joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403750
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
push 0xa0000000
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
je 0x40380f
push esi
push 0xa0000000
push str.FTSafeNetRockey4SMTService
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x4037fa
push 0x42a7d4
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x4037e9
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push 0x42a7d4
push esi
call ebx
test eax, eax
je 0x4037d1
cmp dword [0x42a7d8], 3
jne 0x4037d1
push 0x3e8
call edi
push 0x42a7d4
push esi
call ebx
test eax, eax
jne 0x4037b5
cmp dword [0x42a7d8], 1
pop edi
pop ebx
je 0x4037e9
push 0x202
call fcn.00402d40
add esp, 4
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ebp
ret
push 0x201
call fcn.00402d40
add esp, 4
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ebp
ret

Function at 0x4038b0
Capabilities:
Delete service
Query service status
Shutdown system
Stop service

Disassembly:
push ebp
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
je 0x403983
push esi
push 0xf003f
push str.FTSafeNetRockey4SMTService
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x403979
push 0x42a7d4
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x403954
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push 0x42a7d4
push esi
call ebx
test eax, eax
je 0x40393c
lea esp, [esp]
cmp dword [0x42a7d8], 3
jne 0x40393c
push 0x3e8
call edi
push 0x42a7d4
push esi
call ebx
test eax, eax
jne 0x403920
cmp dword [0x42a7d8], 1
pop edi
pop ebx
je 0x403954
push 0x202
call fcn.00402d40
add esp, 4
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x403972
push 0x203
call fcn.00402d40
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
jmp 0x403990
push 0x201
call fcn.00402d40
add esp, 4
call fcn.00403440
test eax, eax
pop ebp
jne 0x4039a3
push eax
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
ret
Function at 0x404170
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x404
mov eax, dword [0x427da0]
xor eax, esp
mov dword [esp + 0x400], eax
push 0x400
lea eax, [esp + 4]
push 0
push eax
call fcn.0040fd40
mov edx, dword [esp + 0x414]
add esp, 0xc
lea ecx, [esp + 0x40c]
push ecx
push edx
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_wvsprintfA]
push 0x4218a4
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.0040fac6
add esp, 0x404
ret

Function at 0x404770
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
mov eax, dword [0x427da0]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov ebx, ecx
push edi
lea esi, [ebx + 0x2014]
push esi
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
or edi, 0xffffffff
cmp word [esp + 0x20], 0x1000
jb 0x4047c4
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0040fac6
add esp, 0xc
ret 8
mov esi, dword [ebx + 8]
test esi, esi
mov dword [esp + 0x10], esi
je 0x4048b4
mov ax, word [esp + 0x20]
cmp word [esi], ax
jne 0x4047fa
lea edi, [esi + 0x3c]
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test ebp, ebp
je 0x4047f0
mov ecx, dword [edi]
mov dword [ebp], ecx
cmp dword [edi], 0
je 0x40480a
or edi, 0xffffffff
jmp 0x404801
mov dword [esp + 0x10], esi
mov esi, dword [esi + 0x44]
test esi, esi
jne 0x4047d3
jmp 0x4048b4
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x1000
push 2
push 0
call ebp
push 4
push 0x1000
push 8
push 0
mov edi, eax
call ebp
test edi, edi
je 0x404862
test eax, eax
je 0x404862
mov dx, word [esp + 0x20]
push 0
push 0
push eax
push 0x4046f0
push 0
mov word [edi], dx
push 0
mov dword [eax], ebx
mov dword [eax + 4], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x404862
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40487d
push 0x421944
call fcn.00404170
mov eax, dword [esp + 0x24]
add esp, 4
push 0
push eax
mov ecx, ebx
call fcn.00404360
movzx edi, word [esi + 2]
movzx ecx, word [esi + 0x1c]
shl edi, 0x10
or edi, ecx
cmp esi, dword [ebx + 8]
push esi
jne 0x404898
mov edx, dword [esi + 0x44]
mov dword [ebx + 8], edx
jmp 0x4048a2
mov eax, dword [esi + 0x44]
mov ecx, dword [esp + 0x14]
mov dword [ecx + 0x44], eax
call fcn.0040ff0d
add esp, 4
add ebx, 4
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040fac6
add esp, 0xc
ret 8
Function at 0x404ba0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
or eax, 0xffffffff
test edx, edx
push esi
mov esi, dword [esp + 8]
je 0x404bd2
push ebx
push edi
movzx ebx, byte [esi]
mov edi, eax
and edi, 0xff
xor edi, ebx
shr eax, 8
xor eax, dword [ecx + edi*4 + 4]
sub edx, 1
add esi, 1
test edx, edx
jne 0x404bb2
pop edi
pop ebx
not eax
pop esi
ret 8

