joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405e7c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x4229f4], esi
push edi
jne 0x405eb6
mov ecx, 0x4229f0
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x405e92
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x422df0
jl 0x405e8d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x405eeb
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4229f0]
xor eax, esi
inc ecx
dec edx
jne 0x405ece
pop edi
pop esi
not eax
ret 0xc

Function at 0xaee0b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00aee200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xaee0d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaee0c2
add dl, dl
jne 0xaee0e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaee134
xor eax, eax
add dl, dl
jne 0xaee0ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaee1d5
add dl, dl
jne 0xaee0fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaee108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaee113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaee11e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xaee12a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xaee0cd
mov eax, 1
add dl, dl
jne 0xaee142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaee14d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaee139
sub eax, ebx
mov ebx, 1
jne 0xaee180
mov ecx, 1
add dl, dl
jne 0xaee166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xaee171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaee15d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaee0cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xaee197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xaee1a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaee18e
cmp eax, 0x7d00
jae 0xaee1c5
cmp eax, 0x500
jb 0xaee1c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaee0cd
cmp eax, 0x7f
ja 0xaee1c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaee0cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xaee1f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xaee0cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4096e0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
jmp 0x409789
cmp dword [esi + 0x10], 0x1000
jne 0x409775
test byte [esi + 0x15], 1
jne 0x409775
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409734
cmp eax, 2
je 0x409734
cmp eax, 0x10
je 0x409734
cmp eax, 0x20
jne 0x409749
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409749
mov bl, 1
xor ebp, ebp
jmp 0x40975a
mov eax, dword [esi]
add eax, ebp
call fcn.004096d8
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x40974d
test bl, bl
je 0x409775
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40970c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5c002b
Capabilities:
Allocate or change rwx memory

Disassembly:
pushal
pushfd
push 0x5c000b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x5c0018
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5c004c], eax
jmp 0x5c0050
push 0x5c0062
push 0x40
push 0x10
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x5c0066
mov eax, dword [0x5c004c]
mov byte [eax], 0x68
mov dword [eax + 1], 0x5c0080
mov byte [eax + 5], 0xc3
popfd
popal
jmp 0x5c00d5
pushal
pushfd
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x5c00d1], eax
mov dword [sym.imp.KERNEL32.dll_VirtualProtect], reloc.KERNEL32.dll_VirtualProtect
popfd
popal
push section..adata
ret
Function at 0x4035f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4004
call fcn.004533e0
mov eax, dword [0x491700]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x403621
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004533ca
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x84]
push edi
push 0
push 0x4000
lea eax, [ebp - 0x4004]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x4036bc
call fcn.0045320c
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi], eax
call fcn.0045320c
cmp dword [eax], 2
je 0x403668
call fcn.0045320c
cmp dword [eax], 0x2733
jne 0x403673
