joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401990
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
push esi
push edi
xorps xmm0, xmm0
mov esi, ecx
push str.___blackrock_1_____n
movlpd qword [ebp - 0x28], xmm0
call fcn.00401330
add esp, 4
push esi
push str.rounds___u_n
call fcn.00401330
push 0
push 1
push 0x123
push 0x56789123
mov edx, esi
lea ecx, [ebp - 0x70]
call fcn.00401370
add esp, 0x18
lea eax, [ebp - 0x10]
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 0x18], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
call fcn.004448f0
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movsd qword [ebp - 0x20], xmm0
call fcn.004448f0
movaps xmm1, xmm0
xorps xmm0, xmm0
divsd xmm1, qword [ebp - 0x20]
movlpd qword [ebp - 0x18], xmm0
mulsd xmm1, qword [0x456c90]
movsd xmm0, qword [0x456ca0]
comisd xmm1, xmm0
jb 0x401a53
subsd xmm1, xmm0
comisd xmm0, xmm1
jbe 0x401a53
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
add esi, 0
adc edi, 0x80000000
jmp 0x401a59
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
movaps xmm0, xmm1
call fcn.00444840
mov ebx, dword [ebp - 0x28]
add eax, esi
xorps xmm0, xmm0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x24]
adc edx, edi
movlpd qword [ebp - 0x20], xmm0
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
push edi
push esi
lea ecx, [ebp - 0x70]
call fcn.00401900
add esp, 8
add ebx, eax
adc dword [ebp - 4], edx
add esi, 1
adc edi, 0
jne 0x401aa4
cmp esi, 0x4c4b40
jb 0x401a82
xorps xmm0, xmm0
lea eax, [ebp - 0x28]
push eax
movlpd qword [ebp - 0x28], xmm0
movlpd qword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
or ebx, dword [ebp - 4]
je 0x401b7a
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
call fcn.004448f0
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
movsd qword [ebp - 0x20], xmm0
call fcn.004448f0
movaps xmm1, xmm0
xorps xmm0, xmm0
divsd xmm1, qword [ebp - 0x20]
movlpd qword [ebp - 8], xmm0
mulsd xmm1, qword [0x456c90]
movsd xmm0, qword [0x456ca0]
comisd xmm1, xmm0
jb 0x401b2a
subsd xmm1, xmm0
comisd xmm0, xmm1
jbe 0x401b2a
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
add esi, 0
adc edi, 0x80000000
jmp 0x401b30
mov edi, dword [ebp - 4]
mov esi, dword [ebp - 8]
movaps xmm0, xmm1
call fcn.00444840
add eax, esi
adc edx, edi
sub eax, dword [ebp - 0xc]
mov ecx, eax
sbb edx, dword [ebp - 0x14]
call fcn.004448f0
divsd xmm0, qword [0x456c90]
sub esp, 8
movsd xmm1, qword [0x456c78]
divsd xmm1, xmm0
divsd xmm1, qword [0x456c70]
movsd qword [esp], xmm1
push str.iterations_second___5.3f_million_n
call fcn.00401330
add esp, 0xc
push 0x44a41c
call fcn.00401330
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401e40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 1
add edi, esi
adc ebx, ecx
test ebx, ebx
jb 0x401e8f
ja 0x401e62
cmp edi, 2
jbe 0x401e8f
add esi, 1
adc ecx, 0
xor eax, eax
mov dword [ebp + 0xc], ecx
xor edx, edx
mov ecx, esi
bts eax, ecx
cmp ecx, 0x20
cmovae edx, eax
xor eax, edx
cmp ecx, 0x40
mov ecx, dword [ebp + 0xc]
cmovae edx, eax
cmp edx, ebx
jb 0x401e62
ja 0x401e8f
cmp eax, edi
jb 0x401e62
xor eax, eax
xor edx, edx
bts eax, esi
cmp esi, 0x20
pop edi
cmovae edx, eax
xor eax, edx
cmp esi, 0x40
pop esi
cmovae edx, eax
pop ebx
pop ebp
ret
Function at 0x4022f0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
push esi
push edi
xorps xmm0, xmm0
mov esi, ecx
push str.___blackrock_2_____n
movlpd qword [ebp - 0x28], xmm0
call fcn.00401330
add esp, 4
push esi
push str.rounds___u_n
call fcn.00401330
