joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c02e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6480b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [ebx + 0x140]
mov edx, dword [ebx + 0x144]
mov esi, dword [ebx + 0x14c]
shld edx, eax, 3
mov dword [ebp - 0x28], ecx
shl eax, 3
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x148]
shld esi, eax, 3
mov dword [ebp - 0x1c], edx
shl eax, 3
mov dword [ebp - 0x20], eax
lea eax, [edi - 4]
mov dword [ebp - 0x18], esi
cmp eax, 0xc
ja 0x5c0460
push edi
lea eax, [ebx + 0x150]
push eax
push ecx
call fcn.005c9900
mov eax, dword [ebp - 0x24]
add esp, 0xc
or eax, dword [ebp - 0x1c]
mov ecx, esi
mov edx, dword [ebp - 0x20]
jne 0x5c0365
mov eax, edx
or eax, ecx
je 0x5c044d
mov esi, dword [ebp - 0x18]
mov eax, ecx
shr eax, 0x18
mov byte [ebp - 0x14], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0x13], al
mov eax, ecx
shr eax, 8
mov byte [ebp - 0x12], al
mov eax, esi
mov byte [ebp - 0x11], cl
mov ecx, edx
shrd ecx, eax, 0x18
mov byte [ebp - 0xd], dl
mov byte [ebp - 0x10], cl
mov ecx, edx
shrd ecx, eax, 0x10
mov eax, edx
mov edx, dword [ebp - 0x24]
shrd eax, esi, 8
mov esi, dword [ebp - 0x1c]
mov byte [ebp - 0xe], al
mov byte [ebp - 0xf], cl
mov ecx, dword [ebp - 0x1c]
mov eax, ecx
shr eax, 0x18
mov byte [ebp - 0xc], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, ecx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, esi
mov byte [ebp - 9], cl
mov ecx, edx
shrd ecx, eax, 0x18
mov byte [ebp - 5], dl
mov byte [ebp - 8], cl
mov ecx, edx
shrd ecx, eax, 0x10
mov eax, edx
shrd eax, esi, 8
mov byte [ebp - 7], cl
mov byte [ebp - 6], al
xor eax, eax
nop dword [eax]
movzx ecx, byte [ebp + eax - 0x14]
xor byte [ebx + eax + 0x170], cl
movzx ecx, byte [ebp + eax - 0x13]
xor byte [ebx + eax + 0x171], cl
movzx ecx, byte [ebp + eax - 0x12]
xor byte [ebx + eax + 0x172], cl
movzx ecx, byte [ebp + eax - 0x11]
xor byte [ebx + eax + 0x173], cl
add eax, 4
cmp eax, 0x10
jb 0x5c03f0
lea esi, [ebx + 0x170]
push esi
push esi
push ebx
call fcn.005c0f70
add esp, 0xc
xor ecx, ecx
test edi, edi
je 0x5c044d
mov edx, dword [ebp - 0x28]
mov al, byte [esi + ecx]
xor byte [edx + ecx], al
inc ecx
cmp ecx, edi
jb 0x5c0442
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058bb64
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0xffffffec
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058bb64
mov esp, ebp
pop ebp
ret
Function at 0x5c0d70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x6480b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x30], ebx
push eax
push 0x10
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
push ebx
movups xmmword [ebp - 0x14], xmm0
call fcn.005a8670
add esp, 0x14
test eax, eax
jne 0x5c0f5b
movzx eax, byte [ebp - 0x13]
xor edx, edx
movzx ecx, byte [ebp - 0x10]
push esi
movzx esi, byte [ebp - 0x14]
shl esi, 8
or esi, eax
shl ecx, 8
movzx eax, byte [ebp - 0x12]
shl esi, 8
or esi, eax
mov dword [ebx + 0xc0], 0
movzx eax, byte [ebp - 0x11]
shl esi, 8
or esi, eax
mov dword [ebx + 0xc4], 0
movzx eax, byte [ebp - 0xf]
or ecx, eax
mov dword [ebx + 0x104], esi
movzx eax, byte [ebp - 0xe]
shl ecx, 8
or ecx, eax
mov dword [ebx + 0x40], 0
movzx eax, byte [ebp - 0xd]
shl ecx, 8
or ecx, eax
mov dword [ebx + 0x44], 0
movzx eax, byte [ebp - 0xb]
or edx, ecx
movzx ecx, byte [ebp - 8]
push edi
movzx edi, byte [ebp - 0xc]
shl edi, 8
or edi, eax
shl ecx, 8
movzx eax, byte [ebp - 0xa]
shl edi, 8
or edi, eax
mov dword [ebp - 0x1c], edx
movzx eax, byte [ebp - 9]
xor edx, edx
shl edi, 8
or edi, eax
mov dword [ebp - 0x20], 4
movzx eax, byte [ebp - 7]
or ecx, eax
mov dword [ebx + 0x84], edi
movzx eax, byte [ebp - 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 5]
shl ecx, 8
or ecx, eax
or edx, ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], edx
mov dword [ebx + 0x80], edx
mov dword [ebx + 0x100], ecx
shrd dword [ebp - 0x18], edi, 1
shl ecx, 0x1f
and edx, 1
shr edi, 1
xor eax, eax
or dword [ebp - 0x18], eax
or edi, ecx
mov ecx, dword [ebp - 0x1c]
shrd ecx, esi, 1
imul edx, edx, 0xe1000000
xor ecx, eax
shr esi, 1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
xor esi, edx
mov edx, dword [ebp - 0x18]
mov dword [ebx + eax*8 + 0x40], edx
mov dword [ebx + eax*8 + 0x44], edi
mov dword [ebx + eax*8 + 0xc0], ecx
mov dword [ebx + eax*8 + 0xc4], esi
sar eax, 1
mov dword [ebp - 0x20], eax
test eax, eax
jg 0x5c0e81
mov ecx, 2
mov dword [ebp - 0x20], ecx
nop dword [eax + eax]
lea edi, [ecx + 0x18]
mov eax, dword [ebx + edi*8]
lea edi, [ebx + edi*8]
mov dword [ebp - 0x1c], eax
lea edx, [ecx + 8]
mov eax, dword [edi + 4]
lea edx, [ebx + edx*8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx]
mov dword [ebp - 0x28], eax
mov eax, dword [edx + 4]
mov dword [ebp - 0x2c], eax
cmp ecx, 1
jle 0x5c0f4d
lea eax, [ebx + 0x48]
sub edi, edx
lea esi, [edx + 8]
lea ebx, [ecx - 1]
mov edx, dword [eax + 0x80]
lea eax, [eax + 8]
mov ecx, dword [eax + 0x7c]
lea esi, [esi + 8]
xor edx, dword [ebp - 0x1c]
xor ecx, dword [ebp - 0x18]
mov dword [edi + esi - 8], edx
mov dword [edi + esi - 4], ecx
mov edx, dword [eax - 8]
mov ecx, dword [eax - 4]
xor edx, dword [ebp - 0x28]
xor ecx, dword [ebp - 0x2c]
mov dword [esi - 8], edx
mov dword [esi - 4], ecx
sub ebx, 1
jne 0x5c0f13
mov ecx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x30]
add ecx, ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 8
jle 0x5c0ee0
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0058bb64
mov esp, ebp
pop ebp
ret
Function at 0x5c1220
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x6480b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x24]
push esi
mov edx, dword [ebp + 0x10]
lea esi, [ebp - 0x14]
push edi
push dword [ebp + 0x2c]
mov edi, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push ebx
push eax
push dword [ebp + 0x1c]
push ecx
push dword [ebp + 0x14]
push edx
push esi
push 1
push edi
call fcn.005c1750
add esp, 0x2c
test eax, eax
jne 0x5c1375
mov ecx, dword [ebp + 0x2c]
xor edi, edi
xor dl, dl
test ecx, ecx
je 0x5c131c
cmp ecx, 8
jb 0x5c131c
mov edi, dword [ebp + 0x28]
mov eax, ecx
and eax, 0xfffffff8
xorps xmm4, xmm4
mov dword [ebp - 0x18], eax
xorps xmm3, xmm3
mov esi, dword [ebp - 0x18]
xor eax, eax
nop dword [eax + eax]
movd xmm2, dword [eax + edi]
xorps xmm0, xmm0
movd xmm1, dword [ebp + eax - 0x14]
lea eax, [edx + 4]
punpcklbw xmm2, xmm0
add dl, 8
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movzx eax, al
por xmm4, xmm2
movd xmm2, dword [eax + edi]
movd xmm1, dword [ebp + eax - 0x14]
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
movzx eax, dl
pxor xmm2, xmm1
por xmm3, xmm2
cmp eax, esi
jb 0x5c12a0
mov esi, dword [ebp + 0xc]
por xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd edi, xmm3
movzx eax, dl
cmp eax, ecx
jae 0x5c134a
mov esi, dword [ebp + 0x28]
nop word [eax + eax]
movzx ecx, byte [eax + esi]
inc dl
movzx eax, byte [ebp + eax - 0x14]
xor ecx, eax
movzx eax, dl
or edi, ecx
cmp eax, dword [ebp + 0x2c]
jb 0x5c1330
mov esi, dword [ebp + 0xc]
test edi, edi
je 0x5c1373
test esi, esi
je 0x5c135d
mov byte [ebx], 0
lea ebx, [ebx + 1]
sub esi, 1
jne 0x5c1352
pop edi
pop esi
mov eax, 0xfffffff1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058bb64
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058bb64
mov esp, ebp
pop ebp
ret
Function at 0x5c2780
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x6480b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 0x40]
