joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423f90
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 0xc]
push esi
mov esi, ecx
mov ecx, dword [esp + 0xc]
push edi
mov dword [esi + 0xb0], eax
mov dword [esi + 0xb4], ecx
mov dword [esi + 0x1ac], edx
mov edi, dword [eax + 8]
test edi, edi
jne 0x423ff1
mov edx, dword [str.dnf.conn.gamesafe.qq.com]
xor ecx, ecx
test edx, edx
je 0x423feb
mov dx, word [eax]
mov eax, 0x44f30c
cmp word [eax - 4], dx
je 0x423fe0
mov edi, dword [eax + 8]
add eax, 8
inc ecx
test edi, edi
jne 0x423fcd
jmp 0x423feb
mov edi, dword [ecx*8 + 0x44f30c]
test edi, edi
jne 0x423ff1
mov edi, dword [str.connunify.gamesafe.qq.com]
mov ecx, esi
call fcn.0042a410
test eax, eax
je 0x42401e
push str.pack_Init_Error_
push 0
push 0
push 0
push 0x138e
call fcn.00421920
add esp, 0x14
mov eax, 0xfffffffe
pop edi
pop esi
ret 0xc
push edi
lea ecx, [esi + 4]
call fcn.00429890
test eax, eax
je 0x424055
push str.m_Socket.Init_Error
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x3ed
push 0
push 0x1389
call fcn.00421920
add esp, 0x14
mov eax, 0xfffffffd
pop edi
pop esi
ret 0xc
push 0
push 0
push esi
push 0x4240c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0xa8], eax
jne 0x424095
push str._SECCLI:TCP__m_MainCtrl_CreateThread_failed
push eax
push 0x3f7
push 0x3f7
call fcn.00421850
add esp, 0x10
mov eax, 0xfffffffc
pop edi
pop esi
ret 0xc
pop edi
xor eax, eax
pop esi
ret 0xc
Function at 0x429890
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x294
lea eax, [esp + 0x104]
push ebx
push esi
push eax
mov ebx, ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4298df
push str.WSAStartup_failed_
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x3e9
push 0
push 0x1389
call fcn.00421920
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebx
add esp, 0x294
ret 4
push edi
mov ecx, 0x20
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0xd]
mov byte [esp + 0xc], al
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
push ecx
push 0
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
pop edi
jne 0x429924
pop esi
mov eax, 0xfffffffe
pop ebx
add esp, 0x294
ret 4
lea edx, [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
test eax, eax
jne 0x429943
pop esi
mov eax, 0xfffffffd
pop ebx
add esp, 0x294
ret 4
lea eax, [esp + 8]
push str._Specify_Ip_
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
test eax, eax
jne 0x429967
pop esi
mov eax, 0xfffffffc
pop ebx
add esp, 0x294
ret 4
lea ecx, [esp + 8]
push 0x456304
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x4299a1
push esi
push 0x7f
push ebx
call dword [sym.imp.MSVCRT.dll_fgets]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x10
xor eax, eax
pop esi
pop ebx
add esp, 0x294
ret 4
mov eax, dword [esp + 0x2a0]
test eax, eax
jne 0x4299d5
push str.pszSvrAddr_is_NULL_
push eax
push 0x3f7
push eax
push 0xbb8
call fcn.00421920
add esp, 0x14
mov eax, 0xfffffffb
pop esi
pop ebx
add esp, 0x294
ret 4
push eax
push 0x454d40
push 0x7f
push ebx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
xor eax, eax
pop esi
pop ebx
add esp, 0x294
ret 4
Function at 0x429af0
Capabilities:
Resolve dns

Disassembly:
push ebp
push esi
mov esi, ecx
push edi
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebp, eax
test ebp, ebp
jne 0x429b77
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
lea ecx, [esi + 0x80]
cmp eax, 0xffffffff
mov dword [ecx], eax
je 0x429b20
test eax, eax
je 0x429b20
pop edi
