joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406648
xor eax, eax
test eax, eax
je 0x40665b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40665b
xor ecx, ecx
jmp 0x40665e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406787
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4698ec], 0
push esi
jne 0x4067be
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406798
mov dword [ecx*4 + 0x4698e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406793
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067ef
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4698e8]
xor eax, esi
inc ecx
dec edx
jne 0x4067d1
pop edi
not eax
pop esi
ret 0xc

Function at 0x1002988a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10029899
pop dword [ebp - 0xc]
mov eax, 0x9db0f2b9
sub eax, 0x8dae5a20
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xc6dfc410
sub dword [ebp - 0x1c], 0x788d7ec5
mov dword [ebp - 0x18], 0x67398a4c
sub dword [ebp - 0x18], 0x35063e07
mov dword [ebp - 0x14], 0x1bc6c9d
sub dword [ebp - 0x14], 0xb570286f
mov dword [ebp - 0x10], 0x35e6e864
add dword [ebp - 0x10], 0xca19179c
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xd5c48315
sub eax, 0xc5bef209
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x4566d400
sub dword [ebp - 0x1c], 0xd0f46aaa
mov dword [ebp - 0x18], 0x3a4bdcf
add dword [ebp - 0x18], 0x3dc7a3a6
mov dword [ebp - 0x14], 0xd792fc78
add dword [ebp - 0x14], 0x8bdc6ff4
mov dword [ebp - 0x10], 0xb6f98afd
add dword [ebp - 0x10], 0x49067503
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x5ebde
push 0
call eax
mov ecx, 0x4d13
mov esi, eax
mov edx, 0x4b3b5ecb
sub edx, 0x3b34cacb
add edx, dword [ebp - 0xc]
mov ebx, 0x464d7de2
xor dword [ebp - 8], esi
mov edi, dword [edx]
xor dword [ebp - 4], edi
add edi, ebx
mov dword [esi], edi
xor dword [ebp - 4], eax
add esi, 4
add edx, 4
loop 0x100299aa
add eax, 0x777811c4
add eax, 0x8889155b
mov ebx, eax
add eax, 0xa0a13144
sub eax, 0xa0a1313f
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x10009c20
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001cb2d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x10028080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
je 0x10009c99
push 0x100203a0
lea ecx, [ebp - 0x28]
call fcn.10004db0
mov dword [ebp - 4], 0
push 0x100203a4
lea ecx, [ebp - 0x28]
call fcn.10005aa0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.10005aa0
lea ecx, [ebp - 0x28]
call fcn.10009b80
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.100055a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001947d
mov esp, ebp
pop ebp
ret

Function at 0x10009cc0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001cb6d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x10028080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
je 0x10009d39
push 0x100203ac
lea ecx, [ebp - 0x28]
call fcn.10004f70
mov dword [ebp - 4], 0
push str._x32_
lea ecx, [ebp - 0x28]
call fcn.10005ac0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.10005ac0
lea ecx, [ebp - 0x28]
call fcn.10002200
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10001850
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001947d
mov esp, ebp
pop ebp
ret

Function at 0x10011ae0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10011b04
xor eax, eax
jmp 0x10011b84
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10011b1b
xor eax, eax
jmp 0x10011b84
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x10011b67
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x10011b67
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x10011b3e
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x10011b73
xor eax, eax
jmp 0x10011b84
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x10011b81
xor eax, eax
jmp 0x10011b84
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10015440
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001d755
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x1f4
mov eax, dword [0x10028080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x138], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x134], 0
mov ecx, dword [ebp + 8]
call fcn.10004e30
mov dword [ebp - 0x16c], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x134]
or eax, 1
mov dword [ebp - 0x134], eax
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x138]
call fcn.10015120
mov dword [ebp - 0x13c], eax
mov edx, dword [ebp - 0x13c]
push edx
lea ecx, [ebp - 0x168]
call fcn.10014420
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x168]
call fcn.10005890
test eax, eax
je 0x10015568
push 0x104
push 0
lea eax, [ebp - 0x118]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x140], 0x104
lea ecx, [ebp - 0x140]
push ecx
lea edx, [ebp - 0x118]
push edx
push 0
push 0
push str.DLLPathEx
lea ecx, [ebp - 0x168]
call fcn.10005890
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
jne 0x10015568
lea eax, [ebp - 0x118]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
test eax, eax
jbe 0x10015568
lea ecx, [ebp - 0x118]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10014860
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x168]
call fcn.10014730
jmp 0x10015669
mov dword [ebp - 4], 0
jmp 0x10015679
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001947d
mov esp, ebp
pop ebp
ret 8
Function at 0x10017370
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x10017379
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
shl edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100173bc
mov eax, dword [ebp - 8]
jmp 0x10017422
cmp dword [ebp - 0xc], 1
je 0x100173cf
cmp dword [ebp - 0xc], 2
je 0x100173cf
mov eax, 0xd
jmp 0x10017422
cmp dword [ebp + 0xc], 0
je 0x10017416
cmp dword [ebp - 4], 0
je 0x10017405
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x100173fc
mov edx, dword [ebp - 4]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x10017403
mov eax, 0xd
jmp 0x10017422
jmp 0x10017416
mov edx, 2
imul eax, edx, 0
xor ecx, ecx
mov edx, dword [ebp + 0xc]
mov word [edx + eax], cx
mov eax, dword [ebp - 4]
shr eax, 1
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x6d2f4a90
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebp
push esi
push edi
push ecx
mov dword [eax], 0
call fcn.6d2feac0
mov esi, eax
add esp, 4
test esi, esi
jns 0x6d2f4ac7
push 0x444
push str..._.._.._src_share_demo_jvmti_hprof_hprof_check.c
push str.fd_0
push 0
push 1
call fcn.6d2f5ce0
add esp, 0x14
push 0xffffffffffffffff
push 0xffffffffffffffff
push esi
call fcn.6d2feb20
mov edi, eax
and eax, edx
add esp, 0xc
cmp eax, 0xffffffff
jne 0x6d2f4afa
push 0x446
push str..._.._.._src_share_demo_jvmti_hprof_hprof_check.c
push str.Cannot_md_seek___to_end_of_file
push 0
push 1
call fcn.6d2f5ce0
add esp, 0x14
jmp 0x6d2f4b02
cmp edi, 0x200
jg 0x6d2f4b1d
push 0x448
push str..._.._.._src_share_demo_jvmti_hprof_hprof_check.c
push str.__jint_nbytes__512
push 0
push 1
call fcn.6d2f5ce0
add esp, 0x14
push 0
push 0
push esi
call fcn.6d2feb20
add esp, 0xc
or eax, edx
je 0x6d2f4b49
push 0x44a
push str..._.._.._src_share_demo_jvmti_hprof_hprof_check.c
push str.Cannot_md_seek___to_start_of_file
push 0
push 1
call fcn.6d2f5ce0
add esp, 0x14
lea ecx, [edi + 1]
push ecx
call fcn.6d305ad0
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x6d2f4b75
push 0x44d
push str..._.._.._src_share_demo_jvmti_hprof_hprof_check.c
push str.image_NULL
push eax
push 1
call fcn.6d2f5ce0
add esp, 0x14
push ebx
push edi
push ebp
push esi
call sub.msvcr100.dll__read
mov ebx, eax
add esp, 0xc
test ebx, ebx
jg 0x6d2f4ba2
push 0x452
push str..._.._.._src_share_demo_jvmti_hprof_hprof_check.c
push str.System_read_failed.
push 0
push 1
call fcn.6d2f5ce0
add esp, 0x14
cmp edi, ebx
pop ebx
je 0x6d2f4bc2
push 0x454
push str..._.._.._src_share_demo_jvmti_hprof_hprof_check.c
push str.__jint_nbytes_nread
push 0
push 1
call fcn.6d2f5ce0
add esp, 0x14
push esi
call fcn.6d2feb60
mov edx, dword [esp + 0x14]
add esp, 4
mov dword [edx], edi
pop edi
pop esi
mov eax, ebp
pop ebp
ret
Function at 0x6d2f5ce0
Capabilities:
Terminate process

Disassembly:
cmp dword [esp + 0xc], 0
jne 0x6d2f5cef
mov dword [esp + 0xc], 0x6d3092c9
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
test ebp, ebp
je 0x6d2f5d5e
push ebx
push ebp
call fcn.6d3064f0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x6d2f5d0f
mov ebx, 0x6d30a40c
mov esi, dword [esp + 0x20]
test esi, esi
jne 0x6d2f5d1e
mov eax, str.UnknownSourceFile
jmp 0x6d2f5d41
mov edi, dword [sym.imp.msvcr100.dll_strrchr]
push 0x2f
push esi
call edi
add esp, 8
test eax, eax
jne 0x6d2f5d40
push 0x5c
push esi
call edi
add esp, 8
test eax, eax
jne 0x6d2f5d40
mov eax, esi
jmp 0x6d2f5d41
inc eax
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
push ecx
push eax
push ebp
push ebx
push edx
push str.HPROF_ERROR:__s__JVMTI_Error__s__d_____s:_d__n
call fcn.6d2f5be0
add esp, 0x18
pop ebx
jmp 0x6d2f5da8
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x6d2f5d6d
mov eax, str.UnknownSourceFile
jmp 0x6d2f5d90
mov edi, dword [sym.imp.msvcr100.dll_strrchr]
push 0x2f
push esi
call edi
add esp, 8
test eax, eax
jne 0x6d2f5d8f
push 0x5c
push esi
call edi
add esp, 8
test eax, eax
jne 0x6d2f5d8f
mov eax, esi
jmp 0x6d2f5d90
inc eax
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
push ecx
push eax
push edx
push str.HPROF_ERROR:__s___s:_d__n
call fcn.6d2f5be0
add esp, 0x10
cmp byte [esp + 0x10], 0
pop edi
pop esi
pop ebp
jne 0x6d2f5dbd
mov eax, dword [0x6d30e7f8]
cmp byte [eax + 0x65], 0
je 0x6d2f5e00
push str.HPROF_TERMINATED_PROCESS_n
call fcn.6d2f5be0
mov eax, dword [0x6d30e7f8]
add esp, 4
cmp byte [eax + 0x64], 0
jne 0x6d2f5ddb
cmp byte [eax + 0x67], 0
je 0x6d2f5df8
push 0
push 0x16
call dword [sym.imp.msvcr100.dll_signal]
push str.HPROF_DUMPING_CORE_n
call fcn.6d2f5be0
add esp, 0xc
call dword [sym.imp.msvcr100.dll_abort]
push 9
call dword [sym.imp.msvcr100.dll_exit]
ret
Function at 0x6d2f6960
Capabilities:
Delete file

Disassembly:
sub esp, 0x28
mov eax, dword [0x6d30e108]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, ecx
mov eax, dword [esi]
push eax
mov dword [esp + 0xc], esi
call fcn.6d2feaa0
add esp, 4
test eax, eax
js 0x6d2f6aa4
push ebx
push edi
push eax
call fcn.6d2feb60
add esp, 4
call fcn.6d2fe980
mov edi, dword [esi]
mov dword [esp + 0x24], eax
mov eax, edi
mov dword [esp + 0xc], edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x6d2f69a7
sub eax, edx
add eax, 0x40
push eax
mov dword [esp + 0x1c], eax
call fcn.6d305ad0
mov ecx, dword [0x6d30e7f8]
add esp, 4
mov byte [esp + 0x28], 0
cmp byte [ecx + 0x38], 0x62
mov dword [esp + 0x20], eax
je 0x6d2f6a65
xor eax, eax
jmp 0x6d2f69e0
mov cl, byte [eax + str..txt]
mov byte [esp + eax + 0x28], cl
inc eax
test cl, cl
jne 0x6d2f69e0
push 0x2e
push edi
call dword [sym.imp.msvcr100.dll_strrchr]
add esp, 8
mov dword [esp + 0x14], eax
test eax, eax
je 0x6d2f6a65
push ebp
mov ebp, str..txt
xor edi, edi
mov esi, eax
sub ebp, eax
nop
mov bl, byte [esi]
test bl, bl
je 0x6d2f6a5c
movsx edx, byte [esi + ebp]
push edx
call dword [sym.imp.msvcr100.dll_tolower]
movsx ecx, bl
push ecx
mov dword [esp + 0x28], eax
call dword [sym.imp.msvcr100.dll_tolower]
add esp, 8
cmp dword [esp + 0x20], eax
jne 0x6d2f6a5c
inc edi
inc esi
cmp edi, 4
jl 0x6d2f6a10
mov esi, dword [esp + 0x18]
lea edx, [esp + 0x2c]
mov eax, esi
sub edx, esi
jmp 0x6d2f6a50
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x6d2f6a50
mov byte [esi], cl
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
pop ebp
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
lea edx, [esp + 0x28]
push edx
push eax
push edi
push str._s._d_s
push ecx
push ebx
call fcn.6d2fed10
push edi
mov dword [esi], ebx
call sub.msvcr100.dll_free
mov edx, dword [0x6d30e7f8]
mov eax, dword [edx + 0x80]
push eax
call dword [sym.imp.msvcr100.dll_remove]
add esp, 0x20
pop edi
pop ebx
mov ecx, dword [esp + 0x28]
pop esi
xor ecx, esp
call fcn.6d307d33
add esp, 0x28
ret
Function at 0x6d2fcd10
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x20000
mov ebx, eax
call fcn.6d305ad0
mov edi, dword [esp + 0x18]
add esp, 4
mov ebp, eax
lea esp, [esp]
mov eax, 0x20000
cmp edi, eax
jge 0x6d2fcd3b
mov eax, edi
push eax
push ebp
push ebx
call sub.msvcr100.dll__read
mov esi, eax
add esp, 0xc
test esi, esi
js 0x6d2fcd6d
je 0x6d2fcd84
jle 0x6d2fcd5b
push esi
push ebp
call dword [esp + 0x24]
add esp, 8
sub edi, esi
test edi, edi
jg 0x6d2fcd30
push ebp
call sub.msvcr100.dll_free
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.msvcr100.dll__errno]
mov eax, dword [eax]
push eax
push esi
mov ebx, str.read
call fcn.6d2faa50
add esp, 8
test edi, edi
jle 0x6d2fcda6
test esi, esi
jne 0x6d2fcda6
push 0x765
push str..._.._.._src_share_demo_jvmti_hprof_hprof_io.c
push str.File_size_is_smaller_than_bytes_written
push esi
push 1
call fcn.6d2f5ce0
add esp, 0x14
push ebp
call sub.msvcr100.dll_free
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x6d2fe9c0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
sub esp, 0x14
mov eax, dword [0x6d30e108]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
mov edi, dword [esp + 0x20]
push 0
push 1
push 2
call dword [sym.imp.wsock32.dll_socket]
push edi
mov esi, eax
call dword [sym.imp.wsock32.dll_gethostbyname]
test eax, eax
jne 0x6d2fea01
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.6d307d33
add esp, 0x14
ret
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [esp + 0x24]
mov edx, dword [ecx]
push eax
mov dword [esp + 0x10], edx
call dword [sym.imp.wsock32.dll_htons]
push 0x10
lea edx, [esp + 0xc]
push edx
mov ecx, 2
push esi
mov word [esp + 0x16], ax
mov word [esp + 0x14], cx
call dword [sym.imp.wsock32.dll_connect]
mov ecx, dword [esp + 0x18]
inc eax
neg eax
sbb eax, eax
and eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.6d307d33
add esp, 0x14
ret

Function at 0x6d2fea60
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
push edx
push eax
call dword [sym.imp.wsock32.dll_recv]
ret

Function at 0x6d2feb70
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
push edx
push eax
call dword [sym.imp.wsock32.dll_send]
ret
Function at 0x6d2fec90
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x6d30e108]
xor eax, esp
mov dword [esp + 0x190], eax
mov eax, dword [esp + 0x19c]
sub eax, 0
je 0x6d2fecd2
dec eax
jne 0x6d2fece2
mov eax, dword [esp + 0x198]
lea ecx, [esp]
push ecx
push 2
mov dword [0x6d30e7f4], eax
call dword [sym.imp.wsock32.dll_WSAStartup]
mov dword [0x6d30e3d8], eax
jmp 0x6d2fece2
call dword [sym.imp.wsock32.dll_WSACleanup]
mov dword [0x6d30e7f4], 0
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 1
call fcn.6d307d33
add esp, 0x194
ret 0xc
Function at 0x6d300d90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x6d300d9f
pop dword [ebp - 0xc]
mov eax, 0x6d300d9f
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x15ee23e5
sub dword [ebp - 0x1c], 0xc79bde9a
mov dword [ebp - 0x18], 0xe8162937
add dword [ebp - 0x18], 0x4a1d230e
mov dword [ebp - 0x14], 0xf4a3c2ef
sub dword [ebp - 0x14], 0xa8577ec1
mov dword [ebp - 0x10], 0x3f36e256
add dword [ebp - 0x10], 0xc0c91daa
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x2df3ad7e
add eax, 0x3f3ce2ce
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xc78b5ba2
add dword [ebp - 0x1c], 0xace70db4
mov dword [ebp - 0x18], 0xc4981411
add dword [ebp - 0x18], 0x7cd44d64
mov dword [ebp - 0x14], 0xdf336f75
sub dword [ebp - 0x14], 0x7bc40309
mov dword [ebp - 0x10], 0xf3d6ded2
sub dword [ebp - 0x10], 0xf3d6ded2
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x35ed5
push 0
call eax
mov ecx, 0xb1217b96
add ecx, 0x4edec9fd
xor edx, edx
add edx, eax
mov esi, 0x8677e3f7
sub esi, 0x1946c9f7
add esi, dword [ebp - 0xc]
mov ebx, 0x47c71157
sub dword [ebp - 4], esi
mov edi, dword [esi]
xor dword [ebp - 8], 0xaf3df5aa
sub edi, ebx
mov dword [edx], edi
add dword [ebp - 8], 0x9dd7ece
add edx, 4
add esi, 0x8e561561
add esi, 0x71a9eaa3
loop 0x6d300eb3
add eax, 0x1091f
mov ebx, eax
add eax, 0x2aa621e2
sub eax, 0x2aa621dd
mov ecx, 0x2aaa1148
add ecx, 0x4284eeb8
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x6d307400
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov eax, dword [0x6d30e7f8]
mov eax, dword [eax]
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 0x22c]
call eax
test eax, eax
je 0x6d307450
push 0x502
push str..._.._.._src_share_demo_jvmti_hprof_hprof_util.c
push str.Unable_to_get_potential_JVMTI_capabilities.
push 0
push 0
call fcn.6d2f5ce0
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.6d2f5ca0
ret

Function at 0x6d307460
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x6d30e7f8]
mov eax, dword [eax]
mov edx, dword [esp + 4]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x234]
call eax
test eax, eax
je 0x6d3074a3
push 0x50f
push str..._.._.._src_share_demo_jvmti_hprof_hprof_util.c
push str.Unable_to_get_necessary_JVMTI_capabilities.
push 0
push 0
call fcn.6d2f5ce0
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.6d2f5ca0
ret

Function at 0x6d307d33
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d30e108]
jne 0x6d307d3d
repz ret
jmp fcn.6d3081c2
Function at 0x40b480
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4273d4]
jne 0x40b48a
repz ret
jmp fcn.0041168c

Function at 0x41733c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4273d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040e43f
and dword [ebp - 0x14], 0
cmp dword [0x44a3cc], 0
mov dword [ebp - 0x18], eax
jne 0x4173ef
push 0x4037fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x417497
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4037f0
push ebx
call edi
test eax, eax
je 0x417497
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4037e0
push ebx
mov dword [0x44a3cc], eax
call edi
push eax
call esi
push 0x4037cc
push ebx
mov dword [0x44a3d0], eax
call edi
push eax
call esi
push 0x4037b0
push ebx
mov dword [0x44a3d4], eax
call edi
push eax
call esi
mov dword [0x44a3dc], eax
test eax, eax
je 0x4173ef
push 0x403798
push ebx
call edi
push eax
call esi
mov dword [0x44a3d8], eax
mov eax, dword [0x44a3d8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x417448
cmp dword [0x44a3dc], ecx
je 0x417448
push eax
call esi
push dword [0x44a3dc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x417448
test ebx, ebx
je 0x417448
call edi
test eax, eax
je 0x41743f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41743f
test byte [ebp - 8], 1
jne 0x417448
or dword [ebp + 0x10], 0x200000
jmp 0x41747b
mov eax, dword [0x44a3d0]
cmp eax, dword [ebp - 0x18]
je 0x41747b
push eax
call esi
test eax, eax
je 0x41747b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41747b
mov eax, dword [0x44a3d4]
cmp eax, dword [ebp - 0x18]
je 0x41747b
push eax
call esi
test eax, eax
je 0x41747b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44a3cc]
call esi
test eax, eax
je 0x417497
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x417499
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b480
leave
ret
Function at 0x41f660
Capabilities:
Delete directory
Delete file
Get disk information
Read .ini file

Disassembly:
mov eax, 0x1400
call fcn.0041e810
cmp dword [0x7eb150], 0x37
jne 0x41f6f1
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
push 0x40442c
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
lea eax, [esp + 0x804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x404438
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapePosition]
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0
lea edx, [esp + 0xc04]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
mov eax, dword [0x7eb154]
mov edx, dword [0x7e75c0]
mov cl, byte [eax + esi + 0x38d6]
mov byte [edx + esi], cl
add esp, 0x1400
ret