Function at 0x404be0
Capabilities:
Print debug messages
Read file on windows

Disassembly:
sub esp, 0x20
mov eax, dword [0x427da0]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
push ebp
mov ebp, dword [esp + 0x30]
push esi
push 0x421968
push eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], 0
call fcn.00411158
mov esi, eax
add esp, 8
test esi, esi
jne 0x404c2b
pop esi
pop ebp
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0040fac6
add esp, 0x20
ret 0xc
push ebx
push edi
push 2
push 0
push esi
call fcn.0041100f
push esi
call fcn.00410f1a
push 0
push 0
push esi
mov edi, eax
call fcn.0041100f
push edi
call fcn.0041072d
push esi
push edi
mov ebx, eax
push 1
push ebx
call fcn.00410d67
add esp, 0x30
cmp eax, edi
jne 0x404c82
mov ecx, dword [esp + 0x14]
mov eax, edi
sub eax, dword [esp + 0x38]
push eax
push ebx
call fcn.00404ba0
test ebp, ebp
mov dword [esp + 0x10], eax
je 0x404c82
mov ecx, dword [edi + ebx - 4]
mov dword [ebp], ecx
push esi
call fcn.00410a8e
add esp, 4
test ebx, ebx
je 0x404c98
push ebx
call fcn.00410650
add esp, 4
mov esi, dword [esp + 0x10]
push esi
lea edx, [esp + 0x1c]
push str._04x
push edx
call fcn.0040fdff
add esp, 0xc
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x2c]
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
xor ecx, esp
call fcn.0040fac6
add esp, 0x20
ret 0xc

Function at 0x404d20
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
lea ebx, [edi + 4]
lea ebx, [ebx]
push 8
push esi
mov ecx, edi
call fcn.00404b60
shl eax, 0x18
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
lea edx, [eax + eax]
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
lea edx, [eax + eax]
and ecx, 0x4c11db7
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
lea edx, [eax + eax]
and ecx, 0x4c11db7
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
push 0x20
push eax
mov ecx, edi
call fcn.00404b60
mov dword [ebx], eax
add esi, 1
add ebx, 4
cmp esi, 0xff
jle 0x404d30
pop edi
pop esi
pop ebx
ret
Function at 0x404ed0
Capabilities:
Read .ini file

Disassembly:
push eax
mov eax, dword [esp + 0xc]
push 0x100
push ecx
mov ecx, dword [esp + 0x10]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
ret

Function at 0x405800
Capabilities:
Create thread

Disassembly:
test byte [esp + 4], 2
mov dword [0x42df58], 0
je 0x40589b
cmp dword [0x42aa98], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
je 0x405860
cmp dword [0x42aa9c], 0
je 0x405857
test esi, esi
je 0x405857
mov ax, word [0x421478]
mov word [esi + 0x400], ax
mov cl, byte [0x42147a]
mov byte [esi + 0x402], cl
cmp dword [0x42aa98], 0
jne 0x405876
lea edx, [esp + 0x10]
push edx
push 0
push esi
push 0x405670
push 0
push 0
call edi
push eax
call ebx
cmp dword [0x42aa9c], 0
jne 0x405895
lea eax, [esp + 0x10]
push eax
push 0
push esi
push 0x405630
push 0
push 0
call edi
push eax
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
ret
xor eax, eax
ret

