joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ccf68
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov ebx, dword [eax]
not ebx
mov dword [ecx], ebx
mov ebx, dword [eax + 4]
not ebx
mov dword [ecx + 4], ebx
mov ebx, dword [eax + 8]
not ebx
mov dword [ecx + 8], ebx
mov eax, dword [eax + 0xc]
not eax
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x41ccff6
inc eax
mov dword [ebp - 0x10], 0
mov ebx, dword [edx]
mov ebx, dword [ecx + ebx*4]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0x10]
movzx esi, byte [esi + edi]
xor ebx, esi
and ebx, 0xff
mov dword [ebp - 0x14], ebx
mov ebx, dword [edx]
mov ebx, dword [ecx + ebx*4]
shr ebx, 8
and ebx, 0xffffff
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 0x14]
xor ebx, dword [esi + edi*4 + 0xc]
mov esi, dword [edx]
mov dword [ecx + esi*4], ebx
mov ebx, dword [edx]
inc ebx
and ebx, 3
mov dword [edx], ebx
inc dword [ebp - 0x10]
dec eax
jne 0x41ccfb1
not dword [ecx]
not dword [ecx + 4]
not dword [ecx + 8]
not dword [ecx + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41cee8c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov byte [ebp - 5], dl
mov edi, eax
xor eax, eax
push ebp
push 0x41cef34
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.041b5e50
dec eax
je 0x41ceecd
mov ecx, 0x41cef50
mov dl, 1
mov eax, dword [0x41bc3ac]
call fcn.041ad4d4
call fcn.041940c8
xor eax, eax
mov dword [ebp - 4], eax
mov eax, edi
mov edx, 1
call fcn.041b5e78
mov ebx, eax
mov eax, edi
mov edx, 1
call fcn.041b5e9c
mov esi, eax
sub esi, ebx
jb 0x41cef1e
inc esi
push ebx
push 1
push edi
lea eax, [ebp - 0x18]
push eax
call fcn.041b5f48
add esp, 0x10
lea eax, [ebp - 0x18]
mov dl, byte [ebp - 5]
call fcn.041cf080
xor eax, dword [ebp - 4]
xor eax, ebx
mov dword [ebp - 4], eax
rol dword [ebp - 4], 8
inc ebx
dec esi
jne 0x41ceef3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41cef3b
lea eax, [ebp - 0x18]
call fcn.041b0ae0
ret
Function at 0x41e86a4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.041962a8
xor eax, eax
push ebp
push 0x41e87de
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebx + 4]
call fcn.04194934
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x6c]
lea eax, [ebp - 0xc]
mov edx, dword [ebx + 8]
call fcn.04194934
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov edx, dword [ebx + 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov edx, dword [ebx + 0x10]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x70]
mov edx, dword [ebx + 0x14]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x58]
lea eax, [ebx + 0x20]
call fcn.041e891c
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x60]
lea eax, [ebx + 0x28]
call fcn.041e891c
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x48]
lea eax, [ebx + 0x30]
call fcn.041e891c
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x5c]
lea eax, [ebx + 0x38]
call fcn.041e891c
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x64]
lea eax, [ebp - 0x10]
mov edx, dword [ebx + 0x48]
call fcn.04194934
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x4c]
mov edx, dword [ebx + 0x1c]
shl edx, 0x20
add edx, dword [ebx + 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x50]
lea eax, [ebp - 0x14]
mov edx, dword [ebx + 0x40]
call fcn.04194934
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebx + 0x4c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e87e5
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.04194760
lea eax, [ebp - 4]
call fcn.04196234
ret

Function at 0x41ea768
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push ecx
mov dword [esp], edx
mov edx, dword [eax]
sub ecx, 1
jno 0x41ea77a
call fcn.04193890
test ecx, ecx
jl 0x41ea7a3
inc ecx
mov ebx, edx
mov esi, dword [esp]
xor bl, byte [esi]
and ebx, 0xff
