joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411470
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x34
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x28], ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x28]
xor edi, edi
add edi, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov dword [esp + 0x18], eax
adc esi, 0
cmp dword [esp + 0x4c], 0
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x1c], eax
jl 0x41161d
jg 0x4114d2
cmp dword [esp + 0x48], 0
jbe 0x41161d
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [esp + 0x24]
xor ecx, ecx
add ecx, dword [esp + 0x20]
mov dword [esp + 0x10], ecx
adc eax, 0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x3c]
cmp dword [esp + 0x10], edi
jne 0x411538
cmp dword [esp + 0x14], esi
jne 0x411538
mov dword [esp + 0x28], ebx
sub ebx, dword [esp + 0x18]
mov dword [esp + 0x2c], ebp
sbb ebp, dword [esp + 0x1c]
cmp ebp, dword [esp + 0x4c]
jl 0x4114d2
jg 0x41161d
cmp ebx, dword [esp + 0x48]
jb 0x4114d2
jmp 0x41161d
mov edx, dword [0x491df0]
mov esi, ebx
sub esi, dword [esp + 0x28]
mov ecx, ebp
mov eax, dword [0x491df4]
sbb ecx, dword [esp + 0x2c]
shrd edx, eax, 0xa
sar eax, 0xa
cmp ecx, eax
jg 0x41161d
jl 0x411568
cmp esi, edx
jae 0x41161d
movsd xmm0, qword [0x491df8]
push ecx
push ecx
movsd qword [esp], xmm0
push dword [0x491e0c]
push dword [0x491e08]
push dword [0x491e24]
push dword [0x491e20]
push dword [0x491e14]
push dword [0x491e10]
push ebp
push ebx
call fcn.004113e3
add esp, 0x28
lea ecx, [esp + 0x48]
mov esi, eax
mov edi, edx
push 0x490128
call fcn.00411ed5
mov ecx, dword [esp + 0x10]
sub esi, ecx
mov eax, dword [esp + 0x14]
sbb edi, eax
mov dword [0x491e0c], eax
mov eax, esi
mov dword [0x491e08], ecx
or eax, edi
mov dword [0x491e10], ebx
mov dword [0x491e14], ebp
mov dword [0x491e20], esi
mov dword [0x491e24], edi
je 0x41160a
shld edi, esi, 3
shl esi, 3
mov edx, edi
mov ecx, esi
call fcn.00469900
movsd xmm1, qword [0x483bb8]
divsd xmm1, xmm0
jmp 0x41160d
xorps xmm1, xmm1
mov eax, dword [esp + 0x48]
xor ecx, ecx
movsd qword [0x491df8], xmm1
xchg dword [eax], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
Function at 0x411625
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov eax, dword [0x491e10]
sub esp, 0x34
or eax, dword [0x491e14]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push esi
push edi
push 0
pop ebx
jne 0x41175f
push 0x490128
lea ecx, [esp + 0x18]
call fcn.00411ed5
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [0x491df0], ecx
mov dword [0x491df4], edx
call fcn.00469900
movsd xmm1, qword [0x483d98]
mov esi, ebx
divsd xmm1, xmm0
movsd qword [0x491e00], xmm1
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x20], ecx
call ebp
jmp 0x4116c2
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
lea eax, [esp + 0x20]
push eax
call ebp
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [0x491e10], eax
lea eax, [esp + 0x18]
push eax
mov dword [0x491e14], ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ecx, dword [esp + 0x1c]
xor eax, eax
add eax, dword [esp + 0x18]
mov dword [0x491e08], eax
lea eax, [esp + 0x38]
adc ecx, ebx
push eax
mov dword [0x491e0c], ecx
