joyce8/EMBER2024-capa huggingface dataset:
Function at 0x522a30
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x20
mov eax, dword [0x463df0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
xor ebx, ebx
cmp dword [0x59e6cc], ebx
jne 0x522c28
mov eax, dword [0x59f4b0]
push ebp
push esi
cmp eax, 0x463bbc
je 0x522a71
cmp eax, ebx
je 0x522a71
nop
mov esi, dword [eax]
push eax
call fcn.00526d54
add esp, 4
mov eax, esi
cmp esi, ebx
jne 0x522a60
mov esi, 1
push 0x100
mov dword [0x59f4b0], ebx
mov dword [0x59e6cc], esi
mov byte [0x59e6d0], bl
call fcn.00528917
mov ebp, eax
add esp, 4
cmp ebp, ebx
je 0x522bf4
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], 0x59f4b0
push edi
lea esp, [esp]
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea ecx, [esp + 0x24]
push 0x46f780
push ecx
mov dword [esp + 0x1c], ebx
call esi
push 0x4651d5
push 0x46d0e4
push ebp
call esi
push 0xff
push ebp
lea edx, [esp + 0x40]
push edx
push 9
call fcn.00524430
add esp, 0x28
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], ebp
call fcn.0051f9c0
mov ecx, dword [esp + 0x10]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x522b04
sub eax, esi
mov edi, eax
lea eax, [edi + ecx - 1]
cmp eax, ecx
jbe 0x522b2f
mov dl, byte [eax]
cmp dl, 0x20
je 0x522b23
cmp dl, 9
jne 0x522b2f
mov byte [eax], bl
mov ecx, dword [esp + 0x10]
dec eax
dec edi
cmp eax, ecx
ja 0x522b17
cmp edi, ebx
je 0x522bea
push ecx
call sub.WSOCK32.dll_inet_addr
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
jne 0x522b79
mov eax, dword [esp + 0x10]
mov ecx, 0x46f770
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x522b70
cmp dl, bl
je 0x522b6c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x522b70
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x522b50
xor eax, eax
jmp 0x522b75
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x522b7b
xor edi, edi
lea ecx, [edi + 0xd]
push ecx
call fcn.00528917
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x522bea
mov dword [esi + 8], ebx
cmp edi, ebx
je 0x522bbf
mov edx, dword [esp + 0x10]
inc edi
push edi
push edx
lea eax, [esi + 0xc]
push eax
call fcn.00526df0
mov edx, dword [esp + 0x24]
add esp, 0xc
inc dword [esp + 0x14]
mov dword [esi + 4], ebx
mov dword [esi], ebx
mov dword [edx], esi
mov dword [esp + 0x18], esi
jmp 0x522ab0
mov ecx, dword [esp + 0x1c]
push esi
mov dword [esi + 4], ecx
mov byte [esi + 0xc], bl
call fcn.00522850
mov edx, dword [esp + 0x18]
or byte [0x59e6d0], al
inc dword [esp + 0x14]
mov dword [esi], ebx
mov dword [edx], esi
mov dword [esp + 0x18], esi
jmp 0x522ab0
push ebp
call fcn.00526d54
add esp, 4
pop edi
pop esi
pop ebp
cmp dword [0x59f4b0], ebx
je 0x522c1e
call fcn.005229e0
or byte [0x59e6d0], al
mov al, byte [0x59e6d0]
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00526a8a
add esp, 0x20
ret
mov dword [0x59f4b0], 0x463bbc
mov ecx, dword [esp + 0x20]
mov al, byte [0x59e6d0]
pop ebx
xor ecx, esp
call fcn.00526a8a
add esp, 0x20
ret
Function at 0x522c40
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x18
mov eax, dword [0x463df0]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
xor ebp, ebp
push ebp
push 1
push 2
call sub.WSOCK32.dll_socket
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x522c78
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00526a8a
add esp, 0x18
ret 0x10
push esi
push 4
lea eax, [esp + 0x10]
push eax
push 1
push 6
push ebx
mov dword [esp + 0x20], 1
call sub.WSOCK32.dll_setsockopt
xor eax, eax
push 0x10
lea edx, [esp + 0x14]
push edx
mov ecx, 2
mov dword [esp + 0x18], eax
push ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov word [esp + 0x1c], cx
call sub.WSOCK32.dll_bind
cmp eax, 0xffffffff
je 0x522d25
push 0x64
call fcn.0051f5b0
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x522d25
push edi
push 0x64
push 0
push ebp
call fcn.00526600
mov ecx, dword [esp + 0x3c]
mov esi, dword [esp + 0x38]
mov dword [ebp + 4], ebx
mov eax, dword [0x59e6b8]
mov dword [ebp], eax
mov eax, dword [esp + 0x44]
mov dword [0x59e6b8], ebp
mov dword [ebp + 0x3c], ecx
lea edi, [ebp + 0xc]
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
xor esi, esi
add esp, 0xc
mov dword [ebp + 0x24], esi
mov dword [ebp + 0x60], esi
pop edi
cmp eax, esi
je 0x522d60
push eax
call fcn.0051f5b0
add esp, 4
mov dword [ebp + 0x60], eax
cmp eax, esi
jne 0x522d4e
push ebx
call sub.WSOCK32.dll_closesocket
test ebp, ebp
jne 0x522d38
push ebp
call fcn.00526d54
add esp, 4
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00526a8a
add esp, 0x18
ret 0x10
mov ecx, dword [esp + 0x30]
mov edx, eax
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x522d54
jmp 0x522d77
push 2
call fcn.0051f5b0
mov dword [ebp + 0x60], eax
mov byte [eax], 0
mov edx, dword [ebp + 0x60]
add esp, 4
mov byte [edx + 1], 0
mov ecx, dword [esp + 0x20]
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.00526a8a
add esp, 0x18
ret 0x10

Function at 0x522e00
Capabilities:
Connect socket

Disassembly:
sub esp, 0x14
mov eax, dword [0x463df0]
xor eax, esp
mov dword [esp + 0x10], eax
movzx edx, word [0x59e6c0]
xor eax, eax
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [esi + 0x54]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov eax, 2
push edx
mov word [esp + 8], ax
mov dword [esp + 0xc], ecx
call sub.WSOCK32.dll_htons
mov ecx, dword [esi + 4]
mov word [esp + 6], ax
push 0x10
lea eax, [esp + 8]
push eax
push ecx
call sub.WSOCK32.dll_connect
pop esi
test eax, eax
jge 0x522e7a
mov dword [0x463b34], 0x69
xor eax, eax
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00526a8a
add esp, 0x14
ret 4
mov ecx, dword [esp + 0x10]
xor ecx, esp
mov eax, 1
call fcn.00526a8a
add esp, 0x14
ret 4
Function at 0x522e90
Capabilities:
Get hostname

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov esi, eax
xor ebx, ebx
xor edi, edi
test esi, esi
jne 0x522eba
push ebp
call fcn.0051f5b0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x522eb8
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov esi, ebx
push ebp
push esi
call sub.WSOCK32.dll_gethostname
cmp eax, 0xffffffff
je 0x522edc
mov eax, esi
lea edx, [eax + 1]
jmp 0x522ed0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x522ed0
sub eax, edx
lea edi, [eax + 1]
push ebx
call fcn.00526d54
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x522ef0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x128
mov eax, dword [0x463df0]
xor eax, esp
mov dword [esp + 0x124], eax
mov eax, dword [esp + 0x130]
mov ecx, dword [0x463bb8]
push ebx
mov ebx, dword [esp + 0x130]
push esi
mov dword [esp + 0xc], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], 1
lea ebx, [ebx]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, ebx
sub ecx, eax
jns 0x522f3e
xor ecx, ecx
cmp dword [0x59e6b4], 0
jne 0x522fe6
imul ecx, ecx, 0x3e8
lea edx, [esp + 0x10]
push edx
push 0
push 0
lea eax, [esp + 0x24]
push eax
push 0x40
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], ecx
call sub.WSOCK32.dll_select
cmp eax, 1
jl 0x522fe6
mov esi, dword [0x59e6bc]
mov eax, dword [0x463bb8]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x120]
push edx
push 0
push 0x7fff
push esi
push eax