sub esp, 8
lea ecx, [ebp - 0x70]
mov edx, esi
call fcn.00401f10
add esp, 0x10
lea eax, [ebp - 0x10]
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 0x18], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
call fcn.004448f0
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movsd qword [ebp - 0x20], xmm0
call fcn.004448f0
movaps xmm1, xmm0
xorps xmm0, xmm0
divsd xmm1, qword [ebp - 0x20]
movlpd qword [ebp - 0x18], xmm0
mulsd xmm1, qword [0x456c90]
movsd xmm0, qword [0x456ca0]
comisd xmm1, xmm0
jb 0x4023a8
subsd xmm1, xmm0
comisd xmm0, xmm1
jbe 0x4023a8
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
add esi, 0
adc edi, 0x80000000
jmp 0x4023ae
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
movaps xmm0, xmm1
call fcn.00444840
mov ebx, dword [ebp - 0x28]
add eax, esi
xorps xmm0, xmm0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x24]
adc edx, edi
movlpd qword [ebp - 0x20], xmm0
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
push edi
push esi
lea ecx, [ebp - 0x70]
call fcn.00402240
add esp, 8
add ebx, eax
adc dword [ebp - 4], edx
add esi, 1
adc edi, 0
jne 0x4023f9
cmp esi, 0x4c4b40
jb 0x4023d7
xorps xmm0, xmm0
lea eax, [ebp - 0x28]
push eax
movlpd qword [ebp - 0x28], xmm0
movlpd qword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
or ebx, dword [ebp - 4]
je 0x4024cf
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
call fcn.004448f0
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
movsd qword [ebp - 0x20], xmm0
call fcn.004448f0
movaps xmm1, xmm0
xorps xmm0, xmm0
divsd xmm1, qword [ebp - 0x20]
movlpd qword [ebp - 8], xmm0
mulsd xmm1, qword [0x456c90]
movsd xmm0, qword [0x456ca0]
comisd xmm1, xmm0
jb 0x40247f
subsd xmm1, xmm0
comisd xmm0, xmm1
jbe 0x40247f
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
add esi, 0
adc edi, 0x80000000
jmp 0x402485
mov edi, dword [ebp - 4]
mov esi, dword [ebp - 8]
movaps xmm0, xmm1
call fcn.00444840
add eax, esi
adc edx, edi
sub eax, dword [ebp - 0xc]
mov ecx, eax
sbb edx, dword [ebp - 0x14]
call fcn.004448f0
divsd xmm0, qword [0x456c90]
sub esp, 8
movsd xmm1, qword [0x456c78]
divsd xmm1, xmm0
divsd xmm1, qword [0x456c70]
movsd qword [esp], xmm1
push str.iterations_second___5.3f_million_n
call fcn.00401330
add esp, 0xc
push 0x44a41c
call fcn.00401330
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402a80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], ecx
add esi, 0xf
mov ecx, dword [ebp + 0xc]
add ecx, 0x3b9aca00
push edi
adc ebx, 0
lea edi, [edx*2 + 0xf]
test ebx, ebx
jg 0x402ac6
jl 0x402ab2
test ecx, ecx
jae 0x402ac6
mov eax, edi
cdq
add ecx, eax
adc ebx, edx
add edi, 0x1e
test ebx, ebx
jl 0x402ab2
jg 0x402ac6
test ecx, ecx
jb 0x402ab2
lea eax, [ecx - 0x3b9aca00]
cmp eax, 0x1f480
jge 0x402adf
add eax, edi
add edi, 0x1e
cmp eax, 0x1f480
jl 0x402ad3
sub edi, 0x1e
mov dword [ebp + 8], edi
cmp edi, 0xf
jle 0x402b49
nop word [eax + eax]
sub eax, edi
jns 0x402afd
add eax, esi
add esi, 0x1e
test eax, eax
js 0x402af4
mov ebx, eax
mov ecx, esi
mov dword [ebp + 0x10], ebx
mov dword [ebp - 8], ecx
cmp eax, 0x1f480
jae 0x402b3a
mov edi, dword [ebp - 4]
mov ecx, eax
mov edx, eax
and ecx, 0x1f
shr edx, 5
add eax, esi
add esi, 0x1e
mov ecx, dword [ecx*4 + 0x4463b0]
xor dword [edi + edx*4], ecx
cmp eax, 0x1f480
jl 0x402b11
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp - 8]
sub edi, 0x1e
mov eax, ebx
mov dword [ebp + 8], edi
mov esi, ecx
cmp edi, 0xf
jg 0x402af0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402b50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], ecx