call ebp
mov ecx, dword [esp + 0x2c]
xor eax, eax
add eax, dword [esp + 0x28]
adc ecx, ebx
cmp dword [0x491e08], eax
jne 0x411721
cmp dword [0x491e0c], ecx
je 0x4116b2
mov edi, dword [esp + 0x38]
sub edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x3c]
sbb ecx, dword [esp + 0x34]
mov edx, dword [0x491df0]
mov eax, dword [0x491df4]
shrd edx, eax, 0xa
sar eax, 0xa
cmp ecx, eax
jl 0x411757
jg 0x41174d
cmp edi, edx
jbe 0x411757
inc esi
cmp esi, 0x64
jl 0x41168e
mov eax, dword [esp + 0x14]
xor ecx, ecx
xchg dword [eax], ecx
push 0x490128
lea ecx, [esp + 0x24]
call fcn.00411ed5
mov eax, dword [0x491e10]
movsd xmm0, qword [0x491df8]
mov ebp, dword [0x491e08]
mov edi, dword [0x491e0c]
mov ebx, dword [0x491e20]
mov esi, dword [0x491e24]
mov dword [esp + 0x18], eax
mov eax, dword [0x491e14]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x38]
push eax
movsd qword [esp + 0x34], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movsd xmm0, qword [esp + 0x30]
push ecx
push ecx
movsd qword [esp], xmm0
push edi
push ebp
push esi
push ebx
push dword [esp + 0x2c]
push dword [esp + 0x34]
push dword [esp + 0x5c]
push dword [esp + 0x5c]
call fcn.004113e3
add esp, 0x28
mov esi, eax
sub eax, dword [0x491e18]
mov edi, edx
mov ecx, edi
sbb ecx, dword [0x491e1c]
mov dword [esp + 0x34], ecx
js 0x41180a
jg 0x4117fa
cmp eax, 0x1e8480
jbe 0x41180a
mov dword [0x491e18], esi
mov dl, 1
mov dword [0x491e1c], edi
jmp 0x41180c
xor edx, edx
mov eax, dword [esp + 0x20]
xor ecx, ecx
xchg dword [eax], ecx
test dl, dl
je 0x411833
mov ecx, dword [0x491df0]
mov eax, dword [0x491df4]
shrd ecx, eax, 0xb
sar eax, 0xb
push eax
push ecx
call fcn.00411470
pop ecx
pop ecx
mov edx, edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
Function at 0x411a9b
Capabilities:
Create directory
Move file

Disassembly:
sub esp, 0x8b4
push ebx
push ebp
mov ebp, ecx
push esi
push edi
cmp dword [ebp + 0x408], 0xffffffff
jne 0x411ad7
push 0x49012c
lea ecx, [esp + 0x14]
call fcn.00411ed5
mov eax, dword [0x48db44]
inc eax
xor ecx, ecx
mov dword [0x48db44], eax
mov dword [ebp + 0x408], eax
mov eax, dword [esp + 0x10]
xchg dword [eax], ecx
push 0
lea edi, [ebp + 4]
mov ecx, ebp
push edi
call fcn.00411a6a
mov esi, edi
xor ebx, ebx
test esi, esi
je 0x411b27
push 0x2f
push esi
call fcn.004457d0
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x411b27
mov ebx, esi
lea eax, [esp + 0x40]
sub ebx, ebp
sub ebx, 4
push ebx
push edi
push eax
call fcn.004486a0
lea eax, [esp + 0x4c]
mov byte [esp + ebx + 0x4c], 0
push eax
call fcn.004498ab
add esp, 0x10
inc ebx
add esi, 1
jne 0x411aec
cmp byte [edi], 0
je 0x411c2d
push 0x47eeb4
push edi
call fcn.00448116
pop ecx
pop ecx
test eax, eax
je 0x411c2d
push eax
call fcn.00448282
pop ecx
call fcn.0041183f
push 0
push 0xf4240
push edx
push eax
call fcn.00469000
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x18], edx
call fcn.00451253
push 9
pop ecx
mov esi, eax
lea edi, [esp + 0x20]
push ebx
lea eax, [ebp + 4]
push eax
lea eax, [esp + 0x4c]
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.004486a0
lea eax, [esp + 0x2c]
push eax
push str._Y__m__d__H__M__S_
lea eax, [esp + 0x58]
