joyce8/EMBER2024-capa huggingface dataset:
Function at 0x489620
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
mov al, byte [edi]
mov byte [esp + 0x14], al
mov eax, dword [esp + 0x14]
and eax, 0xff
mov ecx, eax
shr eax, 4
and ecx, 0xf
mov bl, byte [eax*4 + 0x49d970]
mov al, byte [edi + 1]
mov dl, byte [ecx*4 + 0x49d970]
mov byte [esp + 0x14], al
mov eax, dword [esp + 0x14]
and eax, 0xff
shl dl, 4
mov ecx, eax
or dl, bl
shr eax, 4
mov byte [edi], dl
and ecx, 0xf
mov bl, byte [eax*4 + 0x49d970]
mov al, byte [edi + 2]
mov dl, byte [ecx*4 + 0x49d970]
mov byte [esp + 0x14], al
mov eax, dword [esp + 0x14]
and eax, 0xff
shl dl, 4
mov ecx, eax
or dl, bl
and ecx, 0xf
mov byte [edi + 1], dl
shr eax, 4
mov dl, byte [ecx*4 + 0x49d970]
mov cl, byte [eax*4 + 0x49d970]
mov al, byte [edi + 3]
shl dl, 4
mov byte [esp + 0x14], al
or dl, cl
mov ecx, dword [esp + 0x14]
mov byte [edi + 2], dl
and ecx, 0xff
mov edx, ecx
shr ecx, 4
and edx, 0xf
mov bl, byte [ecx*4 + 0x49d970]
xor ecx, ecx
mov cl, byte [edi]
mov al, byte [edx*4 + 0x49d970]
mov edx, ecx
and ecx, 3
and edx, 0xfffffffc
shl edx, 3
shl al, 4
or edx, ecx
mov ecx, 4
or al, bl
or edx, ecx
xor ebx, ebx
mov byte [edi + 3], al
mov bl, byte [edi + 2]
and eax, 0xff
shl edx, 8
or edx, ebx
xor ebx, ebx
mov bl, byte [edi + 1]
mov dword [esp + 0x14], ecx
shl eax, 9
or eax, ebx
or ah, 1
shl eax, 0xf
mov esi, eax
mov eax, dword [esp + 0x18]
shl edx, 0xf
cmp eax, ecx
jbe 0x4897da
mov ecx, edx
mov eax, edx
and ecx, 0x3fc0000
mov ebx, esi
shr eax, 6
xor ecx, eax
mov eax, edx
shr ecx, 3
and eax, 0x7f8000
and ebx, 0xf00000
xor ecx, eax
shr ecx, 0xf
mov eax, ecx
xor ecx, 0xff
shl eax, 0x18
shr edx, 8
or edx, eax
mov eax, esi
shr eax, 4
and eax, 0xff0000
add ecx, ebp
xor eax, ebx
mov ebx, esi
shr eax, 1
and ebx, 0x7f8000
xor eax, ebx
mov ebx, esi
shr eax, 4
and ebx, 0x78000
xor eax, ebx
mov ebx, esi
shr ebx, 0x1c
shr eax, 0xb
xor eax, dword [ebx*4 + 0x49d9b0]
shr esi, 8
mov ebx, eax
xor eax, 0xff
shl ebx, 0x18
lea ebp, [ecx + eax]
mov ecx, dword [esp + 0x14]
or esi, ebx
xor ebx, ebx
mov bl, byte [ecx + edi]
mov eax, ebp
and eax, 0xff
mov bl, byte [ebx + 0x49d870]
xor bl, al
mov eax, dword [esp + 0x18]
sar ebp, 8
mov byte [ecx + edi], bl
inc ecx
cmp ecx, eax
mov dword [esp + 0x14], ecx
jb 0x48972d
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4897e0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
push ebx
push esi
push edi
xor edi, edi
push edi
push 0x80
push 4
push edi
push edi
push 0xc0000000
push eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x48981a
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
push ebp
mov ecx, ebx
call fcn.00489310
mov eax, dword [ebx]
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [ebx + 4], eax
je 0x48988b
mov edx, dword [ebx + 4]
lea ecx, [esp + 0x10]
push edi
push ecx
push 4
push edx
push esi
call ebp
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x10]
push edi
push eax
add ecx, 4
push 4
push ecx
push esi
call ebp
mov eax, dword [ebx + 4]
lea edx, [esp + 0x10]
push edi
push edx
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
push ecx
push edx
push esi
call ebp
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
lea edx, [ecx + eax + 8]
mov eax, dword [ebx + 4]
mov dword [esp + 0x14], edx
mov eax, dword [eax + 0xc]
cmp eax, edi
mov dword [ebx + 4], eax
jne 0x489839
lea ecx, [esp + 0x10]
push edi
push ecx
lea edx, [esp + 0x20]
push 4
push edx
push esi
mov dword [esp + 0x2c], 0x18
call ebp
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add ecx, eax
push edi
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x14]
push ecx
mov edi, str.__Sim50_File__
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push str.__Sim50_File__
push esi
call ebp
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
add eax, ecx
push eax
mov dword [esp + 0x18], eax
call sub.MSVCR71.dll_malloc
add esp, 4
mov edi, eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll__llseek]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push 0
push edx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll__llseek]
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x1c]
push 4
push edx
push esi
call ebp
mov eax, dword [esp + 0x14]
push eax
push edi
call fcn.00489980
mov edx, dword [esp + 0x1c]
add esp, 8
lea ecx, [esp + 0x10]
push 0
push ecx
push edx
push edi
push esi
call ebp
push edi
call sub.MSVCR71.dll_free
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x20]
lea edi, [ebx + 0xc]
push eax
push 0x4abf90
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
pop ebp
pop edi
mov dword [ebx + 0x110], ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x489980
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
xor eax, eax
xor edx, edx
mov ebp, 4
mov al, byte [edi]
mov dl, byte [edi + 3]
mov esi, eax
and eax, 3
and esi, 0xfffffffc
xor ecx, ecx
mov cl, byte [edi + 1]
xor ebx, ebx
shl esi, 3
or esi, eax
xor eax, eax
mov al, byte [edi + 2]
or esi, ebp
shl edx, 9
shl esi, 8
or edx, ecx
or esi, eax
mov eax, dword [esp + 0x18]
or dh, 1
shl esi, 0xf
shl edx, 0xf
cmp eax, ebp
mov dword [esp + 0x14], ebp
jbe 0x489a82
mov ecx, esi
mov eax, esi
and ecx, 0x3fc0000
mov ebp, edx
shr eax, 6
xor ecx, eax
mov eax, esi
shr ecx, 3
and eax, 0x7f8000
and ebp, 0xf00000
xor ecx, eax
shr ecx, 0xf
mov eax, ecx
xor ecx, 0xff
shl eax, 0x18
shr esi, 8
or esi, eax
mov eax, edx
shr eax, 4
and eax, 0xff0000
add ecx, ebx
xor eax, ebp
mov ebp, edx
shr eax, 1
and ebp, 0x7f8000
xor eax, ebp
mov ebp, edx
shr eax, 4
and ebp, 0x78000
xor eax, ebp
mov ebp, edx
shr ebp, 0x1c
shr eax, 0xb
xor eax, dword [ebp*4 + 0x49d9b0]
shr edx, 8
mov ebp, eax
xor eax, 0xff
shl ebp, 0x18
lea ebx, [ecx + eax]
mov eax, dword [esp + 0x14]
or edx, ebp
mov ebp, ebx
xor ecx, ecx
and ebp, 0xff
mov cl, byte [eax + edi]
xor ecx, ebp
sar ebx, 8
mov cl, byte [ecx + 0x49d770]
mov byte [eax + edi], cl
mov ecx, dword [esp + 0x18]
inc eax
cmp eax, ecx
mov dword [esp + 0x14], eax
jb 0x4899d4
mov dl, byte [edi]
mov byte [esp + 0x18], dl
mov eax, dword [esp + 0x18]
and eax, 0xff
mov ecx, eax
shr eax, 4
and ecx, 0xf
mov bl, byte [eax*4 + 0x49d970]
mov al, byte [edi + 1]
mov dl, byte [ecx*4 + 0x49d970]
mov byte [esp + 0x18], al
mov eax, dword [esp + 0x18]
and eax, 0xff
shl dl, 4
mov ecx, eax
or dl, bl
shr eax, 4
mov byte [edi], dl
and ecx, 0xf
mov bl, byte [eax*4 + 0x49d970]
mov al, byte [edi + 2]
mov dl, byte [ecx*4 + 0x49d970]
mov byte [esp + 0x18], al
mov eax, dword [esp + 0x18]
and eax, 0xff
shl dl, 4
mov ecx, eax
or dl, bl
shr eax, 4
mov byte [edi + 1], dl
and ecx, 0xf
mov bl, byte [eax*4 + 0x49d970]
mov al, byte [edi + 3]
mov dl, byte [ecx*4 + 0x49d970]
mov byte [esp + 0x18], al
mov eax, dword [esp + 0x18]
and eax, 0xff
shl dl, 4
mov ecx, eax
or dl, bl
and ecx, 0xf
mov byte [edi + 2], dl
shr eax, 4
mov dl, byte [ecx*4 + 0x49d970]
mov cl, byte [eax*4 + 0x49d970]
shl dl, 4
or dl, cl
mov byte [edi + 3], dl
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x405a71
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x238
mov eax, 0x40d9fb
call fcn.0040c9ff
mov dword [ebp - 0x21c], ecx
movzx eax, word [ebp + 8]
xor edi, edi
mov esi, dword [0x415350]
inc edi
push 0xf0
push eax
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
test eax, eax
je 0x405be2
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x405be2
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x405be2
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x405be2
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x220], ecx
mov ecx, 0x403
cmp cx, ax
jne 0x405b5b
push 3
lea eax, [ebp - 0x110]
push esi
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], eax
call main
push dword [ebp - 0x114]
mov eax, dword [ebp - 0x21c]
and dword [ebp - 4], 0
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
lea eax, [ebp - 0x110]
cmove edi, ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x114], eax
je 0x405bd4
push dword [ebp - 0x114]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x405bd4
mov ecx, 0x1234
cmp cx, ax
jne 0x405bd4
or dword [ebp - 0x240], 0xffffffff
lea eax, [ebp - 0x214]
push 3
push esi
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x244], 1
mov dword [ebp - 0x218], eax
call main
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x23c], eax
cmp eax, ecx
je 0x405bae
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
lea eax, [ebp - 0x244]
push eax
mov eax, dword [ebp - 0x21c]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
add esi, dword [ebp - 0x220]
test edi, edi
jne 0x405ac9
mov eax, edi
call fcn.0040c9ba
ret 4

Function at 0x40b919
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x40b928
pop dword [ebp - 0x24]
mov eax, 0x40b928
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x39189
push 0
mov eax, 0xd9a7e73a
sub eax, 0xd9670672
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x49ff
xor esi, esi
add esi, eax
mov edi, 0xc0e73259
add edi, 0x3f5a65a7
add edi, dword [ebp - 0x24]
mov ebx, 0xd671a1be
add ebx, 0x79f31e2d
xor dword [ebp - 4], 0x5df7c316
mov edx, dword [edi]
sub dword [ebp - 0x14], 0x462e4b86
add edx, ebx
xor dword [ebp - 8], 0xce9b0e0
mov dword [esi], edx
sub dword [ebp - 0x10], edi
add esi, 0x857eb685
add esi, 0x7a81497f
add edi, 4
loop 0x40b97e
add eax, 0xc1cf18a6
sub eax, 0xc1cdfdd7
mov ebx, eax
add eax, 0x42dd3012
add eax, 0xbd22cff3
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
mov ecx, 0x50ac60ed
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..data_1
mov ebx, 0x42f314
nop
nop
mov ecx, 0x27060f7
nop
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401b90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ccc88
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5254e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
push 8
mov dword [esi], ebx
call fcn.004a9f06
add esp, 4
cmp eax, ebx
je 0x401c74
mov dword [esi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [esi]
mov dword [eax], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [ebp - 4], ebx
lea edi, [esi + 0x18]
push 8
mov dword [edi], ebx
call fcn.004a9f06
add esp, 4
cmp eax, ebx
je 0x401c50
mov dword [edi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov ecx, dword [edi]
mov dword [ecx], edi
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov eax, 0xf
mov dword [esi + 0x44], eax
mov dword [esi + 0x40], ebx
mov byte [esi + 0x30], bl
mov dword [esi + 0x74], eax
mov dword [esi + 0x70], ebx
mov byte [esi + 0x60], bl
mov word [esi + 0x7c], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], ebx
call fcn.004a936f
push 0x514f9c
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], vtable.std::bad_alloc.0
call fcn.004aba66
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], ebx
call fcn.004a936f
push 0x514f9c
lea edx, [ebp - 0x2c]
push edx
mov dword [ebp - 0x2c], vtable.std::bad_alloc.0
call fcn.004aba66
int3
Function at 0x40a560
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cc90b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5254e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004983e3
push 4
mov dword [ebp - 4], 0
call fcn.004a9f06
mov edi, eax
add esp, 4
test edi, edi
je 0x40a5e0
call fcn.0049821c
mov dword [edi], eax
call fcn.00498097
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.004983a4
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x40a5d6
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.004983cc
jmp 0x40a5e2
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4134b0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get ntdll base address
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d1faf
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x5254e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x14], ebx
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], esi
mov dword [ebp - 4], 4
mov dword [ebx + 0x14], esi
mov dword [ebx + 0x18], esi
mov dword [ebx + 0x20], esi
mov dword [ebx + 0x24], esi
mov dword [ebx + 0x2c], esi
mov dword [ebx + 0x30], esi
lea ecx, [ebx + 0x34]
mov byte [ebp - 4], 0xd
call fcn.0046ad40
lea ecx, [ebx + 0x48]
mov byte [ebp - 4], 0xe
call fcn.0046ad40
mov cl, 1
mov byte [ebx + 0x5c], cl
mov dword [ebx + 0x64], esi
mov dword [ebx + 0x68], esi
mov byte [ebx + 0xb1], cl
lea eax, [ebx + 0x70]
mov dword [eax + 0x4c], eax
mov edx, 0x10
mov dword [eax + 0x48], edx
mov byte [ebx + 0x109], cl
lea eax, [ebx + 0xc0]
mov ecx, eax
neg ecx
and ecx, 0xf
add ecx, eax
mov dword [eax + 0x54], ecx
mov dword [eax + 0x50], edx
mov edi, dword [ebx + 0x114]
mov ecx, 8
mov esi, 0x503df4
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x60], vtable.CryptoPP::SHA256.0
mov dword [ebx], vtable.CryptoPP::PK_MessageAccumulatorImpl_class_CryptoPP::SHA256_.0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a91d2
mov esp, ebp
pop ebp
ret 4
Function at 0x415c00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6e1a
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x5254e0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.ConnectionManager::Start
push str._s:_enter
push 1
xor ebx, ebx
push ebx
call fcn.00432650
add esp, 0x10
push 1
mov esi, 0x52d530
call fcn.00415430
mov eax, dword [0x52d538]
push ebx
push eax
lea ecx, [ebp - 0x34]
call fcn.00414ac0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x38], esp
or esi, 0xffffffff
push esi
mov dword [ebp - 4], ebx
push ebx
xor edx, edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], ebx
push edi
mov word [ecx], dx
call fcn.0041f520
call fcn.00450700
mov ecx, eax
mov dword [0x52d7a0], ecx
mov eax, dword [ecx]
mov edx, dword [eax + 0x40]
add esp, 0x1c
call edx
test al, al
jne 0x415cb4
push str.No_servers_support_this_protocol.
push ebx
push ebx
call fcn.00432650
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
jmp 0x415d74
mov cl, byte [ebp + 8]
mov byte [0x52d7a5], cl
call fcn.00445010
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 8]
push 0xfffffffffffffffd
call eax
mov eax, dword [0x52d53c]
cmp eax, ebx
jne 0x415d60
cmp dword [0x52d788], ebx
jne 0x415d60
push ebx
call fcn.004a9ffb
add esp, 4
push ebx
push ebx
push 0x52d530
push 0x416060
push ebx
push ebx
mov dword [0x52d798], eax
mov dword [0x52d79c], edx
mov dword [0x52d53c], 1
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [0x52d788], eax
cmp eax, ebx
jne 0x415d45
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.Start:_CreateThread_failed___d_
push ebx
push ebx
call fcn.00432650
add esp, 0x10
mov dword [0x52d798], ebx
mov dword [0x52d79c], ebx
mov dword [0x52d53c], ebx
push str.ConnectionManager::Start
push str._s:_exit
push 1
push ebx
call fcn.00432650
add esp, 0x10
lea ecx, [ebp - 0x34]
push ecx
jmp 0x415d74
push eax
push str.Invalid_connection_manager_state_in_Start___d_
push ebx
push ebx
call fcn.00432650
add esp, 0x10
lea edx, [ebp - 0x34]
push edx
mov dword [ebp - 4], esi
call fcn.00414bb0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a91d2
mov esp, ebp
pop ebp
ret 4
Function at 0x41b4b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x5254e0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
push eax
push 0x104
mov dword [ebp - 0x418], 0
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
cmp eax, 0xf6
jg 0x41b53f
test eax, eax
je 0x41b53f
push str.psiphon.route
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov ecx, esi
test eax, eax
je 0x41b525
lea eax, [ebp - 0x414]
push eax
call fcn.0041f060
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a91d2
mov esp, ebp
pop ebp
ret
push 0x4fc3d4
call fcn.0041f060
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a91d2
mov esp, ebp
pop ebp
ret
xor ecx, ecx
push ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], cx
push 0x4fc3d4
mov ecx, esi
call fcn.0041ef70
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, esi
call fcn.004a91d2
mov esp, ebp
pop ebp
ret
Function at 0x41b570
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d3c8a
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x5254e0]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push esi
push edi
mov eax, dword [0x5254e0]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov ebx, dword [ebp + 0xc]
xor edi, edi
push edi
push eax
lea ecx, [esp + 0x40]
call fcn.00414ac0
lea esi, [esp + 0x1c]
mov dword [esp + 0x68], edi
call fcn.0041b4b0
mov byte [esp + 0x68], 1
cmp dword [esp + 0x2c], edi
jne 0x41b614
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.WriteSplitTunnelRoutes___GetSplitTunnelingFilePath_failed___d_
push edi
push edi
call fcn.00432650
add esp, 0x10
cmp dword [esp + 0x30], 8
jb 0x41b5ff
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.004a9dd8
add esp, 4
xor edx, edx
lea eax, [esp + 0x38]
mov dword [esp + 0x2c], edi
mov word [esp + 0x1c], dx
push eax
jmp 0x41b726
cmp dword [esp + 0x30], 8
mov eax, dword [esp + 0x1c]
jae 0x41b623
lea eax, [esp + 0x1c]
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
mov dword [esp + 0x18], esi
mov byte [esp + 0x68], 2
cmp esi, 0xffffffff
jne 0x41b68f
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.WriteSplitTunnelRoutes___CreateFile_failed___d_
push edi
push edi
call fcn.00432650
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [esp + 0x30], 8
jb 0x41b5ff
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.004a9dd8
add esp, 4
xor edx, edx
lea eax, [esp + 0x38]
mov dword [esp + 0x2c], edi
mov word [esp + 0x1c], dx
push eax
jmp 0x41b726
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41b694
push 0
sub eax, edx
lea ecx, [esp + 0x18]
push ecx
mov edi, eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x41b6df
cmp dword [esp + 0x14], edi
jne 0x41b6df
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [esp + 0x1c]
call fcn.00428ed0
lea edx, [esp + 0x38]
push edx
mov dword [esp + 0x6c], 0xffffffff
call fcn.00414bb0
mov al, 1
jmp 0x41b73d
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.WriteSplitTunnelRoutes___WriteFile_failed___d_
push 0
push 0
call fcn.00432650
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [esp + 0x30], 8
jb 0x41b712
mov eax, dword [esp + 0x1c]
push eax
call fcn.004a9dd8
add esp, 4
xor ecx, ecx
lea edx, [esp + 0x38]
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], cx
push edx
mov dword [esp + 0x34], 7
mov dword [esp + 0x6c], 0xffffffff
call fcn.00414bb0
xor al, al
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.004a91d2
mov esp, ebp
pop ebp
ret 8