push eax
xor esi, esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea eax, [ebp - 0x48]
push eax
call ebx
lea eax, [ebp - 0x24]
push eax
call edi
lea eax, [ebp - 0x30]
push eax
call edi
lea eax, [ebp - 0x38]
push eax
call ebx
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
sbb eax, dword [ebp - 0x20]
push esi
push 0x3e8
push eax
push ecx
call fcn.0058c440
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push edx
push eax
call fcn.0058c810
cmp eax, dword [ebp + 8]
jae 0x5c2829
nop word [eax + eax]
lea eax, [ebp - 0x30]
inc esi
push eax
call edi
lea eax, [ebp - 0x38]
push eax
call ebx
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
sbb eax, dword [ebp - 0x20]
push 0
push 0x3e8
push eax
push ecx
call fcn.0058c440
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push edx
push eax
call fcn.0058c810
cmp eax, dword [ebp + 8]
jb 0x5c27f0
mov dword [ebp - 0x28], esi
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058bb64
mov esp, ebp
pop ebp
ret
Function at 0x5c5380
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
mov edx, dword [ebp + 8]
push ebx
push edi
mov edi, dword [edx]
lea ecx, [edx + 8]
mov ebx, dword [edx + 4]
mov dword [ebp - 4], ecx
jbe 0x5c53e3
push esi
mov esi, dword [ebp + 0x14]
sub dword [ebp + 0x10], esi
mov edx, dword [ebp - 4]
lea eax, [edi + 1]
movzx edi, al
lea esi, [esi + 1]
mov cl, byte [ecx + edi]
movzx eax, cl
add eax, ebx
movzx ebx, al
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx]
mov byte [edx + edi], al
add al, cl
mov byte [edx + ebx], cl
mov ecx, edx
mov edx, dword [ebp + 0x10]
movzx eax, al
movzx eax, byte [eax + ecx]
xor al, byte [edx + esi - 1]
sub dword [ebp + 0xc], 1
mov byte [esi - 1], al
jne 0x5c53a1
mov edx, dword [ebp + 8]
pop esi
mov dword [edx], edi
xor eax, eax
pop edi
mov dword [edx + 4], ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5c75e0
Capabilities:
Encrypt data using camellia

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov ebx, dword [ecx]
xor ebx, dword [eax]
mov ecx, dword [ecx + 4]
xor ecx, dword [eax + 4]
mov eax, ecx
shr eax, 0x10
movzx eax, al
movzx esi, byte [eax + 0x6382d0]
mov eax, ecx
shr eax, 0x18
movzx eax, byte [eax + 0x6381d0]
shl eax, 8
or esi, eax
mov eax, ecx
shr eax, 8
movzx eax, al
shl esi, 8
movzx eax, byte [eax + 0x6383d0]
or esi, eax
movzx eax, cl
shl esi, 8
movzx eax, byte [eax + 0x6380d0]
or esi, eax
mov eax, ebx
shr eax, 0x10
mov edx, esi
movzx eax, al
rol edx, 8
movzx ecx, byte [eax + 0x6381d0]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x6380d0]
shl eax, 8
or ecx, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + 0x6382d0]
or ecx, eax
movzx eax, bl
shl ecx, 8
movzx eax, byte [eax + 0x6383d0]
or ecx, eax
xor edx, ecx
mov ecx, dword [ebp + 0x10]
mov eax, edx
rol eax, 0x10
xor esi, eax
mov eax, esi
ror eax, 8
xor edx, eax
mov eax, edx
ror eax, 8
xor eax, dword [ecx]
xor eax, esi
xor dword [ecx + 4], edx
pop esi
mov dword [ecx], eax
pop ebx
pop ebp
ret

Function at 0x5c7840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x10]
push ebx
push esi
movzx eax, byte [edx]
movzx ecx, byte [edx + 1]
movzx esi, byte [edx + 4]
shl eax, 8
or eax, ecx
shl esi, 8
movzx ecx, byte [edx + 2]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 3]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 5]
or esi, ecx
mov dword [ebp + 0x10], eax
movzx ecx, byte [edx + 6]
shl esi, 8
or esi, ecx
movzx ecx, byte [edx + 7]
shl esi, 8
or esi, ecx
cmp dword [ebp + 0xc], 0
mov dword [ebp - 4], esi
jne 0x5c78fa
push edi
mov edi, dword [ebp + 8]
mov dword [ebp + 0xc], 0x10
lea ecx, [edi + 0x44]
mov dword [ebp + 0x10], ecx
xor eax, dword [ecx]
mov edx, eax
mov dword [ebp - 4], eax
mov ebx, eax
shr edx, 8
mov ecx, edx
shr ecx, 8
mov eax, ecx
movzx ecx, cl
shr eax, 8
mov eax, dword [edi + eax*4 + 0x48]
add eax, dword [edi + ecx*4 + 0x448]
movzx ecx, dl
xor eax, dword [edi + ecx*4 + 0x848]
movzx ecx, bl
add eax, dword [edi + ecx*4 + 0xc48]
mov ecx, dword [ebp + 0x10]
xor eax, esi
sub ecx, 4
mov esi, ebx
sub dword [ebp + 0xc], 1
mov dword [ebp + 0x10], ecx
jne 0x5c78a3
mov edx, dword [edi]
xor edx, ebx
mov ebx, dword [edi + 4]
xor ebx, eax
pop edi
jmp 0x5c7913
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.005c7e70
mov edx, dword [ebp + 0x10]
add esp, 0xc
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
mov eax, edx
shr eax, 0x18
pop esi
mov byte [ecx], al
mov eax, edx
shr eax, 0x10
mov byte [ecx + 1], al
mov eax, edx
shr eax, 8
mov byte [ecx + 2], al
mov eax, ebx
shr eax, 0x18
mov byte [ecx + 4], al
mov eax, ebx
shr eax, 0x10
mov byte [ecx + 5], al
mov eax, ebx
shr eax, 8
mov byte [ecx + 6], al
xor eax, eax
mov byte [ecx + 7], bl
mov byte [ecx + 3], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5c7e70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov ecx, dword [ecx]
mov eax, dword [eax]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov ecx, edi
mov dword [ebp + 8], ecx
mov dword [ebp - 8], 0x10
xor eax, dword [ecx]
mov edx, eax
mov ebx, eax
shr edx, 8
mov esi, eax
mov ecx, edx
shr ecx, 8
mov eax, ecx
movzx ecx, cl
shr eax, 8
mov eax, dword [edi + eax*4 + 0x48]
add eax, dword [edi + ecx*4 + 0x448]
movzx ecx, dl
mov edx, esi
xor eax, dword [edi + ecx*4 + 0x848]
movzx ecx, bl
add eax, dword [edi + ecx*4 + 0xc48]
mov ecx, dword [ebp + 8]
xor eax, dword [ebp - 4]
add ecx, 4
sub dword [ebp - 8], 1
mov dword [ebp - 4], edx
mov dword [ebp + 8], ecx
jne 0x5c7e95
mov ecx, dword [edi + 0x40]
xor ecx, eax
mov eax, dword [edi + 0x44]
xor eax, edx
mov edx, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov dword [edx], eax
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret

Function at 0x5ea69f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005ea515
Function at 0x5ed310
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0058c7e0
mov eax, dword [0x6480b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
mov dword [ebp - 0x1018], edx
mov dword [ebp - 0x100c], esi
mov dword [ebp - 0x1008], ecx
mov dword [ebp - 0x1014], eax
test ebx, ebx
je 0x5ed3d2
lea esi, [edx + 6]
mov edx, dword [esi - 6]
cmp edx, 0xffffffff
jne 0x5ed371
mov edx, 4
inc eax
mov word [esi], dx
mov dword [ebp - 0x1014], eax
jmp 0x5ed3b9
xor eax, eax
mov word [esi], ax
test ecx, ecx
je 0x5ed38e
nop word [eax + eax]
cmp dword [ebp + eax*4 - 0x1004], edx
je 0x5ed38e
inc eax
cmp eax, ecx
jb 0x5ed380
cmp eax, ecx
jne 0x5ed3ae
cmp ecx, 0x400
jae 0x5ed3ae
mov dword [ebp + eax*4 - 0x1004], edx
mov ecx, dword [ebp - 0x1008]
inc ecx
mov dword [ebp - 0x1008], ecx
mov eax, dword [ebp - 0x1014]
cmp edx, edi
cmova edi, edx
add esi, 8
sub ebx, 1
jne 0x5ed358
mov ebx, dword [ebp + 0xc]
test eax, eax
jne 0x5ed546
mov esi, dword [ebp - 0x100c]
test esi, esi
js 0x5ed415
cmp esi, 0x3e8
jl 0x5ed3ff
mov eax, 0x10624dd3
imul esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x1010], eax
imul eax, eax, 0xfffffc18
add esi, eax
jmp 0x5ed409
mov dword [ebp - 0x1010], 0
imul eax, esi, 0x3e8
mov dword [ebp - 0x100c], eax
xor ecx, ecx
lea eax, [ebp - 0x1010]
test esi, esi
cmovs eax, ecx
push eax
push ecx
push ecx
lea eax, [ebp - 0x1008]
push eax
lea eax, [edi + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
test esi, esi
jns 0x5ed4ed
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2736
jne 0x5ed544
xor edi, edi
mov dword [ebp - 0x1010], 0
mov dword [ebp - 0x100c], 0
test ebx, ebx
je 0x5ed531
mov esi, dword [ebp - 0x1018]
add esi, 6
nop dword [eax + eax]
mov eax, dword [esi - 6]