add esi, 0xf
mov ecx, dword [ebp + 0xc]
add ecx, 0x3b9aca00
push edi
adc ebx, 0
lea edi, [edx + 5]
test ebx, ebx
jg 0x402b94
jl 0x402b80
test ecx, ecx
jae 0x402b94
nop
mov eax, edi
cdq
add ecx, eax
adc ebx, edx
add edi, 0xa
test ebx, ebx
jl 0x402b80
jg 0x402b94
test ecx, ecx
jb 0x402b80
lea eax, [ecx - 0x3b9aca00]
cmp eax, 0x1f480
jge 0x402bad
add eax, edi
add edi, 0xa
cmp eax, 0x1f480
jl 0x402ba1
sub edi, 0xa
mov dword [ebp + 8], edi
cmp edi, 5
jle 0x402c18
sub eax, edi
jns 0x402bc9
nop dword [eax]
add eax, esi
add esi, 0x1e
test eax, eax
js 0x402bc0
mov ebx, eax
mov ecx, esi
mov dword [ebp + 0x10], ebx
mov dword [ebp - 8], ecx
cmp eax, 0x1f480
jae 0x402c09
mov edi, dword [ebp - 4]
nop dword [eax]
mov ecx, eax
mov edx, eax
and ecx, 0x1f
shr edx, 5
add eax, esi
add esi, 0x1e
mov ecx, dword [ecx*4 + 0x4463b0]
xor dword [edi + edx*4], ecx
cmp eax, 0x1f480
jl 0x402be0
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp - 8]
sub edi, 0xa
mov eax, ebx
mov dword [ebp + 8], edi
mov esi, ecx
cmp edi, 5
jg 0x402bb8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40acc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, ecx
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0xc]
mov edi, dword [eax + 4]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x40acfe
push str.____ipv6_picker_is_null_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 8
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov eax, edi
sub eax, edx
shr eax, 1
add eax, edx
mov ecx, dword [ecx + eax*4]
mov dword [ebp - 0xc], ecx
test ebx, ebx
ja 0x40ad23
jb 0x40ad1c
cmp esi, ecx
jae 0x40ad23
mov edi, eax
mov ecx, dword [ebp - 4]
jmp 0x40ad04
mov ecx, dword [ebp - 8]
lea edx, [eax + 1]
cmp edx, dword [ecx + 4]
je 0x40ad40
test ebx, ebx
jb 0x40ad40
ja 0x40ad1e
mov ecx, dword [ebp - 4]
cmp esi, dword [ecx + eax*4 + 4]
jae 0x40ad04
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
shl eax, 5
sub esi, dword [ebp - 0xc]
sbb ebx, 0
movups xmm0, xmmword [eax + ecx]
movups xmm1, xmmword [eax + ecx]
movups xmmword [ebp - 0x20], xmm0
mov ecx, dword [ebp - 0x14]
psrldq xmm0, 8
movd edx, xmm0
movups xmmword [ebp - 0x30], xmm1
add edx, esi
psrldq xmm1, 0xc
movd eax, xmm1
adc ecx, ebx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ecx
cmp ecx, eax
ja 0x40ad8d
jb 0x40ad85
cmp edx, dword [ebp - 0x28]
jae 0x40ad8d
add dword [ebp - 0x20], 1
adc dword [ebp - 0x1c], 0
mov eax, dword [ebp + 8]
movups xmm0, xmmword [ebp - 0x20]
pop edi
pop esi
movups xmmword [eax], xmm0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40bd10
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8010
call fcn.00444810
mov eax, dword [0x458004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x800c], eax
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0x8010], edx
mov byte [ebp - 0x8004], 0xd
push edi
mov edi, ecx
cmp eax, 0x3fe5
jae 0x40bf34
lea ecx, [eax + 0x1b]
push ebx
push esi
cmp eax, 0x65
jae 0x40bd65
mov byte [ebp - 0x8003], cl
mov esi, 2
jmp 0x40bd81
add eax, 0x1b
mov esi, 3
shr eax, 7
or al, 0x80
and cl, 0x7f
mov byte [ebp - 0x8003], al
mov byte [ebp - 0x8002], cl
mov ebx, dword [ebp + 8]
mov ecx, ebx
mov edx, dword [ebp + 0xc]
mov eax, edx
shrd ecx, eax, 0x18
mov eax, edx
mov byte [ebp + esi - 0x8001], bl
mov byte [ebp + esi - 0x8004], cl
mov ecx, ebx
shrd ecx, eax, 0x10
mov eax, ebx
mov dword [ebp - 0x8008], esi
shrd eax, edx, 8
mov ebx, dword [ebp + 0x14]
mov byte [ebp + esi - 0x8002], al
mov al, byte [ebp + 0x28]
mov byte [ebp + esi - 0x8000], al
mov byte [ebp + esi - 0x8003], cl
mov ecx, dword [ebp + 0x2c]
mov eax, ecx
shr eax, 8
mov byte [ebp + esi - 0x7fff], al
mov byte [ebp + esi - 0x7ffe], cl
mov ecx, dword [ebp + 0x30]
mov eax, ecx
sar eax, 8
mov byte [ebp + esi - 0x7ffd], al
mov al, byte [ebp + 0x34]
mov byte [ebp + esi - 0x7ffb], al
mov al, byte [ebp + 0x20]
mov byte [ebp + esi - 0x7ffa], al
mov eax, ebx
mov edx, dword [ebp + 0x10]
shr eax, 0x18
mov byte [ebp + esi - 0x7ff9], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp + esi - 0x7ff8], al
mov eax, ebx
shr eax, 8
mov byte [ebp + esi - 0x7ff7], al
mov eax, ebx
mov byte [ebp + esi - 0x7ffc], cl
mov ecx, edx
shrd ecx, eax, 0x18
mov eax, ebx
mov byte [ebp + esi - 0x7ff6], bl
mov byte [ebp + esi - 0x7ff5], cl
mov ecx, edx
shrd ecx, eax, 0x10
mov eax, edx
mov byte [ebp + esi - 0x7ff2], dl
mov edx, dword [ebp + 0x18]
shrd eax, ebx, 8
mov ebx, dword [ebp + 0x1c]
mov byte [ebp + esi - 0x7ff3], al
mov eax, ebx
shr eax, 0x18
mov byte [ebp + esi - 0x7ff1], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp + esi - 0x7ff0], al
mov eax, ebx
shr eax, 8
mov byte [ebp + esi - 0x7fef], al
mov eax, ebx
mov byte [ebp + esi - 0x7ff4], cl
mov ecx, edx
shrd ecx, eax, 0x18
mov eax, ebx
mov byte [ebp + esi - 0x7fee], bl
mov byte [ebp + esi - 0x7fed], cl
mov ecx, edx
shrd ecx, eax, 0x10
mov eax, edx
mov byte [ebp + esi - 0x7fea], dl
shrd eax, ebx, 8
mov byte [ebp + esi - 0x7fec], cl
mov byte [ebp + esi - 0x7feb], al
mov esi, dword [ebp + 0x3c]
push esi
push dword [ebp - 0x800c]
mov ebx, dword [ebp - 0x8008]
lea eax, [ebp - 0x7fe9]
add eax, ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
push dword [ebp - 0x8010]
add ebx, 0x1b
lea eax, [ebp - 0x8004]
add esi, ebx
push esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x1c
cmp eax, esi
pop esi
pop ebx
je 0x40bf27
push str.output
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
add esp, 4
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
add dword [edi + 0x248], eax
adc dword [edi + 0x24c], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00443732
mov esp, ebp
pop ebp
ret
Function at 0x40d170
Capabilities:
Receive data
Receive data on socket
Terminate process

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
xor esi, esi
nop dword [eax]
push 0
push 1
lea eax, [esi + edi]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x40d1a9
inc esi
cmp byte [esi + edi - 1], 0xa
je 0x40d1a3
cmp esi, 0x400
jb 0x40d180
pop edi
mov eax, esi
pop esi
pop ebx
ret
push str.redis:_recv_line___failed_n
push 0
call fcn.0041b440
add esp, 8
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x40d1d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov eax, edx
xor ebx, ebx
push esi
mov edx, ecx
mov dword [ebp - 0xc], eax
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], edx
mov esi, dword [edx + 0x2f0]
test edi, edi
je 0x40d297
mov dword [ebp + 8], eax
nop dword [eax]
cmp esi, 7
ja case.0x40d209.5
jmp dword [esi*4 + 0x40d32c]
mov cl, byte [eax]
cmp cl, 0x2b
je 0x40d227
cmp cl, 0x3a
jne 0x40d2f6
mov esi, 1
jmp 0x40d28a
mov esi, 2
jmp 0x40d28a
movzx eax, byte [eax]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
add esp, 4
test eax, eax
mov eax, dword [ebp + 8]
jne 0x40d287
mov cl, byte [eax]
cmp cl, 0xd
je 0x40d287
cmp cl, 0xa
jne 0x40d2f6
mov edx, dword [ebp - 4]
xor esi, esi
mov eax, dword [edx + 0x2ec]
mov ecx, dword [edx + 0x2e8]
mov dword [ebp - 8], eax
mov eax, ecx
or eax, dword [ebp - 8]
je 0x40d2a6
mov eax, dword [ebp - 8]
