joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4036ad
Capabilities:
Create pipe
Get common file path
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x50f588]
mov ecx, dword [0x50e4dc]
sub esp, 0x834
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x4037a5
mov ebx, ecx
mov dword [ebp - 4], eax
cmp dword [0x50f588], 0x959
jne 0x403793
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
xor eax, eax
mov word [ebp - 8], ax
lea edi, [ebp - 6]
stosw word es:[edi], ax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
push esi
push esi
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x402cb0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push esi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0x402d00
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push esi
push esi
push esi
push esi
push esi
push esi
push 0x402d40
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
lea eax, [ebp - 0x830]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
call fcn.004034c9
add ebx, 8
dec dword [ebp - 4]
jne 0x4036d6
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40557b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45e494]
jne 0x405585
repz ret
jmp fcn.00408d9c

Function at 0x40abbb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406b46
and dword [ebp - 4], 0
cmp dword [0x460108], 0
mov ebx, eax
jne 0x40ac6c
push 0x4021ac
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40ad1d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4021a0
push edi
call esi
test eax, eax
je 0x40ad1d
push eax
call fcn.00406ad4
mov dword [esp], 0x402190
push edi
mov dword [0x460108], eax
call esi
push eax
call fcn.00406ad4
mov dword [esp], 0x40217c
push edi
mov dword [0x46010c], eax
call esi
push eax
call fcn.00406ad4
mov dword [esp], 0x402160
push edi
mov dword [0x460110], eax
call esi
push eax
call fcn.00406ad4
pop ecx
mov dword [0x460118], eax
test eax, eax
je 0x40ac6c
push 0x402148
push edi
call esi
push eax
call fcn.00406ad4
pop ecx
mov dword [0x460114], eax
mov eax, dword [0x460114]
cmp eax, ebx
je 0x40acc4
cmp dword [0x460118], ebx
je 0x40acc4
push eax
call fcn.00406b4f
push dword [0x460118]
mov esi, eax
call fcn.00406b4f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40acc4
test edi, edi
je 0x40acc4
call esi
test eax, eax
je 0x40acbb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40acbb
test byte [ebp - 0xc], 1
jne 0x40acc4
or dword [ebp + 0x10], 0x200000
jmp 0x40acfd
mov eax, dword [0x46010c]
cmp eax, ebx
je 0x40acfd
push eax
call fcn.00406b4f
pop ecx
test eax, eax
je 0x40acfd
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40acfd
mov eax, dword [0x460110]
cmp eax, ebx
je 0x40acfd
push eax
call fcn.00406b4f
pop ecx
test eax, eax
je 0x40acfd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x460108]
call fcn.00406b4f
pop ecx
test eax, eax
je 0x40ad1d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40ad1f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a3aa
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
neg eax
fcomp dword [ebx]
rcl byte [ecx + 0x23], 0xc2
push eax
mov eax, dword [esp + 0x68]
push eax
call dword [0x48111c]
mov dword [esp + 0x44], ebx
lea ecx, [esp + 0x44]

Function at 0x415de8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, ebx
mov ecx, dword [esp + 0x14]
sub edi, esi
push 0
neg edi
sbb edi, edi
and edi, ebx
push edi
call fcn.004286b1
mov ebp, eax
int3
add byte [eax], al
push ecx
mov ecx, dword [esp + 0xac]
push edx
mov edx, dword [esp + 0xc8]
push ebx
push 0
push eax
push ebp
push ecx
push edx
call dword [esp + 0x5c]
mov esi, eax
xor ebp, ebp
cmp esi, ebp
mov dword [0x553c9c], ebp
mov dword [esp + 0x18], esi
je 0x415f75
mov eax, dword [esi + 0x1c]
cmp eax, ebp
mov dword [esp + 0x9c], eax
je 0x415f75
push eax
call dword [0x4815e0]
test eax, eax
je 0x415f75
mov eax, dword [esp + 0xec]
mov dword [esp + 0x10], ebp
mov dword [esi + 0xd8], eax
jmp 0x415ead
test esi, esi
je 0x415f9a
mov ecx, dword [esp + 0x48]
push edi
mov dword [ecx], esi
lea ecx, [esp + 0x58]
call fcn.0041c735
push esi
lea ecx, [esp + 0x80]
call fcn.0041c742
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x30]
dec eax
mov dword [esp + 0x1c], eax
mov ebx, eax
test ebx, ebx
jg 0x415c2b
mov eax, dword [esp + 0x78]
mov esi, dword [esp + 0x70]
neg eax
mov eax, dword [esp + 0x28]
cmp eax, ebp
je 0x415f84
push eax
call dword [0x48151c]
cmp ebx, ebp
je 0x415f8f
push ebx
call dword [0x4815b0]
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx]
call dword [edx + 8]
jmp 0x415fc1
mov eax, dword [esp + 0x28]
test eax, eax
je 0x415fa9
push eax
call dword [0x48151c]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x415fb8
push eax
call dword [0x4815b0]
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx]
call dword [eax + 8]
mov esi, 0x5249c0
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], esi
call fcn.0041c743
lea ecx, [esp + 0x68]
mov dword [esp + 0x68], esi
call fcn.0041c750
lea ecx, [esp + 0x7c]
mov dword [esp + 0x7c], esi
call fcn.0041c75d
lea ecx, [esp + 0x54]
mov dword [esp + 0x54], esi
call fcn.0041c76a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xd4
ret 0x14

