joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465693
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00465509

Function at 0x4681a0
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00468122
Function at 0x402840
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Get windows directory from kuser_shared_data

Disassembly:
mov eax, dword [0x7f7408]
sub esp, 0x20c
push ebp
mov ebp, ecx
push esi
push edi
test eax, eax
je 0x4029ed
cmp dword [0x7f740c], 0
jne 0x4029d9
xor eax, eax
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
mov byte [esp + 0x1e], al
lea eax, [esp + 0x20]
push eax
call fcn.00401140
add esp, 0xc
xor edi, edi
xor eax, eax
nop
mov byte [esp + eax + 0x18], al
inc eax
cmp eax, 0x100
jb 0x402890
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x18]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41b0d4]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + edi + 0x18], dl
cmp esi, 0x100
jb 0x4028a0
xor esi, esi
xor edi, edi
xor edx, edx
lea eax, [esi + 1]
movzx esi, al
mov cl, byte [esp + esi + 0x18]
movzx eax, cl
add eax, edi
movzx edi, al
movzx eax, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
mov byte [esp + edi + 0x18], cl
movzx eax, byte [esp + esi + 0x18]
movzx ecx, cl
add ecx, eax
movzx eax, cl
movzx eax, byte [esp + eax + 0x18]
xor al, byte [edx + 0x41b0d8]
mov byte [esp + edx + 0xc], al
inc edx
cmp edx, 0xb
jb 0x4028d5
push 0x200
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00401140
mov edx, 0x7ffe0030
add esp, 0xc
xor ecx, ecx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x402934
sub edx, esi
sar edx, 1
je 0x4029ed
mov esi, ebp
lea edi, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x402950
sub esi, edi
add edx, 0xc
add edx, esi
cmp edx, 0x200
ja 0x4029ed
xor eax, eax
push ebx
test edx, edx
je 0x402988
movzx ebx, word [eax + eax + 0x7ffe0030]
test bx, bx
je 0x402988
mov byte [esp + eax + 0x1c], bl
inc ecx
inc eax
cmp eax, edx
jb 0x402971
xor eax, eax
test edx, edx
je 0x4029a2
mov edi, edi
mov bl, byte [esp + eax + 0x10]
test bl, bl
je 0x4029a2
mov byte [esp + ecx + 0x1c], bl
inc eax
inc ecx
cmp eax, edx
jb 0x402990
xor eax, eax
test edx, edx
je 0x4029bf
lea ecx, [esp + ecx + 0x1c]
lea esp, [esp]
mov bl, byte [eax + ebp]
test bl, bl
je 0x4029bf
mov byte [ecx], bl
inc eax
inc ecx
cmp eax, edx
jb 0x4029b0
push 8
push 0
lea eax, [esp + 0x24]
push eax
call dword [0x7f7408]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
push 0x800
push 0
push ebp
call eax
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20c
ret
Function at 0x402a00
Capabilities:
Check os version

