joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4adaa4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4adad2
mov eax, ebx
call fcn.004ae558
cmp dword [ebx + 0x40], 0
je 0x4adacb
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4adb43
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4adb35
cmp dword [ebx + 8], 0
je 0x4adaf4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4adb06
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4adb35
cmp dword [ebx + 8], 0
je 0x4adae7
cmp eax, 3
je 0x4adb19
dec eax
jne 0x4adae7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4adae7
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4adae7
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4adb61
cmp dword [ebx + 0x14], 0xcc
je 0x4adb61
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004adb6c
pop ebx
ret
Function at 0x4c23d4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x68], 0
jne 0x4c23ec
mov eax, ebx
call fcn.004c2128
cmp dword [ebx + 0x60], 0
jne 0x4c23f9
mov eax, ebx
call fcn.004c2080
mov esi, dword [ebx + 0x68]
test esi, esi
je 0x4c25a0
cmp dword [ebx + 0x60], 0
je 0x4c25a0
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [esp], eax
mov eax, dword [ebx + 0x68]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [esp + 4], eax
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.004c2004
mov edx, dword [esp + 0x1c]
mov ecx, edx
mov esi, dword [esp + 0x14]
sub ecx, esi
mov eax, dword [esp]
cmp ecx, eax
je 0x4c246c
mov ecx, dword [esp + 4]
sub ecx, dword [esp + 0x20]
add ecx, dword [esp + 0x18]
sar ecx, 1
jns 0x4c2455
adc ecx, 0
push ecx
sub eax, edx
add eax, esi
sar eax, 1
jns 0x4c2461
adc eax, 0
push eax
lea eax, [esp + 0x1c]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebx + 0x4c]
mov eax, dword [eax + 0xe0]
test eax, eax
je 0x4c2482
call fcn.00465948
mov esi, eax
jmp 0x4c2485
mov esi, dword [ebx + 0x48]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
and eax, 8
cmp eax, 8
jne 0x4c249a
or esi, 0xffffffff
jmp 0x4c24a4
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x60]
call fcn.0044a4dc
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x60]
call fcn.0044a518
mov edx, dword [esp]
mov eax, dword [ebx + 0x60]
call fcn.0045cf04
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x60]
call fcn.0045cf38
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.00407d4c
mov eax, ebp
mov byte [esp + 0x12], al
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x13], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x60]
call fcn.00465948
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x60]
call fcn.00465948
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x60]
call fcn.00465948
push eax
call sub.user32.dll_SetWindowLongA
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x68]
call fcn.00436458
call fcn.00431e40
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x60]
call fcn.00465948
push eax
mov eax, dword [0x6600e0]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x60]
call fcn.00465948
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4c9170
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4c922a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405cac
mov eax, dword [0x660a58]
cmp dword [eax], 2
jne 0x4c91df
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.004060d0
mov eax, dword [ebx]
call fcn.00405e8c
push eax
mov eax, dword [ebx]
call fcn.00405e7c
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00405e8c
mov edx, eax
dec edx
mov eax, ebx
call fcn.004060d0
jmp 0x4c9211
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.0040b7a8
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00405e6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9231
lea eax, [ebp - 0x3f0]
call fcn.004054cc
ret
Function at 0x4f0994