mov dword [esp + 0x20], 0x10
call sub.WSOCK32.dll_recvfrom
cmp eax, 0xffffffff
je 0x522fe6
test byte [esi + 1], 0x80
je 0x522f30
cmp byte [esi + 6], 0x12
jne 0x522f30
mov eax, dword [esp + 0xc]
test eax, eax
je 0x522fcb
mov ecx, dword [esp + 0x120]
mov dword [eax], ecx
mov eax, esi
mov ecx, dword [esp + 0x12c]
pop esi
pop ebx
xor ecx, esp
call fcn.00526a8a
add esp, 0x128
ret 8
xor eax, eax
jmp 0x522fcd
Function at 0x523030
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x110
mov eax, dword [0x59e6bc]
push ebx
push ebp
mov ebp, dword [esp + 0x124]
push esi
imul ebp, ebp, 0x3e8
push edi
mov dword [esp + 0x10], 1
mov edi, eax
mov ebx, eax
mov esi, 0x7fff
lea ecx, [ecx]
mov eax, dword [esp + 0x124]
mov ecx, dword [eax + 4]
lea edx, [esp + 0x14]
push edx
push 0
push 0
lea eax, [esp + 0x28]
push eax
push 0x40
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], ebp
call sub.WSOCK32.dll_select
cmp eax, 1
jl 0x5230f0
mov ecx, dword [esp + 0x124]
mov edx, dword [ecx + 4]
push 0
push esi
push ebx
push edx
call sub.WSOCK32.dll_recv
test eax, eax
je 0x523109
cmp eax, 0xffffffff
je 0x523122
cmp dword [esp + 0x10], 0
je 0x5230e3
cmp byte [edi], 0xb2
jne 0x523060
mov cl, byte [esp + 0x128]
cmp byte [edi + 6], cl
jne 0x523060
test byte [edi + 1], 0x80
je 0x523060
movzx esi, word [edi + 2]
mov dword [esp + 0x10], 0
cmp esi, eax
jbe 0x52313b
sub esi, eax
add ebx, eax
jmp 0x523060
pop edi
pop esi
pop ebp
mov dword [0x463b34], 0x63
xor eax, eax
pop ebx
add esp, 0x110
ret 0xc
pop edi
pop esi
pop ebp
mov dword [0x463b34], 0x65
xor eax, eax
pop ebx
add esp, 0x110
ret 0xc
pop edi
pop esi
pop ebp
mov dword [0x463b34], 0x62
xor eax, eax
pop ebx
add esp, 0x110
ret 0xc
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 0xc
Function at 0x523150
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x463df0]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push esi
push 0x100
xor ebx, ebx
lea eax, [esp + 0x10]
push ebx
push eax
call fcn.00526600
add esp, 0xc
push 0xff
lea ecx, [esp + 0x10]
push ecx
push 0x46ca40
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, ebx
je 0x5232d4
cmp esi, 0x20
jae 0x5232d4
mov ecx, 0x46ca38
lea eax, [esp + 0xc]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x5231d0
cmp dl, bl
je 0x5231cc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x5231d0
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x5231b0
xor eax, eax
jmp 0x5231d5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x5232d4
mov ecx, 0x46ca30
lea eax, [esp + 0xc]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x523206
cmp dl, bl
je 0x523202
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x523206
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x5231e6
xor eax, eax
jmp 0x52320b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x5232d4
push 8
lea edx, [esp + 0x10]
push 0x46ca24
push edx
call fcn.0052865a
add esp, 0xc
test eax, eax
jne 0x52328f
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
push 0x46ca18
push ecx
mov dword [esp + 0x14], ebx
call fcn.00529f8d
add esp, 0xc
cmp eax, 1
jne 0x52326d
mov edx, dword [esp + 8]
lea eax, [edx + 1]
and eax, 0x800000ff
jns 0x523260
dec eax
or eax, 0xffffff00
inc eax
movzx ax, byte [eax + 0x463bd0]
movzx ebx, ax
jmp 0x5232af
xor eax, eax
cmp esi, ebx
jbe 0x5232b6
movsx ecx, byte [esp + eax + 0xc]
movzx edx, bx
xor ecx, edx
movzx cx, byte [ecx + 0x463bd0]
inc eax
movzx ebx, cx
cmp eax, esi
jb 0x523273
jmp 0x5232af
xor eax, eax
cmp esi, ebx
jbe 0x5232b6
movsx edx, byte [esp + eax + 0xc]
movzx ecx, bx
xor edx, ecx
movzx dx, byte [edx + 0x463bd0]
inc eax
