joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007f9c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x100dc2a0]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x1007fa23
mov eax, dword [ebp - 0x18]
sub eax, 5
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
add ecx, 2
mov dword [ebp - 0x14], ecx
mov esi, esp
lea edx, [ebp - 0xc]
push edx
push 0x40
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100822e5
test eax, eax
jne 0x1007fa4e
mov eax, 0xa
jmp 0x1007fb50
cmp dword [ebp + 0xc], 0
je 0x1007fa9a
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0xe9
mov ecx, dword [ebp - 0x18]
add ecx, 5
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 1], eax
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 1
movzx ecx, al
test ecx, ecx
je 0x1007fa98
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov byte [ecx], 0xeb
mov edx, dword [ebp - 0x20]
mov byte [edx + 1], 0xf9
jmp 0x1007fad6
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x1007fac1
push 7
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x1007fad6
push 5
mov edx, dword [ebp - 4]
add edx, 0xc
push edx
mov eax, dword [ebp - 0x18]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov esi, esp
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100822e5
mov esi, esp
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.100822e5
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp esi, esp
call fcn.100822e5
mov cl, byte [ebp + 0xc]
and cl, 1
shl cl, 1
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 0xfd
or al, cl
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x14], al
mov dl, byte [ebp + 0xc]
and dl, 1
shl dl, 2
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 0xfb
or cl, dl
mov edx, dword [ebp - 4]
mov byte [edx + 0x14], cl
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x1007fb74]
call fcn.10082291
pop eax
pop edx
pop edi
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.100822e5
mov esp, ebp
pop ebp
ret
Function at 0x10080240
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [0x100dc290]
mov dword [ebp - 4], eax
jmp 0x10080267
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10080280
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x1008027e
mov eax, dword [ebp - 4]
jmp 0x10080304
jmp 0x1008025f
mov esi, esp
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.100822e5
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10080301
mov ecx, dword [ebp - 4]
add ecx, 0x20
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
cmp ecx, 0xfe0
jbe 0x100802c3
mov edx, dword [ebp - 4]
mov eax, dword [0x100dc290]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x100dc290], ecx
mov eax, dword [ebp - 4]
pop esi
add esp, 8
cmp ebp, esp
call fcn.100822e5
mov esp, ebp
pop ebp
ret

Function at 0x100807f0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xcccccccc
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x10080840
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x10080840
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x10080840
xor eax, eax
jmp 0x10080881
mov dword [ebp - 4], 1
jmp 0x10080852
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1008087c
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x1008087a
xor eax, eax
jmp 0x10080881
jmp 0x10080849
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0xbed058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00bed1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xbed07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbed06a
add dl, dl
jne 0xbed089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbed0dc
xor eax, eax
add dl, dl
jne 0xbed096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbed17d
add dl, dl
jne 0xbed0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbed0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbed0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbed0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xbed0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xbed075
mov eax, 1
add dl, dl
jne 0xbed0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbed0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbed0e1
sub eax, ebx
mov ebx, 1
jne 0xbed128
mov ecx, 1
add dl, dl
jne 0xbed10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbed119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbed105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbed075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xbed13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbed14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbed136
cmp eax, 0x7d00
jae 0xbed16d
cmp eax, 0x500
jb 0xbed168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbed075
cmp eax, 0x7f
ja 0xbed170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbed075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xbed19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xbed075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4c6c94
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4c6cd6
call fcn.004cca0d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
cmp eax, edi
je 0x4c6cd6
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
cmp eax, edi
jne 0x4c6ccd
xor eax, eax
jmp 0x4c6cde
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004c6ce4
pop edi
pop esi
pop ebx
ret 4

Function at 0x4ccf3d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4ccf6b
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
je 0x4ccf89
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004ccea3
jmp 0x4ccf89
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4ccf89
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004ccea3
test edi, edi
mov eax, edi
jne 0x4ccf73
pop edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x408f6c
mov ecx, 0x230111a6
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..pdata
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x3c885159
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x406e30
Capabilities:
Read clipboard data

Disassembly:
sub esp, 0x20c
push esi
mov esi, dword [esp + 0x218]
push edi
test esi, esi
je 0x406e49
mov dword [esi], 0
mov edi, dword [esp + 0x218]
lea eax, [edi - 0xc000]
cmp eax, 0x3fff
ja 0x406f29
push 0x104
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClipboardFormatNameW]
push 0xb
lea eax, [esp + 0xc]
push str.Link_Source
push eax
call fcn.0049f9c2
add esp, 0xc
test eax, eax
je 0x406f1c
lea eax, [esp + 8]
push str.ObjectLink
push eax
call fcn.0049f841
add esp, 8
test eax, eax
je 0x406f1c
lea eax, [esp + 8]
push str.OwnerLink
push eax
call fcn.0049f841
add esp, 8
test eax, eax
je 0x406f1c
lea eax, [esp + 8]
push str.Native
push eax
call fcn.0049f841
add esp, 8
test eax, eax
je 0x406f1c
lea eax, [esp + 8]
push str.Embed_Source
push eax
call fcn.0049f841
add esp, 8
test eax, eax
je 0x406f1c
lea eax, [esp + 8]
push str.MSDEVColumnSelect
push eax
call fcn.0049f841
add esp, 8
test eax, eax
je 0x406f12
lea eax, [esp + 8]
push str.MSDEVLineSelect
push eax
call fcn.0049f841
add esp, 8
test eax, eax
jne 0x406f30
test esi, esi
je 0x406f1c
mov dword [esi], 1
pop edi
xor eax, eax
pop esi
add esp, 0x20c
ret 8
xor eax, eax
mov word [esp + 8], ax
push edi
call dword [sym.imp.USER32.dll_GetClipboardData]
pop edi
pop esi
add esp, 0x20c
ret 8

Function at 0x406f50
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
cmp dword [0x4e9ebc], 0
push ebx
push esi
push edi
jne 0x406fd8
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
push dword [0x4e8c44]
mov edi, dword [sym.imp.USER32.dll_OpenClipboard]
mov ebx, eax
call edi
test eax, eax
jne 0x406fce
nop dword [eax + eax]
mov eax, dword [0x4e4798]
cmp eax, 0xffffffff
je 0x406f9f
test eax, eax
je 0x406fe1
call esi
mov ecx, dword [0x4e4798]
add ecx, ebx
sub ecx, eax
cmp ecx, 5
jle 0x406fe1
mov edx, 1
mov dword [0x4e4780], 0
mov ecx, 0x8000012f
call fcn.00401600
push dword [0x4e8c44]
mov dword [0x4e4780], 1
call edi
test eax, eax
je 0x406f80
mov dword [0x4e9ebc], 1
mov eax, 1
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x40763c
Capabilities:
Resolve dns

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
push ecx
and dword [ebp], 0
mov dword [esp + 0x14], edx
mov byte [ebx], 0
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x4076ba
cmp word [esi + 8], 2
jne 0x40769c
push 4
pop eax
cmp word [esi + 0xa], ax
jne 0x40769c
mov edi, dword [esi + 0xc]
jmp 0x407696
push dword [eax]
mov edx, dword [esp + 0x1c]
push dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
call fcn.004075d5
mov dword [ebp], eax
test eax, eax
je 0x4076b5
lea ebp, [eax + 0x1c]
add edi, 4
mov eax, dword [edi]
test eax, eax
jne 0x407676
push 0x400
push dword [esi]
push 0x401
push ebx
call fcn.004a4597
add esp, 0x10
xor eax, eax
jmp 0x4076e1
push 8
pop eax
jmp 0x4076e1
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov ecx, 0x2af9
sub eax, ecx
je 0x4076df
sub eax, 1
je 0x4076d8
sub eax, 1
jne 0x4076df
lea eax, [ecx + 2]
jmp 0x4076e1
mov eax, 0x2afa
jmp 0x4076e1
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10

Function at 0x407d00
Capabilities:
Get common file path

Disassembly:
sub esp, 0x230
cmp dword [0x4e8c08], 0
mov ax, cx
mov word [esp + 2], ax
mov dword [esp + 4], str.getaddrinfo
mov dword [esp + 8], 0x40781d
mov dword [esp + 0xc], str.getnameinfo
mov dword [esp + 0x10], 0x407b30
mov dword [esp + 0x14], str.freeaddrinfo
mov dword [esp + 0x18], 0x4077e2
je 0x407d4f
movzx eax, ax
jmp 0x407e56
push 0x104
lea eax, [esp + 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x407e47
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x138]
mov ebx, 0x10c
push eax
lea eax, [esp + 0x30]
push ebx
push eax
call fcn.004a4486
push str.ws2_32
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.004a5305
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [esp + 0x44]
add esp, 0x18
push eax
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test esi, esi
je 0x407dc7
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x407e0b
push esi
call ebp
lea eax, [esp + 0x138]
mov esi, 0x10c
push eax
lea eax, [esp + 0x30]
push esi
push eax
call fcn.004a4486
push str.wship6
lea eax, [esp + 0x3c]
push esi
push eax
call fcn.004a5305
add esp, 0x18
lea eax, [esp + 0x2c]
push eax
call edi
mov esi, eax
test esi, esi
je 0x407e43
push str.getaddrinfo
push esi
call ebx
test eax, eax
je 0x407e40
xor edi, edi
mov ebx, edi
push dword [esp + ebx*8 + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + ebx*8 + 0x18], eax
test eax, eax
je 0x407e40
inc ebx
cmp ebx, 3
jl 0x407e0f
test esi, esi
je 0x407e43
mov eax, dword [esp + edi + 0x18]
mov dword [edi + 0x4e7874], eax
add edi, 8
cmp edi, 0x18
jl 0x407e2c
jmp 0x407e43
push esi
call ebp
pop edi
pop esi
pop ebp
pop ebx
movzx eax, word [esp + 2]
mov dword [0x4e8c08], 1
mov eax, dword [eax*8 + 0x4e7874]
add esp, 0x230
ret
Function at 0x40aabd
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
lea ebx, [edi + 0x24]
mov eax, dword [edi + 0x2c]
cmp esi, eax
jae 0x40aadb
mov ecx, dword [ebx]
cmp byte [ecx + esi], 0
je 0x40ab1e
inc esi
cmp esi, eax
jb 0x40aad0
cmp eax, dword [edi + 0x28]
jne 0x40aafc
mov eax, dword [ebx + 4]
test eax, eax
je 0x40aaeb
add eax, eax
jmp 0x40aaf0
mov eax, 0x800
push eax
mov ecx, ebx
call fcn.0040b697
test eax, eax
jne 0x40ab2c
mov eax, dword [edi + 0x28]
sub eax, dword [edi + 0x2c]
push 0
push eax
mov eax, dword [ebx]
add eax, dword [edi + 0x2c]
push eax
push dword [edi + 0x10]
call dword [sym.imp.WSOCK32.dll_recv]
cmp eax, 0xffffffff
je 0x40ab2c
add dword [edi + 0x2c], eax
jmp 0x40aac7
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40ab28
mov dword [eax], esi
xor eax, eax
jmp 0x40ab36
mov ecx, str.An_internal_error_has_occurred_in_the_debugger_engine._nContinue_running_the_script_without_the_debugger_
call fcn.0040af12
pop edi
pop esi
pop ebx
ret 4

Function at 0x40ab3c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
lea eax, [esp]
push ebp
push esi
push edi
mov edi, ecx
push 0xa
push eax
mov eax, dword [edi + 0x3c]
add eax, 0x26
push eax
call fcn.004a4345
xor ebp, ebp
lea eax, [esp + 0x18]
push ebp
push eax
call fcn.0049da00
push str.__xml_version_1.0__encoding_UTF_8___
push 0x4d1bdc
lea esi, [eax + 1]
push esi
call fcn.0040c05b
add esp, 0x20
add esi, eax
lea eax, [esp + 0xc]
sub esi, eax
push ebp
push esi
push eax
push dword [edi + 0x10]
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, 0xffffffff
je 0x40abca
push 1
push 0x4cee30
lea ecx, [edi + 0x34]
call fcn.0040b1f2
test eax, eax
jne 0x40abca
push ebp
push dword [edi + 0x3c]
push dword [edi + 0x34]
push dword [edi + 0x10]
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, 0xffffffff
je 0x40abca
mov dword [edi + 0x3c], ebp
xor eax, eax
mov dword [edi + 0x40], ebp
jmp 0x40abd4
mov ecx, str.An_internal_error_has_occurred_in_the_debugger_engine._nContinue_running_the_script_without_the_debugger_
call fcn.0040af12
pop edi
pop esi
pop ebp
mov esp, ebp
pop ebp
ret
Function at 0x40af59
Capabilities:
Encode data using base64

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov ebx, ecx
xor esi, esi
mov dword [esp + 0x10], ebx
mov ebp, edx
cmp edi, 0xffffffff
jne 0x40af7a
push ebp
call fcn.004a43f0
pop ecx
mov edi, eax
cmp edi, 2
jbe 0x40b003
lea eax, [ebx + 2]
xor edx, edx
mov dword [esp + 0x18], eax
lea eax, [edi - 3]
push 3
pop ecx
div ecx
mov ebx, dword [esp + 0x18]
lea edx, [eax + 1]
mov esi, edx
shl esi, 2
movzx ecx, byte [ebp]
sub edi, 3
movzx eax, byte [ebp + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp + 2]
shl ecx, 8
add ebp, 3
or ecx, eax
mov eax, ecx
shr eax, 0x12
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx - 2], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx - 1], al
mov eax, ecx
shr eax, 6
and ecx, 0x3f
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx], al
lea ebx, [ebx + 4]
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx - 3], al
sub edx, 1
jne 0x40afa0
mov ebx, dword [esp + 0x10]
test edi, edi
je 0x40b05d
movzx ecx, byte [ebp]
shl ecx, 0x10
cmp edi, 1
jbe 0x40b01c
movzx eax, byte [ebp + 1]
shl eax, 8
or ecx, eax
mov eax, ecx
shr eax, 0x12
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ebx], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ebx + 1], al
cmp edi, 1
jbe 0x40b04f
shr ecx, 6
and ecx, 0x3f
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x40b051
mov al, 0x3d
mov byte [esi + ebx + 2], al
mov byte [esi + ebx + 3], 0x3d
add esi, 4
pop edi
mov byte [esi + ebx], 0
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40c760
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b711d
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov eax, dword [0x4e9e6c]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test eax, eax
je 0x40c7a0
push str.stdout
push esi
mov ecx, 0x4e9e20
call fcn.0040a9ba
mov eax, dword [0x4e9e6c]
cmp eax, 2
je 0x40c926
mov eax, dword [0x4ea764]
mov dword [ebp - 0x44], vtable.TextStream.0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
cmp eax, 0xffffffff
je 0x40c7f9
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x34], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
neg eax
sbb al, al
and byte [ebp - 0x2a], al
mov dword [ebp - 0x44], vtable.TextFile.0
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x44]
push dword [edi + 0x6d0]
push 2
push dword [ebp + 0x10]
call fcn.0047ec70
push dword [ebp + 0xc]
lea ecx, [ebp - 0x44]
push esi
call fcn.0047f460
mov edx, dword [ebp - 0x3c]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
test edx, edx
je 0x40c873
cmp dword [ebp - 0x18], 0
jne 0x40c873
mov eax, dword [ebp - 0x44]
mov eax, dword [eax + 0x10]
cmp eax, fcn.0047f8a0
jne 0x40c865
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push edx
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call edi
jmp 0x40c86e
push edx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x44]
call eax
xor edx, edx
mov dword [ebp - 0x3c], edx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov word [ebp - 0x1c], ax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax + 8]
cmp eax, fcn.0047f840
jne 0x40c8b1
mov ecx, dword [ebp - 0x10]
cmp ecx, 0xffffffff
je 0x40c8bc
mov eax, dword [ebp - 0x40]
and eax, 0x10000003
cmp eax, 0x10000000
je 0x40c8a9
push ecx
call esi
mov edx, dword [ebp - 0x3c]
or ecx, 0xffffffff
mov dword [ebp - 0x10], ecx
jmp 0x40c8bc
lea ecx, [ebp - 0x44]
call eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x44], vtable.TextFile.0
test edx, edx
je 0x40c8eb
cmp dword [ebp - 0x18], 0
jne 0x40c8eb
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push edx
push dword [ebp - 0x14]
push ecx
call edi
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x3c], 0
xor eax, eax
mov word [ebp - 0x1c], ax
cmp ecx, 0xffffffff
je 0x40c90f
mov eax, dword [ebp - 0x40]
and eax, 0x10000003
cmp eax, 0x10000000
je 0x40c908
push ecx
call esi
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x44], vtable.TextStream.0
test eax, eax
je 0x40c926
push eax
call fcn.0049f942
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40e8c0
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x4000
call fcn.004b5e80
push ebp
push esi
mov esi, dword [esp + 0x4018]
push edi
mov edi, ecx
test esi, esi
jne 0x40e8f3
mov esi, dword [edi + 0x640]
test esi, esi
jne 0x40e8f3
mov ecx, dword [edi + 0x278]
movzx eax, word [edi + 0x27c]
jmp 0x40e8fb
movzx ecx, word [esi + 2]
movzx eax, word [esi + 4]
mov ebp, dword [esp + 0x4010]
test ebp, ebp
je 0x40e9e5
push ebx
push dword [esp + 0x4018]
movzx eax, ax
push str.Warning:
push eax
mov eax, dword [0x4e8fe8]
movzx ecx, cx
push dword [eax + ecx*4]
lea eax, [esp + 0x20]
push str._s___d__:____s_s_n
push 0x2000
push eax
call fcn.00481690
mov ebx, eax
add esp, 0x1c
mov eax, dword [esp + 0x401c]
cmp word [eax], 0
je 0x40e96c
push eax
mov ecx, 0x2000
lea eax, [esp + 0x14]
push str._____Specifically:__s_n
sub ecx, ebx
lea eax, [eax + ebx*2]
push ecx
push eax
call fcn.00481690
add esp, 0x10
add ebx, eax
cmp ebp, 3
jne 0x40e990
push 0x4d2a68
push ebx
lea eax, [esp + 0x18]
mov ecx, edi
push eax
call fcn.0040c760
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x4000
ret 0x10
mov eax, dword [0x4e9e68]
test eax, eax
je 0x40e9b2
push str.stderr
lea eax, [esp + 0x14]
mov ecx, 0x4e9e20
push eax
call fcn.0040a9ba
mov eax, dword [0x4e9e68]
cmp eax, 2
je 0x40e9c2
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp ebp, 2
jne 0x40e9e4
push 0
push esi
push dword [esp + 0x4024]
mov ecx, 0x4e9ec0
push 1
push dword [esp + 0x4028]
call fcn.0040d630
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x4000
ret 0x10