call fcn.0045320c
mov dword [eax], 0xb
call fcn.0045320c
cmp dword [eax], 0xb
jne 0x40368a
test byte [esi + 0x88], 1
je 0x403722
mov dword [esi], 1
call fcn.0045320c
mov edx, dword [eax]
push 0x80
add esi, 4
push esi
push edx
call fcn.00435c70
add esp, 0xc
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004533ca
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x4036e4
mov edx, str.Server_closed_the_connection
mov eax, 3
mov ecx, esi
call fcn.004034f0
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004533ca
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, eax
mov eax, dword [esi + 0x90]
lea edi, [ebp - 0x4004]
call fcn.00402c60
pop ebx
test eax, eax
je 0x403722
mov eax, dword [esi + 0x90]
lea edx, [eax + 4]
mov eax, dword [eax]
mov ecx, esi
call fcn.004034f0
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004533ca
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004533ca
mov esp, ebp
pop ebp
ret

Function at 0x403740
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, eax
cmp dword [esi], 0
jne 0x4037d8
mov eax, dword [esi + 0x8c]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x40380e
push 0
push ecx
push eax
mov eax, dword [esi + 0x84]
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x4037dd
push edi
call fcn.0045320c
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi], eax
call fcn.0045320c
cmp dword [eax], 2
pop edi
je 0x40379b
call fcn.0045320c
cmp dword [eax], 0x2733
jne 0x4037a6
call fcn.0045320c
mov dword [eax], 0xb
call fcn.0045320c
cmp dword [eax], 0xb
jne 0x4037b9
test byte [esi + 0x88], 1
je 0x40380e
mov dword [esi], 1
call fcn.0045320c
mov ecx, dword [eax]
push 0x80
add esi, 4
push esi
push ecx
call fcn.00435c70
add esp, 0xc
or eax, 0xffffffff
pop esi
ret
test eax, eax
jle 0x40380e
mov ecx, dword [esi + 0x8c]
cmp eax, dword [ecx - 8]
jne 0x4037fc
push ecx
call fcn.00421e90
add esp, 4
call fcn.00421da0
jmp 0x403808
push 0xffffffffffffffff
push eax
push ecx
call fcn.00422210
add esp, 0xc
mov dword [esi + 0x8c], eax
test ebx, ebx
je 0x403822
mov edx, dword [esi + 0x8c]
xor eax, eax
cmp dword [edx - 8], eax
sete al
mov dword [ebx], eax
xor eax, eax
pop esi
ret
Function at 0x4038e0
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
push 6
push 1
push 2
mov edi, eax
mov dword [ebp - 8], 1
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x403983
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.socket_error:__d_n
call fcn.00421da0
push eax
call fcn.00422170
add esp, 0xc
mov dword [edi], 1
test eax, eax
je 0x403961
mov ecx, eax
lea esi, [ecx + 1]
lea ecx, [ecx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x403930
sub ecx, esi
mov esi, ecx
cmp esi, 0x7f
jb 0x403945
mov esi, 0x7f
push esi
push eax
lea eax, [edi + 4]
push eax
call fcn.004534a0
add esp, 0xc
mov byte [esi + edi + 4], 0
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0045320c
mov ecx, dword [eax]
push 0x80
add edi, 4
push edi
push ecx
call fcn.00435c70
add esp, 0xc
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
push 4
lea ecx, [ebp - 4]
push ecx
push 0x80
push 0xffff
push esi
mov dword [ebp - 4], 0x20001
call fcn.00435640
push 4
lea edx, [ebp - 8]
push edx
push 4
push 0xffff
push esi
call fcn.00435640
add esp, 0x28
cmp eax, 0xffffffff
jne 0x4039ea
mov dword [edi], 1
call fcn.0045320c
mov eax, dword [eax]
push 0x80
add edi, 4
push edi
push eax
call fcn.00435c70
add esp, 0xc
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x403a00
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, eax
lea eax, [ebp - 4]
push eax
push 0x8004667e
push ebx
mov dword [ebp - 4], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x403ac2
push esi
call fcn.0045320c
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi], eax
call fcn.0045320c
mov ecx, dword [eax]
push ecx
push str.ioctlsocket_FIONBIO_:__d_n
call fcn.00421da0
push eax
call fcn.00422170
add esp, 0xc
mov dword [edi], 1
test eax, eax
je 0x403a99
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x403a61
sub ecx, esi
mov esi, ecx
cmp esi, 0x7f
jb 0x403a76