Function at 0x41c55a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and al, 0x14
call 0x492242
mov eax, dword [ebx + 0x5c]
pop esp
cmp eax, esi
je 0x41c8c9
cmp dword [ebx + 0xec], esi
jne 0x41c58e
mov ecx, eax
cmp ecx, esi
jne 0x41c57e
xor ecx, ecx
jmp 0x41c581
mov ecx, dword [ebx + 0x54]
push eax
push ecx
call fcn.00442708
mov dword [ebx + 0xec], eax
mov eax, dword [ebx + 0xec]
invalid

Function at 0x424c9a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
jl 0x424d13
cmp eax, 8
jg 0x424d13
cmp dword [esp + 0x34], 2
jl 0x424d13
call fcn.00449543
mov ebp, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
test ebp, ebp
jg 0x424cc3
test ecx, ecx
jle 0x424d13
mov edi, dword [esp + 0x38]
test edi, edi
je 0x424d1f
cmp dword [edi], 0
jge 0x424cd6
mov dword [esp + 0x10], ebp
mov dword [esp + 0x38], ecx
Function at 0x424cd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
jge 0x424ce4
mov dword [edi + 4], 0
cmp dword [edi + 8], ebp
jle 0x424cec
mov dword [edi + 8], ebp
cmp dword [edi + 0xc], ecx
jle 0x424cf4
mov dword [edi + 0xc], ecx
mov ebp, dword [edi + 8]
mov ebx, dword [edi]
mov ecx, dword [edi + 0xc]
mov edx, dword [edi + 4]
sub ebp, ebx
sub ecx, edx
test ebp, ebp
mov dword [esp + 0x10], ebp
adc byte [ecx + 0x7e38244c], cl
invalid
test ecx, ecx
jg 0x424d27
lea eax, [ebp*4]
lea ebx, [esi + 0x58]
mov dword [esp + 0x14], eax
imul eax, ecx
push eax
mov ecx, ebx
mov dword [esp + 0x1c], eax
call fcn.0042b2d4
test eax, eax
je 0x424d13
mov ecx, dword [ebx + 0x10]
mov eax, dword [esi + 0x68]
test ecx, ecx
jne 0x424d56
xor ebx, ebx
jmp 0x424d59
mov ebx, dword [ebx + 8]
push eax
push ebx
call fcn.0042bc70
mov eax, dword [esp + 0x3c]
add esp, 8
mov dword [esi + 0x8c], eax
lea ebx, [esi + 0x78]
shl eax, 2
push eax

Function at 0x424cd8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
jge 0x424ce4
mov dword [edi + 4], 0
cmp dword [edi + 8], ebp
jle 0x424cec
mov dword [edi + 8], ebp
cmp dword [edi + 0xc], ecx
jle 0x424cf4
mov dword [edi + 0xc], ecx
mov ebp, dword [edi + 8]
mov ebx, dword [edi]
mov ecx, dword [edi + 0xc]
mov edx, dword [edi + 4]
sub ebp, ebx
sub ecx, edx
test ebp, ebp
mov dword [esp + 0x10], ebp
adc byte [ecx + 0x7e38244c], cl
invalid
test ecx, ecx
jg 0x424d27
lea eax, [ebp*4]
lea ebx, [esi + 0x58]
mov dword [esp + 0x14], eax
imul eax, ecx
push eax
mov ecx, ebx
mov dword [esp + 0x1c], eax
call fcn.0042b2d4
test eax, eax
je 0x424d13
mov ecx, dword [ebx + 0x10]
mov eax, dword [esi + 0x68]
test ecx, ecx
jne 0x424d56
xor ebx, ebx
jmp 0x424d59
mov ebx, dword [ebx + 8]
push eax
push ebx
call fcn.0042bc70
mov eax, dword [esp + 0x3c]
add esp, 8
mov dword [esi + 0x8c], eax
lea ebx, [esi + 0x78]
shl eax, 2
push eax

