joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410670
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x47b014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, 0x20
push edi
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
mov word [ebp - 0x34], ax
mov ebx, ecx
xor eax, eax
movlpd qword [ebp - 0x2a], xmm0
push 0x230
push eax
mov dword [ebp - 0x26c], eax
lea eax, [ebp - 0x268]
push eax
movlpd qword [ebp - 0x22], xmm0
mov dword [ebp - 0x32], edi
mov dword [ebp - 0x2e], esi
mov dword [ebp - 0x1a], 1
call fcn.00423950
mov eax, dword [0x471418]
add esp, 0xc
movq xmm0, qword [str.A5137F]
mov dword [ebp - 0xc], eax
mov ax, word [0x47141c]
mov word [ebp - 8], ax
lea eax, [ebp - 0x14]
push 6
push eax
lea eax, [ebp - 0x268]
mov dword [ebp - 0x268], 0x230
push eax
mov eax, dword [ebx + 0x10]
push 0
push 0
mov dword [ebp - 0x260], edi
mov dword [ebp - 0x25c], esi
movq qword [ebp - 0x14], xmm0
call eax
mov esi, eax
mov edi, 1
test esi, esi
je 0x410798
cmp esi, 0x103
je 0x410798
test edi, edi
jle 0x410798
cmp esi, 0x80004005
jne 0x41075c
lea eax, [ebp - 0x268]
push eax
mov eax, dword [ebx + 0x20]
push 0
call eax
mov esi, eax
test esi, esi
jne 0x410754
cmp dword [ebp - 0x24c], eax
jmp 0x410762
cmp esi, 0x490
je 0x410764
cmp esi, 0x4dc
jne 0x410793
lea eax, [ebp - 0x260]
push eax
mov eax, dword [ebx + 0x14]
call eax
push 0x14d
call dword [sym.imp.KERNEL32.dll_Sleep]
push 6
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x268]
push eax
mov eax, dword [ebx + 0x10]
push 0
push 0
call eax
mov esi, eax
dec edi
test esi, esi
jne 0x410724
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, 0x51a
jne 0x4107bd
mov eax, 0xd
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422009
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x4107da
cmp esi, 0x103
je 0x4107da
mov edx, esi
mov ecx, ebx
call fcn.00410480
mov dword [ebp - 0x26c], eax
jmp 0x4107dc
xor eax, eax
test eax, eax
jne 0x410849
mov edi, dword [sym.imp.WINMM.dll_timeGetTime]
call edi
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x270], eax
push 0
push 0
push 0
push 0
push 0x1e
lea eax, [ebp - 0x34]
push eax
push dword [ebx]
call dword [sym.imp.WS2_32.dll_WSAConnect]
cmp eax, 0xffffffff
jne 0x410843
call edi
sub eax, dword [ebp - 0x270]
cmp eax, 0xbb8
jae 0x410827
call esi
cmp eax, 0x2743
je 0x4107f4
call esi
mov edx, eax
mov ecx, ebx
call fcn.00410480
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422009
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x26c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00422009
mov esp, ebp
pop ebp
ret
Function at 0x410a80
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x47b014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], esi
test edi, edi
je 0x410b59
cmp dword [edi], 1
jne 0x410b59
mov esi, ecx
cmp byte [edi + 0x20], 0
jne 0x410b4b
xor ebx, ebx
mov dword [edi], 1
mov eax, dword [esi + 4]
lea ecx, [edi + 0x18]
push ebx
mov dword [edi + 0x14], eax
lea eax, [edi + 4]
push eax
push ebx
lea eax, [ebp - 0xc]
mov byte [edi + 0x20], bl
push eax
push 1
push ecx
push dword [esi]
mov dword [ebp - 0xc], ebx
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
jne 0x410b1f
mov eax, dword [edi + 0x18]
mov ecx, dword [ebp - 0xc]
cmp ecx, eax
ja 0x410b0c
add dword [edi + 0x1c], ecx
sub eax, ecx
mov dword [edi + 0x18], eax
jne 0x410b42
mov dword [edi], 2
jmp 0x410b42
xor edx, edx
mov dword [edi], 3
mov ecx, esi
call fcn.00410480
mov ebx, eax
jmp 0x410b42
cmp eax, 0xffffffff
jne 0x410b37
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x410b37
mov byte [edi + 0x20], 1
jmp 0x410b42
mov dword [edi], 3
mov ebx, 9
cmp dword [edi], 1
je 0x410ab6
mov esi, dword [ebp - 8]
test ebx, ebx
jne 0x410c12
mov ecx, dword [ebp - 0x10]
test esi, esi
je 0x410c28
cmp dword [esi], 1
jne 0x410c28
mov edi, dword [ebp - 0x10]
nop dword [eax]