pop esi
xor eax, eax
pop ebp
ret
push ecx
push esi
mov dword [ecx], 0
call fcn.0042a520
add esp, 8
test eax, eax
jge 0x429b56
push str.gethostbyname_failed_and_GetIPFromIPList_Fail_
push 0
push 0x3ed
push 0
push 0xbb8
call fcn.00421920
add esp, 0x14
or eax, 0xffffffff
pop edi
pop esi
pop ebp
ret
push str.gethostbyname_failed_and_GetIPFromIPList_Success_
push 0
push 0x3ea
push 0
push 0xbb8
call fcn.00421920
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
xor edi, edi
cmp dword [eax], 0
je 0x429b90
mov ecx, dword [eax + 4]
add eax, 4
inc edi
test ecx, ecx
jne 0x429b81
test edi, edi
jne 0x429bb4
push str.no_ip_got_
push 0
push 0x3e9
push 0
push 0xbb8
call fcn.00421920
add esp, 0x14
mov eax, 0xfffffffe
pop edi
pop esi
pop ebp
ret
push ebx
push 0
lea ebx, [esi + 0x80]
call dword [sym.imp.MSVCRT.dll_time]
xor edx, edx
div edi
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + edx*4]
mov eax, dword [ecx]
push eax
push esi
mov dword [ebx], eax
call fcn.0042a660
add esp, 0xc
test eax, eax
je 0x429c06
mov edx, dword [ebx]
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push 0
push 0x3f6
push 0
push 0xbb8
call fcn.00421920
push ebx
push esi
call fcn.0042a520
add esp, 0x1c
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
ret
Function at 0x429f90
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
or eax, 0xffffffff
push ebx
push ebp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x84], eax
je 0x42a17e
cmp dword [esp + 0x124], 5
jae 0x429fce
mov ecx, esi
call fcn.00429f50
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
add esp, 0x10c
ret 8
mov ebx, dword [esp + 0x120]
push 5
push ebx
mov ecx, esi
call fcn.0042a1e0
xor ebp, ebp
cmp eax, ebp
jge 0x429ffe
mov ecx, esi
call fcn.00429f50
pop edi
pop esi
pop ebp
mov eax, 0xfffffffd
pop ebx
add esp, 0x10c
ret 8
jne 0x42a012
pop edi
pop esi
pop ebp
mov eax, 0xfffffffc
pop ebx
add esp, 0x10c
ret 8
cmp eax, 5
mov edi, eax
jae 0x42a07a
mov eax, 5
lea ecx, [edi + ebx]
sub eax, edi
push eax
push ecx
mov ecx, esi
call fcn.0042a1e0
cmp eax, ebp
jl 0x42a0ae
jle 0x42a036
add edi, eax
jmp 0x42a075
mov eax, dword [esi + 0x84]
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x20], eax
push ebp
lea ecx, [esp + 0x20]
push ebp
inc eax
push ecx
push eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x24], 0x16
mov dword [esp + 0x28], ebp
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x42a0c7
cmp eax, ebp
je 0x42a0ff
cmp edi, 5
jb 0x42a019
mov edx, dword [ebx + 1]
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
mov ebx, eax
mov eax, dword [esp + 0x124]
cmp eax, ebx
jae 0x42a118
mov ecx, esi
call fcn.00429f50
pop edi
pop esi
pop ebp
mov eax, 0xfffffff8
pop ebx
add esp, 0x10c
ret 8
mov ecx, esi
call fcn.00429f50
pop edi
pop esi
pop ebp
mov eax, 0xfffffffb
pop ebx
add esp, 0x10c
ret 8
push str.select_error
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x3e9
push ebp
push 0x138a
call fcn.00421920
add esp, 0x14
mov ecx, esi
call fcn.00429f50
pop edi
pop esi
pop ebp
mov eax, 0xfffffffa
pop ebx
add esp, 0x10c
ret 8
mov ecx, esi
call fcn.00429f50
pop edi
pop esi
pop ebp
mov eax, 0xfffffff9
pop ebx
add esp, 0x10c
ret 8
cmp edi, ebx
jae 0x42a17c
mov ecx, dword [esp + 0x120]
mov eax, ebx
sub eax, edi
lea edx, [edi + ecx]
push eax
push edx
mov ecx, esi
call fcn.0042a1e0
cmp eax, ebp
jl 0x42a18b
jle 0x42a13d
add edi, eax
jmp 0x42a178
mov eax, dword [esi + 0x84]
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x20], eax
