joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417900
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jg 0x417920
jl 0x417917
cmp dword [ebp + 0xc], 0
ja 0x417920
xor eax, eax
xor edx, edx
jmp 0x417a67
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x417943
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
jmp 0x417a67
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x4179b5
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.00407240
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00406360
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int_]
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x417a58
mov ecx, dword [ebp - 8]
call fcn.00416a80
mov dword [ebp - 0x20], 0xfff
cmp dword [ebp - 4], 0xfff
jbe 0x417a26
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
cmp dword [ebp - 0x10], 0xfff
je 0x417a24
xor eax, eax
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x24]
sbb edx, eax
mov eax, ecx
jmp 0x417a67
jmp 0x4179d1
cmp dword [ebp - 4], 0
jbe 0x417a58
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x24]
sbb ecx, edx
mov edx, ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x417a70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x417a9c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x417b82
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x417b33
jg 0x417ac5
cmp dword [ebp + 0xc], 0
jbe 0x417b33
cmp dword [ebp - 8], 0
jl 0x417b33
jg 0x417ad3
cmp dword [ebp - 0xc], 0
jbe 0x417b33
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jg 0x417af1
jl 0x417ae5
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0xc]
jae 0x417af1
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push eax
call fcn.00406360
add esp, 0xc
mov eax, dword [ebp - 0xc]
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
sbb edx, dword [ebp - 8]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
cmp dword [ebp + 0x10], 0
jl 0x417b76
jg 0x417b41
cmp dword [ebp + 0xc], 0
jbe 0x417b76
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x4c], 0
je 0x417b76
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x425410
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
xor edx, edx
pop ebp
ret

Function at 0x425430
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
xor edx, edx
pop ebp
ret

Function at 0x425600
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
not eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], 0x4b44d8
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x425661
mov ecx, dword [ebp - 4]
shr ecx, 8
mov edx, dword [ebp - 4]
and edx, 0xff
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
xor edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, dword [eax + edx*4]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
jmp 0x42561b
mov eax, dword [ebp - 4]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x425670
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
not eax
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0x4b44d8
cmp dword [ebp + 0xc], 0
je 0x425729
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
sub ecx, 1
mov dword [ebp + 0xc], ecx
cmp dword [ebp - 0x14], 0
je 0x425727
mov edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 3], al
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov dl, byte [ebp - 3]
mov byte [ebp - 2], dl
movzx eax, byte [ebp - 2]
cmp eax, 0x23
jne 0x425704
cmp dword [ebp + 0xc], 2
jb 0x425704
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x23
jne 0x425704
mov edx, 1
shl edx, 0
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x23
jne 0x425704
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
shr eax, 8
mov ecx, dword [ebp - 0xc]
and ecx, 0xff
movzx edx, byte [ebp - 2]
xor ecx, edx
mov edx, dword [ebp - 0x10]
xor eax, dword [edx + ecx*4]
mov dword [ebp - 0xc], eax
jmp 0x42569b
jmp 0x42579e
mov eax, dword [ebp - 8]
mov cl, byte [eax]
mov byte [ebp - 4], cl
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov al, byte [ebp - 4]
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x42579e
movzx edx, byte [ebp - 1]
cmp edx, 0x23
jne 0x42577f
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x23
jne 0x42577f
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp - 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x23
jne 0x42577f
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
shr edx, 8
mov eax, dword [ebp - 0xc]
and eax, 0xff
movzx ecx, byte [ebp - 1]
xor eax, ecx
mov ecx, dword [ebp - 0x10]
xor edx, dword [ecx + eax*4]
mov dword [ebp - 0xc], edx
jmp 0x425729
mov eax, dword [ebp - 0xc]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x460ac0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x178
mov eax, dword [0x4df040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x16c], 0
mov dword [ebp - 0x154], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0xffffffff
jne 0x460b34
push str.Error_creating_process_snapshot.
mov eax, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
push eax
call fcn.0045e380
add esp, 8
mov dword [ebp - 0x174], eax
push 0x45ef30
mov ecx, dword [ebp - 0x174]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, dword [ebp - 0x16c]
jmp 0x460c7b
lea ecx, [ebp - 0x154]
push ecx
mov edx, dword [ebp - 0x168]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x460c68
mov dword [ebp - 0x160], 0x4cb1b8
lea eax, [ebp - 0x130]
mov dword [ebp - 0x15c], eax
mov ecx, dword [ebp - 0x15c]
mov dl, byte [ecx]
mov byte [ebp - 0x155], dl
mov eax, dword [ebp - 0x160]
cmp dl, byte [eax]
jne 0x460bc3
cmp byte [ebp - 0x155], 0
je 0x460bb7
mov ecx, dword [ebp - 0x15c]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x156], dl
mov eax, dword [ebp - 0x160]
cmp dl, byte [eax + 1]
jne 0x460bc3
add dword [ebp - 0x15c], 2
add dword [ebp - 0x160], 2
cmp byte [ebp - 0x156], 0
jne 0x460b65
mov dword [ebp - 0x170], 0
jmp 0x460bce
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x170], ecx
mov edx, dword [ebp - 0x170]
mov dword [ebp - 0x178], edx
cmp dword [ebp - 0x178], 0
jne 0x460c4d
mov eax, dword [ebp - 0x14c]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0
je 0x460c4d
push 0x28
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x164]
push edx
call sub.KERNEL32.dll_K32GetProcessMemoryInfo
test eax, eax
je 0x460c40
cmp dword [ebp - 0x20], 0x3c2e766
jbe 0x460c40
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x16c], eax
mov ecx, dword [ebp - 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x460c68
mov edx, dword [ebp - 0x164]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x154]
push eax
mov ecx, dword [ebp - 0x168]
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x460b4f
mov edx, dword [ebp - 0x168]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x16c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004acccf
mov esp, ebp
pop ebp
ret

Function at 0x460cf0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
push str.ConsoleWindowClass
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret
Function at 0x460fd0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b05c5
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4df040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
push 0x4cb1e8
lea ecx, [ebp - 0x28]
push ecx
call fcn.004069d0
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.004056c0
mov dword [ebp - 0x2c], eax
push 0
push 0
mov edx, dword [ebp - 0x2c]
push edx
push str.cmd.exe
push 0x4cb1f4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00405810
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00405810
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004acccf
mov esp, ebp
pop ebp
ret

Function at 0x461e60
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
mov eax, dword [0x4df040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x154], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x168], eax
lea eax, [ebp - 0x154]
push eax
mov ecx, dword [ebp - 0x168]
push ecx
call sub.KERNEL32.dll_Process32First
cmp eax, 1
jne 0x461fb9
lea edx, [ebp - 0x154]
push edx
mov eax, dword [ebp - 0x168]
push eax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
jne 0x461fb9
mov dword [ebp - 0x160], 0x4cb3d8
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x15c], ecx
mov edx, dword [ebp - 0x15c]
mov al, byte [edx]
mov byte [ebp - 0x155], al
mov ecx, dword [ebp - 0x160]
cmp al, byte [ecx]
jne 0x461f42
cmp byte [ebp - 0x155], 0
je 0x461f36
mov edx, dword [ebp - 0x15c]
mov al, byte [edx + 1]
mov byte [ebp - 0x156], al
mov ecx, dword [ebp - 0x160]
cmp al, byte [ecx + 1]
jne 0x461f42
add dword [ebp - 0x15c], 2
add dword [ebp - 0x160], 2
cmp byte [ebp - 0x156], 0
jne 0x461ee4
mov dword [ebp - 0x16c], 0
jmp 0x461f4d
sbb edx, edx
or edx, 1
mov dword [ebp - 0x16c], edx
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0
jne 0x461fb4
mov ecx, dword [ebp - 0x14c]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0
jne 0x461f8a
jmp 0x461eb2
push 0x28
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x164]
push eax
call sub.KERNEL32.dll_K32GetProcessMemoryInfo
test eax, eax
je 0x461fa7
mov eax, dword [ebp - 0x20]
jmp 0x461fc6
mov ecx, dword [ebp - 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x461eb2
mov edx, dword [ebp - 0x168]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004acccf
mov esp, ebp
pop ebp
ret
Function at 0x462ab0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b06ad
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4df040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
push 0x4cb1c8
push 0
lea ecx, [ebp + 8]
call fcn.00408830
push 0x3c
push 0
lea eax, [ebp - 0x54]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x54], 0x3c
mov dword [ebp - 0x50], 0x40
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0x4cb1cc
lea ecx, [ebp + 8]
call fcn.004056c0
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x54]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x462b67
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00405810
mov eax, dword [ebp - 0x10]
jmp 0x462ba3
push 0xffffffffffffffff
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00405810
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x46cdd0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
sub esp, 0x18
mov eax, dword [0x4df040]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
test esi, esi
je 0x46ce9b
lea eax, [esp + 4]
push eax
push esi
push 2
call fcn.00487fe0
add esp, 0xc
test eax, eax
jne 0x46ce9b
lea eax, [esp + 8]
push eax
push esi
push 0x17
call fcn.00487fe0
add esp, 0xc
test eax, eax
jne 0x46ce9b
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x46ce24
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.00487fb0
add esp, 0xc
test eax, eax
je 0x46ce58
sub eax, esi
push eax
push 0x2e
push esi
call fcn.00487fb0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x46ce5a
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x46ce86
mov al, byte [esi]
push eax
call fcn.0047b1b0
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x46ce68
pop edi
movzx eax, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004acccf
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop esi
xor ecx, esp
call fcn.004acccf
add esp, 0x18
ret
Function at 0x476cd0
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
cmp dword [edi + 0x608], 0
je 0x476d14
push 1
push edi
call fcn.00468ad0
push dword [edi + 0x59c]
mov eax, dword [edi + 0x608]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.00468ad0
add esp, 0x24
mov eax, esi
pop edi
pop esi
ret
mov edx, dword [esp + 0x10]
mov ecx, edx
sub ecx, 0
je 0x476d29
sub ecx, 1
je 0x476d29
sub ecx, 1
jne 0x476d5a
push dword [edi + 0x598]
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
lea eax, [edx*2 + 0x4ce7d8]
push 1
add eax, edx
push 2
push eax
call esi
push dword [edi + 0x598]
push 1
push dword [esp + 0x30]
push dword [esp + 0x30]
call esi
add esp, 0x20
pop edi
xor eax, eax
pop esi
ret

Function at 0x477460
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x10c
mov eax, dword [0x4df040]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x118]
mov edx, dword [esp + 0x114]
push ebx
mov ebx, dword [esp + 0x114]
mov dword [esp + 8], eax
xor eax, eax
push ebp
mov ebp, dword [esp + 0x128]
mov ecx, dword [ebx + 0x424]
cmp edx, ecx
push esi
sete al
mov esi, 0x448
push edi
lea eax, [eax*4 + 0x420]
mov eax, dword [eax + ebx]
mov dword [esp + 0x10], eax
mov eax, 0x458
cmove esi, eax
mov eax, dword [ebx + 0x548]
add esi, ebx
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x40], 3
je 0x47756d
xor eax, eax
cmp edx, ecx
sete al
lea eax, [eax*4 + 0x438]
cmp dword [eax + ebx], 0x477020
jne 0x47756d
cmp dword [esi], 0
je 0x4774f8
test edi, edi
je 0x47756d
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [esp + 0x20]
call fcn.00486790
add esp, 0x14
cmp eax, 0xffffffff
je 0x47756d
test al, 1
je 0x47756d
cmp dword [esi], 0
jne 0x477544
mov eax, dword [ebx]
mov eax, dword [eax + 0x90c]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x4df014]
mov edi, dword [esi + 4]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov ecx, dword [esi]
test ecx, ecx
je 0x477566
mov eax, dword [esi + 8]
push 0
push edi
add eax, ecx
push eax
push dword [esp + 0x1c]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x47756d
add dword [esi + 8], eax
jmp 0x47756d
mov dword [esi + 4], 0
push 0
push dword [esp + 0x130]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4775d6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x4775a7
mov dword [ebp], 0
lea eax, [edi + 0x52]
jmp 0x4775db
push 0x100
lea eax, [esp + 0x1c]
push eax
push esi
call fcn.00464750
push eax
push str.Send_failure:__s
push dword [ebx]
call fcn.00476d60
mov eax, dword [ebx]
add esp, 0x18
mov dword [eax + 0xd44], esi
mov eax, 0x37
jmp 0x4775d8
xor eax, eax
mov dword [ebp], edi
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004acccf
add esp, 0x10c
ret
Function at 0x4779e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 4]
cmp byte [eax + 0x474], 0
je 0x4779fd
push eax
call fcn.00471250
add esp, 4
test eax, eax
je 0x477a1e
mov al, 1
ret
mov eax, dword [eax + 0x420]
cmp eax, 0xffffffff
je 0x477a1e
push 2
push 1
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
setne al
ret
xor al, al
ret
Function at 0x4797f0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x47980a
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x4cec58
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strpbrk]
add esp, 8
test eax, eax
je 0x479853
test ebp, ebp
je 0x479844
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x479879
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x479879
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x47992f
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x479896
sub ecx, ebx
lea eax, [edx + 1]
add eax, ecx
push eax
call dword [0x4df014]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x479925
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x479925
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4798c8
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4798e0
sub ecx, edx
sub ecx, esi
add ecx, ebx
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x4798f0
test ebp, ebp
je 0x47991c
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x4df018]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x4df018]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x47ee40
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x47ee54
mov eax, dword [eax]
mov eax, dword [eax + 0x78]
mov al, byte [eax + 0xe7]
ret
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x47ee68
xor al, al
ret
push eax
push 0
call fcn.00477910
add esp, 8
mov al, 1
ret

Function at 0x47f9f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [ecx]
cmp byte [eax + 0xb2c], 0
je 0x47fa08
mov dword [esp + 4], ecx
jmp fcn.004a18c0
mov dword [esp + 4], ecx
jmp fcn.0046d3e0