movzx ebx, dx
cmp eax, esi
jb 0x523295
xor eax, eax
cmp ax, bx
jne 0x5232bb
mov ebx, 0xff
pop esi
mov al, bl
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00526a8a
add esp, 0x108
ret
mov ecx, dword [esp + 0x10c]
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.00526a8a
add esp, 0x108
ret
Function at 0x5236a0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x18
mov eax, dword [0x463df0]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
mov eax, dword [esi + 8]
push 0
and eax, 0xfffffffd
push 1
or eax, 1
push 2
mov dword [esi + 8], eax
call sub.WSOCK32.dll_socket
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x523744
push 4
lea ecx, [esp + 8]
push ecx
push 1
push 6
push eax
mov dword [esp + 0x18], 1
call sub.WSOCK32.dll_setsockopt
mov ecx, dword [esi + 4]
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
push 0x10
lea eax, [esp + 0xc]
push eax
mov edx, 2
push ecx
mov word [esp + 0x14], dx
call sub.WSOCK32.dll_bind
cmp eax, 0xffffffff
je 0x523744
or dword [esi + 0xc], 8
test dword [esi + 0x3c], 0x200000
movzx eax, word [esi + 0x44]
je 0x523731
movzx eax, word [esi + 0x1e]
push 0
push 0
push 0
push eax
push 0
push esi
call fcn.005232f0
test eax, eax
jne 0x523766
mov dword [0x463b34], 0x63
or dword [esi + 8], 2
xor eax, eax
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00526a8a
add esp, 0x18
ret 4
mov edx, dword [0x463b50]
mov ecx, dword [esp + 0x18]
pop esi
mov dword [edx + 0x14], eax
xor ecx, esp
mov eax, 1
call fcn.00526a8a
add esp, 0x18
ret 4

Function at 0x523a40
Capabilities:
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
sub esp, 0x1a8
mov eax, dword [0x463df0]
xor eax, esp
mov dword [esp + 0x1a4], eax
cmp dword [0x59e6c8], 0
jne 0x523b41
lea eax, [esp + 0x14]
push eax
push 0x101
mov dword [0x59e6c8], 1
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x523b41
push 4
push 0x59e6c0
push 0x46f78c
push 7
mov dword [0x59e6c4], 1
call fcn.00524430
add esp, 0x10
test eax, eax
je 0x523ab6
mov eax, dword [0x59e6c0]
test eax, eax
je 0x523ab6
cmp eax, 0xffff
jbe 0x523ac0
mov dword [0x59e6c0], 0x574b
push 0x7fff
call fcn.00528917
add esp, 4
mov dword [0x59e6bc], eax
test eax, eax
je 0x523b3c
push 0
push 2
push 2
call sub.WSOCK32.dll_socket
mov dword [0x463bb8], eax
cmp eax, 0xffffffff
je 0x523b3c
mov ecx, 2
push 4
mov word [esp + 8], cx
lea ecx, [esp + 4]
push ecx
push 0x20
push 0xffff
xor edx, edx
push eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x1c], 0
mov word [esp + 0x1a], dx
call sub.WSOCK32.dll_setsockopt
cmp eax, 0xffffffff
je 0x523b3c
mov eax, dword [0x463bb8]
push 0x10
lea edx, [esp + 8]
push edx
push eax
call sub.WSOCK32.dll_bind
cmp eax, 0xffffffff
jne 0x523b41
call fcn.005227e0
mov ecx, dword [esp + 0x1a4]
xor ecx, esp
call fcn.00526a8a
add esp, 0x1a8
ret
Function at 0x523b60
Capabilities:
Get hostname
Send data
Send data on socket

Disassembly:
sub esp, 0x20
mov eax, dword [0x463df0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
xor edi, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], edi
call fcn.00522a30
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x523b90
sub eax, edx
push 0x100
lea ebx, [eax + 1]
call fcn.0051f5b0
mov esi, eax
add esp, 4
cmp esi, edi
je 0x523bd9
push 0x100
push esi
call sub.WSOCK32.dll_gethostname
cmp eax, 0xffffffff
je 0x523bd0
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x523bc4
sub eax, edx
lea edi, [eax + 1]
push esi
call fcn.00526d54
add esp, 4
push 0x12c
lea ebp, [edi + ebx + 0x20]
push ebp
push 0x12
mov dword [esp + 0x20], ebp
call fcn.0051fb00
mov esi, eax
test esi, esi
je 0x523cdc
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x34]
test eax, eax
je 0x523c50
mov ebp, dword [eax]
mov eax, dword [0x463b38]
and eax, 0xe00000
and ebp, 1
or ebp, eax
call fcn.00523150
movzx ecx, al
mov eax, dword [esp + 0x34]
shl ecx, 0x18
or ecx, ebp
mov ebp, dword [esp + 0x14]
mov dword [esi + 8], ecx
mov edx, dword [eax + 4]
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0xc], edx
mov eax, dword [eax + 8]
mov dword [esi + 0x10], eax
mov dword [esi + 0x1c], ecx
mov edx, dword [esp + 0x18]
push ebx
push edx
lea eax, [esi + 0x20]
push eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], edi
call fcn.00526df0
add esp, 0xc
push edi
lea eax, [ebx + esi + 0x20]
call fcn.00522e90
mov edi, dword [0x59f4b0]
test edi, edi
je 0x523cdc
lea esp, [esp]
mov ecx, 2
mov word [esp + 0x1c], cx
mov eax, dword [edi + 4]
test eax, eax
je 0x523cd0
movzx edx, word [0x59e6c0]
push edx
mov dword [esp + 0x24], eax
call sub.WSOCK32.dll_htons
mov ecx, dword [0x463bb8]
push 0x10
mov word [esp + 0x22], ax
lea eax, [esp + 0x20]
push eax
push 0
push ebp
push esi
push ecx
call sub.WSOCK32.dll_sendto
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov eax, edx
mov dword [esp + 0x10], eax
test eax, eax
je 0x523cdc
mov edi, dword [edi]
test edi, edi
jne 0x523c80
cmp dword [esp + 0x10], edi
jne 0x523cef
cmp dword [0x463b34], 0
jne 0x523cef
mov dword [0x463b34], 0x61
push esi
call fcn.00526d54
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00526a8a
add esp, 0x20
ret 0xc
Function at 0x524430
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebx, 2
cmp eax, 0xa
ja case.0x524445.3
jmp dword [eax*4 + 0x524550]
mov edi, 0x46f8b8
jmp case.0x524445.3
mov edi, 0x46f880
jmp 0x52447b
mov edi, 0x46f880
jmp case.0x524445.3
mov edi, 0x46f84c
jmp case.0x524445.3
mov edi, 0x46f818
jmp 0x52447b
mov edi, 0x46f7dc
jmp 0x52447b
mov edi, 0x46f7a0
mov ebx, 3
mov eax, dword [esp + 0x24]
mov dword [esp + 0x24], eax
xor eax, eax
cmp ebx, 2
sete al
mov ebp, 0x20019
add eax, reloc.WSOCK32.dll_accept
cmp dword [0x59f4bc], 0
je 0x5244a8
mov ebp, 0x20119
lea ecx, [esp + 0x18]
push ecx
push ebp
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x5244ef
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x18]
push ecx
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x18]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x52453b
cmp ebx, 3
jne 0x52453b
lea edx, [esp + 0x18]
push edx
push ebp
push 0
push edi
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x52453b
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x18]
push edx
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x18]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
neg eax
pop edi
sbb eax, eax
pop esi
not eax
and eax, dword [esp + 0x1c]
pop ebp
pop ebx
pop ecx
ret
Function at 0x524580
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
cmp ecx, 0x30
ja case.0x524594.1
movzx eax, byte [ecx + 0x5246bc]
jmp dword [eax*4 + 0x5246ac]
mov ebp, 0x14
jmp 0x5245c1
xor edx, edx
cmp byte [esp + 0x18], dl
setne dl
lea edx, [edx*8 + 8]
mov ebp, edx
jmp 0x5245c1
mov ebp, 8
jmp 0x5245c1
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
cmp esi, ebp
jbe 0x5245fb
mov eax, dword [esp + 0x1c]
lea edi, [eax + ebp]
mov eax, esi
sub eax, ebp
mov edx, ebp
cmp ebp, eax
jb 0x5245dc
mov edx, eax
mov eax, dword [esp + 0x1c]
test edx, edx
jbe 0x5245f5
mov ecx, edx
mov bl, byte [edi]
xor byte [eax], bl
inc edi
inc eax
sub ecx, 1
jne 0x5245e6
mov ecx, dword [esp + 0x14]
sub esi, edx
cmp esi, ebp
ja 0x5245d0
lea eax, [ecx - 0x20]
cmp eax, 0x30