push ebp
lea edx, [esp + 0x20]
push ebp
inc eax
push edx
push eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x24], 0x16
mov dword [esp + 0x28], ebp
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x42a1a4
cmp eax, ebp
je 0x42a1bd
cmp edi, ebx
jb 0x42a11c
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 8
mov ecx, esi
call fcn.00429f50
pop edi
pop esi
pop ebp
mov eax, 0xfffffff7
pop ebx
add esp, 0x10c
ret 8
mov ecx, esi
call fcn.00429f50
pop edi
pop esi
pop ebp
mov eax, 0xfffffff6
pop ebx
add esp, 0x10c
ret 8
mov ecx, esi
call fcn.00429f50
pop edi
pop esi
pop ebp
mov eax, 0xfffffff5
pop ebx
add esp, 0x10c
ret 8
Function at 0x42a1e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
mov eax, dword [ecx + 0x84]
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x42a231
jne 0x42a220
push str.server_close_connection_
push 0
push 0x3f7
push 0
push 0x138c
call fcn.00421920
add esp, 0x14
or eax, 0xffffffff
ret 8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and al, 0xfe
ret 8

Function at 0x42a240
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
or eax, 0xffffffff
push ebx
push ebp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x84], eax
je 0x42a2e8
mov ebx, dword [esp + 0x124]
test ebx, ebx
jne 0x42a278
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
add esp, 0x10c
ret 8
xor edi, edi
test ebx, ebx
jbe 0x42a2e6
mov ebp, dword [sym.imp.WS2_32.dll_select]
mov ecx, dword [esp + 0x120]
mov eax, ebx
sub eax, edi
lea edx, [edi + ecx]
push eax
push edx
mov ecx, esi
call fcn.0042a340
test eax, eax
jl 0x42a2f5
jle 0x42a2a5
add edi, eax
jmp 0x42a2e2
mov eax, dword [esi + 0x84]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
mov dword [esp + 0x20], eax
push 0
push edx
inc eax
push 0
push eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x24], 0x16
mov dword [esp + 0x28], 0
call ebp
cmp eax, 0xffffffff
je 0x42a30e
test eax, eax
je 0x42a327
cmp edi, ebx
jb 0x42a284
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 8
mov ecx, esi
call fcn.00429f50
pop edi
pop esi
pop ebp
mov eax, 0xfffffffd
pop ebx
add esp, 0x10c
ret 8
mov ecx, esi
call fcn.00429f50
pop edi
pop esi
pop ebp
mov eax, 0xfffffffc
pop ebx
add esp, 0x10c
ret 8
mov ecx, esi
call fcn.00429f50
pop edi
pop esi
pop ebp
mov eax, 0xfffffffb
pop ebx
add esp, 0x10c
ret 8

Function at 0x42a3a0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov eax, dword [ecx + 0x84]
sub esp, 0x14
cmp eax, 0xffffffff
jne 0x42a3b4
xor eax, eax
add esp, 0x14
ret
xor ecx, ecx
lea edx, [esp]
mov dword [esp + 4], ecx
push edx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], 0x10
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
mov ecx, dword [esp + 8]
inc eax
neg eax
sbb eax, eax
and eax, ecx
add esp, 0x14
ret
Function at 0x42a8c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov ebp, ecx
xor esi, esi
push edi
mov dword [esp + 0x18], ebp
mov byte [esp + 0x1c], 0
mov byte [esp + 0x1d], 1
mov byte [esp + 0x1e], 2
mov byte [esp + 0x1f], 4
mov byte [esp + 0x20], 5
mov byte [esp + 0x21], 7
mov byte [esp + 0x22], 8
mov byte [esp + 0x23], 0xa
mov byte [esp + 0x24], 0xb
mov byte [esp + 0x25], 0xc
mov byte [esp + 0x26], 0x10
mov byte [esp + 0x27], 0x16
mov byte [esp + 0x28], 0x17
mov byte [esp + 0x29], 0x1a
xor eax, eax
mov dl, byte [esp + eax + 0x1c]
mov ecx, 0x1f
sub ecx, edx
mov edx, 1
shl edx, cl
or esi, edx
inc eax
cmp eax, 0xe
jb 0x42a917
xor ecx, ecx
mov edx, ebp
mov eax, ecx
mov edi, 8