Disassembly:
mov ecx, 1
mov edx, 0x7f7548
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x402b29
cmp dword fs:[0xc0], eax
je 0x402a2b
mov dword [0x7f7544], 1
mov eax, dword fs:[0x18]
push ebx
push esi
mov ebx, 1
mov esi, dword [eax + 0x30]
mov eax, dword [esi + 0xa4]
mov dword [0x7f742c], eax
mov eax, dword [esi + 0xa8]
mov dword [0x7f7430], eax
movzx edx, word [esi + 0xac]
mov dword [0x7f7434], edx
mov eax, dword [esi + 0xb0]
mov dword [0x7f7438], eax
mov eax, dword [esi + 0x1f4]
test eax, eax
je 0x402a8b
push 0x7f
push eax
push 0x7f743c
call fcn.00401330
mov edx, dword [0x7f7434]
add esp, 0xc
jmp 0x402a93
xor eax, eax
mov word [0x7f743c], ax
movzx eax, byte [esi + 0xaf]
mov ecx, 0xff
mov word [0x7f753c], ax
movzx eax, word [esi + 0xae]
and ax, cx
mov word [0x7f753e], ax
movzx eax, word [0x7ffe02d0]
mov word [0x7f7540], ax
mov ecx, eax
mov byte [0x7f7542], 0
cmp byte [0x7ffe0268], 0
je 0x402ada
mov ebx, dword [0x7ffe0264]
pop esi
mov byte [0x7f7542], bl
cmp ebx, 1
pop ebx
jne 0x402af4
and ecx, 0xffef
mov word [0x7f7540], cx
test edx, edx
jne 0x402b29
call fcn.00402a00
cmp dword [0x7f742c], 6
ja 0x402b29
jb 0x402b11
cmp dword [0x7f7430], 4
jae 0x402b29
call fcn.00402a00
cmp dword [0x7f742c], 0xa
jae 0x402b29
mov dword [0x7f7434], 1
ret
Function at 0x402e70
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [0x7f815c]
sub esp, 0x11c
test eax, eax
jne 0x402f6e
push ebx
push esi
push edi
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], ax
lea eax, [esp + 0x30]
push eax
call fcn.00401140
add esp, 0xc
xor edi, edi
xor eax, eax
lea ebx, [ebx]
mov byte [esp + eax + 0x28], al
inc eax
cmp eax, 0x100
jb 0x402ec0
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x28]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41b100]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x28]
mov byte [esp + esi + 0x28], al
inc esi
mov byte [esp + edi + 0x28], dl
cmp esi, 0x100
jb 0x402ed0
xor edi, edi
xor ebx, ebx
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [esp + edi + 0x28]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
movzx eax, byte [esp + ebx + 0x28]
mov byte [esp + edi + 0x28], al
mov byte [esp + ebx + 0x28], cl
movzx eax, byte [esp + edi + 0x28]
add eax, edx
movzx eax, al
movzx eax, byte [esp + eax + 0x28]
xor al, byte [esi + 0x41b104]
mov byte [esp + esi + 0xc], al
inc esi
cmp esi, 0x1a
jb 0x402f05
xor edx, edx
lea ecx, [esp + 0xc]
call fcn.00403960
pop edi
pop esi
pop ebx
test eax, eax
je 0x402f69
mov eax, dword [eax + 0x18]
test eax, eax
je 0x402f69
mov dword [0x7f815c], eax
add esp, 0x11c
ret
mov eax, dword [0x7f815c]
add esp, 0x11c
ret

Function at 0x402f90
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
sub esp, 0x40
push ebx
push esi
push edi
test ecx, ecx
jle 0x402fb8
mov eax, dword [ebp + 0x10]
lea edx, [ebp + 0x18]
dec ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0xc], eax
jmp 0x402fc6
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
test ecx, ecx
jle 0x402fdf
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x402fed
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
test ecx, ecx
jle 0x403006
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x403014
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
test ecx, ecx
jle 0x40302d
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x24], eax
jmp 0x40303b
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov eax, edx
mov dword [ebp - 0x30], 0
cdq
mov dword [ebp - 0x40], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x403082
add dword [esp], 5
retf
Function at 0x403160
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0xc08
push ebx
push ebp
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 8], edx
push esi
push edi
test ecx, ecx
je 0x4031ab
xor esi, esi
lea edi, [esp + 0x818]
mov al, byte [esi + ecx]
test al, al
je 0x40319b
cbw
inc esi
mov word [edi], ax
add edi, 2
cmp esi, 0x1ff
jb 0x403181
jmp 0x4031a0
xor eax, eax
mov word [edi], ax
lea edx, [esp + 0x818]
mov dword [esp + 0x10], edx
xor edi, edi
xor ebp, ebp
test edx, edx
je 0x4031fb
mov edi, edx
lea ecx, [edi + 2]
jmp 0x4031c0
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4031c0
sub edi, ecx
sar edi, 1
cmp edi, 0x200
jb 0x4031dc
mov edi, 0x1ff
push edi
push edx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00401330
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x40321d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x403290
mov esi, dword [ebx]
cmp esi, ebx
je 0x403290
test esi, esi
je 0x403290
cmp word [esi + 0x24], 2
jbe 0x40328a
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x40328a
cmp dword [esi + 0x18], 0
je 0x40328a
test ebp, ebp
je 0x403245
cmp ebp, eax
jne 0x40328a
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00401330
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40326a
cmp eax, dword [esi + 0x18]
jne 0x40328a
cmp dword [esp + 0x10], 0
je 0x40329d
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00404000
add esp, 8
test eax, eax
je 0x40329d
mov esi, dword [esi]
cmp esi, ebx
jne 0x403223
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc08
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc08
ret
Function at 0x403960
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0x808
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edx
xor ebp, ebp
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x4039bb
mov edi, ecx
lea edx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x403980
sub edi, edx
sar edi, 1
cmp edi, 0x200
jb 0x40399c
mov edi, 0x1ff
push edi
push ecx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00401330
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x4039dd
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x403a4f
mov esi, dword [ebx]
cmp esi, ebx
je 0x403a4f
test esi, esi
je 0x403a4f
cmp word [esi + 0x24], 2
jbe 0x403a49
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x403a49
cmp dword [esi + 0x18], 0
je 0x403a49
test ebp, ebp
je 0x403a05
cmp ebp, eax
jne 0x403a49
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00401330
mov edx, dword [esp + 0x1c]
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
test edx, edx
je 0x403a2a
cmp edx, dword [esi + 0x18]
jne 0x403a49
cmp dword [esp + 0x14], eax
je 0x403a5c
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00404000
add esp, 8
test eax, eax
je 0x403a5c
mov esi, dword [esi]
cmp esi, ebx
jne 0x4039e3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x808
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x808
ret
Function at 0x41a662
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret
Function at 0x404440
Capabilities:
Set current directory

Disassembly:
push ecx
cmp byte [esp + 8], 0
mov eax, ecx
push ebx
mov ebx, dword [0x4d70f4]
mov ecx, 0x3a
push esi
push edi
mov byte [esp + 0xf], dl
mov esi, 0x4d9860
je 0x404488
inc dword [0x4d9960]
add ebx, 0xe8
mov edi, ebx
mov dword [0x4d70f4], ebx
rep movsd dword es:[edi], dword [esi]
push 0
mov ecx, 0x4dba98
mov dword [ebx + 0x2c], eax
call fcn.0042d340
jmp 0x40448f
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x2c], eax
cmp dword [0x4d9974], 0
xorps xmm0, xmm0
movlpd qword [0x4dc0d8], xmm0
je 0x4044bf
mov eax, dword [0x4d8ae0]
mov ecx, 0x4c3c29
test eax, eax
je 0x4044b8
mov eax, dword [eax]
test eax, eax
cmovne ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp byte [esp + 0xf], 0
jne 0x404544
mov cl, byte [ebx + 0xce]
test cl, cl
jne 0x4044f4
cmp byte [esp + 0x18], 0x65
sete cl
mov byte [ebx + 0xce], cl
jne 0x4044f4
mov dword [ebx], 0xffffffff
mov dword [ebx + 4], 0xffffffff
mov dword [ebx + 0x24], 0xffffffff
cmp dword [0x4dc0e4], 0
je 0x404506
cmp dword [0x4dc0e0], 0
jne 0x40450a
test cl, cl
je 0x404544
mov byte [ebx + 0xcc], 0
test cl, cl
jne 0x404544
cmp dword [0x4dc0e4], 0
jge 0x40452d
pop edi
pop esi
mov dword [ebx + 0xc0], 0xffffffff
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0xbc], eax
mov eax, dword [0x4dc0e4]
mov dword [ebx + 0xc0], eax
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x406200
Capabilities:
Write clipboard data

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0
jne 0x406222
call fcn.004064e0
test eax, eax
jne 0x406222
push str.Cant_open_clipboard_for_writing.
mov ecx, esi
call fcn.00406340
pop esi
ret 4
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x406268
cmp dword [esi + 0x18], eax
je 0x406258
cmp dword [esi + 8], eax
je 0x406245
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [esi + 8], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], 0
mov dword [esi], 0
push 0x4c402c
mov ecx, esi
call fcn.00406340
pop esi
ret 4
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test eax, eax
je 0x4062b5
mov ecx, dword [esi + 0xc]
push ebx
xor bl, bl
test ecx, ecx
je 0x4062a6
cmp dword [esp + 0x10], 0xd
jne 0x40628d
cmp word [ecx], 0
jmp 0x40628f
cmp byte [ecx], bl
push eax
sete bl
call edi
mov eax, dword [esi + 4]
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
test bl, bl
pop ebx
push eax
je 0x4062e9
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
cmp dword [esi + 0x18], 0
je 0x4062df
cmp dword [esi + 8], 0
je 0x4062cc
push dword [esi]
call edi
mov dword [esi + 8], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], 0
mov dword [esi], 0
pop edi
mov eax, 1
pop esi
ret 4
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x406300
mov dword [esi + 4], 0
jmp 0x4062b5
cmp dword [esi + 0x18], 0
je 0x40632a
cmp dword [esi + 8], 0
je 0x406317
push dword [esi]
call edi
mov dword [esi + 8], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], 0
mov dword [esi], 0
push 0x4c403c
mov ecx, esi
call fcn.00406340
pop edi
pop esi
ret 4
Function at 0x4063d0
Capabilities:
Read clipboard data

Disassembly:
sub esp, 0x108
push ebx
push esi
mov esi, dword [esp + 0x118]
push edi
test esi, esi
je 0x4063ea
mov dword [esi], 0
mov ebx, dword [esp + 0x118]
lea eax, [ebx - 0xc000]
cmp eax, 0x3fff
ja 0x4064c0
push 0x104
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClipboardFormatNameA]
push 0xb
lea eax, [esp + 0x10]
push str.Link_Source
push eax
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsnbicmp]
add esp, 0xc
test eax, eax
je 0x4064b2
mov edi, dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
lea eax, [esp + 0xc]
push str.ObjectLink
push eax
call edi
add esp, 8
test eax, eax
je 0x4064b2
lea eax, [esp + 0xc]
push str.OwnerLink
push eax
call edi
add esp, 8
test eax, eax
je 0x4064b2
lea eax, [esp + 0xc]
push str.Native
push eax
call edi
add esp, 8
test eax, eax
je 0x4064b2
lea eax, [esp + 0xc]
push str.Embed_Source
push eax
call edi
add esp, 8
test eax, eax
je 0x4064b2
lea eax, [esp + 0xc]
push str.MSDEVColumnSelect
push eax
call edi
add esp, 8
test eax, eax
je 0x4064a8
lea eax, [esp + 0xc]
push str.MSDEVLineSelect
push eax
call edi
add esp, 8
test eax, eax
jne 0x4064c5
test esi, esi
je 0x4064b2
mov dword [esi], 1
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret 8
mov byte [esp + 0xc], 0
push ebx
call dword [sym.imp.USER32.dll_GetClipboardData]
pop edi
pop esi
pop ebx
add esp, 0x108
ret 8

Function at 0x4064e0
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
push ebx
mov ebx, ecx
cmp dword [ebx + 0x18], 0
je 0x4064f0
mov eax, 1
pop ebx
ret
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
push dword [0x4d9978]
mov edi, dword [sym.imp.USER32.dll_OpenClipboard]
mov ebp, eax
call edi
test eax, eax
jne 0x40655e
nop
mov eax, dword [0x4d7100]
cmp eax, 0xffffffff
je 0x40652f
test eax, eax
je 0x40656f
call esi
mov ecx, dword [0x4d7100]
add ecx, ebp
sub ecx, eax
cmp ecx, 5
jle 0x40656f
mov edx, 1
mov dword [0x4d70ec], 0
mov ecx, 0x8000012f
call fcn.00401870
push dword [0x4d9978]
mov dword [0x4d70ec], 1
call edi
test eax, eax
je 0x406510
pop edi
pop esi
pop ebp
mov dword [ebx + 0x18], 1
mov eax, 1
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x406f20
Capabilities:
Get common file path

Disassembly:
sub esp, 0x234
cmp dword [0x4dd50c], 0
mov ax, cx
push ebx
push ebp
push esi
push edi
mov word [esp + 0x12], ax
mov dword [esp + 0x14], str.getaddrinfo
mov dword [esp + 0x18], 0x406920
mov dword [esp + 0x1c], str.getnameinfo
mov dword [esp + 0x20], 0x406d30
mov dword [esp + 0x24], str.freeaddrinfo
mov dword [esp + 0x28], fcn.004068d0
je 0x406f80
movzx eax, ax
mov eax, dword [eax*8 + 0x4d8e84]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x234
ret
push 0x104
lea eax, [esp + 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x407085
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea eax, [esp + 0x13c]
push eax
lea eax, [esp + 0x30]
push 0x10c
push eax
call esi
add esp, 0xc
lea eax, [esp + 0x2c]
push str.ws2_32
push 0x10c
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test edi, edi
je 0x406ffc
push str.getaddrinfo
push edi
call ebx
test eax, eax
jne 0x407048
push edi
call ebp
lea eax, [esp + 0x13c]
push eax
lea eax, [esp + 0x30]
push 0x10c
push eax
call esi
add esp, 0xc
lea eax, [esp + 0x2c]
push str.wship6
push 0x10c
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407085
push str.getaddrinfo
push edi
call ebx
test eax, eax
je 0x407082
xor esi, esi
nop word [eax + eax]
push dword [esp + esi*8 + 0x14]
push edi
call ebx
mov dword [esp + esi*8 + 0x18], eax
test eax, eax
je 0x407082
inc esi
cmp esi, 3
jl 0x407050
mov eax, dword [esp + 0x18]
mov dword [0x4d8e84], eax
mov eax, dword [esp + 0x20]
mov dword [0x4d8e8c], eax
mov eax, dword [esp + 0x28]
mov dword [fcn.004068d0], eax
jmp 0x407085
push edi
call ebp
movzx eax, word [esp + 0x12]
pop edi
pop esi
pop ebp
mov eax, dword [eax*8 + 0x4d8e84]
mov dword [0x4dd50c], 1
pop ebx
add esp, 0x234
ret
Function at 0x40b2c0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40
lea eax, [esp + 4]
push esi
push edi
mov edi, ecx
push 0xa
push eax
mov eax, dword [edi + 0x30]
add eax, 0x26
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itoa]
add esp, 0xc
lea eax, [esp + 0xc]
push 0
push eax
call dword [sym.imp.VCRUNTIME140.dll_strchr]
push str.__xml_version_1.0__encoding_UTF_8___
push 0x4c4d4c
lea esi, [eax + 1]
push esi
call fcn.00405ed0
add esp, 0x14
add esi, eax
lea eax, [esp + 0xc]
sub esi, eax
push 0
push esi
push eax
push dword [edi + 0x10]
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, 0xffffffff
je 0x40b375
cmp dword [edi + 0x34], 0
jne 0x40b375
mov eax, dword [edi + 0x30]
lea ecx, [edi + 0x28]
inc eax
push eax
call fcn.0040c260
test eax, eax
jne 0x40b375
mov edx, dword [edi + 0x30]
mov ecx, dword [edi + 0x28]
mov al, byte [0x4c4d50]
push 0
mov byte [edx + ecx], al
inc dword [edi + 0x30]
push dword [edi + 0x30]
push dword [edi + 0x28]
push dword [edi + 0x10]
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, 0xffffffff
je 0x40b375
mov dword [edi + 0x30], 0
xor eax, eax
mov dword [edi + 0x34], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x4d8a78
call fcn.0040b8c0
push 0x10014
push dword [0x4dc0b0]
push str.An_internal_error_has_occurred_in_the_debugger_engine._nContinue_running_the_script_without_the_debugger_
push dword [0x4d9978]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
jne 0x40b3ae
push 0
push 4
mov ecx, 0x4dba98
call fcn.0042d940
pop edi
mov eax, 0x3e6
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40c010
Capabilities:
Encode data using base64

Disassembly:
push ecx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebp, ecx
mov dword [esp + 8], ebp
test esi, esi
je 0x40c180
cmp byte [esp + 0x18], 0
jne 0x40c058
lea ecx, [esi - 1]
mov eax, 0xaaaaaaab
mul ecx
mov eax, dword [ebp + 8]
mov ecx, ebp
shr edx, 1
lea eax, [eax + edx*4]
add eax, 5
push eax
call fcn.0040c260
test eax, eax
je 0x40c058
pop esi
mov eax, 0x3e6
pop ebp
pop ecx
ret 0xc
push edi
mov edi, dword [esp + 0x14]
test edi, edi
je 0x40c17f
push ebx
mov ebx, dword [ebp + 8]
xor edx, edx
add ebx, dword [ebp]
mov dword [esp + 0x1c], ebx
cmp esi, 0xffffffff
jne 0x40c089
mov esi, edi
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x40c080
sub esi, ecx
cmp esi, 2
jbe 0x40c11c
lea ecx, [esi - 3]
mov eax, 0xaaaaaaab
mul ecx
add ebx, 2
mov eax, edx
shr eax, 1
inc eax
mov dword [esp + 0x20], eax
mov ebp, eax
lea edx, [eax*4]
movzx ecx, byte [edi]
lea ebx, [ebx + 4]
movzx eax, byte [edi + 1]
sub esi, 3
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 2]
shl ecx, 8
add edi, 3
or ecx, eax
mov eax, ecx
shr eax, 0x12
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx - 6], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx - 5], al
mov eax, ecx
shr eax, 6
and ecx, 0x3f
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx - 4], al
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx - 3], al
sub ebp, 1
jne 0x40c0b1
mov ebp, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
test esi, esi
je 0x40c177
movzx ecx, byte [edi]
shl ecx, 0x10
cmp esi, 1
jbe 0x40c134
movzx eax, byte [edi + 1]
shl eax, 8
or ecx, eax
mov eax, ecx
shr eax, 0x12
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + ebx], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + ebx + 1], al
cmp esi, 1
jbe 0x40c169
shr ecx, 6
and ecx, 0x3f
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x40c16b
mov al, 0x3d
mov byte [edx + ebx + 2], al
mov byte [edx + ebx + 3], 0x3d
add edx, 4
mov byte [edx + ebx], 0
add dword [ebp + 8], edx
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret 0xc
Function at 0x40c830
Capabilities:
Query environment variable

Disassembly:
push esi
push edi
push 0
push 0
push dword [esp + 0x14]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
test edi, edi
jne 0x40c888
mov edi, dword [esi + 4]
test edi, edi
je 0x40c8b0
mov eax, dword [edi + 0x10]
add eax, 0xffffffff
mov dword [edi + 0x10], eax
jne 0x40c876
mov eax, dword [edi + 4]
test eax, eax
je 0x40c86b
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
push 0x14
push edi
call fcn.004c0c55
add esp, 8
pop edi
mov dword [esi + 4], 0
mov eax, esi
mov byte [esi + 8], 0
pop esi
ret 4
push 0
mov ecx, esi
call fcn.0040ca40
mov ecx, dword [esi + 4]
push edi
call fcn.00405c30
mov eax, dword [esi + 4]
push edi
push dword [eax]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, dword [esi + 4]
mov dword [ecx + 8], eax
pop edi
mov eax, esi
pop esi
ret 4