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x6c], 0
jne 0x4f09ac
mov eax, ebx
call fcn.004f0208
cmp dword [ebx + 0x68], 0
jne 0x4f09b9
mov eax, ebx
call fcn.004f0164
mov esi, dword [ebx + 0x6c]
test esi, esi
je 0x4f0b6c
cmp dword [ebx + 0x68], 0
je 0x4f0b6c
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [esp], eax
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [esp + 4], eax
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.004effc8
lea eax, [esp + 0x14]
xor edx, edx
call fcn.0053d678
cmp eax, dword [esp]
je 0x4f0a3b
lea eax, [esp + 0x14]
xor edx, edx
call fcn.0053d68c
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x4f0a17
adc edx, 0
push edx
lea eax, [esp + 0x18]
xor edx, edx
call fcn.0053d678
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x4f0a30
adc edx, 0
push edx
lea eax, [esp + 0x1c]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x4f0a4e
mov eax, dword [eax + 0x18]
call fcn.00465948
mov esi, eax
jmp 0x4f0a51
mov esi, dword [ebx + 0x50]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
and eax, 8
cmp eax, 8
jne 0x4f0a66
or esi, 0xffffffff
jmp 0x4f0a70
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x68]
call fcn.0044a4dc
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x68]
call fcn.0044a518
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.0045cf04
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x68]
call fcn.0045cf38
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.00407d4c
mov eax, ebp
mov byte [esp + 0x12], al
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x13], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.00465948
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.00465948
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.00465948
push eax
call sub.user32.dll_SetWindowLongA
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x6c]
call fcn.00436458
call fcn.00431e40
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.00465948
push eax
mov eax, dword [0x6600e0]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x68]
call fcn.00465948
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4f0dac
Capabilities:
Allocate or change rwx memory
Find taskbar
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa0
mov dword [esp], eax
mov eax, dword [esp]
xor ecx, ecx
mov edx, 0x10
call fcn.00403cd4
lea eax, [esp + 0x3c]
push eax
call sub.kernel32.dll_GetSystemInfo
call sub.user32.dll_GetDesktopWindow
test eax, eax
je 0x4f0fa5
push 0
push 0x4f0fb0
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4f0fa5
push 0
push 0x4f0fc0
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4f0fa5
push 0
push 0x4f0fd0
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x4f0fa5
push 0
push 0x4f0fe0
push 0
push eax
call sub.user32.dll_FindWindowExA
mov ebp, eax
test ebp, ebp
je 0x4f0fa5
push 0
push 0
push 0x418
push ebp
call sub.user32.dll_SendMessageA
mov dword [esp + 4], eax
cmp dword [esp + 4], 1
jl 0x4f0fa5
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push ebp
call sub.user32.dll_GetWindowThreadProcessId
cmp dword [esp + 8], 0
je 0x4f0fa5
mov eax, dword [esp + 8]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
je 0x4f0fa5
push 0x40
push 0x1000
push 0x1000
push 0
push edi
call sub.kernel32.dll_VirtualAllocEx
mov esi, eax
test esi, esi
je 0x4f0fa5
or ebx, 0xffffffff
cmp ebx, dword [esp + 4]
jge 0x4f0f91
inc ebx
push esi
push ebx
push 0x417
push ebp
call sub.user32.dll_SendMessageA
test eax, eax
je 0x4f0f87
lea eax, [esp + 0xc]
push eax
push 0x18
lea eax, [esp + 0x20]
push eax
push esi
push edi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x4f0f87
test byte [esp + 0x21], 0xd
jne 0x4f0f87
movzx eax, byte [esp + 0x20]
and al, 8
cmp al, 8
je 0x4f0f87
lea eax, [esp + 0xc]
push eax
push 4