Function at 0x405ea0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x41ff9b
mov eax, dword fs:[0]
push eax
sub esp, 0xe78
mov eax, dword [0x427da0]
xor eax, esp
mov dword [esp + 0xe74], eax
push esi
push edi
mov eax, dword [0x427da0]
xor eax, esp
push eax
lea eax, [esp + 0xe84]
mov dword fs:[0], eax
mov esi, dword [esp + 0xe94]
push 1
lea ecx, [esp + 0x14]
call fcn.00404ef0
push 0x104
lea eax, [esp + 0xd80]
push eax
push 0
mov dword [esp + 0xe98], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x42aa7c
push 8
lea ecx, [esp + 0xd84]
push ecx
mov ecx, 0x42e0b0
call fcn.00404be0
push 0x42aa80
mov dword [0x42aa78], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test esi, esi
mov dword [0x42aaa8], eax
mov dword [0x426828], 0xea60
mov ecx, 0x42aab0
je 0x405f68
push esi
push str.FTRockeyIVSwordhui
call fcn.004061c0
push esi
jmp 0x405f79
push 0
push str.FTRockeyIVSwordhui
call fcn.004061c0
push str.._svrcfg.ini
lea ecx, [esp + 0x14]
call fcn.00405160
mov edx, dword [esp + 0x964]
imul edx, edx, 0xea60
push 0x405720
mov ecx, 0x42aab0
mov dword [0x42682c], edx
call fcn.00406360
xor eax, eax
cmp dword [esp + 0x18], eax
je 0x405fb1
mov eax, 3
push 0
push eax
call fcn.00405800
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
add esp, 8
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x4056b0
push 0
push 0
call esi
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0x405cc0
push 0
push 0
mov edi, eax
call esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
call edi
push esi
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0xe8c], 0xffffffff
call fcn.00404f10
xor eax, eax
mov ecx, dword [esp + 0xe84]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xe74]
xor ecx, esp
call fcn.0040fac6
add esp, 0xe84
ret
Function at 0x4061c0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x294
mov eax, dword [0x427da0]
xor eax, esp
mov dword [esp + 0x290], eax
push ebx
mov ebx, dword [esp + 0x29c]
push esi
push edi
mov edi, dword [esp + 0x2a8]
lea eax, [esp + 0xc]
push eax
push 0x202
mov esi, ecx
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x406202
push 0x66
jmp 0x4062c7
mov ax, word [esp + 0xc]
cmp al, 2
jne 0x4062bf
cmp ah, al
jne 0x4062bf
test ebx, ebx
jne 0x40626b
mov ecx, dword [str.FTRockeyIVSwordhui]
mov edx, dword [0x421a24]
mov eax, dword [0x421a28]
mov dword [esp + 0x19c], ecx
mov ecx, dword [0x421a2c]
mov dword [esp + 0x1a0], edx
mov dx, word [0x421a30]
mov dword [esp + 0x1a4], eax
mov al, byte [0x421a32]
mov dword [esp + 0x1a8], ecx
mov word [esp + 0x1ac], dx
mov byte [esp + 0x1ae], al
jmp 0x40627a
push ebx
lea ecx, [esp + 0x1a0]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x19c]
push edx
mov byte [esp + 0x29f], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [esp + 0x1a0]
push eax
mov ecx, esi
call fcn.004083b0
test edi, edi
lea ecx, [esi + 4]
je 0x4062b1
push edi
call fcn.00405200
xor eax, eax
jmp 0x4062d6
push str.._svrcfg.ini
call fcn.00405200
xor eax, eax
jmp 0x4062d6
call dword [sym.imp.WSOCK32.dll_WSACleanup]
push 0x67
mov ecx, 0x42e090
call fcn.00405430
mov eax, 0x7d1
mov ecx, dword [esp + 0x29c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040fac6
add esp, 0x294
ret 8
Function at 0x4080a0
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x427da0]
xor eax, esp
mov dword [esp + 0x94], eax
push esi
lea eax, [esp + 4]
push eax
xor esi, esi
mov dword [esp + 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x4080e0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
sbb esi, esi
neg esi
add esi, 1
mov eax, dword [esp + 0x14]
cmp eax, 1
jne 0x408156
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x40810e
mov esi, 1
mov eax, esi
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0040fac6
add esp, 0x98
ret
cmp eax, 0xa
jne 0x408130
mov esi, 4
mov eax, esi
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0040fac6
add esp, 0x98
ret
cmp eax, 0x32
jbe 0x4081ff
mov esi, 6
mov eax, esi
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0040fac6
add esp, 0x98
ret
cmp eax, 2
jne 0x4081ff
mov eax, dword [esp + 8]
cmp eax, 6
jne 0x40818c
cmp dword [esp + 0xc], 0
jne 0x40818e
mov esi, 9
mov eax, esi
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0040fac6
add esp, 0x98
ret
jb 0x4081ab
mov esi, 0xa
mov eax, esi
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0040fac6
add esp, 0x98
ret
cmp eax, 4
jne 0x4081cd
mov esi, 2
mov eax, esi
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0040fac6
add esp, 0x98
ret
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x4081f2
mov esi, 5
mov eax, esi
pop esi
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0040fac6
add esp, 0x98
ret
xor ecx, ecx
cmp eax, 1
setne cl
add ecx, 7
mov esi, ecx
mov ecx, dword [esp + 0x98]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040fac6
add esp, 0x98
ret