test al, 1
je 0x42a946
shr eax, 1
xor eax, esi
jmp 0x42a948
shr eax, 1
dec edi
jne 0x42a93c
mov dword [edx], eax
inc ecx
add edx, 4
cmp ecx, 0x100
jl 0x42a935
lea edi, [ebp + 0x400]
mov dword [esp + 0x14], 0x100
mov dword [esp + 0x10], edi
mov ecx, dword [edi - 0x400]
mov edx, ecx
mov eax, ecx
and edx, 0xff
mov esi, ecx
mov ebx, edx
and eax, 0xff00
shl ebx, 0x10
shr esi, 8
add eax, ebx
mov ebx, esi
shl eax, 8
and ebx, 0xff00
add eax, ebx
mov ebx, 3
shr ecx, 0x18
add eax, ecx
mov dword [edi + 0xc00], eax
mov ecx, dword [esp + 0x18]
add edi, 0x400
mov ecx, dword [ecx + edx*4]
xor ecx, esi
mov edx, ecx
mov eax, ecx
and edx, 0xff
mov esi, ecx
mov ebp, edx
and eax, 0xff00
shl ebp, 0x10
shr esi, 8
add eax, ebp
mov ebp, esi
shl eax, 8
and ebp, 0xff00
mov dword [edi - 0x400], ecx
add eax, ebp
shr ecx, 0x18
add eax, ecx
dec ebx
mov dword [edi + 0xc00], eax
jne 0x42a9a9
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
add edi, 4
dec eax
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
jne 0x42a96b
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x42c4e0
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 8]
shr eax, 3
je 0x42c55f
push ebx
push ebp
push edi
mov edi, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov ecx, dword [edi]
mov edx, dword [edi + 4]
xor eax, eax
mov ebx, edx
mov ebp, edx
shr ebx, 5
shl ebp, 4
xor ebx, ebp
mov ebp, eax
and ebp, 3
add ebx, dword [esi + ebp*4]
mov ebp, eax
xor ebp, edx
sub eax, 0x61c88647
add ebp, ecx
lea ecx, [ebx + ebp]
mov ebx, ecx
mov ebp, ecx
shr ebx, 5
shl ebp, 4
xor ebx, ebp
mov ebp, eax
shr ebp, 0xb
and ebp, 3
add ebx, dword [esi + ebp*4]
mov ebp, eax
xor ebp, ecx
add ebp, edx
cmp eax, 0xc6ef3720
lea edx, [ebx + ebp]
jne 0x42c500
mov eax, dword [esp + 0x14]
mov dword [edi], ecx
mov dword [edi + 4], edx
add edi, 8
dec eax
mov dword [esp + 0x14], eax
jne 0x42c4f9
pop edi
pop ebp
pop ebx
call fcn.0042c450
mov ecx, dword [esp + 0xc]
mov edx, dword [eax]
push ecx
mov ecx, dword [esp + 0x14]
push 0x10
push ecx
push 1
push esi
mov ecx, eax
call dword [edx]
pop esi
ret 0xc

Function at 0x42c580
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 8]
shr eax, 3
je 0x42c5fd
push ebx
push ebp
push edi
mov edi, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov eax, 0xc6ef3720
mov ebx, edx
mov ebp, edx
shr ebx, 5
shl ebp, 4
xor ebx, ebp
mov ebp, eax
shr ebp, 0xb
and ebp, 3
add ebx, dword [esi + ebp*4]
mov ebp, eax
xor ebp, edx
add eax, 0x61c88647
add ebx, ebp
sub ecx, ebx
mov ebx, ecx
mov ebp, ecx
shr ebx, 5
shl ebp, 4
xor ebx, ebp
mov ebp, eax
and ebp, 3
add ebx, dword [esi + ebp*4]
mov ebp, eax
xor ebp, ecx
add ebx, ebp
sub edx, ebx
test eax, eax
jne 0x42c5a3
mov eax, dword [esp + 0x14]
mov dword [edi], edx
mov dword [edi + 4], ecx
add edi, 8
dec eax
mov dword [esp + 0x14], eax
jne 0x42c599
pop edi
pop ebp
pop ebx
call fcn.0042c450
mov ecx, dword [esp + 0xc]
mov edx, dword [eax]
push ecx
mov ecx, dword [esp + 0x14]
push 0x10
push ecx
push 0
push esi
mov ecx, eax
call dword [edx]
pop esi
ret 0xc
Function at 0x449180
Capabilities:
Set thread local storage value

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4491a9
push eax
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [0x4629fc]
add esp, 4
test eax, eax
je 0x4491a9
mov eax, dword [0x4629f8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
ret
Function at 0x406a30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73a1b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00409390
mov ebx, dword [ebp + 8]
xor edi, edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
cmp ebx, edi
mov dword [ebp - 4], edi
mov dword [esi], 0x751390
jne 0x406a9e
push 0x13
push 0x7948f4
push str.pPort
push str.ASSERT
push 0x793720
call fcn.00401080
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x20], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x24], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x409400
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esi + 4]
mov dword [esi], 0x751420
test eax, eax
je 0x409446
push 0
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x409440
mov eax, dword [esi + 4]
push 5
push eax
call dword [sym.imp.kernel32.dll_TerminateThread]
push str.Hard_terminate_thread__may_be_lost_some_resources.
call fcn.00401560
add esp, 4
mov ecx, dword [esi + 4]
push ecx
call edi
mov esi, dword [esi + 8]
test esi, esi
je 0x409450
push esi
call edi
pop edi
pop esi
ret

Function at 0x4094b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
jne 0x40953b
push 0
push 0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateEventA]
test eax, eax
mov dword [esi + 8], eax
jne 0x4094e9
push str.Create_close_thread_event_failed.
call fcn.00401080
add esp, 4
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov cl, byte [ebp + 8]
lea eax, [ebp - 4]
neg cl
sbb ecx, ecx
push eax
and ecx, 0xfffffffc
add ecx, 4
push ecx
push esi
push 0x409650
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
mov dword [esi + 4], eax
je 0x40951b
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.kernel32.dll_CloseHandle]
push str.Create_thread_failed.
call fcn.00401080
add esp, 4
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
push str.Cant_create_thread_since_already_created.
call fcn.00401080
add esp, 4
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x409560
Capabilities:
Resume thread

Disassembly:
mov eax, dword [ecx + 4]
test eax, eax
je 0x409576
push eax
call dword [sym.imp.kernel32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x40958a
mov al, 1
ret
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push str.::ResumeThread___failed__d__in_ResumeThread__.
call fcn.00401080
add esp, 8
xor al, al
ret
Function at 0x409590
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x4095e5
push eax
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.kernel32.dll_SetEvent]
mov ecx, dword [ebp + 8]
mov edx, dword [esi + 4]
push ecx
push edx
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x4095ec
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.kernel32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esi + 8]
mov dword [esi + 4], 0
push ecx
call edi
mov dword [esi + 8], 0
pop edi
mov al, 1
pop esi
pop ebp
ret 4
xor al, al
pop esi
pop ebp
ret 4

Function at 0x40cd40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2804
call fcn.00702820
push edi
push str.iphlpapi.dll
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
jne 0x40cd82
push 0x14
push 0x7963d8
push str.hModule
push str.IF_OK
push 0x793720
call fcn.00401080
add esp, 0x14
pop edi
mov esp, ebp
pop ebp
ret
push str.GetAdaptersInfo
push edi
call dword [sym.imp.kernel32.dll_GetProcAddress]
lea ecx, [ebp - 4]
lea edx, [ebp - 0x2804]
push ecx
push edx
mov dword [0x7e5840], eax
mov dword [ebp - 4], 0x2800
call eax
test eax, eax
je 0x40cdc9
push 0x1f
push 0x7963d8
push str.dwStatus__ERROR_SUCCESS
push str.ASSERT
push 0x793720
call fcn.00401080
add esp, 0x14
mov ecx, dword [ebp + 8]
push ebx
push esi
lea esi, [ebp - 0x2804]
mov dl, 1
test dl, dl
je 0x40cdf2
lea eax, [esi + 0x194]
mov edx, ecx
mov ebx, dword [eax]
mov dword [edx], ebx
mov ax, word [eax + 4]
mov word [edx + 4], ax
xor dl, dl
jmp 0x40ce04
xor eax, eax
mov bl, byte [esi + eax + 0x194]
xor byte [eax + ecx], bl
inc eax
cmp eax, 6
jl 0x40cdf4
mov esi, dword [esi]
test esi, esi
jne 0x40cdd6
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x40dce0
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push edi
mov edi, dword [esi]
xor edx, edx
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esp + 0x10], edi
mov edi, dword [esi + 4]
mov dword [esp + 0x24], edi
mov edi, dword [esi + 8]
mov esi, dword [esi + 0xc]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov edi, 0x20
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x10]
mov esi, ecx
sub edx, 0x61c88647
shr esi, 5
add esi, ebx
mov ebx, ecx
shl ebx, 4
add ebx, ebp
mov ebp, dword [esp + 0x18]
xor esi, ebx
lea ebx, [edx + ecx]
xor esi, ebx
mov ebx, dword [esp + 0x14]
add eax, esi
mov esi, eax
shr esi, 5
add esi, ebx
mov ebx, eax
shl ebx, 4
add ebx, ebp
xor esi, ebx
lea ebx, [edx + eax]
xor esi, ebx
add ecx, esi
dec edi
jne 0x40dd16
mov edx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [edx], eax
mov dword [edx + 4], ecx
pop ebx
add esp, 0xc
ret
Function at 0x40de70
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], ecx
mov dword [eax + 4], ecx
mov eax, 1
ret
Function at 0x4145f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
xor eax, eax
mov cl, byte [edx]
test cl, cl
je 0x414611
imul eax, eax, 0x1000193
movsx ecx, cl
xor eax, ecx
mov cl, byte [edx + 1]
inc edx
test cl, cl
jne 0x4145fe
and eax, 0x3ff
pop ebp
ret
Function at 0x43d820
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73bc81
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push 0x18
mov dword [esi], 0x752810
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0x752800
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x24], ebx
call fcn.004055b0
mov cl, byte [ebp + 0xb]
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ebx
mov byte [esi + 0x2c], cl
mov byte [eax], bl
mov edx, dword [esi + 0x24]
mov dword [edx + 4], ebx
mov eax, dword [esi + 0x24]
mov dword [eax + 8], eax
mov eax, dword [esi + 0x24]
mov dword [eax + 0xc], eax
push 0x18
mov dword [ebp - 4], ebx
mov dword [esi + 0x30], ebx
call fcn.004055b0
mov cl, byte [ebp + 0xb]
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ebx
mov byte [esi + 0x38], cl
mov byte [eax], bl
mov edx, dword [esi + 0x30]
mov dword [edx + 4], ebx
mov eax, dword [esi + 0x30]
mov dword [eax + 8], eax
mov eax, dword [esi + 0x30]
mov dword [eax + 0xc], eax
push 0x18
mov byte [ebp - 4], 1
mov dword [esi + 0x3c], ebx
call fcn.004055b0
mov cl, byte [ebp + 0xb]
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
mov byte [esi + 0x44], cl
mov byte [eax], bl
mov edx, dword [esi + 0x3c]
mov dword [edx + 4], ebx
mov eax, dword [esi + 0x3c]
mov dword [eax + 8], eax
mov eax, dword [esi + 0x3c]
mov dword [eax + 0xc], eax
push 0x14
mov byte [ebp - 4], 2
mov dword [esi], 0x7527ec
call fcn.00728cf3
add esp, 0x10
cmp eax, ebx
je 0x43d90d
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax], 0x7527cc
mov byte [eax + 0x10], 1
jmp 0x43d90f
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword [esi + 4], eax
mov dword [esi + 0x18], esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4