joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432170
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [esp + 0x10]
test edx, edx
push esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0
je 0x432237
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x432195
sub eax, esi
mov dword [esp + 0x14], eax
je 0x432237
mov ecx, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
push 1
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4321f2
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov edi, dword [esp + 0x20]
lea edx, [esp + 0x10]
push edx
push eax
push eax
push eax
mov eax, dword [esp + 0x1c]
push edi
push eax
call ebp
mov ecx, dword [esp + 0xc]
mov esi, eax
test esi, esi
je 0x4321f7
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop ebp
pop esi
add esp, 8
ret
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x10]
push edx
push eax
push 0
push 0
push edi
push ecx
call ebp
mov esi, eax
test esi, esi
je 0x432223
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebp
mov eax, esi
pop esi
add esp, 8
ret
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebp
xor eax, eax
pop esi
add esp, 8
ret
mov eax, 0x57
pop esi
add esp, 8
ret
Function at 0x432570
Capabilities:
Delete file
Move file
Write file on windows

Disassembly:
mov eax, 0x1520
call fcn.00459eb0
push ebx
push edi
mov edi, ecx
mov eax, dword [edi]
test eax, eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
je 0x43270d
mov cl, byte [edi + 4]
test cl, cl
lea ebx, [edi + 4]
je 0x43270d
mov ecx, dword [esp + 0x152c]
test ecx, ecx
je 0x43270d
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4325d1
pop edi
xor eax, eax
pop ebx
add esp, 0x1520
ret 4
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
push ebx
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x432702
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4326fb
cmp eax, 0x4c4b40
jbe 0x43267a
lea edx, [esp + 0x28]
mov eax, ebx
sub edx, ebx
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x432620
lea edi, [esp + 0x28]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x432630
mov ax, word [0x473668]
lea ecx, [esp + 0x28]
push ecx
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x28]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push ebx
call ebp
mov edi, dword [esp + 0x14]
mov esi, eax
cmp esi, 0xffffffff
je 0x432702
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [esp + 0x1534]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
movzx edx, word [esp + 0x2a]
movzx ecx, word [esp + 0x26]
push eax
movzx eax, word [esp + 0x2c]
push edx
movzx edx, word [esp + 0x2c]
push eax
movzx eax, word [esp + 0x2e]
push ecx
movzx ecx, word [esp + 0x2e]
push edx
movzx edx, word [esp + 0x30]
push eax
push ecx
push edx
lea eax, [esp + 0x150]
push str._d__02d__02d__02d:_02d:_02d._03d___x_:__.4096s_r_n
push eax
call fcn.00458ee7
add esp, 0x2c
push 0
lea ecx, [esp + 0x18]
push ecx
push eax
lea edx, [esp + 0x138]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 0x10], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop esi
pop ebp
mov eax, dword [esp + 8]
pop edi
pop ebx
add esp, 0x1520
ret 4
Function at 0x432a80
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x468710
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x314
push ebx
push esi
mov ebx, ecx
push edi
lea eax, [ebx + 0x10c]
mov dword [ebp - 0x10], esp
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [ebp - 4], 0
lea ecx, [ebx + 8]
lea edx, [ebp - 0x11c]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x432ac6
lea ecx, [ebp - 0x11c]
push 0x2e
push ecx
call fcn.0045a180
add esp, 8
test eax, eax
je 0x432ae8
mov byte [eax], 0
lea edi, [ebp - 0x11c]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x432af0
mov edx, dword [str..bak]
mov al, byte [0x474d30]
lea ecx, [ebp - 0x11c]
mov dword [edi], edx
push ecx
mov byte [edi + 4], al
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 8]
mov edi, eax
test edi, edi
jne 0x432bd7
lea eax, [ebp - 0x11c]
push eax
lea esi, [ebx + 8]
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ecx, dword [ebp + 8]
push edi
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x432b63
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x432bd7
mov edx, dword [ebx]
push esi
mov ecx, ebx
call dword [edx + 4]
mov edi, eax
jmp 0x432bd7
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x14]
push eax
push esi
mov dword [ebp - 0x14], edi
mov dword [ebp + 8], edi
call fcn.0044c5e0
mov eax, dword [ebp + 8]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
mov eax, dword [ebp - 0x14]
movzx edx, ax
push edx
shr eax, 0x10
push eax
push esi
lea eax, [ebp - 0x31c]
push str._s_has_been_updated_to_version__d._d._d._d._n
push eax
call fcn.00458ee7
lea ecx, [ebp - 0x320]
push ecx
mov dword [ebp - 0x320], 1
call fcn.0043e010
mov edx, dword [ebx]
add esp, 0x2c
push esi
mov ecx, ebx
call dword [edx + 4]
mov edi, eax
jmp 0x432bd7
add ebx, 0x10c
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x433010
Capabilities:
Check os version

Disassembly:
sub esp, 0x40
push esi
mov esi, 1
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xff
cmp eax, 5
jb 0x43303a
mov eax, dword [esp + 0x48]
push eax
push str..Global_s
lea ecx, [esp + 0xc]
push ecx
jmp 0x433049
mov edx, dword [esp + 0x48]
push edx
push str.._s
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x433076
xor esi, esi
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0x433087
mov dword [ecx], eax
mov eax, esi
pop esi
add esp, 0x40
ret
cmp eax, 0xffffffff
je 0x433093
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x40
ret
Function at 0x433100
Capabilities:
Delete service
Stop service

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push eax
push str.KAPFA
call fcn.00433010
mov esi, dword [esp + 0x18]
add esp, 8
cmp esi, 0xffffffff
je 0x433144
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0
push 0
push 0xa0000034
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push 0xf01ff
mov esi, eax
push str.KAPFA
push esi
call ebx
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x433185
lea edx, [esp + 0x18]
push edx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push edi
call ebp
push 0xf01ff
push str.KAPFA
push esi
call ebx
mov edi, eax
test edi, edi
je 0x4331a2
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
call ebp
push esi
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x24
ret

Function at 0x4332c0
Capabilities:
Create service
Delete service
Query environment variable

Disassembly:
sub esp, 0x20c
push 0x104
lea eax, [esp + 8]
push eax
push str.SYSTEMROOT
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x4332ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x20c
ret
push ebx
push esi
push edi
push str.KAPFA.SYS
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x11c]
push str._s_system32drivers_s
push edx
call fcn.00458ee7
add esp, 0x10
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
mov esi, eax
push str.KAPFA
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x433346
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
call ebx
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x128]
push eax
push 1
push 3
push 1
push 0xf01ff
push str.KAPFA
push str.KAPFA
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
je 0x43337b
push eax
call ebx
mov eax, str.KAPFA
mov ecx, esi
call fcn.00432fb0
push esi
call ebx
push 0
push str.KAPFA
call fcn.00433010
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 8
call edi
mov esi, eax
test esi, esi
jne 0x4333d8
lea ecx, [esp + 0xc]
push ecx
push eax
push eax
push 0x4331c0
push eax
push eax
call fcn.004599db
add esp, 0x18
test eax, eax
je 0x4333d4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x20c
ret
call edi
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x20c
ret
Function at 0x4341d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x40
push esi
mov esi, 1
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xff
cmp eax, 5
push edi
jb 0x4341f6
push str..Global_s
lea eax, [esp + 0xc]
push eax
jmp 0x434200
push str.._s
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x43422d
xor esi, esi
test ebx, ebx
je 0x43423a
mov dword [ebx], eax
mov eax, esi
pop esi
add esp, 0x40
ret
cmp eax, 0xffffffff
je 0x434246
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x40
ret

Function at 0x434250
Capabilities:
Create service
Delete service
Query environment variable

Disassembly:
sub esp, 0x208
push 0x104
lea eax, [esp + 4]
push eax
push str.SYSTEMROOT
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x43427c
call dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x208
ret
push ebx
push esi
push edi
push str.KASEYAHA.SYS
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x118]
push str._s_system32drivers_s
push edx
call fcn.00458ee7
add esp, 0x10
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
mov esi, eax
push str.KASEYAHA
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x4342d6
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
call ebx
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x124]
push eax
push 1
push 3
push 1
push 0xf01ff
push str.KASEYAHA
push str.KASEYAHA
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
je 0x43430b
push eax
call ebx
mov eax, str.KASEYAHA
mov ecx, esi
call fcn.00432fb0
push esi
call ebx
xor ebx, ebx
mov edi, str.KASEYAHA
call fcn.004341d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
add esp, 0x208
ret

Function at 0x434340
Capabilities:
Delete service
Stop service

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push 0xf01ff
mov esi, eax
push str.KASEYAHA
push esi
call ebx
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x434388
lea eax, [esp + 0x10]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push edi
call ebp
push 0xf01ff
push str.KASEYAHA
push esi
call ebx
mov edi, eax
test edi, edi
je 0x4343a5
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
call ebp
push esi
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret
Function at 0x4385a0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
push ebx
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push str.SOFTWAREWinSock2Kaseya_Agent_LSP
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x438677
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ecx, 0x40
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
push eax
push eax
push eax
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x34]
push eax
push 0
push ecx
mov dword [esp + 0x34], 0x100
call esi
cmp eax, 0x103
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
je 0x438657
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x20]
push edx
push eax
call ebx
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
push eax
push eax
push eax
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x34]
push eax
push 0
push ecx
mov dword [esp + 0x34], 0x100
call esi
cmp eax, 0x103
jne 0x438614
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SOFTWAREWinSock2Kaseya_Agent_LSP
push 0x80000002
call ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439120
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
sub esp, 0x1a0
push esi
mov esi, dword [esp + 0x1b8]
lea eax, [esp + 0x14]
push eax
push 0x101
mov dword [esi], 0xffffffff
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x439152
or eax, 0xffffffff
pop esi
add esp, 0x1a0
ret
push 0
push 1
push 2
call sub.WS2_32.dll_socket
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x439176
call fcn.00452f92
mov eax, 0xfffffffe
pop esi
add esp, 0x1a0
ret
mov ecx, dword [esp + 0x1ac]
test ecx, ecx
je 0x4391b8
lea ecx, [esp + 0x1ac]
push ecx
push 0x8004667e
push eax
call sub.WS2_32.dll_ioctlsocket
test eax, eax
je 0x4391b8
mov edx, dword [esi]
push edx
call sub.WS2_32.dll_closesocket
call fcn.00452f92
mov dword [esi], 0xffffffff
mov eax, 0xfffffffe
pop esi
add esp, 0x1a0
ret
cmp dword [esp + 0x1a8], 1
jne 0x439253
mov eax, dword [esp + 0x1b4]
push eax
mov word [esp + 8], 2
call sub.WS2_32.dll_htons
push 0
mov word [esp + 0xa], ax
call sub.WS2_32.dll_htonl
mov edx, dword [esi]
push 0x10
lea ecx, [esp + 8]
push ecx
push edx
mov dword [esp + 0x14], eax
call sub.WS2_32.dll_bind
cmp eax, 0xffffffff
jne 0x43921e
mov eax, dword [esi]
push eax
call sub.WS2_32.dll_closesocket
call fcn.00452f92
mov dword [esi], 0xffffffff
mov eax, 0xfffffff9
pop esi
add esp, 0x1a0
ret
mov ecx, dword [esp + 0x1b0]
mov edx, dword [esi]
push ecx
push edx
call sub.WS2_32.dll_listen
cmp eax, 0xffffffff
jne 0x439253
mov eax, dword [esi]
push eax
call sub.WS2_32.dll_closesocket
call fcn.00452f92
mov dword [esi], 0xffffffff
mov eax, 0xfffffff8
pop esi
add esp, 0x1a0
ret
xor eax, eax
pop esi
add esp, 0x1a0
ret
Function at 0x439260
Capabilities:
Connect socket
Get socket status
Resolve dns

Disassembly:
sub esp, 0x120
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
cmp dword [esp + 0x124], 1
push esi
push edi
mov dword [esp + 0x10], 0x10
jne 0x43935f
mov edi, dword [esp + 0x144]
test edi, edi
je 0x4394ad
mov esi, dword [esp + 0x130]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push esi
call sub.WS2_32.dll_accept
cmp eax, 0xffffffff
mov dword [edi], eax
jne 0x4394a2
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x439351
mov eax, dword [esp + 0x134]
test eax, eax
jle 0x439494
lea edx, [esp + 0x24]
xor ecx, ecx
mov dword [esp + 8], ecx
push edx
push esi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], 1
call sub.WS2_32.dll___WSAFDIsSet
lea eax, [esp + 8]
push eax
push 0
push 0
lea ecx, [esp + 0x30]
push ecx
push 0
call sub.WS2_32.dll_select
cmp eax, 1
jne 0x439486
lea edx, [esp + 0x24]
push edx
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x439486
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push esi
call sub.WS2_32.dll_accept
cmp eax, 0xffffffff
mov dword [edi], eax
jne 0x4394a2
pop edi
mov eax, 0xfffffff6
pop esi
add esp, 0x120
ret
mov eax, dword [esp + 0x138]
test eax, eax
mov word [esp + 0x14], 2
je 0x439390
push eax
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
jne 0x43938a
pop edi
mov eax, 0xfffffffc
pop esi
add esp, 0x120
ret
mov dword [esp + 0x18], eax
jmp 0x4393d2
mov eax, dword [esp + 0x13c]
test eax, eax
je 0x4394ad
push eax
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x4393b7
pop edi
mov eax, 0xfffffffb
pop esi
add esp, 0x120
ret
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
mov esi, dword [edx]
mov eax, ecx
shr ecx, 2
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x140]
push ecx
call sub.WS2_32.dll_htons
mov esi, dword [esp + 0x130]
push 0x10
lea edx, [esp + 0x18]
push edx
push esi
mov word [esp + 0x22], ax
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
jne 0x4394a2
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x43942d
cmp eax, 0x2735
je 0x43942d
cmp eax, 0x2748
je 0x4394a2
pop edi
mov eax, 0xfffffffa
pop esi
add esp, 0x120
ret
mov eax, dword [esp + 0x134]
test eax, eax
jle 0x439494
lea edx, [esp + 0x24]
xor ecx, ecx
mov dword [esp + 8], ecx
push edx
push esi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], 1
call sub.WS2_32.dll___WSAFDIsSet
lea eax, [esp + 8]
push eax
push 0
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
call sub.WS2_32.dll_select
cmp eax, 1
jne 0x439486
lea edx, [esp + 0x24]
push edx
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x4394a2
pop edi
mov eax, 0xfffffff1
pop esi
add esp, 0x120
ret
pop edi
mov eax, 0xfffffff7
pop esi
add esp, 0x120
ret
pop edi
xor eax, eax
pop esi
add esp, 0x120
ret
pop edi
mov eax, 0xfffffffd
pop esi
add esp, 0x120
ret
Function at 0x439fa0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
sub esp, 8
test edx, edx
push esi
push edi
je 0x43a11d
mov esi, dword [esp + 0x18]
test esi, esi
je 0x43a11d
mov edi, dword [esp + 0x20]
test edi, edi
je 0x43a11d
push ebx
mov ebx, dword [esp + 0x20]
mov ecx, ebx
push ebp
mov ebp, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, ebp
and ecx, 3
rep stosb byte es:[edi], al
mov eax, edx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x439fe6
sub eax, edx
mov edx, eax
mov eax, esi
mov dword [esp + 0x10], edx
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43a000
sub eax, esi
test dl, 1
mov dword [esp + 0x14], eax
jne 0x43a055
test al, 1
jne 0x43a055
test bl, 1
jne 0x43a055
cmp edx, eax
jle 0x43a021
mov eax, edx
cmp ebx, eax
jle 0x43a027
mov eax, ebx
cdq
sub eax, edx
mov esi, eax
sar esi, 1
push esi
call fcn.00459619
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x43a055
push esi
call fcn.00459619
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x43a062
push ebx
call fcn.0045932f
add esp, 4
pop ebp
pop ebx
pop edi
mov eax, 0xfffffffe
pop esi
add esp, 8
ret
xor eax, eax
mov ecx, esi
mov edx, ecx
shr ecx, 2
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x10]
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, dword [esp + 0x20]
push ebx
push eax
call fcn.00439e90
add esp, 0xc
test eax, eax
jne 0x43a0c0
mov ecx, esi
mov edx, ecx
shr ecx, 2
mov edi, ebp
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x14]
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, dword [esp + 0x24]
push ebp
push eax
call fcn.00439e90
add esp, 0xc
test eax, eax
je 0x43a0dc
push ebx
call fcn.0045932f
push ebp
call fcn.0045932f
add esp, 8
pop ebp
pop ebx
pop edi
mov eax, 0xfffffffd
pop esi
add esp, 8
ret
test esi, esi
jle 0x43a0ef
mov edi, ebx
mov eax, ebp
sub edi, ebp
mov cl, byte [edi + eax]
xor byte [eax], cl
inc eax
dec esi
jne 0x43a0e6
mov eax, dword [esp + 0x24]
cdq
sub eax, edx
mov edx, dword [esp + 0x28]
sar eax, 1
push eax
push edx
push ebp
call fcn.00439f40
push ebx
call fcn.0045932f
push ebp
call fcn.0045932f
add esp, 0x14
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 8
ret
pop edi
or eax, 0xffffffff
pop esi
add esp, 8
ret
Function at 0x43b0f0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
push ebp
mov ebp, ecx
jne 0x43b104
mov eax, 0x57
pop ebp
ret 4
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x43b130
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop ebp
ret 4
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
jne 0x43b152
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
mov eax, 0xd
pop ebp
ret 4
lea eax, [esi + 2]
push ebx
push eax
call fcn.00459619
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x43b178
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop esi
pop edi
mov eax, 8
pop ebp
ret 4
push 0
lea ecx, [esp + 0x18]
push ecx
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x43b1ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov esi, eax
call fcn.0045932f
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret 4
push edi
mov byte [ebx + esi], 0
mov byte [ebx + esi + 1], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, dword [esp + 0x14]
jbe 0x43b1d8
push ebx
call fcn.0045932f
add esp, 4
pop ebx
pop esi
pop edi
mov eax, 0x1e
pop ebp
ret 4
or edi, 0xffffffff
cmp esi, 3
jbe 0x43b257
movsx ecx, byte [ebx]
cmp ecx, 0xff
jne 0x43b218
movsx edx, byte [ebx + 1]
cmp edx, 0xfe
lea eax, [ebx + 1]
jne 0x43b218
lea ebx, [ebx]
mov cl, byte [eax - 1]
test cl, cl
jne 0x43b20c
cmp byte [eax], 0
je 0x43b25c
mov dl, byte [eax]
mov byte [eax - 1], dl
mov byte [eax], cl
add eax, 2
jmp 0x43b200
cmp ecx, 0xfe
jne 0x43b22b
movsx eax, byte [ebx + 1]
cmp eax, 0xff
je 0x43b25c
push ebx
call fcn.0043a370
mov cl, byte [eax]
add esp, 4
cmp cl, 0x3c
jne 0x43b257
push eax
mov ecx, ebp
call fcn.0043af70
push ebx
mov edi, eax
call fcn.0045932f
add esp, 4
pop ebx
pop esi
mov eax, edi
pop edi
pop ebp
ret 4
mov edi, 0xd
push ebx
call fcn.0045932f
add esp, 4
pop ebx
pop esi
mov eax, edi
pop edi
pop ebp
ret 4