Function at 0x408230
Capabilities:
Encrypt data using blowfish

Disassembly:
mov ecx, dword [esp + 4]
mov eax, ecx
shr eax, 8
movzx edx, al
mov eax, dword [edx*4 + 0x427088]
push esi
movzx esi, cl
add eax, dword [esi*4 + 0x426c88]
mov edx, ecx
shr edx, 0x10
movzx edx, dl
xor eax, dword [edx*4 + 0x427488]
shr ecx, 0x18
add eax, dword [ecx*4 + 0x427888]
pop esi
ret 4

Function at 0x408290
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov eax, dword [ebx]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp]
mov dword [esp + 0x14], ecx
mov esi, 0x426c40
jmp 0x4082b4
mov eax, dword [esp + 0x18]
xor eax, dword [esi]
mov ecx, edi
push eax
mov dword [esp + 0x1c], eax
call fcn.00408230
xor dword [esp + 0x14], eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
call fcn.00408270
add esi, 4
cmp esi, 0x426c80
jl 0x4082b0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
mov ecx, edi
call fcn.00408270
mov ecx, dword [0x426c84]
mov eax, dword [esp + 0x14]
xor eax, dword [0x426c80]
xor ecx, dword [esp + 0x18]
pop edi
mov dword [ebx], ecx
pop esi
mov dword [ebp], eax
pop ebp
pop ebx
ret 8
Function at 0x4083b0
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebx
push ebp
push esi
movsx esi, word [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
mov ebp, ecx
xor eax, eax
mov ebx, 0x426c40
movsx ecx, byte [eax + edi]
add eax, 1
cmp eax, esi
jl 0x4083d3
xor eax, eax
movsx edx, byte [eax + edi]
shl ecx, 8
add eax, 1
or edx, ecx
cmp eax, esi
jl 0x4083e5
xor eax, eax
movsx ecx, byte [eax + edi]
shl edx, 8
add eax, 1
or ecx, edx
cmp eax, esi
jl 0x4083f7
xor eax, eax
movsx edx, byte [eax + edi]
shl ecx, 8
add eax, 1
or edx, ecx
cmp eax, esi
jl 0x408409
xor eax, eax
xor dword [ebx], edx
add ebx, 4
cmp ebx, 0x426c88
jl 0x4083c6
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov esi, 0x426c44
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, ebp
call fcn.00408290
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov dword [esi - 4], edx
mov dword [esi], eax
add esi, 8
cmp esi, 0x426c8c
jl 0x408425
mov esi, 0x426c8c
mov edi, 0x80
jmp 0x408460
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
mov ecx, ebp
call fcn.00408290
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esi - 4], eax
mov dword [esi], ecx
add esi, 8
sub edi, 1
jne 0x408460
cmp esi, 0x427c8c
jl 0x408453
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x40a880
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov eax, dword [0x427da0]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
push edi
mov ecx, 6
lea esi, [esp + 0x2c]
lea edi, [esp + 8]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov al, byte [esp + 9]
xor al, byte [esp + 0xa]
pop edi
xor al, byte [esp + 7]
