joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101862b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x2c
call fcn.1005da00
mov eax, dword [0x10288294]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x18], eax
push ebx
push ebp
movzx ebx, byte [eax]
lea ebp, [eax + 1]
mov edx, ebp
shl ebx, 0x18
push esi
push edi
mov edi, dword [esp + 0x54]
movzx eax, byte [edx]
movzx ecx, byte [edx + 3]
shl eax, 0x10
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
mov esi, dword [edi]
movzx eax, byte [edx + 2]
or ebx, eax
mov dword [esp + 0x1c], edi
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [esp + 0x24], ebp
movzx eax, byte [edx + 6]
mov dword [esp + 0x14], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [esp + 0x14]
shl ecx, 8
or ecx, eax
mov dword [esp + 0x14], ebx
mov eax, ebx
mov byte [esp + 0x2f], bl
shr eax, 0x18
or edx, ecx
mov byte [esp + 0x2c], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x32], al
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], edx
mov byte [esp + 0x33], dl
test eax, eax
je 0x10186475
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x40]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
nop dword [eax]
dec eax
mov dword [esp + 0x48], eax
test esi, esi
jne 0x10186405
push dword [esp + 0x20]
lea eax, [esp + 0x18]
push eax
call fcn.10185cc0
mov ebx, dword [esp + 0x1c]
add esp, 8
mov edx, dword [esp + 0x18]
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ebx
mov ecx, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
inc ebp
mov byte [esp + 0x2f], bl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov al, byte [esp + esi + 0x2c]
inc esi
xor al, byte [edi]
and esi, 7
mov byte [ecx + edi], al
inc edi
mov eax, dword [esp + 0x48]
test eax, eax
jne 0x101863a0
test ebp, ebp
mov ebp, dword [esp + 0x24]
je 0x1018645c
mov ecx, dword [esp + 0x28]
mov eax, ebx
shr eax, 0x18
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp], al
mov eax, ebx
shr eax, 8
mov byte [ebp + 1], al
mov eax, edx
shr eax, 0x18
mov byte [ebp + 2], bl
mov byte [ebp + 3], al
mov eax, edx
shr eax, 0x10
mov byte [ebp + 4], al
mov eax, edx
shr eax, 8
mov byte [ebp + 5], al
mov byte [ebp + 6], dl
mov eax, dword [esp + 0x1c]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.1005d919
add esp, 0x2c
ret
mov ecx, dword [esp + 0x38]
mov dword [edi], esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1005d919
add esp, 0x2c
ret
Function at 0x10189ee0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, 0x98
call fcn.1005da00
mov eax, dword [0x10288294]
xor eax, esp
mov dword [esp + 0x94], eax
mov ecx, dword [esp + 0xa8]
push edi
mov edi, dword [esp + 0xa0]
mov dword [esp + 4], edi
mov eax, dword [ecx]
mov dword [esp + 0x68], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x6c], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x70], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x74], eax
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x78], eax
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x7c], eax
mov eax, dword [ecx + 0x18]
mov dword [esp + 0x80], eax
mov eax, dword [ecx + 0x1c]
mov ecx, dword [esp + 0xb0]
mov dword [esp + 0x84], eax
mov dword [esp + 0x58], 0x61707865
mov dword [esp + 0x5c], 0x3320646e
mov eax, dword [ecx]
mov dword [esp + 0x88], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x8c], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x90], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x60], 0x79622d32
mov dword [esp + 0x64], 0x6b206574
test eax, eax
je 0x1018a0dd
push ebx
mov ebx, dword [esp + 0xa8]
push ebp
push esi
nop
mov esi, 0x40
cmp eax, esi
cmovb esi, eax
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x24], esi
push eax
call fcn.1018a100
add esp, 8
xor eax, eax
test esi, esi
je 0x1018a0ac
cmp esi, 0x20
jb 0x1018a084
lea edx, [edi - 1]
lea ecx, [esp + esi + 0x23]
add edx, esi
cmp edi, ecx
ja 0x10189ffc
lea ecx, [esp + 0x24]
