]
movzx eax, word [eax]
shl eax, 2
cmp eax, 4
jle 0x44218a
push ebp
push esi
push edi
lea ebp, [eax - 4]
lea ecx, [ecx]
mov esi, dword [ebx]
mov edi, esi
and edi, 0x80808080
mov eax, edi
shr eax, 7
sub edi, eax
and edi, 0x1b1b1b1b
lea eax, [esi + esi]
and eax, 0xfefefefe
xor edi, eax
mov edx, edi
and edx, 0x80808080
mov eax, edx
shr eax, 7
sub edx, eax
lea eax, [edi + edi]
and eax, 0xfefefefe
and edx, 0x1b1b1b1b
xor edx, eax
mov ecx, edx
and ecx, 0x80808080
mov eax, ecx
shr eax, 7
sub ecx, eax
lea eax, [edx + edx]
and eax, 0xfefefefe
and ecx, 0x1b1b1b1b
xor ecx, eax
mov eax, ecx
xor eax, esi
xor ecx, edx
xor edx, eax
rol edx, 0x10
xor ecx, edi
xor edi, eax
ror eax, 8
xor eax, edx
lea ebx, [ebx + 4]
rol edi, 8
xor eax, edi
xor eax, ecx
mov dword [ebx - 4], eax
dec ebp
jne 0x442100
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x442580
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 8
push edi
sub eax, 0
je 0x44259e
dec eax
jne 0x442752
mov eax, 0xe
lea edi, [eax - 6]
jmp 0x4425a6
mov eax, 0xa
lea edi, [eax - 6]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
xor esi, esi
mov word [ebx], ax
mov word [ebx + 2], di
lea ebp, [ebx + 4]
test edi, edi
jle 0x442613
mov edx, dword [esp + 0x20]
add edx, 2
movzx ecx, byte [edx - 2]
movzx eax, byte [edx - 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
mov dword [ebp + esi*4], ecx
movzx ecx, byte [edx + 2]
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 5]
shl ecx, 8
or ecx, eax
mov dword [ebp + esi*4 + 4], ecx
add esi, 2
lea edx, [edx + 8]
cmp esi, edi
jl 0x4425c4
movzx eax, word [ebx]
mov dword [esp + 0x10], 0x494498
lea eax, [eax*4 + 4]
mov dword [esp + 0x14], eax
mov esi, edi
cmp edi, eax
jge 0x442728
mov ecx, ebp
mov dword [esp + 0x28], ebp
lea esp, [esp]
mov eax, esi
cdq
idiv edi
mov ebx, dword [ebp + esi*4 - 4]
test edx, edx
jne 0x4426a7
mov edx, dword [esp + 0x10]
mov eax, ebx
shr eax, 0x10
and eax, 0xff
movzx ecx, byte [eax + str.cw]
mov eax, ebx
shr eax, 8
and eax, 0xff
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
movzx eax, bl
shl ecx, 8
movzx eax, byte [eax + str.cw]
shr ebx, 0x18
or ecx, eax
movzx ebx, byte [ebx + str.cw]
movzx eax, byte [edx]
shl ecx, 8
or ebx, ecx
mov ecx, dword [esp + 0x28]
shl eax, 0x18
xor ebx, eax
inc edx
mov dword [esp + 0x10], edx
cmp edi, 8
jne 0x44270a
mov eax, esi
and eax, reloc.WS2_32.dll_getsockopt
jns 0x4426ba
dec eax
or eax, 0xfffffff8
inc eax
cmp eax, 4
jne 0x44270a
mov eax, ebx
shr eax, 0x10
and eax, 0xff
movzx ecx, byte [eax + str.cw]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or ecx, eax
mov eax, ebx
shr eax, 8
and eax, 0xff
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
movzx eax, bl
shl ecx, 8
movzx ebx, byte [eax + str.cw]
or ebx, ecx
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx]
xor eax, ebx
mov dword [ebp + esi*4], eax
inc esi
add ecx, 4
mov dword [esp + 0x28], ecx
cmp esi, dword [esp + 0x14]
jl 0x442640
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
pop esi
mov eax, dword [ecx]
mov dword [ebx + 0x1e4], eax
mov eax, dword [ecx + 4]
mov dword [ebx + 0x1e8], eax
mov eax, dword [ecx + 8]
mov dword [ebx + 0x1ec], eax
mov eax, dword [ecx + 0xc]
pop ebp
mov dword [ebx + 0x1f0], eax
pop ebx
pop edi
add esp, 8
ret