add eax, ebx
push 0x80
push eax
call fcn.00450f84
lea eax, [esp + 0x60]
push eax
call fcn.004498ab
add esp, 0x24
xor esi, esi
push esi
lea eax, [esp + 0xc4]
mov ecx, ebp
push eax
call fcn.00411a6a
lea eax, [esp + 0xc0]
push 0x47eeb4
push eax
call fcn.00448116
pop ecx
pop ecx
test eax, eax
je 0x411c2d
push eax
call fcn.00448282
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x4c8]
push eax
call fcn.00447910
lea eax, [esp + 0xcc]
add eax, ebx
push eax
lea eax, [esp + 0x4d0]
push eax
call fcn.00447920
lea eax, [esp + 0x4d4]
push eax
lea eax, [esp + 0xd8]
push eax
call fcn.004512e3
add esp, 0x1c
inc esi
cmp esi, 0x2710
jl 0x411bb5
and dword [ebp + 0x404], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8b4
ret
Function at 0x413cc1
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, ecx
mov dword [esp + 0xc], esi
test ebp, ebp
jg 0x413cdb
jl 0x413cd2
test ebx, ebx
jne 0x413cdb
xor eax, eax
xor edx, edx
jmp 0x413da0
cmp dword [esi + 0x38], 0
je 0x413cf1
push ebp
push ebx
push dword [esp + 0x1c]
call fcn.0041426b
jmp 0x413da0
mov eax, dword [esi + 0x1c]
push edi
mov edi, ebx
mov ecx, dword [eax]
test ecx, ecx
je 0x413d37
mov eax, dword [esi + 0x2c]
cmp dword [eax], 0
jbe 0x413d37
cmp dword [eax], ebx
mov esi, ebx
mov edi, dword [esp + 0x18]
cmovb esi, dword [eax]
push esi
push ecx
push edi
call fcn.00406555
mov ecx, dword [esp + 0x1c]
add edi, esi
mov dword [esp + 0x24], edi
add esp, 0xc
mov edi, ebx
sub edi, esi
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov esi, ecx
jmp 0x413d3f
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
cmp dword [esi + 0x4c], 0
je 0x413d96
mov ecx, esi
call fcn.0041501d
mov ecx, dword [esp + 0x18]
mov edx, edi
mov eax, 0xfff
cmp edi, eax
jbe 0x413d81
push dword [esi + 0x4c]
push eax
push 1
push ecx
call fcn.00449afb
mov ecx, dword [esp + 0x28]
sub edi, eax
add ecx, eax
add esp, 0x10
mov dword [esp + 0x18], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x413d96
jmp 0x413d52
test edx, edx
je 0x413d96
push dword [esi + 0x4c]
push edi
push 1
push ecx
call fcn.00449afb
add esp, 0x10
sub edi, eax
sub ebx, edi
mov eax, ebx
sbb ebp, 0
mov edx, ebp
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x41752c
Capabilities:
Create tcp socket
Initialize winsock library
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00416f2c
mov dword [esi], vtable.SocketTCPListener.0
xor edi, edi
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [esi + 4]
mov dword [ecx], eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x276d
jne 0x417585
lea eax, [esp + 0x10]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x417585
inc edi
cmp edi, 2
jl 0x41754d
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 1
push eax
mov eax, dword [esi + 4]
push 0x8004667e
push dword [eax]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4175e5
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0x10
lea eax, [ebp - 0x10]
mov esi, ecx
push 0
push eax
call fcn.00445670
mov ecx, dword [ebp + 8]
add esp, 0xc
mov dword [ebp + 8], 1
push 2
pop eax
mov word [ebp - 0x10], ax
mov eax, dword [ecx]
mov dword [ebp - 0xc], eax
mov ax, word [ecx + 4]