cmp byte [esi + 0x20], 0
jne 0x410c0b
xor ebx, ebx
mov dword [esi], 1
mov eax, dword [edi + 8]
lea ecx, [esi + 0x18]
push ebx
mov dword [esi + 0x14], eax
lea eax, [esi + 4]
push eax
lea eax, [ebp - 8]
mov byte [esi + 0x20], bl
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
push 1
push ecx
push dword [edi]
mov dword [ebp - 8], ebx
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
jne 0x410bdf
mov eax, dword [esi + 0x18]
mov ecx, dword [ebp - 0xc]
cmp ecx, eax
ja 0x410bcc
add dword [esi + 0x1c], ecx
sub eax, ecx
mov dword [esi + 0x18], eax
jne 0x410c02
mov dword [esi], 2
jmp 0x410c02
xor edx, edx
mov dword [esi], 3
mov ecx, edi
call fcn.00410480
mov ebx, eax
jmp 0x410c02
cmp eax, 0xffffffff
jne 0x410bf7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x410bf7
mov byte [esi + 0x20], 1
jmp 0x410c02
mov dword [esi], 3
mov ebx, 9
cmp dword [esi], 1
je 0x410b70
mov edi, dword [ebp - 0x14]
test ebx, ebx
je 0x410c25
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422009
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
push esi
mov edx, edi
call fcn.004108d0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00422009
mov esp, ebp
pop ebp
ret
Function at 0x411310
Capabilities:
Initialize winsock library
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [0x47b014]
xor eax, esp
mov dword [esp + 0x198], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x28
push 1
call fcn.0043153d
mov edi, eax
add esp, 8
mov dword [ebx + 0x3fa0], edi
test edi, edi
jne 0x411350
lea esi, [eax + 0xc]
jmp 0x41142b
mov esi, dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [edi], 0xffffffff
call esi
mov dword [edi + 4], eax
call esi
push str.BTHPROPS.CPL
mov dword [edi + 8], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi + 0xc], eax
test eax, eax
je 0x411426
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.BluetoothAuthenticateDevice
push eax
call esi
push str.BluetoothRemoveDevice
push dword [edi + 0xc]
mov dword [edi + 0x10], eax
call esi
push str.BluetoothFindFirstRadio
push dword [edi + 0xc]
mov dword [edi + 0x14], eax
call esi
push str.BluetoothFindRadioClose
push dword [edi + 0xc]
mov dword [edi + 0x18], eax
call esi
push str.BluetoothGetDeviceInfo
push dword [edi + 0xc]
mov dword [edi + 0x1c], eax
call esi
cmp dword [edi + 0x10], 0
mov dword [edi + 0x20], eax
je 0x411426
cmp dword [edi + 0x14], 0
je 0x411426
cmp dword [edi + 0x18], 0
je 0x411426
cmp dword [edi + 0x1c], 0
je 0x411426
test eax, eax
je 0x411426
lea eax, [esp + 0x10]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x411426
push 1
push eax
push eax
push 3
push 1
push 0x20
call dword [sym.imp.WS2_32.dll_WSASocketW]
xor ecx, ecx
mov dword [edi], eax
cmp eax, 0xffffffff
mov esi, 0xd
cmovne esi, ecx
je 0x41142b
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x198]
xor ecx, esp
call fcn.00422009
mov esp, ebp
pop ebp
ret
mov esi, 0xd
mov ecx, ebx
call fcn.00410860
mov ecx, dword [esp + 0x1a4]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00422009
mov esp, ebp
pop ebp
ret
Function at 0x411ac0
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a0
mov eax, dword [0x47b014]
xor eax, esp
mov dword [esp + 0x19c], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0x43f4a0
push 0x1140
call fcn.0042219a
mov esi, eax
add esp, 8
test esi, esi
je 0x411c1f
push 0x109e
lea ecx, [esi + 4]
mov dword [esi], 0xffffffff
push 0
push ecx
call fcn.00423950
add esp, 0xc
mov byte [esi + 0x10a2], 0
xorps xmm0, xmm0
lea eax, [esi + 0x10d8]
movq qword [esi + 0x10a4], xmm0
mov byte [esi + 0x10ac], 0
push 0x60
movups xmmword [esi + 0x10b0], xmm0
push 0
movq qword [esi + 0x10c0], xmm0
push eax
mov dword [esi + 0x10c8], 0
mov dword [esi + 0x10cc], 0
call fcn.00423950
add esp, 0xc
mov dword [esi + 0x1138], 0xffffffff
call fcn.00415150
mov dword [esi + 0x10d0], eax
mov dword [edi + 0x3fa0], esi