cmp edx, ecx
jae 0x1018a084
lea ecx, [ebx - 1]
add ecx, esi
cmp edi, ecx
ja 0x1018a009
cmp edx, ebx
jae 0x1018a084
mov ebp, esi
lea edx, [edi + 0x10]
lea esi, [esp + 0x24]
mov ecx, ebx
sub ecx, esi
and ebp, 0xffffffe0
mov dword [esp + 0x14], ecx
mov ecx, edi
sub ecx, esi
mov dword [esp + 0x18], ecx
mov ecx, ebx
mov ebx, dword [esp + 0x14]
sub ecx, edi
mov esi, dword [esp + 0x18]
mov edi, ecx
mov dword [esp + 0x1c], ecx
nop word [eax + eax]
movups xmm0, xmmword [esp + eax + 0x24]
lea ecx, [ebx + eax]
movups xmm1, xmmword [esp + ecx + 0x24]
lea ecx, [esi + eax]
lea edx, [edx + 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [esp + eax + 0x34]
add eax, 0x20
movups xmmword [esp + ecx + 0x24], xmm1
movups xmm1, xmmword [edi + edx - 0x20]
pxor xmm1, xmm0
movups xmmword [edx - 0x20], xmm1
cmp eax, ebp
jb 0x1018a040
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0xb0]
cmp eax, esi
jae 0x1018a0ac
lea ecx, [esp + 0x24]
mov ebp, edi
sub ebx, ecx
sub ebp, ecx
lea edx, [esp + 0x24]
add edx, eax
inc eax
mov cl, byte [ebx + edx]
xor cl, byte [edx]
mov byte [edx + ebp], cl
cmp eax, esi
jb 0x1018a092
mov ebx, dword [esp + 0xb0]
mov eax, dword [esp + 0xb4]
add edi, esi
inc dword [esp + 0x94]
sub eax, esi
add ebx, esi
mov dword [esp + 0x10], edi
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], eax
test eax, eax
jne 0x10189fb0
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x98]
pop edi
xor ecx, esp
call fcn.1005d919
add esp, 0x98
ret
Function at 0x1018ca40
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x1018ca54
mov dword [esp + 0x18], fcn.1018b220
jmp fcn.1017c990
mov dword [esp + 0x18], fcn.1018a4c0
jmp fcn.1017c6d0
Function at 0x4016b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46d228
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x48c06c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x2c], ebx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x24], eax
test ecx, ecx
jne 0x4016f7
xor al, al
jmp 0x4017eb
test eax, eax
jne 0x4016ff
xor esi, esi
jmp 0x401702
mov esi, dword [eax + 4]
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
push 0x20
push 0
inc esi
movq qword [ebp - 0x20], xmm0
call fcn.0044b0ea
mov edi, eax
mov dword [ebp - 0x18], 0x20
add esp, 8
mov dword [ebp - 0x20], edi
mov al, byte [ebp + 0xc]
mov dword [ebp - 4], 0
movzx ecx, word [ebx]
mov ebx, 0xb
mov word [edi], cx
mov dword [edi + 2], 0x10001
mov dword [edi + 6], esi
mov byte [edi + 0xa], al
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], ebx
test eax, eax
je 0x40179c
mov ecx, dword [eax + 4]
mov eax, dword [eax]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
lea ebx, [ecx + 0xb]
cmp ebx, 0x20
jbe 0x40178b
mov esi, 0x40
cmp ebx, esi
cmova esi, ebx
push esi
push edi
call fcn.0044b0ea
mov ecx, dword [ebp - 0x24]
mov edi, eax
mov eax, dword [ebp - 0x28]
add esp, 8
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x18], esi
push ecx
push eax
lea eax, [edi + 0xb]
push eax
call fcn.004471a0
add esp, 0xc
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x2c]
cmp byte [eax + 2], 1
jne 0x4017a8
inc word [eax]
mov eax, dword [ebp - 0x30]
push 0
push ebx
push edi
push dword [eax]
call dword [sym.imp.WS2_32.dll_send]
mov ebx, eax
test ebx, ebx
jns 0x4017da
cmp byte [0x48ca80], 0
je 0x4017d0
mov ecx, str.error_while_sending_data
call fcn.00403510
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
neg ebx
push edi
call fcn.0044b0f5
shr ebx, 0x1f
add esp, 4
xor bl, 1
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042f1ff
mov esp, ebp
pop ebp
ret 0xc
Function at 0x401810
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x48c06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push 0
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x10]
push 0xb
push ecx
push dword [eax]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jns 0x40185e
cmp byte [0x48ca80], 0
je 0x401856
mov ecx, str.error_while_recieving_data
call fcn.00403510
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
neg eax
cmp eax, 0xffffd8ba
je 0x40197c
cmp eax, 0xffffd8bb
je 0x40197c
test eax, eax
je 0x40197c
push ebx
push esi
mov esi, dword [ebp - 0xa]
dec esi
push edi
lea edi, [esi + 0xb]
push edi
mov dword [ebp - 0x14], edi
call fcn.0042f70a
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4018a6
push edi
push 0
push ebx
call fcn.00447720
add esp, 0xc
jmp 0x4018a8
xor ebx, ebx
movq xmm0, qword [ebp - 0x10]
lea edi, [ebx + 0xb]
movq qword [ebx], xmm0
mov ax, word [ebp - 8]
mov word [ebx + 8], ax
mov al, byte [ebp - 6]
mov byte [ebx + 0xa], al
test esi, esi
je 0x401910
mov eax, dword [ebp - 0x18]
push 0
push dword [ebp - 0x14]
push edi
push dword [eax]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jns 0x4018f6
cmp byte [0x48ca80], 0
je 0x4018ee
mov ecx, str.error_while_recieving_data
call fcn.00403510
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
neg eax
cmp eax, 0xffffd8ba
je 0x40195e
cmp eax, 0xffffd8bb
je 0x40195e
test eax, eax
je 0x40195e
jle 0x401910
add edi, eax
sub esi, eax
jne 0x4018c6
mov esi, dword [ebp - 0x14]
push esi
call fcn.0044eb94
mov ecx, dword [ebp - 0x1c]
push esi
push ebx
push eax
mov dword [ecx], eax
mov dword [ecx + 8], esi
mov dword [ecx + 4], 0
call fcn.004471a0
push ebx
call fcn.0042f210
mov ecx, dword [ebp - 0x20]
add esp, 0x14
cmp byte [ecx + 2], 0
jne 0x401949
mov ax, word [ebp - 0x10]
mov word [ecx], ax
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042f1ff
mov esp, ebp
pop ebp
ret 8
push ebx
call fcn.0042f210
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042f1ff
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.0042f1ff
mov esp, ebp
pop ebp
ret 8
Function at 0x4067d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46d7d0
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x6c
push esi
mov eax, dword [0x48c06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea esi, [ecx + 0x10]
push esi
lea ecx, [ebp - 0x70]
call fcn.00406b90
movss xmm0, dword [ebx + 0x10]
lea eax, [ebp - 0x70]
movaps xmm1, xmm0
movss xmm2, dword [esi + 0x18]
mulss xmm1, dword [esi + 0x20]
mov ecx, esi
push eax
movss xmm3, dword [esi + 0x1c]
movss xmm4, dword [esi + 0x10]
movss dword [ebp - 0x18], xmm1
movss xmm1, dword [esi + 0x24]
mulss xmm1, xmm0
movss xmm5, dword [esi]
movss xmm6, dword [esi + 8]
movss dword [ebp - 0x1c], xmm1
movss xmm1, dword [esi + 0x28]
mulss xmm1, xmm0
movss xmm7, dword [esi + 0xc]
movss dword [ebp - 0x20], xmm1
movss xmm1, dword [esi + 0x2c]
mulss xmm1, xmm0
movss xmm0, dword [ebx + 0xc]
mulss xmm2, xmm0
mulss xmm3, xmm0
movss dword [ebp - 0x24], xmm1
movss xmm1, dword [esi + 0x14]
mulss xmm1, xmm0
mulss xmm4, xmm0
movss xmm0, dword [ebx + 8]
mulss xmm5, xmm0
mulss xmm6, xmm0
movss dword [ebp - 0x14], xmm5
movss xmm5, dword [esi + 4]
mulss xmm5, xmm0
addss xmm6, xmm2
movss xmm2, dword [esi + 0x34]
mulss xmm7, xmm0
movss xmm0, dword [ebp - 0x14]
addss xmm5, xmm1
addss xmm6, dword [ebp - 0x20]
movss xmm1, dword [esi + 0x38]
addss xmm0, xmm4
addss xmm7, xmm3
movss xmm3, dword [esi + 0x30]
addss xmm5, dword [ebp - 0x1c]
addss xmm1, xmm6
addss xmm0, dword [ebp - 0x18]
addss xmm7, dword [ebp - 0x24]
addss xmm2, xmm5
movss dword [ebp - 0x38], xmm1
addss xmm3, xmm0
movss xmm0, dword [esi + 0x3c]
addss xmm0, xmm7
movss dword [ebp - 0x3c], xmm2
movss dword [ebp - 0x40], xmm3
movss dword [ebp - 0x34], xmm0
call fcn.00406cd0
push fcn.00406390
push 4
push 0x10
lea eax, [ebp - 0x70]
mov dword [ebp - 4], 0
push eax
call fcn.0042f973
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
Function at 0x408af0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push 0x60
push 0
push edi
call fcn.00447720
mov eax, dword [esi]
add esp, 0xc
mov dword [edi], eax
mov ecx, esi
mov al, byte [esi + 0x50]
mov byte [edi + 4], al
mov eax, dword [esi + 0x40]
mov dword [edi + 5], eax
mov eax, dword [esi + 0x44]
mov dword [edi + 9], eax
mov eax, dword [esi + 0x48]
mov dword [edi + 0xd], eax
call fcn.004065a0
movss dword [edi + 0x11], xmm0
xor ecx, ecx
mov eax, dword [esi + 8]
movss xmm0, dword [eax]
movss xmm1, dword [eax + 4]
movss xmm2, dword [eax + 8]
movss dword [edi + 0x29], xmm1
xorps xmm1, xmm1
movss dword [edi + 0x2d], xmm2
xorps xmm2, xmm2
movss dword [edi + 0x25], xmm0
mov eax, dword [esi + 4]
mov dword [edi + 0x31], eax
movups xmm0, xmmword [esi + 0x51]
movups xmmword [edi + 0x15], xmm0
nop word [eax + eax]
movups xmm0, xmmword [edi + ecx]
pxor xmm1, xmm0
movups xmm0, xmmword [edi + ecx + 0x10]
add ecx, 0x20
pxor xmm2, xmm0
cmp ecx, 0x40
jb 0x408b70
pxor xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
pxor xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
pxor xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 2
pxor xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 1
pxor xmm1, xmm0
movd eax, xmm1
cmp ecx, 0x5f
jae 0x408bcf
xor al, byte [ecx + edi]
inc ecx
cmp ecx, 0x5f
jb 0x408bc6
mov byte [edi + 0x5f], al
mov eax, edi
pop edi
pop esi
pop ebp
ret 4

Function at 0x40cb40
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi + 4]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 5]
xor edx, eax
movzx eax, byte [esi + 6]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 7]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
add edx, ecx
imul eax, edx, 0x1000193
and eax, dword [edi + 0x18]
pop edi
pop esi
pop ebp
ret 4
Function at 0x40de30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea edi, [eax - 1]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edi
mov esi, ecx
sar edi, 1
mov ebx, edx
mov ecx, edx
cmp edx, edi
jge 0x40de80
add ecx, ecx
xor eax, eax
movss xmm0, dword [esi + ecx*8 + 0xc]
comiss xmm0, dword [esi + ecx*8 + 0x14]
seta al
xor eax, 1
inc eax
add ecx, eax
mov eax, dword [esi + ecx*8]
mov dword [esi + edx*8], eax
mov eax, dword [esi + ecx*8 + 4]
mov dword [esi + edx*8 + 4], eax
mov edx, ecx
cmp ecx, edi
jl 0x40de51
mov eax, dword [ebp - 4]
cmp ecx, edi
jne 0x40de9d
test al, 1
jne 0x40de9d
mov eax, dword [esi + eax*8 - 8]
mov dword [esi + edx*8], eax
mov eax, dword [ebp - 4]
mov eax, dword [esi + eax*8 - 4]
mov dword [esi + edx*8 + 4], eax
mov edx, dword [ebp - 8]
mov edi, dword [ebp + 0xc]
cmp ebx, edx
jge 0x40dec9
movss xmm0, dword [edi + 4]
lea ecx, [edx - 1]
sar ecx, 1
comiss xmm0, dword [esi + ecx*8 + 4]
jbe 0x40dec9
mov eax, dword [esi + ecx*8]
mov dword [esi + edx*8], eax
mov eax, dword [esi + ecx*8 + 4]
mov dword [esi + edx*8 + 4], eax
mov edx, ecx
cmp ebx, ecx
jl 0x40dea4
mov eax, dword [edi]
mov dword [esi + edx*8], eax
mov eax, dword [edi + 4]
pop edi
mov dword [esi + edx*8 + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x410ba0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 8], edx
push ebx
push esi
mov esi, ecx
push edi
test eax, eax
jne 0x410bca
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov eax, esi
mov dword [esi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 4]
mov dword [ebp - 4], 0
mov ecx, eax
call fcn.00410b30
test eax, eax
je 0x410bf8
mov dword [esi], eax
mov eax, esi
mov dword [esi + 8], 0
mov dword [esi + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 4]
lea eax, [ebx + 1]
push eax
mov dword [ebp - 4], eax
call fcn.0044eb94
mov edi, eax
add esp, 4
test edi, edi
jne 0x410c25
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov eax, esi
mov dword [esi], 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
push ebx
push 1
push edi
call fcn.00454b99
add esp, 0x10
cmp eax, ebx
je 0x410c5e
push edi
call fcn.0044b0f5
add esp, 4
mov dword [esi + 8], 0
mov dword [esi], 2
mov eax, esi
mov dword [esi + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
mov edx, edi
xor ecx, ecx
call fcn.0040f6f0
add esp, 4
cmp eax, 1
jne 0x410c77
mov byte [edi + ebx], 0
mov ebx, dword [ebp - 4]
push dword [ebp + 0x14]
sub esp, 8
push eax
mov eax, dword [ebp - 8]
mov edx, eax
push ecx
push ebx
push edi
push eax
mov ecx, esi
call fcn.00410910
add esp, 0x20
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41ba80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x41bab1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x41baa0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x426f60
Capabilities:
Initialize winsock library
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x48c06c]
xor eax, esp
mov dword [esp + 0x194], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x426f9f
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.0042f1ff
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push ecx
push eax
push ecx
mov edx, str.WinSock2_initialization_error__
mov ecx, 0x48e550
call fcn.00405620
add esp, 4
mov ecx, eax
call fcn.00403970
push ecx
mov edx, 0x4802e0
mov ecx, eax
call fcn.00405620
add esp, 4
mov ecx, eax
call fcn.00403b20
push 1
call fcn.004551f6
int3
Function at 0x42b7f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46f2c1
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x48c06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.0042b3d0
mov esi, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
lea edx, [esi + 0x10]
mov word [esi + 0xc], 0
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp + 8]
lea edi, [edx + 8]
mov byte [ebp - 4], 1
mov dword [ebp - 0x20], edi
mov eax, dword [ecx]
add ecx, 8
mov dword [ebp + 8], ecx
push ecx
mov ecx, edi
mov dword [edx], eax
call fcn.004038a0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [ecx + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [ecx + 0x20]
mov dword [edi + 0x20], eax
mov eax, esi
movsd xmm0, qword [ecx + 0x28]
movsd qword [edi + 0x28], xmm0
movups xmm0, xmmword [ecx + 0x30]
movups xmmword [edi + 0x30], xmm0
movups xmm0, xmmword [ecx + 0x40]
movups xmmword [edi + 0x40], xmm0
movups xmm0, xmmword [ecx + 0x50]
movups xmmword [edi + 0x50], xmm0
movups xmm0, xmmword [ecx + 0x60]
movups xmmword [edi + 0x60], xmm0
movups xmm0, xmmword [ecx + 0x70]
movups xmmword [edi + 0x70], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42c0a9
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x46f38f
call fcn.0042fd63
mov edi, ecx
mov dword [ebp - 0x30], edi
xor ebx, ebx
cmp dword [edi + 0x38], ebx
je 0x42c1d3
cmp byte [edi + 0x3d], bl
je 0x42c1d3
mov eax, dword [edi]
push 0xffffffffffffffff
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.0042fd03
mov ecx, edi
call esi
cmp eax, 0xffffffff
jne 0x42c0ec
xor al, al
jmp 0x42c1d5
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.00404460
lea eax, [edi + 0x40]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
lea esi, [ebp - 0x28]
mov dword [ebp - 0x2c], esi
cmp ecx, 0x10
jb 0x42c121
mov dword [ebp - 0x2c], eax
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x42c12b
mov edx, eax
mov edi, dword [edi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x2c]
mov esi, dword [edi]
push eax
push edx
push dword [ebp - 0x34]
mov ecx, dword [esi + 0x20]
call fcn.0042fd03
mov ecx, edi
call dword [esi + 0x20]
sub eax, ebx
je 0x42c15a
sub eax, 1
jne 0x42c1b8
mov edi, dword [ebp - 0x30]
jmp 0x42c160
mov edi, dword [ebp - 0x30]
mov byte [edi + 0x3d], bl
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, 0x10
jb 0x42c170
mov edx, eax
mov esi, dword [ebp - 0x38]
sub esi, edx
je 0x42c19a
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x42c181
mov edx, eax
push dword [edi + 0x4c]
push esi
push 1
push edx
call fcn.0045436f
add esp, 0x10
cmp esi, eax
jne 0x42c1c3
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
cmp byte [edi + 0x3d], 0
je 0x42c1c1
test esi, esi
jne 0x42c113
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.004045a0
jmp 0x42c10d
dec eax
sub eax, 1
jne 0x42c1c7
inc eax
jmp 0x42c1c5
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [ebp - 0x28]
call fcn.00402200
mov al, bl
jmp 0x42c1d5
mov al, 1
call fcn.0042fd1e
ret