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x30]
push eax
push edi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x4f0f87
cmp dword [esp + 0xc], 0
je 0x4f0f87
mov eax, dword [0x660674]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x14]
jne 0x4f0f87
push esi
push ebx
push 0x41d
push ebp
call sub.user32.dll_SendMessageA
test eax, eax
je 0x4f0f63
lea eax, [esp + 0xc]
push eax
push 0x10
mov eax, dword [esp + 8]
push eax
push esi
push edi
call sub.kernel32.dll_ReadProcessMemory
cmp dword [esp + 0xc], 0
je 0x4f0f91
lea eax, [esp + 0x2c]
push eax
push ebp
call sub.user32.dll_GetWindowRect
mov eax, dword [esp]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
call fcn.00407da8
jmp 0x4f0f91
cmp ebx, dword [esp + 4]
jl 0x4f0eba
push 0x8000
push 0
push esi
push edi
call sub.kernel32.dll_VirtualFreeEx
push edi
call sub.kernel32.dll_CloseHandle_1
add esp, 0x60
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x50c544
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, ebx
call fcn.0050c530
test eax, eax
jne 0x50c565
mov eax, esi
call fcn.004054cc
jmp 0x50c5f6
mov eax, ebx
call fcn.0050c68c
test al, al
je 0x50c5ab
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
mov edi, eax
mov eax, esi
mov ecx, edi
xor edx, edx
call fcn.004055bc
test edi, edi
je 0x50c5a2
mov eax, dword [esi]
push eax
inc edi
push edi
push 0xd
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
jmp 0x50c5f6
mov eax, esi
call fcn.004054cc
jmp 0x50c5f6
mov ebp, dword [ebx + 0x78]
test ebp, ebp
je 0x50c5ef
mov eax, dword [ebp + 0x250]
call fcn.00421864
test eax, eax
jle 0x50c5dd
mov eax, dword [ebx + 0x78]
mov eax, dword [eax + 0x250]
mov edx, edi
call fcn.0049d4e4
mov edx, dword [eax + 0xc]
mov eax, esi
call fcn.00405520
jmp 0x50c5f6
mov eax, esi
mov edx, dword [ebx + 0x78]
mov edx, dword [edx + 0x258]
call fcn.00405520
jmp 0x50c5f6
mov eax, esi
call fcn.004054cc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x50e2f0
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 1
push esi
mov ecx, 1
xor edx, edx
xor eax, eax
call fcn.00407d30
push esi
push 0
push 0x419
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
pop esi
pop ebx
ret
Function at 0x53dacc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call sub.kernel32.dll_GetTickCount
mov ebx, eax
mov eax, dword [0x660674]
mov eax, dword [eax]
call fcn.0044d65c
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, esi
jb 0x53dad7
pop esi
pop ebx
ret

Function at 0x53e080
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffe9c
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.0040b078
test al, al
je 0x53e107
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x160
call fcn.00403cd4
or esi, 0x100
test esi, esi
jns 0x53e0bb
call fcn.00404430
push esi
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
mov eax, ebx
call fcn.0040595c
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x53e107
mov dl, 1
mov eax, dword [0x42fc2c]
call fcn.00437a64
mov dword [esp], eax
mov edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.00437e74
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
je 0x53e107
mov eax, esp
call fcn.00411188
mov eax, dword [esp]
add esp, 0x164
pop esi
pop ebx
ret

Function at 0x53e420
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x6660cc
test esi, esi
jne 0x53e43a
xor eax, eax
jmp 0x53e52b
cmp dword [ebp], 0
jne 0x53e445
call fcn.0053e3b0
xor ebx, 0xffffffff
cmp edi, 8
jb 0x53e505
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x53e451
test edi, edi
jbe 0x53e526
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x53e509
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x59cdc0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, esi
mov edx, dword [0x58edc0]
call fcn.004046f4
test al, al
je 0x59ce8e