add ecx, 0xffffffff
mov dword [edx + 0x2e8], ecx
adc eax, 0xffffffff
mov dword [edx + 0x2ec], eax
mov eax, dword [ebp + 8]
jmp 0x40d28a
mov edx, dword [ebp - 4]
inc ebx
inc eax
mov dword [ebp + 8], eax
cmp ebx, edi
jb 0x40d200
pop edi
mov dword [edx + 0x2f0], esi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.redis:_out_of_sync_n
push 0
call fcn.0041b440
add esp, 8
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, dword [ebp - 0xc]
movsx ecx, byte [ebx + 0x44be1e]
mov al, byte [eax + ebx]
mov byte [ebp + 0xb], al
movzx eax, al
cmp ecx, eax
jne 0x40d2f1
inc esi
cmp byte [ebp + 0xb], 0xa
jne case.0x40d209.5
pop edi
pop esi
mov dword [edx + 0x2f0], 0
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
add eax, ebx
push eax
sub edi, ebx
push edi
push str.redis:_unexpected_data:__.s_n
push 0
call fcn.0041b440
add esp, 0x10
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push esi
push str.redis:_unexpected_state:__u_n
push 0
call fcn.0041b440
add esp, 0xc
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop dword [eax]
adc dl, dl
inc eax
add byte [esi], ch
rol byte [eax], cl
mov ebp, 0xbd0040d2
rol byte [eax], cl
mov ebp, 0x110040d2
rol dword [eax], cl
mov ebp, 0xbd0040d2
rol byte [eax], cl
int3
Function at 0x40e3a0
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push 0x4009c
push 1
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov esi, eax
add esp, 8
test esi, esi
jne 0x40e3d8
push str.____out_of_memory__aborting_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
push 0x540
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
jne 0x40e412
push str.smack
push str._s:_out_of_memory_error_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 0xc
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push 0x540
push 0
push edi
call sub.VCRUNTIME140.dll_memset
or dword [edi + 4], 1
add esp, 0xc
push 8
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [edi], eax
test eax, eax
je 0x40e3ec
mov dword [eax], 0x6e6e6162
mov dword [eax + 4], 0x317265
mov dword [esi + 4], edi
xor edi, edi
mov ecx, dword [0x458748]
test ecx, ecx
je 0x40e480
xor eax, eax
push dword [eax + 0x458754]
mov edx, ecx
mov ecx, dword [esi + 4]
push edi
push dword [eax + 0x45874c]
call fcn.0043a740
inc edi
add esp, 0xc
lea eax, [edi + edi*4]
shl eax, 2
mov ecx, dword [eax + 0x458748]
test ecx, ecx
jne 0x40e455
mov ecx, dword [esi + 4]
call fcn.0043aee0
push esi
mov dword [esi + str.http], 0x458c0c
mov dword [esi + 0x7e5c], 0x458c0c
mov dword [esi + 0x248], 0x458c9c
mov dword [esi + 0x710], 0x458cc8
mov dword [esi + 0x708], 0x459cb0
mov dword [esi + 0x760], 0x459cb0
mov dword [esi + 0xf94], 0x459cb0
mov dword [esi + 0xf98], 0x459cb0
mov dword [esi + 0xf9c], 0x459cb0
mov dword [esi + 0xfa0], 0x459cb0
mov dword [esi + 0xfa4], 0x459cb0
mov dword [esi + 0xfa8], 0x459cb0
mov dword [esi + 0x20a8], 0x459cb0
mov dword [esi + 0x20b8], 0x459cb0
mov dword [esi + 0x20dc], 0x459cb0
mov dword [esi + 0x8408], 0x459cb0
mov dword [esi + 0x8d84], 0x459cb0
mov dword [esi + 0x7f4c], 0x459cb0
mov dword [esi + 0xaf48], 0x446844
mov dword [esi + 0x78], 0x449b38
mov dword [esi + 0x3510], 0x447ed0
call dword [0x458c24]
add esp, 4
push esi
call fcn.00413310
add esp, 4
push esi
call dword [0x459cc8]
add esp, 4
push esi
call dword [0x458cb4]
add esp, 4
push esi
call dword [0x458ce0]
add esp, 4
push esi
call dword [0x458c50]
add esp, 4
push esi
call fcn.0043a170
add esp, 4
mov eax, esi
pop edi
pop esi
pop ecx
ret
Function at 0x4144b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, edx