mov esi, 0x7f
push esi
push eax
lea edx, [edi + 4]
push edx
call fcn.004534a0
add esp, 0xc
push ebx
mov byte [esi + edi + 4], 0
call dword [sym.imp.WS2_32.dll_closesocket]
pop esi
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
call fcn.0045320c
mov eax, dword [eax]
push 0x80
add edi, 4
push edi
push eax
call fcn.00435c70
add esp, 0xc
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
pop esi
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x403cf0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x88]
mov ebx, eax
mov eax, esi
and edi, 1
call fcn.004038e0
mov dword [ebp - 4], eax
test eax, eax
js 0x403df3
mov ecx, dword [ebp + 0xc]
mov eax, 2
push ecx
mov word [ebx], ax
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [ebp + 8]
push edx
mov word [ebx + 2], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x403d47
test eax, eax
je 0x403d47
mov dword [ebx + 4], eax
jmp 0x403e07
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x403dfd
mov ecx, dword [ebp + 8]
push ecx
push str.cant_resolve:__s_n
call fcn.00421da0
push eax
call fcn.00422170
add esp, 0xc
mov dword [esi], 2
test eax, eax
je 0x403dbc
mov ecx, eax
lea edi, [ecx + 1]
nop
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x403d80
sub ecx, edi
mov edi, ecx
cmp edi, 0x7f
jb 0x403d95
mov edi, 0x7f
push edi
push eax
lea edx, [esi + 4]
push edx
call fcn.004534a0
mov ecx, dword [ebp - 4]
add esp, 0xc
push ecx
mov byte [edi + esi + 4], 0
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
push 0x3ed
push str.....depshiredishiredis.c
push str.type__REDIS_ERR_IO
call fcn.0045c66f
call fcn.0045320c
mov eax, dword [eax]
push 0x80
add esi, 4
push esi
push eax
call fcn.00435c70
mov ecx, dword [ebp - 4]
add esp, 0x18
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [ebx + 4], ecx
mov ebx, dword [ebp - 4]
mov eax, esi
call fcn.00403ad0
test eax, eax
jne 0x403df3
test edi, edi
jne 0x403e24
mov eax, esi
call fcn.00403a00
test eax, eax
jne 0x403df3
mov edx, dword [ebp - 4]
pop edi
mov dword [esi + 0x84], edx
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404fa0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2ee18
call fcn.004533e0
mov eax, dword [0x491700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push edi
push 0x3e8
push eax
push esi
call fcn.00453320
mov dword [ebp - 0x2ee18], eax
imul eax, eax, 0x3e8
sub esi, eax
mov al, byte [ebp + 0xc]
imul esi, esi, 0x3e8
mov ecx, 1
mov dword [ebp - 0x2ee14], edx
mov dword [ebp - 0x2ee14], esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xfa08], edi
mov dword [ebp - 0x1f40c], edi
mov dword [ebp - 0x2ee10], edi
test cl, al
je 0x40501b
mov dword [ebp - 0xfa04], esi
mov dword [ebp - 0xfa08], ecx
test al, 2
je 0x40502b
mov dword [ebp - 0x1f408], esi
mov dword [ebp - 0x1f40c], ecx
lea ecx, [ebp - 0x2ee18]
push ecx
lea edx, [ebp - 0x2ee10]
push edx
lea eax, [ebp - 0x1f40c]
push eax
lea ecx, [ebp - 0xfa08]
push ecx
lea edx, [esi + 1]
push edx
call dword [sym.imp.WS2_32.dll_select]
cmp eax, edi
jle 0x405081
lea eax, [ebp - 0xfa08]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x40506b
mov edi, 1
lea ecx, [ebp - 0x1f40c]
push ecx
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x40507f
or edi, 2
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004533ca
mov esp, ebp
pop ebp
ret

Function at 0x405220
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push 0x8004667e
push ecx
mov dword [ebp - 4], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x405273
push esi
call fcn.0045320c
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi], eax
call fcn.0045320c
mov edx, dword [eax]
mov eax, dword [ebp + 8]
push edx
push str.ioctlsocket_FIONBIO_:__d_n
call fcn.00405200
add esp, 8
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4053a0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x4053b7
test eax, eax
jne 0x4053e0
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x4053d9
mov eax, dword [ebp + 8]
push esi
push str.cant_resolve:__s
call fcn.00405200
add esp, 8
or eax, 0xffffffff
pop esi
pop ebp
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edx, dword [ebp + 0x10]
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4053f0
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4054a0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x491700]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
mov eax, 2
call fcn.00405400
mov ebx, eax
cmp ebx, 0xffffffff
je 0x405513
mov ecx, dword [ebp + 8]
mov eax, 2
push ecx
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
push esi
mov word [ebp - 0x12], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x4054f1
test eax, eax
je 0x4054f1
mov dword [ebp - 0x10], eax
jmp 0x405530
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x405526
push esi
push str.cant_resolve:__s_n
mov eax, edi
call fcn.00405200
add esp, 8
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004533ca
mov esp, ebp
pop ebp
ret
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
push 0x10
lea edx, [ebp - 0x14]
push edx
push ebx
call fcn.00437ab0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4055aa
call fcn.0045320c
cmp dword [eax], 0x2733
je 0x40555e
call fcn.0045320c
cmp dword [eax], 0x3e5
jne 0x405569
call fcn.0045320c
mov dword [eax], 0x70
call fcn.0045320c
cmp dword [eax], 0x70
jne 0x405579
test byte [ebp + 0xc], 1
jne 0x4055aa
call fcn.0045320c
mov eax, dword [eax]
push eax
push str.connect:__d_n
mov eax, edi
call fcn.00405200
add esp, 8
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004533ca
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.004533ca
mov esp, ebp
pop ebp
ret
Function at 0x40a2e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x491700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x40c], eax
call fcn.00421da0
mov edi, eax
test ebx, ebx
je 0x40a3bf
cmp byte [ebx], 0x2d
jne 0x40a400
cmp byte [ebx + 1], 0
jne 0x40a400
call fcn.0045532d
mov esi, eax
push esi
push 3
lea ecx, [ebp - 0x408]
push 1
push ecx
call fcn.00454932
add esp, 0x10
cmp eax, 3
jne 0x40a36c
cmp byte [ebp - 0x408], 0xef
jne 0x40a35f
cmp byte [ebp - 0x407], 0xbb
jne 0x40a35f
cmp byte [ebp - 0x406], 0xbf
je 0x40a36c
push 0
push 0
push esi
call fcn.0045556c
add esp, 0xc
push esi
lea edx, [ebp - 0x408]
push 0x401
push edx
call fcn.00454bf2
add esp, 0xc
test eax, eax
je 0x40a3ad
lea eax, [ebp - 0x408]
push eax
push edi
call fcn.00422090
push esi
lea ecx, [ebp - 0x408]
push 0x401
push ecx
mov edi, eax
call fcn.00454bf2
add esp, 0x14
test eax, eax
jne 0x40a385
call fcn.0045532d
cmp esi, eax
je 0x40a3bf
push esi
call fcn.00454006
add esp, 4
mov esi, dword [ebp - 0x40c]
test esi, esi
je 0x40a3e0
push 0x474a38
push edi
call fcn.00422090
push esi
push eax
call fcn.00422090
add esp, 0x10
mov edi, eax
push edi
call fcn.004091b0
push edi
call fcn.00421e90
mov ecx, dword [ebp - 4]
add esp, 8
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004533ca
mov esp, ebp
pop ebp
ret
push 0x473dac
push ebx
call fcn.0045431c
mov esi, eax
add esp, 8
test esi, esi
jne 0x40a32b
push ebx
push str.Fatal_error__cant_open_config_file__s
push 3
call fcn.0041a370
add esp, 0xc
push 1
call fcn.00453a84
int3

Function at 0x40c830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor esi, esi
xor edi, edi
cmp dword [ebp + 0x18], esi
jb 0x40c888
ja 0x40c845
cmp dword [ebp + 0x14], esi
jbe 0x40c888
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
lea esp, [esp]
mov ecx, dword [ebp + 0x10]
movzx ecx, byte [esi + ecx]
movzx ebx, al
shrd eax, edx, 8
xor ecx, ebx
xor eax, dword [ecx*8 + 0x474d08]
shr edx, 8
xor edx, dword [ecx*8 + 0x474d0c]
add esi, 1
adc edi, 0
cmp edi, dword [ebp + 0x18]
jb 0x40c850
ja 0x40c883
cmp esi, dword [ebp + 0x14]
jb 0x40c850
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret
Function at 0x40ddb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x491700]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x74]
push eax
call fcn.00428be0
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x74]
push edi
push edx
call fcn.00428c20
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x18]
push ecx
call fcn.00428cd0
lea ebx, [ebp - 0x15]
sub ebx, esi
mov dword [ebp - 0x7c], ebx
lea ecx, [ebp - 0x18]
lea edi, [ebp - 0x17]
lea edx, [ebp - 0x16]
sub ecx, esi
sub edi, esi
sub edx, esi
lea ebx, [ebp - 0x14]
add esp, 0x18
sub ebx, esi
mov eax, esi
mov dword [ebp - 0x78], ebx
mov esi, 4
movzx ebx, byte [ecx + eax]
xor byte [eax], bl
movzx ebx, byte [edi + eax]
xor byte [eax + 1], bl
movzx ebx, byte [edx + eax]
xor byte [eax + 2], bl
mov ebx, dword [ebp - 0x7c]
movzx ebx, byte [ebx + eax]
xor byte [eax + 3], bl
mov ebx, dword [ebp - 0x78]
movzx ebx, byte [ebx + eax]
xor byte [eax + 4], bl
add eax, 5
dec esi
jne 0x40de16
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004533ca
mov esp, ebp
pop ebp
ret

Function at 0x40f210
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x48f008]
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
xor ecx, edi
cmp edi, 4
jl 0x40f265
push ebx
push esi
mov esi, edi
shr esi, 2
mov eax, esi
neg eax
lea edi, [edi + eax*4]
jmp 0x40f240
mov eax, dword [edx]
imul ecx, ecx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
mov ebx, eax
shr ebx, 0x18
xor ebx, eax
imul ebx, ebx, 0x5bd1e995
xor ecx, ebx
add edx, 4
dec esi
jne 0x40f240
pop esi
pop ebx
dec edi
je 0x40f280
dec edi
je 0x40f277
dec edi
jne 0x40f28b
movzx eax, byte [edx + 2]
shl eax, 0x10
xor ecx, eax
movzx eax, byte [edx + 1]
shl eax, 8
xor ecx, eax
movzx edx, byte [edx]
xor ecx, edx
imul ecx, ecx, 0x5bd1e995
mov edx, ecx
shr edx, 0xd
xor edx, ecx
imul edx, edx, 0x5bd1e995
mov eax, edx
shr eax, 0xf
xor eax, edx
pop edi
pop ebp
ret
Function at 0x40f3c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ebx
lea ebx, [ebx]
cmp dword [esi + 0x28], 0xffffffff
mov edx, 0x64
je 0x40f498
nop
dec edx
cmp dword [esi + 0x14], 0
mov dword [ebp + 8], edx
je 0x40f4a1
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 8]
cmp dword [ecx + eax*4], 0
jne 0x40f41a
lea ebx, [ebx]
inc eax
mov dword [esi + 0x28], eax
cmp dword [ecx + eax*4], 0
je 0x40f410
mov eax, dword [esi + 0x28]
mov edi, dword [ecx + eax*4]
test edi, edi
je 0x40f454
mov ecx, dword [esi]
mov edx, dword [edi]
mov eax, dword [ecx]
mov ebx, dword [edi + 0x10]
push edx
call eax
and eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx + eax*4]
mov dword [edi + 0x10], edx
mov ecx, dword [esi + 0x18]
mov dword [ecx + eax*4], edi
dec dword [esi + 0x14]
inc dword [esi + 0x24]
add esp, 4
mov edi, ebx
test ebx, ebx
jne 0x40f424
mov edx, dword [ebp + 8]
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 8]
mov dword [ecx + eax*4], 0
inc dword [esi + 0x28]
test edx, edx
jne 0x40f3f0
mov ebx, dword [ebp - 4]
add ebx, 0x64
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
xor ecx, ecx
sub edi, dword [ebp - 0xc]
mov eax, ecx
sbb ecx, eax
mov eax, dword [ebp + 0xc]
cdq
cmp ecx, edx
jg 0x40f498
jl 0x40f3e0
cmp edi, eax
jbe 0x40f3e0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 8]
push edx
call fcn.004392f0
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x20]
mov dword [esi + 8], eax
mov eax, dword [esi + 0x24]
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 4]
add esp, 4
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
pop edi
mov dword [esi + 0x28], 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x415020
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
call fcn.00414e70
mov esi, eax
add esp, 4
test esi, esi
jne 0x41505d
call fcn.0045320c
mov eax, dword [eax]
push edi
push eax
call fcn.00453433
add esp, 4
push eax
push str.Error_registering_fd_event_for_the_new_client:__s__fd_d_
push 3
call fcn.0041a370
push edi
call fcn.00437790
add esp, 0x14
pop esi
pop ebp
ret
mov ecx, dword [0x493b58]
mov edx, dword [ecx + 0x14]
cmp edx, dword [0x493f90]
jbe 0x41509a
mov eax, dword [esi]
push 0
push 0x24
push str._ERR_max_number_of_clients_reached_r_n
push eax
call dword [sym.imp.WS2_32.dll_send]
add dword [0x493ce8], 1
push esi
adc dword [0x493cec], 0
call fcn.004121c0
add esp, 4
pop esi
pop ebp
ret
add dword [0x493cb0], 1
mov ecx, dword [ebp + 8]
adc dword [0x493cb4], 0
or dword [esi + 0x58], ecx
pop esi
pop ebp
ret