mov esi, dword [0x4200984]
mov ebx, dword [esi + ebx*4]
shr edx, 8
xor ebx, edx
mov edx, ebx
add dword [esp], 1
dec ecx
jne 0x41ea77f
mov dword [eax], edx
pop edx
pop esi
pop ebx
ret
Function at 0x41eaf60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, edx
mov ebx, eax
mov eax, dword [ebx + 0x28]
mov dword [esp + 8], eax
cmp ecx, esi
jge 0x41eaf7a
inc dword [esp + 8]
mov eax, dword [ebx + 0x18]
mov dword [esp], eax
mov eax, dword [ebx + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x20]
mov edx, ecx
dec edx
test edx, edx
jl 0x41eafcb
inc edx
shl eax, 5
mov ecx, dword [esp + 8]
movzx ecx, byte [ecx + 2]
xor eax, ecx
and eax, 0x3fff
mov ecx, dword [esp + 8]
and ecx, dword [ebx + 0x58]
mov edi, dword [esp]
mov ebp, dword [esp + 4]
mov ebp, dword [ebp + eax*4]
mov dword [edi + ecx*4], ebp
mov ecx, dword [esp + 4]
mov edi, dword [esp + 8]
mov dword [ecx + eax*4], edi
inc dword [esp + 8]
dec edx
jne 0x41eaf92
mov edx, dword [esp]
mov dword [ebx + 0x18], edx
mov edx, dword [esp + 4]
mov dword [ebx + 0x1c], edx
mov dword [ebx + 0x20], eax
mov eax, dword [esp + 8]
mov dword [ebx + 0x28], eax
cmp byte [ebx + 4], 0
je 0x41eb005
add dword [ebx + 0x44], esi
add dword [ebx + 0x48], esi
cmp byte [ebx + 0x34], 0
je 0x41eb025
mov eax, dword [ebx + 0x44]
cmp eax, dword [ebx + 0x40]
jb 0x41eb025
mov eax, ebx
call fcn.041eb3c0
jmp 0x41eb025
mov eax, dword [esp + 8]
sub eax, dword [ebx + 0x44]
cmp eax, dword [ebx + 0x5c]
jl 0x41eb025
mov byte [ebx + 4], 1
mov eax, dword [esp + 8]
sub eax, dword [ebx + 0x5c]
sub eax, dword [ebx + 0x44]
add dword [ebx + 0x44], eax
add dword [ebx + 0x48], eax
cmp word [ebx + 0x3a], 0
je 0x41eb05a
add dword [ebx + 0x10], esi
mov esi, dword [ebx + 0x10]
test esi, 0xfff
jne 0x41eb05a
mov dword [esp + 0xc], esi
fild dword [esp + 0xc]
fmul dword [0x41eb074]
fild dword [ebx + 0x50]
fdivp st(1)
call fcn.04192fe4
mov edx, eax
mov eax, dword [ebx + 0x3c]
call dword [ebx + 0x38]
mov eax, dword [ebx + 0x44]
cmp eax, dword [ebx + 0x40]
jb 0x41eb069
mov eax, ebx
call fcn.041eb3c0
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41ed640
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov dword [esp], eax
lea esi, [esp + 8]
mov eax, dword [esp]
mov eax, dword [eax + 8]
mov dword [esi], eax
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov dword [esi + 4], eax
mov eax, dword [esp]
mov eax, dword [eax + 0x10]
mov dword [esi + 8], eax
mov dword [esp + 4], edx
mov ebx, ecx
dec ebx
test ebx, ebx
jl 0x41ed6d3
inc ebx
mov eax, dword [esi + 8]
and eax, 0xffff
or eax, 2
mov edx, dword [esp + 4]
mov dl, byte [edx]
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor dl, cl
mov eax, dword [esp + 4]
mov byte [eax], dl
mov eax, dword [esp + 4]
mov al, byte [eax]
mov edx, dword [esi]
call fcn.041e9de0
mov edi, eax
mov dword [esi], edi
and edi, 0xff
add dword [esi + 4], edi
imul edi, dword [esi + 4], 0x8088405
inc edi
mov dword [esi + 4], edi
mov eax, edi
shr eax, 0x18
mov edx, dword [esi + 8]
call fcn.041e9de0
mov dword [esi + 8], eax
inc dword [esp + 4]
dec ebx
jne 0x41ed673
mov eax, dword [esp]
mov edx, dword [esi]
mov dword [eax + 8], edx
mov eax, dword [esp]
mov edx, dword [esi + 4]
mov dword [eax + 0xc], edx
mov eax, dword [esp]
mov edx, dword [esi + 8]
mov dword [eax + 0x10], edx
add esp, 0x14
pop edi
pop esi
pop ebx
ret

Function at 0x41ed6f4
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov edx, ecx
mov eax, ebx
call fcn.041ed784
mov dword [ebp - 8], 0xc
mov edi, dword [ebp - 4]
lea esi, [ebp - 0x14]
mov eax, dword [ebx + 0x10]
and eax, 0xffff
or eax, 2
mov edx, eax
xor edx, 1
imul edx, eax
shr edx, 8
xor dl, byte [edi]
mov byte [esi], dl
mov edx, dword [ebx + 8]
mov al, byte [esi]
call fcn.041e9de0
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.041e9de0
mov dword [ebx + 0x10], eax
inc esi
inc edi
dec dword [ebp - 8]
jne 0x41ed718
mov al, byte [ebp + 0xb]
cmp al, byte [ebp - 9]
sete al
mov byte [ebx + 4], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41ed784
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], edx
mov ebx, eax
mov dword [ebx + 8], 0x12345678
mov dword [ebx + 0xc], 0x23456789
mov dword [ebx + 0x10], 0x34567890
mov eax, dword [esp]
call fcn.041949d8
mov esi, eax
test esi, esi
jle 0x41ed7f2
mov edi, 1
mov eax, dword [esp]
mov al, byte [eax + edi - 1]
mov edx, dword [ebx + 8]
call fcn.041e9de0
mov ebp, eax
mov dword [ebx + 8], ebp
and ebp, 0xff
add dword [ebx + 0xc], ebp
imul ebp, dword [ebx + 0xc], 0x8088405
inc ebp
mov dword [ebx + 0xc], ebp
mov eax, ebp
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.041e9de0
mov dword [ebx + 0x10], eax
inc edi
dec esi
jne 0x41ed7b6
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41ed958
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.041edbe0
mov dword [ebp - 0x10], 0xa
lea edi, [ebp - 0x1c]
mov eax, pe_nt_image_headers32
call fcn.0419325c
mov byte [ebp - 9], al
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, esi
xor eax, 1
imul esi
shr eax, 8
mov esi, eax
mov edx, dword [ebx + 8]
mov al, byte [ebp - 9]
call fcn.041e9de0
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.041e9de0
mov dword [ebx + 0x10], eax
mov eax, esi
xor al, byte [ebp - 9]
mov byte [edi], al
inc edi
dec dword [ebp - 0x10]
jne 0x41ed97d
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.041edbe0
mov dword [ebp - 0x10], 0xa
lea edi, [ebp - 0x1c]
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, esi
xor eax, 1
imul esi
shr eax, 8
mov esi, eax
mov al, byte [edi]
mov edx, dword [ebx + 8]
call fcn.041e9de0
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.041e9de0
mov dword [ebx + 0x10], eax
mov eax, esi
xor byte [edi], al
inc edi
dec dword [ebp - 0x10]
jne 0x41ed9f8
mov al, byte [ebp + 0xa]
mov byte [ebp - 9], al
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, esi
xor eax, 1
imul esi
shr eax, 8
mov esi, eax
mov edx, dword [ebx + 8]
mov al, byte [ebp - 9]
call fcn.041e9de0
mov edi, eax
mov dword [ebx + 8], edi
and edi, 0xff
add dword [ebx + 0xc], edi
imul edi, dword [ebx + 0xc], 0x8088405
inc edi
mov dword [ebx + 0xc], edi
mov eax, edi
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.041e9de0
mov dword [ebx + 0x10], eax
mov eax, esi
xor al, byte [ebp - 9]
mov byte [ebp - 0x12], al
mov al, byte [ebp + 0xb]
mov byte [ebp - 9], al
mov esi, dword [ebx + 0x10]
and esi, 0xffff
or esi, 2
mov eax, esi
xor eax, 1
imul esi
shr eax, 8
mov esi, eax
mov edx, dword [ebx + 8]
mov al, byte [ebp - 9]
call fcn.041e9de0
mov edi, eax
mov dword [ebx + 8], edi
and edi, 0xff
add dword [ebx + 0xc], edi
imul edi, dword [ebx + 0xc], 0x8088405
inc edi
mov dword [ebx + 0xc], edi
mov eax, edi
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.041e9de0
mov dword [ebx + 0x10], eax
mov eax, esi
xor al, byte [ebp - 9]
mov byte [ebp - 0x11], al
mov byte [ebx + 4], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
mov edx, dword [ebp - 0x18]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x14]
mov dword [eax + 8], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41edb24
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov dword [esp + 4], ecx
mov dword [esp], eax
lea edi, [esp + 0xc]
mov eax, dword [esp]
mov eax, dword [eax + 8]
mov dword [edi], eax
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov dword [edi + 4], eax
mov eax, dword [esp]
mov eax, dword [eax + 0x10]
mov dword [edi + 8], eax
mov dword [esp + 8], edx
mov esi, dword [esp + 4]
dec esi
test esi, esi
jl 0x41edbbc
inc esi
mov eax, dword [edi + 8]
and eax, 0xffff
or eax, 2
mov edx, dword [esp + 8]
mov bl, byte [edx]
mov edx, ebx
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor dl, cl
mov eax, dword [esp + 8]
mov byte [eax], dl
mov edx, dword [edi]
mov eax, ebx
call fcn.041e9de0
mov ebp, eax
mov dword [edi], ebp
and ebp, 0xff
add dword [edi + 4], ebp
imul ebx, dword [edi + 4], 0x8088405
inc ebx
mov dword [edi + 4], ebx
mov eax, ebx
shr eax, 0x18
mov edx, dword [edi + 8]
call fcn.041e9de0
mov dword [edi + 8], eax
inc dword [esp + 8]
dec esi
jne 0x41edb5e
mov eax, dword [esp]
mov edx, dword [edi]
mov dword [eax + 8], edx
mov eax, dword [esp]
mov edx, dword [edi + 4]
mov dword [eax + 0xc], edx
mov eax, dword [esp]
mov edx, dword [edi + 8]
mov dword [eax + 0x10], edx
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x41edbe0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], edx
mov ebx, eax
mov dword [ebx + 8], 0x12345678
mov dword [ebx + 0xc], 0x23456789
mov dword [ebx + 0x10], 0x34567890
mov eax, dword [esp]
call fcn.041949d8
mov esi, eax
test esi, esi
jle 0x41edc4e
mov edi, 1
mov eax, dword [esp]
mov al, byte [eax + edi - 1]
mov edx, dword [ebx + 8]
call fcn.041e9de0
mov ebp, eax
mov dword [ebx + 8], ebp
and ebp, 0xff
add dword [ebx + 0xc], ebp
imul ebp, dword [ebx + 0xc], 0x8088405
inc ebp
mov dword [ebx + 0xc], ebp
mov eax, ebp
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.041e9de0
mov dword [ebx + 0x10], eax
inc edi
dec esi
jne 0x41edc12
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x41f1a94
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41f1b12
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.wsock32.dll_getsockname
test eax, eax
jne 0x41f1afc
movzx eax, word [ebp - 0x14]
mov dword [esi], eax
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x10]
call fcn.041f19e8
mov edx, dword [ebp - 0x18]
mov eax, edi
call fcn.04194790
mov ax, word [ebp - 0x12]
push eax
call sub.wsock32.dll_ntohs
movzx eax, ax
mov edx, dword [ebp + 8]
mov dword [edx], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41f1b19
lea eax, [ebp - 0x18]
call fcn.0419473c
ret
Function at 0x41f59f8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41f5a95
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [ebx + 0x30]
call fcn.0419624c
mov eax, dword [ebx + 0x30]
mov edx, dword [eax]
call dword [edx + 0xc]
test eax, eax
jle 0x41f5a74
mov eax, dword [ebx + 0x30]
mov edx, dword [eax]
call dword [edx + 0xc]
mov edx, eax
dec edx
lea ecx, [ebp - 0x10]
mov eax, dword [ebx + 0x30]
mov esi, dword [eax]
call dword [esi + 0x14]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
xor edx, edx
call fcn.041b4e90
lea edx, [ebp - 0x20]
pop eax
call fcn.041b63a4
jne 0x41f5a74
mov eax, dword [ebx + 0x30]
mov edx, dword [eax]
call dword [edx + 0xc]
mov edx, eax
dec edx
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0xa0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41f5a9c
lea eax, [ebp - 0x20]
mov edx, dword [0x4191078]
mov ecx, 2
call fcn.04195174
ret

Function at 0x41fa414
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, ecx
mov byte [ebp - 1], 0
push edx
call fcn.041f944c
pop ecx
cmp eax, 4
jne 0x41fa487
mov dword [ebp - 0xc], 0x800
mov eax, 0x10
call fcn.04192d18
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x41fa480
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.ws2_32.dll_getsockname_1
test eax, eax
jne 0x41fa465
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41fa487
mov edx, 0x10
mov eax, dword [ebp - 8]
call fcn.04192d48
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402cd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x413553
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x416800
mov dword [esi + 4], edi
lea ebx, [esi + 8]
mov dword [esp + 0x18], edi
mov ecx, ebx
call fcn.00412ae6
mov dword [ebx], 0x4167ec
lea ebx, [esi + 0x1c]
mov byte [esp + 0x18], 1
mov ecx, ebx
call fcn.00412ae6
or eax, 0xffffffff
push 0x41c7e8
mov dword [ebx], 0x4167b0
push edi
mov dword [esi], 0x4167c4
mov dword [esi + 0x54], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x30], 0x10
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x38], 0xc0c0c0
mov dword [esi + 0x3c], edi
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x404f40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4137cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x4168a8
mov eax, dword [esi + 0x30]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x1c], 1
je 0x404fd0
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 0x20]
mov ecx, edx
push ebx
sub eax, ecx
mov ecx, dword [esi + 0x28]
mov ebx, edi
sub ecx, ebx
mov ebx, dword [esi + 0x1c]
cmp esi, ebp
je 0x404f97
mov ebp, dword [esi + 4]
push 0xcc0020
push edx
push edi
push ebp
push eax
mov eax, dword [ebx + 4]
push ecx
push edx
push edi
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 0x18]
pop ebx
test eax, eax
jne 0x404fc1
mov ecx, dword [esi + 4]
push eax
push ecx
call sub.MFC42.DLL_CDC::SelectGdiObject
jmp 0x404fd6
mov eax, dword [eax + 4]
mov ecx, dword [esi + 4]
push eax
push ecx
call sub.MFC42.DLL_CDC::SelectGdiObject
jmp 0x404fd6
mov dword [esi + 8], ebp
mov dword [esi + 4], ebp
lea edi, [esi + 0x10]
mov dword [esp + 0x10], edi
mov dword [edi], 0x416830
mov ecx, edi
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, esi
mov dword [edi], 0x41681c
mov dword [esp + 0x1c], 0xffffffff
call fcn.00412bfa
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4065e0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x413a40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
xor eax, eax
push esi
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x41686c
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], eax
push ecx
push eax
push eax
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CGdiObject::Attach
mov esi, dword [esp + 0x30]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call sub.MFC42.DLL_CDC::SelectObject_1
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
mov dword [esp + 0x3c], eax
mov ecx, esi
lea eax, [edi + 2]
push eax
lea eax, [esp + 0x1c]
push ebx
push eax
call sub.MFC42.DLL_CDC::MoveTo
lea eax, [edi + 5]
mov ecx, esi
push eax
push ebx
call sub.MFC42.DLL_CDC::LineTo
lea ebp, [edi + 3]
lea eax, [ebx + 1]
push ebp
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
lea eax, [edi + 6]
mov ecx, esi
push eax
lea eax, [ebx + 1]
push eax
call sub.MFC42.DLL_CDC::LineTo
lea eax, [edi + 4]
lea ecx, [ebx + 2]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
lea eax, [edi + 7]
mov ecx, esi
push eax
lea eax, [ebx + 2]
push eax
call sub.MFC42.DLL_CDC::LineTo
lea eax, [ebx + 3]
push ebp
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
lea eax, [edi + 6]
mov ecx, esi
push eax
lea eax, [ebx + 3]
push eax
call sub.MFC42.DLL_CDC::LineTo
lea eax, [edi + 2]
lea ecx, [ebx + 4]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
lea eax, [edi + 5]
mov ecx, esi
push eax
lea eax, [ebx + 4]
push eax
call sub.MFC42.DLL_CDC::LineTo
lea ecx, [edi + 1]
lea eax, [ebx + 5]
push ecx
lea edx, [esp + 0x1c]
push eax
push edx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
lea eax, [edi + 4]
mov ecx, esi
push eax
lea eax, [ebx + 5]
push eax
call sub.MFC42.DLL_CDC::LineTo
add ebx, 6
push edi
lea eax, [esp + 0x1c]
push ebx
push eax
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
push ebp
push ebx
mov ecx, esi
call sub.MFC42.DLL_CDC::LineTo
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CDC::SelectObject_1
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [esp + 0x10], 0x416830
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 1
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10