mov word [ebp - 0xe], ax
lea eax, [ebp + 8]
push 4
push eax
mov eax, dword [esi + 4]
push 4
push 0xffff
push dword [eax]
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x10
lea eax, [ebp - 0x10]
push eax
mov eax, dword [esi + 4]
push dword [eax]
call dword [sym.imp.WS2_32.dll_bind]
neg eax
pop esi
sbb al, al
inc al
leave
ret 8

Function at 0x417bbc
Capabilities:
Create tcp socket
Initialize winsock library
Set socket configuration

Disassembly:
mov eax, 0x46a1fd
call fcn.00469788
sub esp, 0x198
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14], esi
call fcn.00416f2c
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi], vtable.SocketTCP.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [esi + 4]
mov dword [ecx], eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x276d
jne 0x417c26
lea eax, [ebp - 0x1a4]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x417c26
inc edi
cmp edi, 2
jl 0x417bec
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 1
push eax
mov eax, dword [esi + 4]
push 0x8004667e
push dword [eax]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x417c5c
mov eax, dword [esi + 4]
push dword [eax]
push 0xffffffffffffffff
push str.Failed_to_unblock_socket___d__sock_x__n
push 2
call fcn.00411c99
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x417cac
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x10
lea eax, [ebp - 0x10]
mov esi, ecx
push 0
push eax
call fcn.00445670
mov ecx, dword [ebp + 8]
add esp, 0xc
xor ebx, ebx
inc ebx
mov eax, dword [ecx]
push 2
mov dword [ebp - 0xc], eax
mov ax, word [ecx + 4]
pop edi
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x10]
push 0x10
push eax
mov eax, dword [esi + 4]
mov word [ebp - 0x10], di
mov dword [esi + 8], ebx
push dword [eax]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x417d0a
mov ecx, dword [esi + 0xc]
mov dword [esi + 8], edi
test ecx, ecx
je 0x417d42
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x417d42
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x417d28
mov eax, dword [esi + 4]
mov dword [esi + 8], ebx
cmp byte [eax + 9], 1
je 0x417d42
mov byte [eax + 9], bl
jmp 0x417d42
and dword [esi + 8], 0
mov esi, dword [esi + 0xc]
test esi, esi
je 0x417d42
mov edx, dword [esi]
mov ecx, eax
call fcn.0041771c
push eax
mov ecx, esi
call dword [edx + 8]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x417e4e
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebp, ecx
mov eax, dword [ebp + 4]
push 0
push edi
push dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
cmp esi, 0xffffffff
jne 0x417e98
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2738
je 0x417e84
cmp eax, 0x2733
jne 0x417e8e
imul edi, edi, 3
sar edi, 2
test edi, edi
jne 0x417e57
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
neg eax
jmp 0x417eab
test esi, esi
jle 0x417ea9
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x417ea9
mov eax, dword [ecx]
push esi
call dword [eax + 8]
mov eax, esi
pop edi
pop esi
pop ebp
ret 8

Function at 0x419aae
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x46a39d
call fcn.00469788
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov eax, accept
and byte [esi + 8], 0xfe
and dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [ebp - 4], ebx
and byte [esi + 0x14], 0xfe
and dword [esi + 0x10], eax
mov dword [esi + 0x18], ebx
and byte [esi + 0x20], 0xfe
and dword [esi + 0x1c], eax
mov dword [esi + 0x24], ebx
and byte [esi + 0x34], 0xfe
and dword [esi + 0x30], eax
mov dword [esi + 0x38], ebx
and byte [esi + 0x40], 0xfe
and dword [esi + 0x3c], eax
mov dword [esi + 0x44], ebx
mov byte [ebp - 4], 4
push 8
mov word [esi + 0x28], 1
call fcn.004232df
pop ecx
mov ecx, eax
call fcn.00419714
mov ecx, dword [ebp - 0xc]
mov dword [esi], eax
mov eax, esi
mov byte [esi + 0x2a], bl
mov dword [esi + 0x2c], ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41b239
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, edx
mov ebp, ecx
push 0xc
pop edx
mov ecx, eax
mov dword [esp + 0x18], eax
mov ebx, 0x9e3779b9
mov dword [esp + 0x10], ecx
xor esi, esi
mov edi, ebx
cmp eax, edx
jb 0x41b351
push 0xc
xor edx, edx
pop ecx
div ecx
mov dword [esp + 0x14], eax
movzx edx, byte [ebp + 7]
movzx ecx, byte [ebp + 6]
movzx eax, byte [ebp + 4]
add edi, eax
shl edx, 8
movzx eax, byte [ebp + 0xa]
add edx, ecx
movzx ecx, byte [ebp + 5]
shl edx, 8
add edx, ecx
movzx ecx, byte [ebp + 0xb]
shl ecx, 8
add ecx, eax
shl edx, 8
movzx eax, byte [ebp + 9]
add edi, edx
shl ecx, 8
add ecx, eax
movzx eax, byte [ebp + 8]
add esi, eax
shl ecx, 8
movzx eax, byte [ebp + 2]
add esi, ecx
movzx ecx, byte [ebp + 3]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebp + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebp]
shl ecx, 8
add ecx, eax
mov eax, esi
shr eax, 0xd
sub ecx, esi
sub ecx, edi
sub edi, esi
add ebx, ecx
xor ebx, eax
sub edi, ebx
mov eax, ebx
shl eax, 8
xor edi, eax
sub esi, edi
mov eax, edi
shr eax, 0xd
sub esi, ebx
xor esi, eax
sub ebx, esi
mov eax, esi
shr eax, 0xc
sub ebx, edi
xor ebx, eax
sub edi, esi
sub edi, ebx
mov eax, ebx
shl eax, 0x10
xor edi, eax
sub esi, edi
mov eax, edi
shr eax, 5
sub esi, ebx
xor esi, eax
sub ebx, esi
mov eax, esi
shr eax, 3
sub ebx, edi
xor ebx, eax
sub edi, esi
mov eax, ebx
sub edi, ebx
shl eax, 0xa
xor edi, eax
sub esi, edi
mov eax, edi
shr eax, 0xf
sub esi, ebx
xor esi, eax
push 0xc
pop eax
add ebp, eax
mov ecx, dword [esp + 0x10]
sub ecx, eax
sub dword [esp + 0x14], 1
mov dword [esp + 0x10], ecx
jne 0x41b26d
mov eax, dword [esp + 0x18]
add esi, eax
lea eax, [ecx - 1]
cmp eax, 0xa
ja case.default.0x41b35b
jmp dword [eax*4 + 0x41b431]
movzx eax, byte [ebp + 0xa]
shl eax, 0x18
add esi, eax
movzx eax, byte [ebp + 9]
shl eax, 0x10
add esi, eax
movzx eax, byte [ebp + 8]
shl eax, 8
add esi, eax
movzx eax, byte [ebp + 7]
shl eax, 0x18
add edi, eax
movzx eax, byte [ebp + 6]
shl eax, 0x10
add edi, eax
movzx eax, byte [ebp + 5]
shl eax, 8
add edi, eax
movzx eax, byte [ebp + 4]
add edi, eax
movzx eax, byte [ebp + 3]
shl eax, 0x18
add ebx, eax
movzx eax, byte [ebp + 2]
shl eax, 0x10
add ebx, eax
movzx eax, byte [ebp + 1]
shl eax, 8
add ebx, eax
movzx eax, byte [ebp]
add ebx, eax
sub ebx, esi
mov eax, esi
shr eax, 0xd
sub ebx, edi
xor ebx, eax
sub edi, esi
sub edi, ebx
mov eax, ebx
shl eax, 8
xor edx, edx
xor edi, eax