mov dword [ebp - 0x1008], 0
cmp eax, 0xffffffff
je 0x5ed4c9
lea ecx, [ebp - 0x1010]
mov dword [ebp - 0x1004], eax
push ecx
push 0
push 0
lea ecx, [ebp - 0x1008]
mov dword [ebp - 0x1008], 1
push ecx
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x5ed4c9
jle 0x5ed4d2
mov eax, 0x100
jmp 0x5ed4ce
mov eax, 4
inc edi
mov word [esi], ax
add esi, 8
sub ebx, 1
jne 0x5ed480
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058bb64
mov esp, ebp
pop ebp
ret
jle 0x5ed544
xor edi, edi
test ebx, ebx
je 0x5ed531
mov esi, dword [ebp - 0x1018]
add esi, 6
nop
mov eax, dword [esi - 6]
cmp eax, 0xffffffff
jne 0x5ed50f
mov eax, 4
jmp 0x5ed525
lea ecx, [ebp - 0x1008]
push ecx
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x5ed529
mov eax, 0x100
inc edi
mov word [esi], ax
add esi, 8
sub ebx, 1
jne 0x5ed500
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058bb64
mov esp, ebp
pop ebp
ret
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058bb64
mov esp, ebp
pop ebp
ret
Function at 0x406e3b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4278a4], 0
jne 0x406e79
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406e4f
mov dword [ecx*4 + 0x4278a0], eax
inc ecx
cmp ecx, 0x100
jl 0x406e4a
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406ea6
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4278a0]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406e87
not eax
pop ebp
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x422c55e8
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x6c6e6ffa
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x411133
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
mov esi, dword [ebp + 0x1c]
push 0xa
pop ecx
xor eax, eax
push 0xa
mov ebx, dword [ebp + 0x24]
lea edi, [ebp - 0x58]
rep stosd dword es:[edi], eax
pop ecx
mov edx, dword [ebp + 0x18]
lea edi, [ebp - 0x30]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0x10]
lea edi, [ebp - 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x20]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], esi
xor esi, esi
push esi
push esi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x58]
push eax
push 0x410e3a
mov dword [ebp - 0x54], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x38], ebx
mov ebx, dword [ebp + 0x28]
push esi
push esi
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, esi
jne 0x411206
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x4111dc
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
cmp ebx, esi
jl 0x4111e7
mov ebx, 0x80004005
push ebx
push 0x428
push str.elevation.cpp
call fcn.0043294e
push str.Failed_to_create_elevated_cache_thread.
push ebx
call fcn.0042fa86
pop ecx
pop ecx
jmp 0x41124d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x30]
push eax
push 0x410ee7
push dword [ebp + 0xc]
call fcn.004033b1
mov ebx, eax
cmp ebx, esi
jge 0x411230
push str.Failed_to_pump_messages_in_child_process.
push ebx
call fcn.0042fa86
pop ecx
pop ecx
jmp 0x411246
push edi
call fcn.0040e8a3
mov eax, dword [ebp + 0x34]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x38]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
ret
pop ebx
leave
ret 0x34
Function at 0x41e7dc
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4540d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
push 1
push edx
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x41e847
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x41e81f
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
js 0x41e82a
mov esi, 0x80004005
push esi
push 0x1ef
push str.msuengine.cpp
call fcn.0043294e
push str.Failed_to_stop_wusa_service.
push esi
call fcn.0042fa86
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00427eaa
leave