ja case.0x52460a.33
movzx edx, byte [eax + 0x5246fc]
jmp dword [edx*4 + 0x5246f0]
mov ebp, 8
jmp 0x52462e
movzx ebp, byte [esp + 0x18]
neg ebp
sbb ebp, ebp
and ebp, 0xfffffff4
add ebp, 0x14
jmp 0x52462e
mov ebp, 0x14
cmp esi, ebp
jae 0x524665
mov eax, dword [esp + 0x1c]
lea ebx, [eax + esi]
lea esp, [esp]
mov edi, ebp
sub edi, esi
cmp esi, edi
jae 0x52464a
mov edi, esi
mov ecx, dword [esp + 0x1c]
push edi
push ecx
push ebx
call fcn.00526df0
add esi, edi
add esp, 0xc
add ebx, edi
cmp esi, ebp
jb 0x524640
mov ecx, dword [esp + 0x14]
cmp byte [esp + 0x18], 0
je 0x5246a0
cmp esi, 0x10
jae 0x5246a0
cmp ecx, 0x20
je 0x52467b
cmp ecx, 0x30
jne 0x5246a0
mov eax, dword [esp + 0x1c]
mov edx, 0x10
sub edx, esi
push edx
add eax, esi
push 0
push eax
call fcn.00526600
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, 0x10
pop ebx
ret 0x10
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x525710
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
mov eax, dword [ebx]
cdq
sub eax, edx
push ebp
sar eax, 1
push esi
mov esi, dword [ecx]
add eax, 4
xor ebp, ebp
push edi
mov edi, dword [ecx + 4]
test eax, eax
jle 0x525760
add ebx, 0xc
mov dword [esp + 0x14], eax
mov ecx, edi
xor ecx, ebp
mov eax, esi
call fcn.00525620
movzx ecx, ax
mov edx, eax
shr edx, 0x10
mov dword [ebx - 4], ecx
mov dword [ebx], edx
mov ebp, esi
add ebx, 8
sub dword [esp + 0x14], 1
mov esi, edi
mov edi, eax
jne 0x525738
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x525770
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov ebx, dword [ebp]
movzx eax, word [ebp + ebx*4 + 8]
movzx ecx, word [ebp + ebx*4 + 0x10]
push esi
movzx esi, word [ebp + ebx*4 + 0x14]
push edi
movzx edi, word [ebp + ebx*4 + 0xc]
shl edi, 0x10
shl esi, 0x10
or edi, eax
mov eax, dword [esp + 0x1c]
xor edi, dword [eax]
or esi, ecx
xor esi, dword [eax + 4]
xor esi, edi
test ebx, ebx
jle 0x5257d7
lea edx, [ebp + 8]
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
mov ecx, esi
call fcn.00525560
add dword [esp + 0x18], 4
xor eax, edi
sub dword [esp + 0x10], 1
mov edi, esi
mov esi, eax
jne 0x5257b4
mov eax, dword [esp + 0x1c]
movzx ecx, word [ebp + ebx*4 + 0x24]
movzx edx, word [ebp + ebx*4 + 0x20]
shl ecx, 0x10
or ecx, edx
movzx edx, word [ebp + ebx*4 + 0x18]
xor edi, esi
xor edi, ecx
movzx ecx, word [ebp + ebx*4 + 0x1c]
shl ecx, 0x10
or ecx, edx
mov dword [eax + 4], edi
pop edi
xor ecx, esi
pop esi
pop ebp
mov dword [eax], ecx
pop ebx
pop ecx
ret 8

Function at 0x525810
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov ebx, dword [ebp]
movzx eax, word [ebp + ebx*4 + 0x18]
movzx ecx, word [ebp + ebx*4 + 0x20]
push esi
movzx esi, word [ebp + ebx*4 + 0x24]
push edi
movzx edi, word [ebp + ebx*4 + 0x1c]
shl edi, 0x10
shl esi, 0x10
or edi, eax
mov eax, dword [esp + 0x1c]
xor edi, dword [eax]
or esi, ecx
xor esi, dword [eax + 4]
lea ecx, [ebx - 1]
xor esi, edi
mov dword [esp + 0x10], ecx
test ecx, ecx
jl 0x525881
lea edx, [ebp + ecx*4 + 8]
mov dword [esp + 0x18], edx
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
mov ecx, esi
call fcn.00525560
sub dword [esp + 0x18], 4
xor eax, edi
mov edi, esi
mov esi, eax
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
test eax, eax
jge 0x525858
mov eax, dword [esp + 0x1c]
movzx ecx, word [ebp + ebx*4 + 0x14]
movzx edx, word [ebp + ebx*4 + 0x10]
shl ecx, 0x10
or ecx, edx
movzx edx, word [ebp + ebx*4 + 8]
xor edi, esi
xor edi, ecx
movzx ecx, word [ebp + ebx*4 + 0xc]
shl ecx, 0x10
or ecx, edx
mov dword [eax + 4], edi
pop edi
xor ecx, esi
pop esi
pop ebp
mov dword [eax], ecx
pop ebx
pop ecx
ret 8