movzx edx, byte [ebx + 5]
mov edi, esi
mov eax, edi
call fcn.0059ce9c
movzx eax, byte [ebx + 6]
mov byte [edi + 6], al
movzx edx, byte [ebx + 7]
mov eax, edi
call fcn.0059ced4
movzx eax, byte [ebx + 8]
mov byte [edi + 8], al
movzx edx, byte [ebx + 9]
mov eax, edi
call fcn.0059cf90
movzx eax, byte [ebx + 0xa]
mov byte [edi + 0xa], al
movzx edx, byte [ebx + 0xb]
mov eax, edi
call fcn.0059cee4
movzx edx, byte [ebx + 0xc]
mov eax, edi
call fcn.0059cef8
movzx edx, byte [ebx + 0xd]
mov eax, edi
call fcn.0059cf0c
movzx edx, byte [ebx + 0xf]
mov eax, edi
call fcn.0059cfac
mov edx, dword [ebx + 0x14]
mov eax, edi
call fcn.0059d020
movzx eax, byte [ebx + 4]
mov byte [edi + 4], al
movzx eax, byte [ebx + 0x10]
mov byte [edi + 0x10], al
movzx edx, byte [ebx + 0x18]
mov eax, edi
call fcn.0059d0cc
movzx edx, byte [ebx + 0x1a]
mov eax, edi
call fcn.0059d044
mov eax, ebx
call fcn.0059d098
mov edx, eax
mov eax, edi
call fcn.0059d0a4
movzx eax, byte [ebx + 0x19]
mov byte [edi + 0x19], al
movzx eax, byte [ebx + 0x20]
mov byte [edi + 0x20], al
jmp 0x59ce97
mov edx, esi
mov eax, ebx
call fcn.00421180
pop edi
pop esi
pop ebx
ret

Function at 0x5a7a5c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5a7af1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 4]
call fcn.004054cc
push 0
mov eax, dword [ebp + 8]
push eax
lea eax, [esi + edi]
push eax
mov eax, dword [ebx + 0x20]
push eax
call sub.wsock32.dll_recv
mov esi, eax
cmp esi, 0xffffffff
jne 0x5a7adb
lea eax, [ebp - 4]
push eax
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x5a7b0c
call fcn.0040bc98
mov edx, dword [ebp - 4]
lea eax, [ebx + 4]
call fcn.00405520
xor esi, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a7af8
lea eax, [ebp - 4]
call fcn.004054cc
ret
Function at 0x5a7b44
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5a7bd9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 4]
call fcn.004054cc
push 0
mov eax, dword [ebp + 8]
push eax
lea eax, [esi + edi]
push eax
mov eax, dword [ebx + 0x20]
push eax
call sub.wsock32.dll_send
mov esi, eax
cmp esi, 0xffffffff
jne 0x5a7bc3
lea eax, [ebp - 4]
push eax
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x5a7bf4
call fcn.0040bc98
mov edx, dword [ebp - 4]
lea eax, [ebx + 4]
call fcn.00405520
xor esi, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a7be0
lea eax, [ebp - 4]
call fcn.004054cc
ret

Function at 0x5aa8fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov eax, dword [ebp + 0x10]
call fcn.00406fa8
mov eax, dword [ebp + 0xc]
call fcn.00406fa8
xor eax, eax
push ebp
push 0x5aa967
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp + 8]
dec edx
test edx, edx
jl 0x5aa946
inc edx
xor eax, eax
lea ecx, [eax + esi]
movzx ecx, byte [ebx + ecx]
mov edi, dword [ebp + 0xc]
xor cl, byte [edi + eax]
mov edi, dword [ebp + 0x10]
mov byte [edi + eax], cl
inc eax
dec edx
jne 0x5aa92f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5aa96e
lea eax, [ebp + 0xc]
mov edx, dword [0x40915c]
mov ecx, 2
call fcn.00406250
ret

Function at 0x5aa978
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00406fa8
mov eax, dword [ebp - 8]
call fcn.00406fa8
xor eax, eax
push ebp
push 0x5aa9e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp + 8]
dec edx
test edx, edx
jl 0x5aa9bf
inc edx
xor eax, eax
mov ecx, dword [ebp - 8]
movzx ecx, byte [ecx + eax]
mov ebx, dword [ebp - 4]
xor byte [ebx + eax], cl
inc eax
dec edx
jne 0x5aa9ae
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5aa9e7
lea eax, [ebp - 8]
mov edx, dword [0x40915c]
mov ecx, 2
call fcn.00406250
ret
Function at 0x5aa9f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040594c
xor eax, eax
push ebp
push 0x5aabe6
push dword fs:[eax]
mov dword fs:[eax], esp
push 8
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, dword [0x40915c]