sub esi, edi
mov eax, edi
shr eax, 0xd
sub esi, ebx
xor esi, eax
sub ebx, esi
mov eax, esi
shr eax, 0xc
sub ebx, edi
xor ebx, eax
sub edi, esi
sub edi, ebx
mov eax, ebx
shl eax, 0x10
xor edi, eax
sub esi, edi
mov eax, edi
shr eax, 5
sub esi, ebx
xor esi, eax
sub ebx, esi
mov eax, esi
shr eax, 3
sub ebx, edi
xor ebx, eax
sub edi, esi
sub edi, ebx
mov eax, ebx
shl eax, 0xa
xor edi, eax
sub esi, edi
mov eax, edi
sub esi, ebx
shr eax, 0xf
xor eax, esi
xor eax, edx
xor edx, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x41b709
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
or eax, 0xffffffff
cmp byte [edi + 0x54], bl
je 0x41b75a
cmp byte [edi + 0x4c], bl
je 0x41b757
mov byte [esp + 0x14], al
mov byte [esp + 0x15], al
mov byte [esp + 0x16], al
mov byte [esp + 0x17], al
mov byte [edi + 0x54], bl
mov ecx, dword [edi + 0x38]
lea eax, [esp + 0x14]
push ebx
push 4
push eax
call fcn.0041b891
mov ecx, eax
mov eax, dword [ecx]
mov eax, dword [eax + 4]
test byte [eax + ecx + 0xc], 6
jne 0x41b739
mov byte [edi + 0x54], bl
mov eax, dword [edi + 0x20]
lea ebx, [edi + 0x58]
mov ecx, dword [edi + 0x10]
mov eax, dword [eax]
sub eax, dword [ecx]
mov dword [edi + 0x5c], eax
mov eax, dword [ecx]
mov dword [ebx], eax
mov eax, dword [edi + 0x48]
mov ecx, ebx
mov dword [edi + 0x68], eax
mov eax, dword [edi + 0x40]
mov dword [edi + 0x64], eax
xor eax, eax
cmp byte [edi + 0x55], al
push 4
pop edx
cmovne edx, eax
call fcn.0042d9bb
test eax, eax
je 0x41b795
cmp eax, 1
jne 0x41b7ec
mov ebx, dword [edi + 0x48]
sub ebx, dword [edi + 0x68]
cmp byte [edi + 0x4c], 0
mov ebp, dword [edi + 0x40]
je 0x41b7c5
xor edx, edx
test ebx, ebx
je 0x41b7c5
mov ecx, dword [edi + 0x50]
mov eax, ecx
shr eax, 0x11
add eax, 0x79
shl ecx, 0xd
xor eax, ecx
mov dword [edi + 0x50], eax
xor byte [edx + ebp], al
inc edx
cmp edx, ebx
jb 0x41b7aa
mov ecx, dword [edi + 0x38]
push 0
push ebx
push dword [edi + 0x40]
call fcn.0041b891
mov ecx, eax
mov eax, dword [ecx]
mov eax, dword [eax + 4]
test byte [eax + ecx + 0xc], 6
jne 0x41b814
cmp dword [edi + 0x68], 0
jne 0x41b7f9
lea ebx, [edi + 0x58]
jmp 0x41b76e
push str.ocstream_decompression_failure:
push eax
call fcn.0041b82e
jmp 0x41b823
mov ecx, dword [edi + 0x10]
mov eax, ebx
mov edx, dword [edi + 0x20]
mov esi, dword [ecx]
mov ecx, dword [edi + 0x30]
sub esi, dword [edx]
add esi, dword [edi + 0x5c]
sub dword [ecx], esi
mov ecx, dword [edi + 0x20]
add dword [ecx], esi
jmp 0x41b826
mov edx, str.ocstream:_failed_to_write_to_buffer._n
mov ecx, 0x48ee30
call fcn.004162eb
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x423a2c
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, ecx
mov esi, dword [edi]
test esi, esi
jne 0x423a3a
xor eax, eax
jmp 0x423a6b
push ebx
and esi, 0xfffffffc
xor ebx, ebx
push esi
push dword [esp + 0x14]
push edi
call dword [edi + 8]
add esp, 0xc
lea ecx, [eax - 1]
mov eax, esi
sar ecx, 0x1f
and cl, 1
movzx ecx, cl
cmovne eax, ebx
xor ecx, 1
mov ebx, eax
mov esi, dword [esi + ecx*4]
and esi, 0xfffffffc
jne 0x423a40
pop ebx
pop edi
pop esi
ret 4

Function at 0x42913e
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [ecx]
push edi
mov edi, esi