Function at 0x4256ae
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x7c]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ecx, dword [eax + 8]
mov dword [esp + 0x6c], ecx
sub ecx, esi
mov ebx, dword [eax + 0xc]
mov dword [esp + 0x7c], ecx
test ecx, ecx
mov dword [esp + 0x70], ebx
jle 0x4258a1
sub ebx, edi
test ebx, ebx
mov dword [esp + 0x20], ebx
jle 0x4258a1
mov eax, dword [esp + 0x80]
test eax, eax
je 0x425707
mov edx, dword [eax]
mov dword [esp + 0x44], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x4c], edx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x50], eax
xor edx, edx
push ebp
test ebx, ebx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x14], edx
jle 0x42588a
add byte [eax], al
mov ebp, dword [0x481570]
mov eax, ebx
mov dword [esp + 0x10], 0x32
xor al, byte [eax]
add byte [eax], al
sub eax, edx
cmp eax, 0x32
jg 0x425739
mov dword [esp + 0x10], eax
xor eax, eax
test ecx, ecx
jle 0x425871
mov ebx, dword [esp + 0x10]
add ebx, edx
mov dword [esp + 0x20], ebx
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x68
ret 0x1c
Function at 0x42572a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x7c]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ecx, dword [eax + 8]
mov dword [esp + 0x6c], ecx
sub ecx, esi
mov ebx, dword [eax + 0xc]
mov dword [esp + 0x7c], ecx
test ecx, ecx
mov dword [esp + 0x70], ebx
jle 0x4258a1
sub ebx, edi
test ebx, ebx
mov dword [esp + 0x20], ebx
jle 0x4258a1
mov eax, dword [esp + 0x80]
test eax, eax
je 0x425707
mov edx, dword [eax]
mov dword [esp + 0x44], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x4c], edx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x50], eax
xor edx, edx
push ebp
test ebx, ebx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x14], edx
jle 0x42588a
add byte [eax], al
mov ebp, dword [0x481570]
mov eax, ebx
mov dword [esp + 0x10], 0x32
xor al, byte [eax]
add byte [eax], al
sub eax, edx
cmp eax, 0x32
jg 0x425739
mov dword [esp + 0x10], eax
xor eax, eax
test ecx, ecx
jle 0x425871
mov ebx, dword [esp + 0x10]
add ebx, edx
mov dword [esp + 0x20], ebx
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x68
ret 0x1c

Function at 0x42572c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x7c]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ecx, dword [eax + 8]
mov dword [esp + 0x6c], ecx
sub ecx, esi
mov ebx, dword [eax + 0xc]
mov dword [esp + 0x7c], ecx
test ecx, ecx
mov dword [esp + 0x70], ebx
jle 0x4258a1
sub ebx, edi
test ebx, ebx
mov dword [esp + 0x20], ebx
jle 0x4258a1
mov eax, dword [esp + 0x80]
test eax, eax
je 0x425707
mov edx, dword [eax]
mov dword [esp + 0x44], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x4c], edx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x50], eax
xor edx, edx
push ebp
test ebx, ebx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x14], edx
jle 0x42588a
add byte [eax], al
mov ebp, dword [0x481570]
mov eax, ebx
mov dword [esp + 0x10], 0x32
xor al, byte [eax]
add byte [eax], al
sub eax, edx
cmp eax, 0x32
jg 0x425739
mov dword [esp + 0x10], eax
xor eax, eax
test ecx, ecx
jle 0x425871
mov ebx, dword [esp + 0x10]
add ebx, edx
mov dword [esp + 0x20], ebx
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x68
ret 0x1c

Function at 0x42577f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test eax, eax
je 0x425798
lea ecx, [esp + 0x48]
lea edx, [esp + 0x28]
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
call dword [0x481564]
adc eax, 0x481564
lea ecx, [esp + 0x28]
push ecx
call dword [0x4815a4]
test eax, eax
jne 0x425858
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x40], ecx
mov eax, edi
mov ecx, esi
mov dword [esp + 0x44], edx
Function at 0x425b15
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea ecx, [esp + 0x58]
mov dword [esp + 0xa0], 0xffffffff
mov dword [esp + 0x58], 0x5249c0
call fcn.0042c210
or al, 0x85
push dword [ecx - 0x75]
mov word [eax + eax*8], fs
rol byte [eax], 0
add byte [ebp - 0x2d7a00af], cl
jle 0x425b3b
mov eax, ebp
lea ecx, [esi + ebp - 4]
mov esi, dword [eax]
add eax, 4
mov dword [ecx], esi
sub ecx, 0x3f
movsd dword es:[edi], dword [esi]
ja 0x425b2e
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0xc8]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0xb4]
mov edi, dword [esp + 0xa8]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x10]
push ebx
push eax
mov dword [esp + 0x54], ecx
push ebp
push 1
lea ecx, [esp + 0x54]
mov dword [esp + 0x54], edx
mov edx, dword [esp + 0x48]
push esi
push ecx
mov ecx, dword [esp + 0x48]
push edi
mov dword [esp + 0x6c], edx
call fcn.0044b209
test eax, eax
je 0x425a84
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x48], edx
mov edx, dword [esp + 0x14]
push ebx
push ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x58], eax
push ebp
push edx
lea eax, [esp + 0x54]
push esi
push eax
push edi
call fcn.0044b23d
test eax, eax
je 0x425a84
push 0
push 0
push 0
push 0
call dword [0x481120]
mov ecx, dword [edi + 4]
push eax
push ecx
mov dword [esp + 0x1c], eax
call dword [0x4810a0]
mov esi, eax
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x8c], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x34]
dec esi
mov dword [esp + 0x84], eax
Function at 0x425b1d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea ecx, [esp + 0x58]
mov dword [esp + 0xa0], 0xffffffff
mov dword [esp + 0x58], 0x5249c0
call fcn.0042c210
or al, 0x85
push dword [ecx - 0x75]
mov word [eax + eax*8], fs
rol byte [eax], 0
add byte [ebp - 0x2d7a00af], cl
jle 0x425b3b
mov eax, ebp
lea ecx, [esi + ebp - 4]
mov esi, dword [eax]
add eax, 4
mov dword [ecx], esi
sub ecx, 0x3f
movsd dword es:[edi], dword [esi]
ja 0x425b2e
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0xc8]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0xb4]
mov edi, dword [esp + 0xa8]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x10]
push ebx
push eax
mov dword [esp + 0x54], ecx
push ebp
push 1
lea ecx, [esp + 0x54]
mov dword [esp + 0x54], edx
mov edx, dword [esp + 0x48]
push esi
push ecx
mov ecx, dword [esp + 0x48]
push edi
mov dword [esp + 0x6c], edx
call fcn.0044b209
test eax, eax
je 0x425a84
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x48], edx
mov edx, dword [esp + 0x14]
push ebx
push ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x58], eax
push ebp
push edx
lea eax, [esp + 0x54]
push esi
push eax
push edi
call fcn.0044b23d
test eax, eax
je 0x425a84
push 0
push 0
push 0
push 0
call dword [0x481120]
mov ecx, dword [edi + 4]
push eax
push ecx
mov dword [esp + 0x1c], eax
call dword [0x4810a0]
mov esi, eax
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x8c], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x34]
dec esi
mov dword [esp + 0x84], eax

Function at 0x429f2f
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
call fcn.0042b3a7
jmp 0x429f20
and eax, 0
sub esp, 0x18
push esi
mov esi, ecx
mov eax, dword [esi + 0x40]
cmp eax, 0xffffffff
clc
dec dword [edi]
invalid
sahf
add byte [eax], al
invalid
lea ecx, [esp + 4]
push ecx
push 0x4004667f
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x429fd5
mov ecx, dword [esp + 4]
mov eax, 1
cmp ecx, eax

Function at 0x42a265
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
sub esp, 0x28
push ebx
push edi
mov edi, ecx
or ebx, 0xffffffff
cmp dword [edi + 0x40], ebx
jne 0x42a289
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 8
cmp word [esp + 0x44], 0x20
push ebp
push esi
Function at 0x42a291
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
jne 0x42a324
mov eax, dword [edi + 0x58]
mov ebp, dword [esp + 0x48]
shr eax, 0xa6
aad 0xf8
test eax, eax
mov ebp, dword [esp + 0x48]
lea ecx, [esp + 0x48]
push ecx
push 0x4004667f
push ebp
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x42a417
mov eax, dword [esp + 0x48]
mov esi, 1
cmp eax, esi
jge 0x42a352
mov dword [esp + 0x48], esi
lea ecx, [esp + 0x24]
call fcn.004308cb
lea ecx, [esp + 0x10]
mov dword [esp + 0x40], esi
call fcn.004308d8
mov esi, dword [sym.imp.WS2_32.dll_recv]
mov eax, dword [esp + 0x48]
mov byte [esp + 0x40], 2
push 0
push eax
push eax
lea ecx, [esp + 0x1c]
call fcn.004309e4
push eax
push ebp
call esi
cmp eax, ebx
je 0x42a3b4
test eax, eax
jle 0x42a3b4
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
neg ecx
sbb ecx, ecx
push eax
and ecx, edx
push ecx
lea ecx, [esp + 0x2c]
call fcn.00431049
mov eax, 0x400
mov dword [esp + 0x48], eax
jmp 0x42a377
mov eax, dword [esp + 0x34]
test eax, eax
je 0x42a3ef
mov eax, dword [edi + 0x58]
xor ecx, ecx
shr eax, 0xc9
sub bl, al
jle 0x42a3ef
mov edx, dword [edi + 0x50]
cmp dword [edx], ebp
je 0x42a3d9
inc ecx
add edx, 4
cmp ecx, eax
jl 0x42a3cb
jmp 0x42a3ef
mov edx, dword [edi + 0x60]
mov eax, dword [edi]
mov ecx, dword [edx + ecx*4]
push ecx
lea ecx, [esp + 0x28]
push ecx
mov ecx, edi
call dword [eax + 0xc0]
mov esi, 0x5249c0
lea ecx, [esp + 0x10]
mov byte [esp + 0x40], 1
mov dword [esp + 0x10], esi
call fcn.00430b76
lea ecx, [esp + 0x24]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x24], esi
call fcn.00430b87
mov ecx, dword [esp + 0x38]
pop esi
pop ebp
pop edi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 8

Function at 0x42a4a1
Capabilities:
Create process on windows

Disassembly:
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0xffffffffffffffff
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x98
call 0x49854f
push 0xffffffffffffffff
push 0
mov ecx, dword [ebp - 4]
add ecx, 0xac
call 0x498561
mov esp, ebp
pop ebp
ret

Function at 0x42b77c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add dh, al
test byte [eax + eax*2], ah
push es
add byte [eax], al
sub eax, ebp
pop edx
jb 0x42b790
add byte [ebp + 0x3a8248c], cl
add byte [eax], al
add dh, al
test byte [eax + eax*2], ah
push es
add byte [eax], al
sub al, ch
pop edx
jb 0x42b7a4
add byte [ebp + 0x36c248c], cl
add byte [eax], al
add dh, al
test byte [eax + eax*2], ah
push es
add byte [eax], al
daa
Function at 0x42bfce
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cwde
loope 0x42bf43
add byte [eax + 0x64], dl
mov dword [0], esp
sub esp, 0x38
push ebx
mov ebx, ecx
mov ecx, dword [esp + 0x58]
dec esp
and al, 0x58
dec esp
and al, 0x58
push 0xffffffffffffffff
push 0
call fcn.00458338
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x42c2fe
mov eax, dword [ecx]
push ebp
push esi
push edi
call dword [eax + 8]
mov ecx, dword [ebx + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [ecx]
call dword [edx + 0x10]
mov ebp, eax
jo 0x42bef9
test byte ss:[ecx - 0x7ae7db94], 0xed
jle 0x42bf55
mov ecx, dword [ebx + 0xc]
push esi
mov eax, dword [ecx]
call dword [eax + 0x14]
add edi, eax
inc esi
cmp esi, ebp
jl 0x42bf45
mov ecx, dword [esp + 0x60]
call fcn.004585fe
mov ecx, eax
mov eax, dword [esp + 0x58]
cmp ecx, 0xffffffff
je 0x42bf72
cmp ecx, 0xfffffffe
jne 0x42bf88
cmp edi, eax
jle 0x42bf83
push edi
push 0x64
push eax
call dword [0x4812a4]
mov ecx, eax
cmp ecx, 0xfffffffe
jne 0x42bf88
mov ecx, 0x64
mov eax, dword [esp + 0x5c]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 2
cdq
idiv ecx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ecx]
mov ebp, eax
sub al, 0x2c
daa
pop esp
call dword [edx + 0x18]
mov edi, eax
xor esi, esi
test edi, edi
jle 0x42bfc2
mov ecx, dword [ebx + 0xc]
push esi
mov eax, dword [ecx]
call dword [eax + 0xc]
sub ebp, eax
add edi, ebx
stc
jl 0x42bfae
mov dword [esp + 0x5c], ebp
mov ecx, dword [esp + 0x60]
cmp dword [ecx + 0x30], 2
jne 0x42bffb
mov eax, dword [ecx + 0x34]
lea esi, [eax - 1]
cmp edi, esi
jle 0x42bfd8
mov esi, edi
mov eax, dword [ecx + 0x38]
test eax, eax
jg 0x42bfea
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x14], eax
jmp 0x42c006
mov ecx, dword [esp + 0x10]
cmp ecx, eax
jge 0x42bff4
mov eax, ecx
dec eax
mov dword [esp + 0x14], eax
jmp 0x42c006
mov ecx, dword [esp + 0x10]
mov esi, edi
dec ecx
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x34]
call fcn.0043257f
add bh, al
inc esp
and al, 0x34
les ecx, [ecx + 0x52]
add byte [ebx], dh
in eax, dx
push esi
lea ecx, [esp + 0x38]
mov dword [esp + 0x54], ebp
mov ecx, dword [esp + 0x3c]
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret 0x10

Function at 0x42c15d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x28], esi
inc esi
cmp edi, edx
mov ebx, dword [eax + edi*4]
mov dword [esp + 0x20], esi

Function at 0x42c16b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x2c], ebx
jge 0x42c17c
mov ebp, dword [eax + edi*4 + 4]
dec ebp
mov dword [esp + 0x30], ebp
jmp 0x42c186
mov eax, dword [esp + 0x14]
mov dword [esp + 0x30], eax
mov ebp, eax
adc eax, 0x8b602706
inc eax
sub al, 0x85
sal byte [eax - 0x7d], 0xf8
add dword [ebp + 7], esi
lea ebx, [ecx + edi]
test al, bl
jne 0x42c1b1
cmp eax, 2
jne 0x42c2d1
lea eax, [ecx + edi]
test al, 1
jne 0x42c2d1
mov edx, dword [esp + 0x64]
mov esi, dword [edx + 4]
mov eax, dword [edx]
mov dword [esp + 0x18], esi
lea ebx, [esi + 1]
test ebx, ebx
jne 0x42c1eb
test eax, eax
je 0x42c1de
push eax
call 0x49aea7
fsubr st(4)
push es
add byte [ebx - 0x7c97dbb4], cl
les eax, [ebx + ecx*4]
rol edi, 1
add dword [eax], eax
Function at 0x42e12d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and al, 0x1c
add dword [eax], eax
add dh, al
test byte [eax + edx*4], ah
add al, byte [eax]
add byte [edx], cl
call 0x4a3e8d
push ebp
push ebp
push ebp
lea ecx, [esp + 0x1d0]
mov byte [esp + 0x290], 0xb
call 0x4a3ea4
mov eax, 5
mov dword [esp + 0x164], ebp
mov dword [esp + 0x16c], ebp
mov dword [esp + 0x168], ebp
mov dword [esp + 0x170], eax
mov dword [esp + 0x17c], ebp
mov dword [esp + 0x184], ebp
mov dword [esp + 0x180], ebp
mov dword [esp + 0x188], eax
lea ecx, [esp + 0x1ec]
mov byte [esp + 0x284], 0xe
call fcn.0045a987
mov ecx, dword [0x54300c]
mov dword [esp + 0xb0], ecx
mov byte [esp + 0x284], 0x10
mov dword [esp + 0x54], 1