cmp dword [esi + 0x10d0], 0
je 0x411c29
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x10c8], eax
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
cmp dword [esi + 0x10c8], 0
mov dword [esi + 0x10cc], eax
mov dword [esi], 0xffffffff
je 0x411c29
test eax, eax
je 0x411c29
lea eax, [esp + 0x10]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x411bd6
mov esi, 0xd
jmp 0x411c2e
push 1
push 0
push 0
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x411bcf
push 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 1
push ecx
push 1
push 6
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x19c]
xor ecx, esp
call fcn.00422009
mov esp, ebp
pop ebp
ret
mov dword [edi + 0x3fa0], 0
mov esi, 0xc
mov ecx, edi
call fcn.004119c0
mov ecx, dword [esp + 0x1a4]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.00422009
mov esp, ebp
pop ebp
ret
Function at 0x412070
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x47b014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
xorps xmm0, xmm0
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [ebx + 0x10c8]
mov edi, edx
movlpd qword [ebp - 0x28], xmm0
movlpd qword [ebp - 0x20], xmm0
mov dword [ebp - 0x18], eax
test esi, esi
je 0x412129
push 0
lea eax, [ebp - 0x28]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], edi
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], esi
push eax
push 1
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0
push eax
push dword [ebx]
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
jne 0x4120e4
add edi, dword [ebp - 0xc]
sub esi, dword [ebp - 0xc]
jmp 0x4120a0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x412113
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebx]
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x412113
add edi, dword [ebp - 0xc]
sub esi, dword [ebp - 0xc]
jmp 0x4120a0
pop edi
pop esi
mov eax, 9
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422009
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00422009
mov esp, ebp
pop ebp
ret
Function at 0x413810
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x47b014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x3f9c]
test eax, eax
je 0x4139a9
cmp dword [eax + 0x1c], 0
jne 0x413841
cmp dword [eax + 0x20], 0
je 0x4139a9
cmp dword [0x47ba88], 0xffffffff
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jne 0x413900
push 0x18
call fcn.00430bd3
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
add esp, 4
mov esi, eax
push esi
call edi
push 0x18
mov dword [0x481af0], esi
call fcn.00430bd3
add esp, 4
mov esi, eax
push esi
call edi
push 0
push 0
push 0
push 0
mov dword [0x481aac], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 8
mov dword [0x47ba84], eax
xor esi, esi
call fcn.00430bd3
mov edi, eax
add esp, 4
test edi, edi
je 0x4138ef
lea eax, [ebp - 8]
mov dword [edi], 0x413550
push eax
push esi
push edi
push 0x40e100
push esi
push esi
mov dword [edi + 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
jne 0x4138ef
push edi
call fcn.00430bb8
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add esp, 4
mov dword [0x47ba88], esi
push dword [0x481af0]
call edi
jmp 0x413910
mov dword [0x47ba88], esi
cmp esi, 0xffffffff
je 0x41390a
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [0x481af0]
call edi
jmp 0x413910
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, 0x481ab0
cmp dword [eax], ebx
je 0x4139a7
add eax, 4
cmp eax, 0x481af0
jl 0x413915
cmp dword [0x47ba88], 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
je 0x41394f
push dword [0x481af0]
call esi
cmp dword [0x47ba88], 0xffffffff
je 0x41394f
push dword [0x481af0]
call edi
xor eax, eax
cmp dword [eax*4 + 0x481ab0], 0
je 0x413963
inc eax
cmp eax, 0x10
jl 0x413951
jmp 0x41396a
mov dword [eax*4 + 0x481ab0], ebx
mov eax, dword [ebx + 0x3f9c]
mov dword [ebx + 0x3fa4], 0
mov byte [ebx + 0x3fa8], 0
mov ecx, dword [eax + 0x20]
test ecx, ecx
je 0x413996
movzx eax, byte [0x4819f8]
push eax
push ebx
call ecx
add esp, 8
cmp dword [0x47ba88], 0xffffffff
je 0x4139a7
push dword [0x481af0]
call esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00422009
mov esp, ebp
pop ebp
ret
Function at 0x413c80
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x47b014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x230]
mov edi, ecx
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x413d6a
cmp word [ebp - 0x230], 0
lea eax, [ebp - 0x230]
mov ecx, 0x104
je 0x413ce7
nop dword [eax]
test ecx, ecx
je 0x413d0a
add eax, 2
dec ecx
cmp word [eax], 0
jne 0x413cd0
test ecx, ecx
je 0x413d0a
cmp ecx, 1
jbe 0x413d05
mov esi, str.Scanmatik
sub esi, eax
nop
movzx edx, word [esi + eax]
test dx, dx
je 0x413d05
mov word [eax], dx
dec ecx
add eax, 2
cmp ecx, 1
ja 0x413cf0
xor ecx, ecx
mov word [eax], cx
push 0
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x413d2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x413d6a
push dword [ebp + 0xc]
lea eax, [ebp - 0x230]
push dword [ebp + 8]
push str.bluesoleil_spp_handle_
push eax
push str._s_s_016llX
push 0x104
push edi
call fcn.004019b0
add esp, 0x1c
xor eax, eax
mov word [edi + 0x208], ax
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422009
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.00422009
mov esp, ebp
pop ebp
ret

Function at 0x413d80
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x47b014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x413dea
push 0
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x420], 0
push eax
push 4
lea eax, [ebp - 0x420]
mov dword [ebp - 0x41c], 0
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0xffffffff
push dword [ebp + 0xc]
lea ecx, [ebp - 0x418]
push dword [ebp + 8]
call fcn.00413c80
add esp, 8
test al, al
je 0x413e0f
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00422009
mov esp, ebp
pop ebp
ret
Function at 0x413e20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x47b014]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 0x42c], eax
push dword [ebp + 8]
xor bl, bl
lea ecx, [ebp - 0x41c]
mov edi, edx
mov byte [ebp - 0x428], bl
call fcn.00413c80
add esp, 8
test al, al
je 0x413f18
cmp dword [esi + 8], 0xffffffff
jne 0x413eb1
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
jne 0x413eb1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x428]
cmp eax, 0x20
movzx ecx, cl
mov edx, 1
cmove ecx, edx
mov dword [ebp - 0x428], ecx
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x413f08
push 0
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x424]
mov dword [ebp - 0x420], 0
push eax
push 4
lea eax, [ebp - 0x420]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x413f08
cmp dword [ebp - 0x424], 4
jne 0x413f08
mov bl, 1
test edi, edi
je 0x413f18
mov eax, dword [ebp - 0x420]
mov dword [edi], eax
jmp 0x413f18
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.00413d80
add esp, 8
mov ecx, dword [ebp - 0x42c]
test ecx, ecx
je 0x413f2a
mov eax, dword [ebp - 0x428]
mov byte [ecx], al
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00422009
mov esp, ebp
pop ebp
ret

Function at 0x414d10
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
mov eax, esi
and eax, 1
imul ecx, eax, 0x9960034c
mov eax, esi
shr eax, 1
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
imul edx, eax, 0x9960034c
xor edx, ecx
mov eax, edx
shr edx, 1
and eax, 1
imul ecx, eax, 0x9960034c
xor ecx, edx
mov eax, ecx
shr ecx, 1
and eax, 1
imul edx, eax, 0x9960034c
xor edx, ecx
mov eax, edx
shr edx, 1
and eax, 1
imul ecx, eax, 0x9960034c
xor ecx, edx
mov eax, ecx
shr ecx, 1
and eax, 1
imul edx, eax, 0x9960034c
xor edx, ecx
mov eax, edx
shr edx, 1
and eax, 1
imul ecx, eax, 0x9960034c
xor ecx, edx
mov eax, ecx
shr ecx, 1
and eax, 1
imul eax, eax, 0x9960034c
xor eax, ecx
mov dword [esi*4 + 0x481af8], eax
inc esi
cmp esi, 0xff
jbe 0x414d13
xor eax, eax
pop esi
mov edx, dword [eax + 0x481af8]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x481af8]
movzx ecx, dl
mov dword [eax + 0x481ef8], edx
shr edx, 8
xor edx, dword [ecx*4 + 0x481af8]
movzx ecx, dl
mov dword [eax + 0x4822f8], edx
shr edx, 8
xor edx, dword [ecx*4 + 0x481af8]
movzx ecx, dl
mov dword [eax + 0x4826f8], edx
shr edx, 8
xor edx, dword [ecx*4 + 0x481af8]
movzx ecx, dl
mov dword [eax + 0x482af8], edx
shr edx, 8
xor edx, dword [ecx*4 + 0x481af8]
movzx ecx, dl
mov dword [eax + 0x482ef8], edx
shr edx, 8
xor edx, dword [ecx*4 + 0x481af8]
movzx ecx, dl
mov dword [eax + 0x4832f8], edx
shr edx, 8
xor edx, dword [ecx*4 + 0x481af8]
mov dword [eax + 0x4836f8], edx
add eax, 4
cmp eax, 0x3fc
jbe 0x414da4
mov dword [0x483af8], 1
ret
Function at 0x414fc7
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43e099
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x47b014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp ecx, 3
ja case.default.0x414f7c
jmp dword [ecx*4 + 0x415134]
push ecx
call fcn.00414e50
add esp, 4
push 0x43f4a0
test al, al
jne 0x414fcc
push 0xc
call fcn.0042219a
add esp, 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test eax, eax
je case.default.0x414f7c
mov ecx, eax
call fcn.00416fb0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0x43f4a0
push 0x3c
call fcn.0042219a
add esp, 8
mov dword [ebp - 0x10], eax
test eax, eax
je case.default.0x414f7c
mov dword [eax], vtable.SMWifiConnector::impl.0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0
mov dword [eax], vtable.SMWifiConnector_Win8_WFD.0
mov dword [eax + 0x34], 0
mov byte [eax + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0x43f4a0
push 0x3c
call fcn.0042219a
add esp, 8
mov dword [ebp - 0x10], eax
test eax, eax
je case.default.0x414f7c
mov dword [eax], vtable.SMWifiConnector::impl.0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0
mov dword [eax], vtable.SMWifiConnector_Win8_WFD.0
mov dword [eax + 0x34], 0
mov byte [eax + 0x38], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0x43f4a0
push 0xc
call fcn.0042219a
add esp, 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
test eax, eax
je case.default.0x414f7c
mov ecx, eax
call fcn.00416fb0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x41505a
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43e099
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x47b014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp ecx, 3
ja case.default.0x414f7c
jmp dword [ecx*4 + 0x415134]
push ecx
call fcn.00414e50
add esp, 4
push 0x43f4a0
test al, al
jne 0x414fcc
push 0xc
call fcn.0042219a
add esp, 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test eax, eax
je case.default.0x414f7c
mov ecx, eax
call fcn.00416fb0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0x43f4a0
push 0x3c
call fcn.0042219a
add esp, 8
mov dword [ebp - 0x10], eax
test eax, eax
je case.default.0x414f7c
mov dword [eax], vtable.SMWifiConnector::impl.0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0
mov dword [eax], vtable.SMWifiConnector_Win8_WFD.0
mov dword [eax + 0x34], 0
mov byte [eax + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0x43f4a0
push 0x3c
call fcn.0042219a
add esp, 8
mov dword [ebp - 0x10], eax
test eax, eax
je case.default.0x414f7c
mov dword [eax], vtable.SMWifiConnector::impl.0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0
mov dword [eax], vtable.SMWifiConnector_Win8_WFD.0
mov dword [eax + 0x34], 0
mov byte [eax + 0x38], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0x43f4a0
push 0xc
call fcn.0042219a
add esp, 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
test eax, eax
je case.default.0x414f7c
mov ecx, eax
call fcn.00416fb0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret