joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404640
Capabilities:
Create service
Modify service

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x10034
call fcn.0040a8ec
push 3
push str.ServicesActive
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test eax, eax
je 0x404796
mov esi, eax
mov ebp, dword [esp + 0x10048]
lea ebx, [esp + 0x36]
push 0xfffe
push 0
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x7fff
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
push ebp
call sub.msvcrt.dll_strlen
add esp, 4
test ebp, ebp
je 0x4046e0
mov edi, eax
test eax, eax
je 0x4046e0
push 0x43a584
push ebx
call sub.msvcrt.dll_wcscat
add esp, 8
push ebx
call sub.msvcrt.dll_wcslen
add esp, 4
lea eax, [esp + eax*2]
add eax, 0x36
push edi
push ebp
push eax
call sub.msvcrt.dll_mbstowcs
add esp, 0xc
push 0x43a58a
push ebx
call sub.msvcrt.dll_wcscat
add esp, 8
sub esp, 0x34
xorps xmm0, xmm0
movups xmmword [esp + 0x20], xmm0
mov dword [esp + 0x1c], ebx
movaps xmm0, xmmword [0x43a460]
movups xmmword [esp + 0xc], xmm0
mov dword [esp], esi
mov dword [esp + 0x30], 0
mov dword [esp + 8], str.wsclient
mov dword [esp + 4], str.wsclient
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
je 0x40479d
mov dword [esp + 4], str.wsclient_service
lea ecx, [esp + 4]
mov edi, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push ecx
push 1
push eax
mov ebx, eax
call edi
mov dword [esp], 1
mov eax, esp
push eax
push 4
push ebx
call edi
movaps xmm0, xmmword [0x43a470]
movups xmmword [esp + 0x20], xmm0
movaps xmm0, xmmword [0x43a480]
movups xmmword [esp + 8], xmm0
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0x3a98
lea eax, [esp + 8]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x20]
push eax
push 2
push ebx
call edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call edi
push esi
call edi
mov eax, 1
jmp 0x4047b3
push str.install_service.OpenSCManager
jmp 0x4047a9
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push str.install_service.CreateService
call fcn.00404560
add esp, 4
xor eax, eax
add esp, 0x10034
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404b00
Capabilities:
Delete service

Disassembly:
push ebp
push ebx
push edi
push esi
push 5
push str.ServicesActive
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test eax, eax
je 0x404b5d
mov esi, eax
push 0x10000
push str.wsclient
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x404b64
mov edi, eax
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov ebx, 1
test eax, eax
jne 0x404b4f
push str.delete_service.DeleteService
call fcn.00404560
add esp, 4
xor ebx, ebx
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call ebp
push esi
call ebp
jmp 0x404b7a
push str.delete_service.OpenSCManager
jmp 0x404b70
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push str.delete_service.OpenService
call fcn.00404560
add esp, 4
xor ebx, ebx
mov eax, ebx
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x405ea0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 8]
lock inc dword [0x4433f8]
test eax, eax
je 0x405ebb
lock inc dword [0x4433fc]
push esi
push eax
call sub.msvcrt.dll_realloc
add esp, 8
test eax, eax
je 0x405ee7
mov ecx, dword [esp + 0x10]
sub esi, ecx
jbe 0x405ee5
mov edx, eax
add edx, ecx
push esi
push 0
push edx
mov esi, eax
call sub.msvcrt.dll_memset
mov eax, esi
add esp, 0xc
pop esi
ret
push 2
call dword [0x440010]
add esp, 4
push eax
push 1
push 0x10
push str.realloc_failed__n
call sub.msvcrt.dll_fwrite
add esp, 0x10
push 0xffffffffffffffff
call sub.msvcrt.dll_exit
int3

Function at 0x405f10
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
lock inc dword [0x4433f8]
push eax
push 1
call sub.msvcrt.dll_calloc
add esp, 8
test eax, eax
je 0x405f2b
ret
push 2
call dword [0x440010]
add esp, 4
push eax
push 1
push 0xf
push 0x43acf0
call sub.msvcrt.dll_fwrite
add esp, 0x10
push 0xffffffffffffffff
call sub.msvcrt.dll_exit
int3
Function at 0x406230
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x14]
mov ecx, dword [esi + 0x24]
test cl, 8
jne 0x4063aa
and ecx, 0xffffc007
or ecx, 8
mov dword [esi + 0x24], ecx
mov eax, dword [0x4433a8]
inc eax
mov dword [0x4433a8], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov edi, dword [esi]
movd xmm0, dword [edi + 0x24]
movd xmm1, dword [edi + 0x20]
punpckldq xmm1, xmm0
pshufd xmm0, xmm1, 0x44
movdqu xmmword [esi + 0x48], xmm0
and ecx, 0xffff800f
mov dword [esi + 0x24], ecx
mov edx, dword [edi + 0xc0]
test edx, edx
je 0x4062b0
mov eax, dword [edi + 0xbc]
jmp 0x4062d6
mov dword [edi + 0xc0], 0x2000
push 0x2000
call fcn.00405f10
add esp, 4
mov dword [edi + 0xbc], eax
mov edx, dword [edi + 0xc0]
mov ecx, dword [esi + 0x24]
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], edx
pxor xmm0, xmm0
movdqu xmmword [esi + 0x60], xmm0
mov dword [esi + 0x70], 0x2000000
mov dword [esi + 0x74], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0xa4], 0x2000000
and ecx, 0xffff7fff
movdqu xmmword [esi + 0xa8], xmm0
movdqu xmmword [esi + 0xb8], xmm0
movdqu xmmword [esi + 0xc8], xmm0
movdqu xmmword [esi + 0xd8], xmm0
movdqu xmmword [esi + 0xe8], xmm0
pxor xmm0, xmm0
movq qword [esi + 0xf8], xmm0
mov dword [esi + 0x24], ecx
mov dword [esi + 0x100], 0
mov dword [esi + 0x104], 0
mov dword [esp], 0
mov dword [esp + 4], 4
lea eax, [esp + 4]
mov edi, esp
push eax
push edi
push 0x1008
push 0xffff
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
je 0x4063b0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2736
jne 0x4063c9
mov ecx, dword [esi + 0x30]
mov eax, 0x10
cmp ecx, 2
ja 0x4063a7
mov eax, dword [ecx*4 + 0x43ad68]
mov dword [esi + 0x28], eax
add esp, 8
pop esi
pop edi
ret
mov eax, dword [esp]
cmp eax, 1
je 0x4063c9
cmp eax, 2
je 0x4063dc
cmp eax, 3
jne 0x4063e3
mov eax, 0x100
jmp 0x4063e8
mov dword [esi + 0x28], 0x100000
mov eax, dword [esi + 0x30]
mov dword [esp], 1
jmp 0x4063f5
mov eax, 0x1000
jmp 0x4063e8
mov eax, 0xfffff00
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x30]
mov dword [esp], 0
push edi
push 0x8004667e
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [esi + 0x40]
test eax, eax
je 0x40644a
cmp dword [esi + 0x44], 0
je 0x40645d
mov dword [esp], 0x1c
push edi
push eax
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_getsockname]
movzx eax, word [esi + 0x2a]
test eax, 0xff0
je 0x4063aa
mov dword [esp], 0x1c
push edi
push dword [esi + 0x44]
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_getpeername]
add esp, 8
pop esi
pop edi
ret
push 0x1c
call fcn.00405f10
add esp, 4
mov dword [esi + 0x40], eax
cmp dword [esi + 0x44], 0
jne 0x40640f
push 0x1c
call fcn.00405f10
add esp, 4
mov dword [esi + 0x44], eax
mov eax, dword [esi + 0x40]
jmp 0x40640f
Function at 0x4072b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
cmp dword [ebx], 0
je 0x40736f
cmp dword [ebx + 4], 0
je 0x40737b
mov eax, dword [ebx + 8]
or eax, dword [ebx + 0xc]
je 0x40738e
lea ebp, [edi + 0xe0]
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0xcc]
cmp eax, 0xffffffff
je 0x40739e
push 0
push 1
push 0x43ad74
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x4074ab
mov ecx, dword [edi + 0xd8]
test ecx, ecx
je 0x4073f4
mov esi, dword [edi + 0xd4]
cmp esi, ecx
jne 0x407439
mov eax, ecx
add eax, ecx
mov esi, 0x10
cmovne esi, eax
lea eax, [esi*8]
lea eax, [eax + eax*4]
shl ecx, 3
lea ecx, [ecx + ecx*4]
push ecx
push eax
push dword [edi + 0xd0]
call fcn.00405ea0
add esp, 0xc
mov dword [edi + 0xd0], eax
mov dword [edi + 0xd8], esi
mov edx, dword [edi + 0xdc]
jmp 0x40747b
mov dword [ebx], edi
cmp dword [ebx + 4], 0
jne 0x4072d0
mov dword [ebx + 4], 0x400
mov eax, dword [ebx + 8]
or eax, dword [ebx + 0xc]
jne 0x4072dc
call fcn.004061f0
mov dword [ebx + 0xc], edx
mov dword [ebx + 8], eax
jmp 0x4072dc
lea eax, [edi + 0xc8]
push eax
push 0
push 1
push 2
call fcn.0040fe30
add esp, 0x10
test eax, eax
jne 0x4074ab
push dword [edi + 0xc8]
push edi
call fcn.00408170
add esp, 8
mov esi, eax
mov dword [eax + 0xa8], 0x408780
push eax
call fcn.004090d0
add esp, 4
mov dword [esi + 0x20], 3
inc dword [edi + 0x3c]
mov eax, dword [edi + 0xcc]
jmp 0x4072f8
mov dword [edi + 0xdc], 0
mov dword [edi + 0xd4], 0
mov dword [edi + 0xd8], 0x10
push 0x280
call fcn.00405f10
add esp, 4
mov dword [edi + 0xd0], eax
mov ecx, dword [edi + 0xd8]
mov esi, dword [edi + 0xd4]
cmp esi, ecx
je 0x40732c
mov dword [esp], ebp
mov eax, dword [edi + 0xd0]
mov edx, dword [edi + 0xdc]
lea ebp, [edx + esi]
cmp ebp, ecx
jne 0x407478
lea ecx, [edx + edx*4]
lea ecx, [eax + ecx*8]
shl esi, 3
lea edx, [esi + esi*4]
push edx
push ecx
push eax
call sub.msvcrt.dll_memmove
add esp, 0xc
mov dword [edi + 0xdc], 0
mov eax, dword [edi + 0xd0]
xor edx, edx
mov ebp, dword [esp]
mov ecx, dword [edi + 0xd4]
lea edx, [edx + edx*4]
lea eax, [eax + edx*8]
lea ecx, [ecx + ecx*4]
movsd xmm0, qword [ebx + 0x20]
movsd qword [eax + ecx*8 + 0x20], xmm0
movups xmm0, xmmword [ebx]
movups xmm1, xmmword [ebx + 0x10]
movups xmmword [eax + ecx*8 + 0x10], xmm1
movups xmmword [eax + ecx*8], xmm0
inc dword [edi + 0xd4]
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4083f0
Capabilities:
Set socket configuration

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [esp + 0x40]
mov edi, 1
test ebx, 0xff00000
jne 0x408426
mov edi, 2
test ebx, 0xff000
jne 0x408426
mov edi, 3
test ebx, 0xf00
je 0x40851f
mov eax, dword [esp + 0x3c]
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp + 4], xmm0
xor esi, esi
test eax, eax
js 0x408521
lea ebp, [esp + 4]
push eax
push dword [esp + 0x3c]
push ebp
call fcn.0040fdb0
add esp, 0xc
test eax, eax
jne 0x408521
movzx eax, word [esp + 4]
push 0
push edi
push eax
call dword [sym.imp.WS2_32.dll_socket]
test eax, eax
js 0x40852b
mov edi, eax
cmp dword [esp + 0x44], 0
je 0x4084a3
push edi
push dword [esp + 0x38]
call fcn.00408170
add esp, 8
mov esi, eax
mov dword [eax + 0x28], ebx
push ebp
call fcn.0040fe10
add esp, 4
push eax
push ebp
push esi
call fcn.00406ac0
add esp, 0xc
jmp 0x408521
cmp word [esp + 4], 0x17
jne 0x4084c2
mov dword [esp], 0
mov eax, esp
push 4
push eax
push 0x1b
push 0x29
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
push ebp
call fcn.0040fe10
add esp, 4
push eax
push ebp
push edi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
js 0x40853a
test ebx, 0xff00000
je 0x4084f0
push 0x7fffffff
push edi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
js 0x408541
push edi
push dword [esp + 0x38]
call fcn.00408170
add esp, 8
mov esi, eax
mov dword [eax + 0x28], ebx
push ebp
call fcn.0040fe10
add esp, 4
push eax
push ebp
push esi
call fcn.00406a80
add esp, 0xc
mov dword [esi + 0x20], 3
jmp 0x408521
xor esi, esi
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x43ad76
call sub.msvcrt.dll_perror
add esp, 4
jmp 0x408521
push 0x43ad7d
jmp 0x408546
push 0x43ad82
call sub.msvcrt.dll_perror
add esp, 4
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x408521

Function at 0x408560
Capabilities:
Create udp socket

Disassembly:
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x30]
xorps xmm0, xmm0
movups xmmword [esp + 0xc], xmm0
movups xmmword [esp], xmm0
xor esi, esi
test eax, eax
js 0x4085cc
mov edi, esp
push eax
push dword [esp + 0x30]
push edi
call fcn.0040fdb0
add esp, 0xc
test eax, eax
jne 0x4085cc
movzx eax, word [esp]
push 0
push 2
push eax
call dword [sym.imp.WS2_32.dll_socket]
test eax, eax
js 0x4085d4
push eax
push dword [esp + 0x2c]
call fcn.00408170
add esp, 8
mov esi, eax
mov dword [eax + 0x28], 0x1000
push edi
call fcn.0040fe10
add esp, 4
push eax
push edi
push esi
call fcn.00406ac0
add esp, 0xc
mov eax, esi
add esp, 0x1c
pop esi
pop edi
ret
push 0x43ad76
call sub.msvcrt.dll_perror
add esp, 4
jmp 0x4085cc
Function at 0x408fd0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov esi, dword [ebp + 8]
mov edi, dword [esi + 0x30]
mov ebx, dword [esi + 0x44]
push ebx
call fcn.0040fe10
add esp, 4
push eax
push ebx
push edi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
js 0x409036
jne 0x409045
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
xorps xmm1, xmm1
movsd qword [esp + 0x20], xmm1
movaps xmmword [esp], xmm0
mov dword [esp + 0x10], 0x409820
mov dword [esp + 0x14], esi
mov eax, dword [esi + 0x2c]
mov dword [esp + 0x18], eax
mov eax, esp
push eax
push dword [esi]
call fcn.004072b0
add esp, 8
xor eax, eax
jmp 0x409084
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x40908c
mov eax, dword [esi + 0xbc]
test eax, eax
mov ecx, 0x2710
cmovne ecx, eax
push 1
push ecx
push 0x4090b0
push dword [esi]
call fcn.00407ad0
add esp, 0x10
mov dword [esi + 0xd8], eax
mov dword [eax + 0x18], esi
or byte [esi + 0x24], 0x80
push 4
push 0x4088a0
push esi
call fcn.00408290
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x43ad89
call sub.msvcrt.dll_perror
add esp, 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x34], eax
push esi
call fcn.00408380
add esp, 4
mov eax, edi
jmp 0x409084

Function at 0x4093b0
Capabilities:
Get local ipv4 addresses
Get socket information
Send data
Send data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, edx
mov esi, ecx
mov ecx, dword [esp + 0x18]
mov eax, dword [esi + 0x28]
cmp eax, 0x1fff
jle 0x4093eb
cmp eax, 0x2000
je 0x4093f9
cmp eax, 0x100000
je 0x40943f
cmp eax, 0x1000000
jne 0x409451
push ecx
push edi
push dword [esi + 0xf8]
call fcn.0040f680
jmp 0x40945b
cmp eax, 0x100
je 0x4093f9
cmp eax, 0x1000
jne 0x409451
mov ebp, dword [esi + 0x30]
mov ebx, dword [esi + 0x44]
push ebx
call fcn.0040fe10
add esp, 4
push eax
push ebx
push 0
push dword [esp + 0x24]
push edi
push ebp
call dword [sym.imp.WS2_32.dll_sendto]
mov ecx, dword [esi + 0x40]
cmp word [ecx + 2], 0
jne 0x40944c
mov dword [esp], 0x1c
mov edx, esp
push edx
push ecx
push dword [esi + 0x30]
mov esi, eax
call dword [sym.imp.WS2_32.dll_getsockname]
mov eax, esi
add esp, 4
jmp 0x40945e
push 0
push ecx
push edi
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_send]
add esp, 4
jmp 0x40945e
push ecx
push edi
push dword [esi + 0x30]
call sub.msvcrt.dll__write
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409620
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push edi
push esi
push eax
mov esi, ecx
mov dword [esp], 0x1c
mov edi, esp
push edi
push dword [ecx + 0x44]
push dword [ecx + 0x30]
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
js 0x4096b6
mov dword [esp], 0x1c
push edi
push dword [esi + 0x40]
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_getsockname]
cmp dword [esi + 0x28], 0x1000000
jne 0x4096a5
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x4096ce
mov ecx, dword [esi + 0x100]
test ecx, ecx
je 0x409680
push ecx
push eax
call fcn.0040f690
add esp, 8
mov eax, dword [esi + 0xf8]
push eax
call fcn.0040f640
add esp, 4
cmp eax, 0xfffffffe
je 0x409724
test eax, eax
jne 0x409740
push 1
push esi
call fcn.00408320
add esp, 8
push esi
call fcn.00406b40
add esp, 4
push esi
call fcn.00406670
jmp 0x4096c5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x34], eax
push esi
call fcn.00409470
add esp, 4
add esp, 4
pop esi
pop edi
ret
mov eax, dword [esi + 0xfc]
test eax, eax
jne 0x4096fb
mov eax, dword [0x43ad98]
mov eax, dword [eax]
test eax, eax
jne 0x4096fb
push 0
call fcn.0040f2c0
add esp, 4
mov dword [esi + 0xfc], eax
or byte [esi + 0x25], 0x80
test eax, eax
je 0x409756
push dword [esi + 0x30]
push eax
call fcn.0040f500
add esp, 8
test eax, eax
je 0x40974c
mov dword [esi + 0xf8], eax
mov ecx, dword [esi + 0x100]
test ecx, ecx
jne 0x409670
jmp 0x409680
test byte [esi + 0x38], 1
jne 0x4096c8
push 1
push 0x4097c0
push esi
call fcn.00408290
add esp, 0xc
add esp, 4
pop esi
pop edi
ret
mov dword [esi + 0x34], 0x413
jmp 0x4096bf
mov eax, 0x412
jmp 0x4096bc
mov eax, 0x411
jmp 0x4096bc

Function at 0x409bd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
xor edx, edx
test ecx, ecx
je 0x409c4e
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp ecx, 1
je 0x409c30
mov ebx, dword [esp + 0x1c]
and ebx, 0xfffffffe
xor edx, edx
nop dword [eax + eax]
mov ebp, dword [eax + 0xc]
add ebp, edx
and ebp, 3
movzx ecx, byte [eax + ebp + 8]
xor cl, byte [edi + edx]
mov byte [esi + edx], cl
mov ecx, dword [eax + 0xc]
add ecx, edx
inc ecx
and ecx, 3
movzx ecx, byte [eax + ecx + 8]
xor cl, byte [edi + edx + 1]
mov byte [esi + edx + 1], cl
add edx, 2
cmp ebx, edx
jne 0x409c00
mov ebx, dword [esp + 0x1c]
test bl, 1
je 0x409c50
mov ecx, dword [eax + 0xc]
add ecx, edx
and ecx, 3
movzx ecx, byte [eax + ecx + 8]
xor cl, byte [edi + edx]
mov byte [esi + edx], cl
jmp 0x409c50
xor ebx, ebx
add bl, byte [eax + 0xc]
and bl, 3
mov byte [eax + 0xc], bl
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409c60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
movzx ecx, byte [esp + 0x28]
mov eax, dword [esp + 0x20]
xor edx, edx
test eax, eax
je 0x409ce1
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
movzx ebx, cl
cmp eax, 8
jae 0x409cef
mov ebp, edx
test al, 1
je 0x409ca3
mov ecx, ebx
and ecx, 3
mov ebp, dword [esp + 0x24]
movzx ecx, byte [ebp + ecx]
xor cl, byte [esi + edx]
mov byte [edi + edx], cl
mov ebp, edx
or ebp, 1
lea ecx, [eax - 1]
cmp edx, ecx
mov edx, dword [esp + 0x24]
je 0x409cda
nop
lea ecx, [ebx + ebp]
and ecx, 3
movzx ecx, byte [edx + ecx]
xor cl, byte [esi + ebp]
mov byte [edi + ebp], cl
lea ecx, [ebx + ebp]
inc ecx
and ecx, 3
movzx ecx, byte [edx + ecx]
xor cl, byte [esi + ebp + 1]
mov byte [edi + ebp + 1], cl
add ebp, 2
cmp eax, ebp
jne 0x409cb0
movzx ecx, byte [esp + 0x28]
jmp 0x409ce3
xor eax, eax
add al, cl
and al, 3
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
lea edx, [eax - 1]
mov ch, cl
and ch, 3
mov cl, dl
and cl, 3
add cl, ch
test cl, 4
jne 0x409dc9
mov ebp, edx
cmp edx, 3
mov edx, 0
ja 0x409c84
mov byte [esp], ch
mov ecx, edi
sub ecx, esi
cmp ecx, 0x20
jb 0x409c84
movzx ecx, byte [esp]
mov edx, dword [esp + 0x24]
add ecx, edx
mov ebp, edi
sub ebp, ecx
cmp ebp, 0x20
mov edx, 0
jb 0x409c84
xor edx, edx
cmp eax, 0x20
jb 0x409d86
mov edx, eax
and edx, 0xffffffe0
movups xmm0, xmmword [esi]
movups xmm1, xmmword [esi + 0x10]
mov ecx, ebx
and ecx, 3
mov ebp, dword [esp + 0x24]
movups xmm2, xmmword [ebp + ecx]
xorps xmm2, xmm0
movups xmm0, xmmword [ebp + ecx + 0x10]
xorps xmm0, xmm1
movups xmmword [edi], xmm2
movups xmmword [edi + 0x10], xmm0
cmp edx, eax
je 0x409cda
test al, 0x18
je 0x409c84
mov ebp, edx
mov ecx, eax
and ecx, 0xfffffff8
mov dword [esp], ecx
mov ecx, ebx
and ecx, 3
mov edx, dword [esp + 0x24]
nop dword [eax]
movsd xmm0, qword [esi + ebp]
movsd xmm1, qword [edx + ecx]
xorps xmm1, xmm0
movlps qword [edi + ebp], xmm1
add ebp, 8
cmp dword [esp], ebp
jne 0x409da0
mov edx, dword [esp]
cmp edx, eax
jne 0x409c84
jmp 0x409cda
xor edx, edx
jmp 0x409c84
Function at 0x409e80
Capabilities:
Encode data using base64

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
cmp dword [esp + 0x18], 0
je 0x409f68
xor edi, edi
mov esi, 0xffffffff
mov ebp, 1
xor ecx, ecx
jmp 0x409ef0
movzx eax, byte [ebx - 1]
and eax, 0xf
movzx edx, byte [ebx]
shr edx, 6
movzx eax, byte [edx + eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov edx, dword [esp + 0x1c]
mov byte [edx + ecx], al
movzx eax, byte [ebx]
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [edx + ecx + 1], al
add ecx, 2
inc edi
inc esi
inc ebx
mov eax, dword [esp + 0x18]
add eax, ebp
dec eax
dec ebp
cmp eax, 1
je 0x409f47
mov eax, edi
mov edx, 0xaaaaaaab
mul edx
shr edx, 1
lea edx, [edx + edx*2]
mov eax, edi
sub eax, edx
cmp eax, 2
je 0x409eb0
cmp eax, 1
jne 0x409f30
movzx eax, byte [ebx - 1]
shl eax, 4
and eax, 0x30
movzx edx, byte [ebx]
shr edx, 4
movzx eax, byte [eax + edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
jmp 0x409f3d
movzx eax, byte [ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov edx, dword [esp + 0x1c]
mov byte [edx + ecx], al
inc ecx
jmp 0x409ee0
mov edx, 0xaaaaaaab
mov eax, esi
mul edx
shr edx, 1
lea eax, [edx + edx*2]
sub esi, eax
cmp esi, 1
je 0x409f97
test esi, esi
jne 0x409fb7
neg ebp
mov ebx, dword [esp + 0x14]
jmp 0x409f6f
xor ecx, ecx
mov ebp, 0xffffffff
movzx eax, byte [ebx + ebp]
shl eax, 4
and eax, 0x30
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov edx, dword [esp + 0x1c]
mov byte [edx + ecx], al
mov byte [edx + ecx + 1], 0x3d
lea eax, [edx + ecx]
add eax, 2
add ecx, 3
jmp 0x409fb4
movzx eax, byte [ebx - 1]
and eax, 0xf
movzx eax, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov edx, dword [esp + 0x1c]
mov byte [edx + ecx], al
lea eax, [edx + ecx]
inc eax
add ecx, 2
mov byte [eax], 0x3d
mov eax, ecx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40f2c0
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
push 0x4e8
call sub.msvcrt.dll_malloc
add esp, 4
test eax, eax
je 0x40f42a
mov esi, eax
mov edi, dword [esp + 0x28]
add eax, 0x2e4
mov dword [esp + 0x10], eax
push eax
call fcn.00417eb0
add esp, 4
lea ebx, [esi + 0x348]
push ebx
call fcn.0041a2b0
add esp, 4
lea eax, [esi + 0x4e0]
mov dword [esp + 0xc], eax
push eax
call fcn.0041ad70
add esp, 4
push esi
call fcn.0041b030
add esp, 4
mov ebp, esi
add ebp, 0x1a4
push ebp
call fcn.0041b4b0
add esp, 4
test edi, edi
je 0x40f3a3
mov eax, dword [edi]
test eax, eax
je 0x40f367
cmp byte [eax], 0
je 0x40f367
push eax
push ebx
call fcn.00419960
add esp, 8
test eax, eax
je 0x40f367
push 2
call dword [0x440010]
add esp, 4
push eax
push 1
push 0x14
push str.ssl_crt_file_error__n
jmp 0x40f419
mov eax, dword [edi + 4]
mov dl, 1
test eax, eax
je 0x40f3ba
cmp byte [eax], 0
je 0x40f3ba
push 0
push 0
push 0
push eax
push dword [esp + 0x1c]
call fcn.0041c4c0
add esp, 0x14
test eax, eax
je 0x40f3b8
push 2
call dword [0x440010]
add esp, 4
push eax
push 1
push 0x14
push str.ssl_key_file_error__n
jmp 0x40f419
mov dword [esp], ebx
mov al, 1
mov dword [esp + 8], eax
mov dword [esp + 4], 0
xor ebx, ebx
jmp 0x40f3db
xor edx, edx
mov dword [esp + 8], edx
mov dword [esp], ebx
xor eax, eax
cmp word [edi + 0x10], 0
setne al
add eax, eax
mov dword [esp + 4], eax
xor ebx, ebx
cmp word [edi + 0x12], 0
sete bl
push 0
push 0
push esi
push 0x41b260
push ebp
call fcn.0041bab0
add esp, 0x14
push 0
push 0
push ebx
mov edi, dword [esp + 0x1c]
push edi
call fcn.00417ee0
add esp, 0x10
test eax, eax
je 0x40f436
push 2
call dword [0x440010]
add esp, 4
push eax
push 1
push 0x12
push str.ssl_config_error__n
call sub.msvcrt.dll_fwrite
add esp, 0x10
push esi
call fcn.00439a34
add esp, 4
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
push dword [esp + 4]
push edi
call fcn.00417a00
add esp, 8
push ebp
push 0x41bc90
push edi
call fcn.00417a10
add esp, 0xc
cmp byte [esp + 8], 0
jne 0x40f42c
push 0
push dword [esi + 0x4dc]
push edi
call fcn.00417ae0
add esp, 0xc
push dword [esp + 0xc]
push dword [esp + 4]
push edi
call fcn.00417a60
add esp, 0xc
test eax, eax
je 0x40f42c
push 2
call dword [0x440010]
add esp, 4
push eax
push 1
push 0x1b
push str.ssl_key_file_check_failed__n
jmp 0x40f419

Function at 0x40fcb0
Capabilities:
Initialize winsock library

Disassembly:
mov cl, 1
xor eax, eax
lock cmpxchg byte [0x443400], cl
jne 0x40fcd8
sub esp, 0x190
mov eax, esp
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
add esp, 0x190
ret