shr esi, 5
and edi, 0x7fffffff
and esi, 0x3ffffff
inc esi
mov ebx, edi
cmp ebx, esi
jb 0x42917f
push ebp
mov ebp, dword [ecx + 8]
dec ebp
add ebp, ebx
movzx ecx, byte [ebp]
mov edx, edi
mov eax, edi
shl edx, 5
shr eax, 2
sub ebx, esi
add edx, eax
sub ebp, esi
add edx, ecx
xor edi, edx
cmp ebx, esi
jae 0x429162
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
Function at 0x4325e6
Capabilities:
Create directory

Disassembly:
mov eax, 0x1000
call fcn.00442e00
push ebp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x14], 0x10
jb 0x4325fd
mov esi, dword [esi]
mov ebp, 0x477aa0
xor edi, edi
push ebp
push esi
call fcn.004431e0
pop ecx
pop ecx
test eax, eax
je 0x43265d
push ebx
xor ebx, ebx
inc ebx
sub ebx, esi
lea eax, [esi + edi]
push ebp
push eax
call fcn.004431e0
pop ecx
pop ecx
lea edi, [ebx + eax]
cmp edi, 0x1000
jae 0x43264c
push edi
lea eax, [esp + 0x14]
push esi
push eax
call fcn.004486a0
lea eax, [esp + 0x1c]
mov byte [esp + edi + 0x1b], 0
push eax
call fcn.004498ab
add esp, 0x10
lea eax, [esi + edi]
push ebp
push eax
call fcn.004431e0
pop ecx
pop ecx
test eax, eax
jne 0x432617
pop ebx
push esi
call fcn.004498ab
pop ecx
pop edi
pop esi
mov al, 1
pop ebp
add esp, 0x1000
ret
Function at 0x44008c
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x46b878
call fcn.00469788
sub esp, 0x10
push esi
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x4401a6
mov eax, dword [esi]
push ebx
push edi
call dword [eax + 0x11c]
mov edi, str..skl
test eax, eax
je 0x4400b8
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x11c]
jmp 0x4400ba
mov eax, edi
and byte [ebp - 0x18], 0xfe
lea ecx, [ebp - 0x1c]
push 1
push eax
call fcn.00428865
and dword [ebp - 4], 0
mov ebx, accept
jmp 0x4400f9
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x11c]
test eax, eax
je 0x4400ee
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x11c]
jmp 0x4400f0
mov eax, edi
push eax
lea ecx, [ebp - 0x1c]
call fcn.00428bdf
mov edx, dword [esi + 0x4c]
mov eax, dword [ebp - 0x1c]
and eax, ebx
mov ecx, dword [edx + 0x10]
and ecx, ebx
cmp eax, ecx
jbe 0x4400d4
mov edi, dword [ebp - 0x14]
mov ecx, 0x47ece6
mov al, byte [edx + 0x10]
test edi, edi
cmovne ecx, edi
xor edx, edx
xor byte [ecx], al
mov ebx, dword [esi + 0x4c]
test dword [ebx + 0x10], 0x7fffffff
jbe 0x440155
test edi, edi
mov eax, 0x47ece6
mov ecx, eax
cmovne ecx, edi
cmp dword [ebx + 0x18], 0
cmovne eax, dword [ebx + 0x18]
mov al, byte [eax + edx]
xor byte [ecx + edx + 1], al
inc edx
mov ebx, dword [esi + 0x4c]
mov eax, dword [ebx + 0x10]
and eax, 0x7fffffff
cmp edx, eax
jl 0x44012a
lea ecx, [ebp - 0x1c]
call fcn.0043fd54
push 0x20
call fcn.00441ea6
pop ecx
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
push ecx
mov ecx, eax
call fcn.0042974b
mov byte [ebp - 4], 0
mov dword [esi + 0x6c], eax
pop edi
pop ebx
test eax, eax
je 0x44018c
mov edx, dword [eax]
mov ecx, eax
push esi
call dword [edx + 0x14]
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
call dword [eax + 0xa8]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 2
call fcn.0042908e
mov eax, dword [esi + 0x6c]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret