joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d25f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x47c894]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x200
lea eax, [ebp - 0x604]
push eax
call fcn.0040d0e0
add esp, 8
mov dword [ebp - 0x61c], eax
cmp dword [ebp - 0x61c], 0xffffffff
jne 0x40d22d
xor eax, eax
jmp 0x40d47f
mov ecx, dword [ebp - 0x61c]
mov dword [ebp - 0x620], ecx
cmp dword [ebp - 0x620], 3
ja case.default.0x40d24c
mov edx, dword [ebp - 0x620]
jmp dword [edx*4 + 0x40d490]
mov dword [ebp - 0x610], str.FIREFOX.EXE
jmp 0x40d2d5
mov dword [ebp - 0x610], str.Google_Chrome
jmp 0x40d2d5
mov dword [ebp - 0x610], 0x47bb6c
jmp 0x40d2d5
mov eax, dword [ebp + 8]
push eax
push str.__WINDIR___system32cmd.exe__c__start_microsoft_edge:_s_
push 0x200
lea ecx, [ebp - 0x204]
push ecx
call fcn.004040d0
add esp, 0x10
push 0x200
push 0x47d8b8
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [ebp - 0x614], eax
cmp dword [ebp - 0x614], 0x200
jb 0x40d2c4
xor eax, eax
jmp 0x40d47f
mov eax, 0x47d8b8
jmp 0x40d47f
xor eax, eax
jmp 0x40d47f
lea eax, [ebp - 0x604]
push eax
push str._s_shellopencommand
push 0x200
lea ecx, [ebp - 0x404]
push ecx
call fcn.004040d0
add esp, 0x10
lea edx, [ebp - 0x60c]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x404]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x608], 0
je 0x40d37a
mov ecx, dword [ebp - 0x610]
push ecx
push str.SOFTWAREWow6432NodeClientsStartMenuInternet_s_shellopencommand
push 0x200
lea edx, [ebp - 0x404]
push edx
call fcn.004040d0
add esp, 0x10
lea eax, [ebp - 0x60c]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x404]
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x608], 0
je 0x40d37a
xor eax, eax
jmp 0x40d47f
mov dword [ebp - 0x614], 0x200
lea edx, [ebp - 0x614]
push edx
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x624]
push ecx
push 0
push 0x47d8b1
mov edx, dword [ebp - 0x60c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x608], 0
jne 0x40d3c5
cmp dword [ebp - 0x624], 1
je 0x40d3d9
mov eax, dword [ebp - 0x60c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40d47f
mov ecx, dword [ebp - 0x60c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x47bc18
lea edx, [ebp - 0x204]
push edx
call fcn.00413050
add esp, 8
test eax, eax
je 0x40d458
mov eax, dword [ebp + 8]
push eax
push 0x47bc1c
lea ecx, [ebp - 0x204]
push ecx
call fcn.0040cf90
add esp, 0xc
mov dword [ebp - 0x618], eax
cmp dword [ebp - 0x618], 0
jne 0x40d429
xor eax, eax
jmp 0x40d47f
mov edx, dword [ebp - 0x618]
push edx
push 0x47bc20
push 0x200
push 0x47d8b8
call fcn.004040d0
add esp, 0x10
mov eax, dword [ebp - 0x618]
push eax
call fcn.0042f891
add esp, 4
jmp 0x40d47a
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x204]
push edx
push 0x47bc24
push 0x200
push 0x47d8b8
call fcn.004040d0
add esp, 0x14
mov eax, 0x47d8b8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ee13
mov esp, ebp
pop ebp
ret
Function at 0x40d26b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x47c894]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x200
lea eax, [ebp - 0x604]
push eax
call fcn.0040d0e0
add esp, 8
mov dword [ebp - 0x61c], eax
cmp dword [ebp - 0x61c], 0xffffffff
jne 0x40d22d
xor eax, eax
jmp 0x40d47f
mov ecx, dword [ebp - 0x61c]
mov dword [ebp - 0x620], ecx
cmp dword [ebp - 0x620], 3
ja case.default.0x40d24c
mov edx, dword [ebp - 0x620]
jmp dword [edx*4 + 0x40d490]
mov dword [ebp - 0x610], str.FIREFOX.EXE
jmp 0x40d2d5
mov dword [ebp - 0x610], str.Google_Chrome
jmp 0x40d2d5
mov dword [ebp - 0x610], 0x47bb6c
jmp 0x40d2d5
mov eax, dword [ebp + 8]
push eax
push str.__WINDIR___system32cmd.exe__c__start_microsoft_edge:_s_
push 0x200
lea ecx, [ebp - 0x204]
push ecx
call fcn.004040d0
add esp, 0x10
push 0x200
push 0x47d8b8
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [ebp - 0x614], eax
cmp dword [ebp - 0x614], 0x200
jb 0x40d2c4
xor eax, eax
jmp 0x40d47f
mov eax, 0x47d8b8
jmp 0x40d47f
xor eax, eax
jmp 0x40d47f
lea eax, [ebp - 0x604]
push eax
push str._s_shellopencommand
push 0x200
lea ecx, [ebp - 0x404]
push ecx
call fcn.004040d0
add esp, 0x10
lea edx, [ebp - 0x60c]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x404]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x608], 0
je 0x40d37a
mov ecx, dword [ebp - 0x610]
push ecx
push str.SOFTWAREWow6432NodeClientsStartMenuInternet_s_shellopencommand
push 0x200
lea edx, [ebp - 0x404]
push edx
call fcn.004040d0
add esp, 0x10
lea eax, [ebp - 0x60c]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x404]
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x608], 0
je 0x40d37a
xor eax, eax
jmp 0x40d47f
mov dword [ebp - 0x614], 0x200
lea edx, [ebp - 0x614]
push edx
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x624]
push ecx
push 0
push 0x47d8b1
mov edx, dword [ebp - 0x60c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x608], 0
jne 0x40d3c5
cmp dword [ebp - 0x624], 1
je 0x40d3d9
mov eax, dword [ebp - 0x60c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40d47f
mov ecx, dword [ebp - 0x60c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x47bc18
lea edx, [ebp - 0x204]
push edx
call fcn.00413050
add esp, 8
test eax, eax
je 0x40d458
mov eax, dword [ebp + 8]
push eax
push 0x47bc1c
lea ecx, [ebp - 0x204]
push ecx
call fcn.0040cf90
add esp, 0xc
mov dword [ebp - 0x618], eax
cmp dword [ebp - 0x618], 0
jne 0x40d429
xor eax, eax
jmp 0x40d47f
mov edx, dword [ebp - 0x618]
push edx
push 0x47bc20
push 0x200
push 0x47d8b8
call fcn.004040d0
add esp, 0x10
mov eax, dword [ebp - 0x618]
push eax
call fcn.0042f891
add esp, 4
jmp 0x40d47a
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x204]
push edx
push 0x47bc24
push 0x200
push 0x47d8b8
call fcn.004040d0
add esp, 0x14
mov eax, 0x47d8b8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ee13
mov esp, ebp
pop ebp
ret
Function at 0x40d277
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x47c894]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x200
lea eax, [ebp - 0x604]
push eax
call fcn.0040d0e0
add esp, 8
mov dword [ebp - 0x61c], eax
cmp dword [ebp - 0x61c], 0xffffffff
jne 0x40d22d
xor eax, eax
jmp 0x40d47f
mov ecx, dword [ebp - 0x61c]
mov dword [ebp - 0x620], ecx
cmp dword [ebp - 0x620], 3
ja case.default.0x40d24c
mov edx, dword [ebp - 0x620]
jmp dword [edx*4 + 0x40d490]
mov dword [ebp - 0x610], str.FIREFOX.EXE
jmp 0x40d2d5
mov dword [ebp - 0x610], str.Google_Chrome
jmp 0x40d2d5
mov dword [ebp - 0x610], 0x47bb6c
jmp 0x40d2d5
mov eax, dword [ebp + 8]
push eax
push str.__WINDIR___system32cmd.exe__c__start_microsoft_edge:_s_
push 0x200
lea ecx, [ebp - 0x204]
push ecx
call fcn.004040d0
add esp, 0x10
push 0x200
push 0x47d8b8
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [ebp - 0x614], eax
cmp dword [ebp - 0x614], 0x200
jb 0x40d2c4
xor eax, eax
jmp 0x40d47f
mov eax, 0x47d8b8
jmp 0x40d47f
xor eax, eax
jmp 0x40d47f
lea eax, [ebp - 0x604]
push eax
push str._s_shellopencommand
push 0x200
lea ecx, [ebp - 0x404]
push ecx
call fcn.004040d0
add esp, 0x10
lea edx, [ebp - 0x60c]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x404]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x608], 0
je 0x40d37a
mov ecx, dword [ebp - 0x610]
push ecx
push str.SOFTWAREWow6432NodeClientsStartMenuInternet_s_shellopencommand
push 0x200
lea edx, [ebp - 0x404]
push edx
call fcn.004040d0
add esp, 0x10
lea eax, [ebp - 0x60c]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x404]
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x608], 0
je 0x40d37a
xor eax, eax
jmp 0x40d47f
mov dword [ebp - 0x614], 0x200
lea edx, [ebp - 0x614]
push edx
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x624]
push ecx
push 0
push 0x47d8b1
mov edx, dword [ebp - 0x60c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x608], 0
jne 0x40d3c5
cmp dword [ebp - 0x624], 1
je 0x40d3d9
mov eax, dword [ebp - 0x60c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40d47f
mov ecx, dword [ebp - 0x60c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x47bc18
lea edx, [ebp - 0x204]
push edx
call fcn.00413050
add esp, 8
test eax, eax
je 0x40d458
mov eax, dword [ebp + 8]
push eax
push 0x47bc1c
lea ecx, [ebp - 0x204]
push ecx
call fcn.0040cf90
add esp, 0xc
mov dword [ebp - 0x618], eax
cmp dword [ebp - 0x618], 0
jne 0x40d429
xor eax, eax
jmp 0x40d47f
mov edx, dword [ebp - 0x618]
push edx
push 0x47bc20
push 0x200
push 0x47d8b8
call fcn.004040d0
add esp, 0x10
mov eax, dword [ebp - 0x618]
push eax
call fcn.0042f891
add esp, 4
jmp 0x40d47a
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x204]
push edx
push 0x47bc24
push 0x200
push 0x47d8b8
call fcn.004040d0
add esp, 0x14
mov eax, 0x47d8b8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ee13
mov esp, ebp
pop ebp
ret
Function at 0x40d4a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [0x47c894]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x30c]
push eax
push 0x20019
push 0
push str.SoftwareClientsStartMenuInternet
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0
jne 0x40d559
mov dword [ebp - 0x310], 0x100
lea ecx, [ebp - 0x310]
push ecx
lea edx, [ebp - 0x104]
push edx
lea eax, [ebp - 0x314]
push eax
push 0
push 0x47d8b2
mov ecx, dword [ebp - 0x30c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 2
jne 0x40d524
jmp 0x40d559
cmp dword [ebp - 0x308], 0
jne 0x40d536
cmp dword [ebp - 0x314], 1
je 0x40d54a
mov edx, dword [ebp - 0x30c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40d637
mov eax, dword [ebp - 0x30c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40d578
push str.IEXPLORE.EXE
push 0x100
lea ecx, [ebp - 0x104]
push ecx
call fcn.004040d0
add esp, 0xc
mov dword [ebp - 0x310], eax
lea edx, [ebp - 0x104]
push edx
push str.SOFTWAREClientsStartMenuInternet_s_shellopencommand
push 0x200
lea eax, [ebp - 0x304]
push eax
call fcn.004040d0
add esp, 0x10
lea ecx, [ebp - 0x30c]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x304]
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0
je 0x40d5cb
xor eax, eax
jmp 0x40d637
mov dword [ebp - 0x310], 0x200
lea eax, [ebp - 0x310]
push eax
push 0x47dab8
lea ecx, [ebp - 0x314]
push ecx
push 0
push 0x47d8b3
mov edx, dword [ebp - 0x30c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0
jne 0x40d614
cmp dword [ebp - 0x314], 1
je 0x40d625
mov eax, dword [ebp - 0x30c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40d637
mov ecx, dword [ebp - 0x30c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x47dab8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ee13
mov esp, ebp
pop ebp
ret
Function at 0x40d650
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x860
mov eax, dword [0x47c894]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push str.https:__mudfish.net_api_docs_errorcode__s
push 0x400
lea ecx, [ebp - 0x804]
push ecx
call fcn.004040d0
add esp, 0x10
lea edx, [ebp - 0x804]
push edx
call fcn.0040d1f0
add esp, 4
mov dword [ebp - 0x808], eax
cmp dword [ebp - 0x808], 0
je 0x40d6c0
mov eax, dword [ebp - 0x808]
push eax
push 0x47bcc8
push 0x400
lea ecx, [ebp - 0x404]
push ecx
call fcn.004040d0
add esp, 0x10
jmp 0x40d73b
call fcn.0040d4a0
mov dword [ebp - 0x808], eax
cmp dword [ebp - 0x808], 0
je 0x40d6fd
lea edx, [ebp - 0x804]
push edx
mov eax, dword [ebp - 0x808]
push eax
push str._s__s
push 0x400
lea ecx, [ebp - 0x404]
push ecx
call fcn.004040d0
add esp, 0x14
jmp 0x40d73b
lea edx, [ebp - 0x804]
push edx
push str.Failed_to_open_the_default_browser._Please_see__s
push 0x400
lea eax, [ebp - 0x404]
push eax
call fcn.004040d0
add esp, 0x10
lea ecx, [ebp - 0x404]
push ecx
push 0x47bd08
push str.Mudfish_error_code
call fcn.00402310
add esp, 0xc
jmp 0x40d82d
lea edx, [ebp - 0x404]
push edx
call fcn.00434ba6
add esp, 4
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
jne 0x40d770
push 0x10e
push str.C:Work_ttolliblibmudecwin32_errorcode.c
push str.cmd___NULL
call fcn.0041de99
add esp, 0xc
push 0x44
push 0
lea ecx, [ebp - 0x860]
push ecx
call fcn.00412d20
add esp, 0xc
mov dword [ebp - 0x860], 0x44
push 0x10
push 0
lea edx, [ebp - 0x81c]
push edx
call fcn.00412d20
add esp, 0xc
lea eax, [ebp - 0x81c]
push eax
lea ecx, [ebp - 0x860]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0x80c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40d7f5
push 0x11e
push str.mudec_openHelper
push str.CreateProcess
call fcn.00401f90
add esp, 0xc
mov eax, dword [ebp - 0x80c]
push eax
call fcn.0042f891
add esp, 4
jmp 0x40d82d
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x81c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x81c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x80c]
push ecx
call fcn.0042f891
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ee13
mov esp, ebp
pop ebp
ret
Function at 0x40d9b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4014
call fcn.0040f0d0
mov eax, dword [0x47c894]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0x80
push 3
push 0
push 3
push connect
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x4010], eax
cmp dword [ebp - 0x4010], 0xffffffff
jne 0x40d9f9
xor eax, eax
jmp 0x40daf7
push 1
push 0
push 0
push 0
call fcn.00407be0
add esp, 0x10
mov dword [ebp - 0x4008], eax
cmp dword [ebp - 0x4008], 0
jne 0x40da2c
push 0x2a
push 0x47be68
push 0x47beb8
call fcn.0041de99
add esp, 0xc
xor edx, edx
jne 0x40da0f
mov dword [ebp - 0x400c], 0xffffffff
push 0
lea eax, [ebp - 0x400c]
push eax
push 0x4000
lea ecx, [ebp - 0x4004]
push ecx
mov edx, dword [ebp - 0x4010]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x4014], eax
cmp dword [ebp - 0x4014], 0
jne 0x40da8b
mov eax, dword [ebp - 0x4008]
push eax
call fcn.00408480
add esp, 4
mov ecx, dword [ebp - 0x4010]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x40daf7
cmp dword [ebp - 0x400c], 0
jne 0x40da96
jmp 0x40dad5
cmp dword [ebp - 0x400c], 0
jg 0x40dab3
push 0x35
push str.C:Work_ttol_binmudadmwin32_mudadm.c
push 0x47bf20
call fcn.0041de99
add esp, 0xc
mov eax, dword [ebp - 0x400c]
push eax
lea ecx, [ebp - 0x4004]
push ecx
mov edx, dword [ebp - 0x4008]
push edx
call fcn.00407e20
add esp, 0xc
jmp 0x40da30
mov eax, dword [ebp - 0x4008]
push eax
call fcn.00408390
add esp, 4
mov ecx, dword [ebp - 0x4010]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x4008]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ee13
mov esp, ebp
pop ebp
ret

Function at 0x40db10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push eax
call fcn.00434c00
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00402b50
add esp, 0xc
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 8]
jne 0x40db46
jmp 0x40db5a
push 0x47bf2c
call fcn.00446071
add esp, 4
push 1
call fcn.00446b10
mov esp, ebp
pop ebp
ret

Function at 0x40db60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00402b50
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 4]
jne 0x40db85
jmp 0x40db99
push str.Write_error_CLI_socket
call fcn.00446071
add esp, 4
push 1
call fcn.00446b10
mov esp, ebp
pop ebp
ret
Function at 0x40e110
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push str.usage:_mudadm__options__commands..._n
push 2
call fcn.0041e0b2
add esp, 4
push eax
call fcn.00404240
add esp, 8
push str.Show_this_help
push 0x47c09c
push 0x47c0a0
push 2
call fcn.0041e0b2
add esp, 4
push eax
call fcn.00404240
add esp, 0x10
push str.Sets_the_CLIs_address
push str._T__address_:port
push str.______28s___s_n
push 2
call fcn.0041e0b2
add esp, 4
push eax
call fcn.00404240
add esp, 0x10
push 1
call fcn.00446b10
pop ebp
ret

Function at 0x40e180
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
push 0x47c0ec
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00407950
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x40e1d0
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x54
je 0x40e1bf
cmp dword [ebp - 0x10], 0x68
je 0x40e1c9
jmp 0x40e1c9
mov eax, dword [0x47f588]
mov dword [ebp - 8], eax
jmp 0x40e1ce
call fcn.0040e110
jmp 0x40e18d
mov ecx, dword [0x477d3c]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx*4]
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [0x477d3c]
mov dword [ebp + 8], ecx
push 0
call fcn.00403250
add esp, 4
call fcn.0040e720
call fcn.0040e2c0
push 0
push 0x47c0f0
call fcn.0040bf30
add esp, 8
mov dword [0x47dcb8], eax
cmp dword [0x47dcb8], 0
jne 0x40e233
push 0x10a
push 0x47c0f4
push str.vl___NULL
call fcn.0041de99
add esp, 0xc
cmp dword [ebp - 8], 0
jne 0x40e259
push str..mudfish.vsm
call fcn.0040dee0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x40e257
call fcn.0040e050
mov dword [ebp - 4], eax
jmp 0x40e285
cmp dword [ebp - 8], 0
jne 0x40e276
push 0x111
push str.mudadm.c
push str.T_arg___NULL
call fcn.0041de99
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
call fcn.0040dba0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x40e292
push 2
call fcn.00446b10
cmp dword [ebp + 8], 0
jle 0x40e2ac
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040dc10
add esp, 0xc
push 0
call fcn.00446b10
mov esp, ebp
pop ebp
ret
Function at 0x40eb90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4014
call fcn.0040f0d0
mov eax, dword [0x47c894]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0x80
push 3
push 0
push 3
push connect
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x4010], eax
cmp dword [ebp - 0x4010], 0xffffffff
jne 0x40ebd9
xor eax, eax
jmp 0x40eceb
push 1
push 0
push 0
push 0
call fcn.00407be0
add esp, 0x10
mov dword [ebp - 0x4008], eax
cmp dword [ebp - 0x4008], 0
jne 0x40ec0c
push 0x2c
push 0x47c338
push 0x47c394
call fcn.0041de99
add esp, 0xc
xor edx, edx
jne 0x40ebef
mov dword [ebp - 0x400c], 0xffffffff
push 0
lea eax, [ebp - 0x400c]
push eax
push 0x4000
lea ecx, [ebp - 0x4004]
push ecx
mov edx, dword [ebp - 0x4010]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x4014], eax
cmp dword [ebp - 0x4014], 0
jne 0x40ec7f
push 0x31
push str.lva_readFile
push str.ReadFile
call fcn.00401f90
add esp, 0xc
mov eax, dword [ebp - 0x4008]
push eax
call fcn.00408480
add esp, 4
mov ecx, dword [ebp - 0x4010]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x40eceb
cmp dword [ebp - 0x400c], 0
jne 0x40ec8a
jmp 0x40ecc9
cmp dword [ebp - 0x400c], 0
jg 0x40eca7
push 0x38
push 0x47c3c8
push str.n___0
call fcn.0041de99
add esp, 0xc
mov eax, dword [ebp - 0x400c]
push eax
lea ecx, [ebp - 0x4004]
push ecx
mov edx, dword [ebp - 0x4008]
push edx
call fcn.00407e20
add esp, 0xc
jmp 0x40ec10
mov eax, dword [ebp - 0x4008]
push eax
call fcn.00408390
add esp, 4
mov ecx, dword [ebp - 0x4010]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x4008]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ee13
mov esp, ebp
pop ebp
ret

Function at 0x44cee7
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044cdbb

Function at 0x451788
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00451380

Function at 0x451793
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045150a

Function at 0x45b220
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045ac1c
Function at 0x4382fa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pushal
mov edx, dword [ebp + 8]
add edx, dword [edx + 0x3c]
mov edx, dword [edx + 0x78]
add edx, dword [ebp + 8]
mov ecx, dword [edx + 0x18]
mov esi, dword [edx + 0x20]
add esi, dword [ebp + 8]
push ecx
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
xor edi, edi
mov ecx, dword [eax]
inc eax
adc edi, ecx
rol ecx, 8
or cl, cl
jne 0x43831a
cmp edi, dword [ebp + 0xc]
pop ecx
loopne 0x438313
jne 0x438357
sub esi, 4
sub esi, dword [ebp + 8]
sub esi, dword [edx + 0x20]
shr esi, 1
add esi, dword [edx + 0x24]
add esi, dword [ebp + 8]
lodsd eax, dword [esi]
movzx eax, ax
shl eax, 2
add eax, dword [edx + 0x1c]
add eax, dword [ebp + 8]
mov edx, dword [eax]
add edx, dword [ebp + 8]
mov dword [esp + 0x1c], edx
jmp 0x43835f
mov dword [esp + 0x1c], 0
popal
leave
ret 8
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x13e17796
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x555e030b
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x408923
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x4085d8
add edi, 1
dec edi
call fcn.0040894e
push edi
pop edi
xor dword [edx], ebx
add edi, 1
push ecx
pop ecx
inc edx
cmp edx, eax
jne fcn.00408923
push 0xb0a38ef5
pop edi
and ecx, edi
ret