pop esi
xor al, byte [esp + 4]
xor al, byte [esp + 5]
xor ecx, ecx
jmp 0x40a8c0
mov dl, byte [esp + ecx + 6]
xor dl, byte [esp + ecx + 7]
add ecx, 6
xor dl, byte [esp + ecx + 2]
xor dl, byte [esp + ecx + 3]
xor dl, byte [esp + ecx + 5]
xor dl, byte [esp + ecx + 4]
xor al, dl
cmp ecx, 0x12
jl 0x40a8c0
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0040fac6
add esp, 0x20
ret
Function at 0x40abf0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x3c
mov eax, dword [0x427da0]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
mov ebp, dword [esp + 0x48]
mov eax, ebp
imul eax, eax, 0x126
cmp dword [eax + 0x432bc8], 0
push esi
push edi
jne 0x40ac31
mov eax, 0xa2
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0040fac6
add esp, 0x3c
ret 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00410924
call fcn.00410931
lea ecx, [esp + 0x14]
push 0x19
push ecx
mov bl, al
call fcn.0040a4f0
add esp, 0xc
mov byte [esp + 0x11], 0xa
mov byte [esp + 0x12], bl
mov byte [esp + 0x13], bl
mov byte [esp + 0x14], bl
mov byte [esp + 0x15], bl
xor eax, eax
lea ebx, [ebx]
xor byte [esp + eax + 0x16], bl
add eax, 1
cmp eax, 0x12
jl 0x40ac70
sub esp, 0x1c
mov ecx, 6
lea esi, [esp + 0x2c]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.0040a880
lea edx, [esp + 0x48]
mov byte [esp + 0x44], al
push edx
lea eax, [esp + 0x30]
push eax
push ebp
call fcn.0040a6d0
mov ecx, dword [esp + 0x70]
add esp, 0x28
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040fac6
add esp, 0x3c
ret 4
Function at 0x40acc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x44
mov eax, dword [0x427da0]
xor eax, esp
mov dword [esp + 0x40], eax
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x58]
imul edx, edx, 0x126
cmp dword [edx + 0x432bc8], 0
mov ecx, dword [esp + 0x5c]
push ebx
push ebp
mov ebp, dword [esp + 0x5c]
push esi
mov esi, dword [esp + 0x58]
push edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
jne 0x40ad1b
mov eax, 0xa2
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.0040fac6
add esp, 0x44
ret 0x1c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00410924
call fcn.00410931
mov bl, al
lea eax, [esp + 0x1c]
push 0x19
push eax
call fcn.0040a4f0
movzx eax, byte [edi + 1]
movzx ecx, byte [esi + 1]
movzx edx, byte [esi]
xor al, bl
xor cl, bl
xor dl, bl
mov byte [esp + 0x2c], al
movzx eax, byte [ebp]
mov byte [esp + 0x2a], cl
movzx ecx, byte [edi]
mov byte [esp + 0x2b], dl
movzx edx, byte [ebp + 1]
xor al, bl
xor cl, bl
xor dl, bl
mov byte [esp + 0x2f], al
mov eax, dword [esp + 0x20]
mov byte [esp + 0x2d], cl
movzx ecx, byte [eax + 1]
mov byte [esp + 0x2e], dl
movzx edx, byte [eax]
xor cl, bl
xor dl, bl
add esp, 0xc
cmp dword [esp + 0x70], 0
mov byte [esp + 0x19], 1
mov byte [esp + 0x1a], bl
mov byte [esp + 0x1b], bl
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], bl
mov byte [esp + 0x24], cl
mov byte [esp + 0x25], dl
je 0x40adb4
mov al, bl
xor al, 1
mov byte [esp + 0x26], al
jmp 0x40adb8
mov byte [esp + 0x26], bl
sub esp, 0x1c
mov ecx, 6
lea esi, [esp + 0x34]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.0040a880
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x38]
mov byte [esp + 0x50], al
mov eax, dword [esp + 0x78]
push edx
push eax
call fcn.0040a6d0
mov edx, dword [esp + 0x38]
add esp, 0x28
test edx, edx
je 0x40ae21
movzx esi, byte [esp + 0x3a]
movzx edi, byte [esp + 0x3b]
movzx ecx, bl
xor esi, ecx
xor edi, ecx
shl esi, 8
add esi, edi
movzx edi, byte [esp + 0x3c]
xor edi, ecx
shl esi, 8
add esi, edi
movzx edi, byte [esp + 0x3d]
shl esi, 8
xor edi, ecx
add esi, edi
mov dword [edx], esi
mov ecx, dword [esp + 0x50]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040fac6
add esp, 0x44
ret 0x1c
Function at 0x40afa0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x3c
mov eax, dword [0x427da0]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
mov ebp, dword [esp + 0x48]
mov eax, ebp
imul eax, eax, 0x126
cmp dword [eax + 0x432bc8], 0
push esi
mov esi, dword [esp + 0x58]
push edi
jne 0x40afe5
mov eax, 0xa2
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0040fac6
add esp, 0x3c
ret 0x10
mov ebx, dword [esp + 0x58]
cmp ebx, 0x1f0
jle 0x40b00b
mov eax, 0xa4
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0040fac6
add esp, 0x3c
ret 0x10
mov ecx, ebx
and ecx, reloc.WSOCK32.dll_ntohs
jns 0x40b01a
dec ecx
or ecx, 0xfffffff0
inc ecx
jne 0x40aff1
test ebx, ebx
jl 0x40aff1
lea edx, [esp + 0x10]
push 0x19
push edx
call fcn.0040a4f0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00410924
add esp, 4
call fcn.00410931
mov cl, al
xor cl, byte [esp + 0x54]
mov edx, ebx
sar edx, 8
xor dl, al
mov byte [esp + 0x13], cl
mov ecx, dword [esi]
mov byte [esp + 0x14], dl
mov edx, dword [esi + 4]
mov dword [esp + 0x16], ecx
mov ecx, dword [esi + 8]
xor bl, al
mov dword [esp + 0x1a], edx
mov edx, dword [esi + 0xc]
mov dword [esp + 0x1e], ecx
mov byte [esp + 0x11], 0x10
mov byte [esp + 0x12], al
mov byte [esp + 0x15], bl
mov dword [esp + 0x22], edx
xor ecx, ecx
xor byte [esp + ecx + 0x16], al
add ecx, 1
cmp ecx, 0x10
jl 0x40b084
sub esp, 0x1c
mov ecx, 6
lea esi, [esp + 0x2c]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.0040a880
mov byte [esp + 0x44], al
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x30]
push ecx
push ebp
call fcn.0040a6d0
mov ecx, dword [esp + 0x70]
add esp, 0x28
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040fac6
add esp, 0x3c
ret 0x10