mov edx, 0xc
movzx eax, byte [esi]
not eax
movzx ecx, byte [esi + 1]
movzx eax, al
mov eax, dword [eax*4 + 0x4469d0]
xor eax, 0xffffff
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4469d0]
movzx ecx, byte [esi + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4469d0]
movzx ecx, byte [esi + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4469d0]
movzx ecx, byte [esi + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4469d0]
movzx ecx, byte [esi + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4469d0]
movzx ecx, byte [esi + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4469d0]
movzx ecx, byte [esi + 7]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4469d0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4469d0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4469d0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4469d0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4469d0]
cmp edi, edx
jbe 0x4145a8
nop dword [eax]
movzx ecx, byte [edx + esi]
inc edx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4469d0]
cmp edx, edi
jb 0x414590
not eax
mov ecx, eax
shr ecx, 8
movzx edx, cl
movzx ecx, al
shl ecx, 8
or edx, ecx
mov ecx, eax
shr ecx, 0x10
shl edx, 8
movzx ecx, cl
or edx, ecx
shr eax, 0x18
shl edx, 8
pop edi
or eax, edx
pop esi
ret
Function at 0x417750
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x458004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push 0x540
call edi
mov esi, eax
add esp, 4
test esi, esi
jne 0x4177a2
push str.smack
push str._s:_out_of_memory_error_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 0xc
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push 0x540
push 0
push esi
call sub.VCRUNTIME140.dll_memset
and dword [esi + 4], 0xfffffffe
add esp, 0xc
push 9
call edi
mov ecx, eax
add esp, 4
mov dword [esi], ecx
test ecx, ecx
je 0x41777c
movq xmm0, qword [str.snmp_mib]
xor ebx, ebx
movq qword [ecx], xmm0
mov al, byte [0x44e190]
mov byte [ecx + 8], al
mov dword [0x4dc1f4], esi
mov dword [ebp - 0x110], ebx
cmp dword [str.selftest], ebx
je 0x41790a
xor eax, eax
mov esi, dword [eax + 0x45b088]
xor edi, edi
mov al, byte [esi]
test al, al
je 0x4178d7
cmp al, 0x2e
jne 0x417816
nop dword [eax + eax]
inc esi
cmp byte [esi], 0x2e
je 0x417810
push 0
lea eax, [ebp - 0x10c]
push eax
push esi
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
mov edx, dword [ebp - 0x10c]
add esp, 0xc
mov ebx, eax
cmp esi, edx
je 0x4178d1
mov ecx, ebx
mov esi, edx
and ecx, 0xf0000000
or ecx, 0
je 0x41784f
mov eax, 4
jmp 0x417884
mov eax, ebx
and eax, 0xffe00000
or eax, 0
je 0x417862
mov eax, 3
jmp 0x417884
mov eax, ebx
and eax, 0xffffc000
or eax, 0
je 0x417875
mov eax, 2
jmp 0x417884
mov eax, ebx
and eax, 0xffffff80
or eax, 0
je 0x4178b4
mov eax, 1
lea ecx, [eax*8]
mov edx, eax
sub ecx, eax
nop
cmp edi, 0x100
jae 0x4178a6
mov eax, ebx
shr eax, cl
or al, 0x80
mov byte [ebp + edi - 0x108], al
inc edi
sub ecx, 7
sub edx, 1
jne 0x417890
mov edx, dword [ebp - 0x10c]
cmp edi, 0x100
jae 0x4178c7
and bl, 0x7f
mov byte [ebp + edi - 0x108], bl
inc edi
mov al, byte [edx]
test al, al
jne 0x417807
mov ebx, dword [ebp - 0x110]
mov ecx, dword [0x4dc1f4]
lea edx, [ebp - 0x108]
push 5
push ebx
push edi
call fcn.0043a740
inc ebx
add esp, 0xc
mov dword [ebp - 0x110], ebx
lea eax, [ebx*8]
cmp dword [eax + 0x45b08c], 0
jne 0x4177f5
mov ecx, dword [0x4dc1f4]
call fcn.0043aee0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00443732
mov esp, ebp
pop ebp
ret