call fcn.00406e24
add esp, 4
push 2
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x407d04]
call fcn.00406e24
add esp, 4
push 2
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x407d04]
call fcn.00406e24
add esp, 4
push 0
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, dword [0x40915c]
call fcn.00406e24
add esp, 4
xor edi, edi
mov eax, dword [ebp - 0x10]
push eax
push 0
push 8
xor ecx, ecx
mov edx, dword [ebx + 0x60]
mov eax, dword [0x547be4]
call fcn.00548654
cmp dword [ebp - 4], 0
je 0x5aaba0
mov eax, dword [ebx + 0x18]
call fcn.005a5de4
mov esi, eax
mov eax, dword [0x547b00]
call fcn.00547fbc
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 4]
call dword [eax]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov eax, dword [ebx]
call fcn.005aacb0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx]
call fcn.005aacb0
mov eax, dword [ebp - 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
push edx
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 4]
mov eax, dword [eax]
xor eax, dword [esp]
xor edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
push edx
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
xor eax, dword [esp]
xor edx, dword [esp + 4]
add esp, 8
push edx
push eax
lea edx, [ebp - 0x38]
mov eax, dword [ebx]
call fcn.005aac60
jmp 0x5aab53
inc edi
lea edx, [ebp - 0x38]
mov eax, dword [ebx]
call fcn.005aabf8
fmul dword [0x5aabf4]
add esp, 0xfffffff4
fstp xword [esp]
wait
call fcn.0042c358
add al, 0x40
mov byte [ebp - 0x16], al
movzx edx, byte [ebp - 0x16]
mov eax, dword [ebx + 0x18]
call fcn.005a6064
mov eax, dword [ebp - 0x10]
call fcn.00406c68
cmp edi, eax
jl 0x5aab25
lea edx, [ebp - 0x38]
mov eax, dword [ebx]
call fcn.005aabf8
fmul dword [0x5aabf4]
add esp, 0xfffffff4
fstp xword [esp]
wait
call fcn.0042c358
mov byte [ebp - 0x15], al
mov eax, dword [ebx + 0x18]
call fcn.005a5de4
mov edi, eax
mov eax, dword [ebx + 0x18]
call fcn.005a5dc4
cmp edi, esi
je 0x5aaba0
movzx edx, byte [ebp - 0x15]
xor byte [eax + esi], dl
inc esi
cmp edi, esi
jne 0x5aab94
xor edx, edx
mov eax, dword [ebx + 0x18]
call fcn.005a6064
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5aabed
lea eax, [ebp - 0x14]
mov edx, dword [0x40915c]
mov ecx, 2
call fcn.00406250
lea eax, [ebp - 0xc]
mov edx, dword [0x407d04]
mov ecx, 2
call fcn.00406250
lea eax, [ebp - 4]
call fcn.004054cc
ret
Function at 0x5ab0b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
mov esi, 0x10
mov ecx, dword [ebx + esi*4 + 0xc]
xor ecx, dword [ebx + esi*4 - 8]
xor ecx, dword [ebx + esi*4 - 0x20]
xor ecx, dword [ebx + esi*4 - 0x28]
mov edx, 1
mov eax, ebx
call fcn.005aafec
mov dword [ebx + esi*4 + 0x18], eax
inc esi
cmp esi, 0x50
jne 0x5ab0be
mov edi, dword [ebx + 4]
mov eax, dword [ebx + 8]
mov dword [esp], eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x14]
mov dword [esp + 0xc], eax
xor esi, esi
mov ecx, edi
mov edx, 5
mov eax, ebx
call fcn.005aafec
mov ebp, eax
mov eax, dword [esp + 4]
push eax
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [esp + 8]
mov edx, esi
mov eax, ebx
call fcn.005ab04c
add ebp, eax
add ebp, dword [esp + 0xc]
add ebp, dword [ebx + esi*4 + 0x18]
mov edx, esi
mov eax, ebx
call fcn.005ab004
add ebp, eax
mov eax, dword [esp + 8]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 4]
mov dword [esp + 8], eax
mov ecx, dword [esp]
mov edx, 0x1e
mov eax, ebx
call fcn.005aafec
mov dword [esp + 4], eax
mov dword [esp], edi
mov edi, ebp
inc esi
cmp esi, 0x50
jne 0x5ab104
add dword [ebx + 4], edi
mov eax, dword [esp]
add dword [ebx + 8], eax
mov eax, dword [esp + 4]
add dword [ebx + 0xc], eax
mov eax, dword [esp + 8]
add dword [ebx + 0x10], eax
mov eax, dword [esp + 0xc]
add dword [ebx + 0x14], eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret