joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403853
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, str.Serpiei
mov edi, eax
push esi
call fcn.00402ee5
test eax, eax
pop ecx
je 0x4038a7
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 0xc], 0x4035da
call edi
pop edi
xor eax, eax
pop esi
leave
ret 0x10
and byte [ebp - 0x114], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
call fcn.00402bc0
lea eax, [ebp - 0x114]
push 1
push eax
push str.Microsoft_.NET_COM_Integration_with_SOAP
push str.Microsoft_.Net_Frameworek_COMi_Suppoot
push esi
call fcn.00403044
add esp, 0x18
call fcn.00402130
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x503b8c
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x503376
mov dword [0x50521c], 2
jmp 0x503bbc
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x50408c
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c8f
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503cbc
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c8f
mov eax, dword [0x505250]
jmp 0x503cc9
call 0x502c0d
ret
Function at 0x6b8012f3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call sym._GetSystemInfo_4
sub esp, 4
mov eax, dword [ebp - 0x14]
cmp eax, 0x182
je 0x6b801325
mov eax, dword [ebp - 0x14]
cmp eax, 0x1e6
je 0x6b801325
mov eax, dword [ebp - 0x14]
cmp eax, 0x24a
jne 0x6b80132c
mov eax, 1
jmp 0x6b801331
mov eax, 0
leave
ret

Function at 0x6b801333
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sym._strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x110]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.AutoRun
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
leave
ret
Function at 0x6b80144b
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [ebp - 0xc], eax
mov dword [esp], str.kernel32.dll
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 4], str.LoadLibraryA
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0x14], eax
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x18], eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov edx, dword [ebp - 0x18]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov dword [esp + 0xc], 0x8000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x6b80159b
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._GetFileSize_8
sub esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._malloc
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x6b8015e1
mov dword [esp], str.malloc_failed
call sym._puts
mov eax, 0
jmp 0x6b80162a
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._ReadFile_20
sub esp, 0x14
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xc], eax
je 0x6b801627
mov dword [esp], str.ReadFile_failed
call sym._puts
mov eax, 0
jmp 0x6b80162a
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x6b801726
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov eax, dword [ebp + 8]
call eax
nop
leave
ret

Function at 0x6b801af0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x6b80603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x6b806034]
sub esp, 4
test ebx, ebx
je 0x6b801b3b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x6b801b34
test esi, esi
je 0x6b801b34
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6b801b10
mov dword [esp], 0x6b80603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x6b801d20
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x6b804148
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x6b801d70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x6b801e48
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x6b801dae
cmp eax, 4
jne 0x6b801dd0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x6b801dbe
cmp edx, 4
je 0x6b801dbe
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.6b801d20
Function at 0x4032f0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42faa8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x442288]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x26c]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, 0xffffffff
jne 0x4033fd
push dword [esi + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x18]
xor eax, eax
mov word [ebp - 0x14], ax
mov dword [ebp - 0x10], eax
call fcn.004036c0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
push dword [esi + 0x10]
call fcn.00403450
lea edi, [esi + 0x1c]
push edi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi + 0x26c], eax
lea ecx, [ebp - 0x14]
cmp eax, 0xffffffff
jne 0x40339a
mov eax, dword [ebp - 0x18]
cmp eax, ecx
je 0x403386
push eax
call fcn.0041ed69
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
cmp eax, ecx
je 0x4033b7
push eax
call fcn.0041ed69
lea eax, [ebp - 0x14]
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax]
call eax
test al, al
jne 0x4033e9
lea ebx, [ebx]
push edi
push dword [esi + 0x26c]
call ebx
test eax, eax
je 0x403408
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax]
call eax
test al, al
je 0x4033d0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edi, [esi + 0x1c]
push edi
push eax
call ebx
test eax, eax
jne 0x4033be
mov eax, dword [esi + 0x26c]
cmp eax, 0xffffffff
je 0x403434
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x250
push 0
push edi
mov dword [esi + 0x26c], 0xffffffff
call fcn.00429200
add esp, 0xc
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4042e0
Capabilities:
Create mailslot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
push 1
lea eax, [ebp - 0x20]
mov edi, edx
push eax
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x20]
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
push 0x80
push edi
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x404361
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.Failed_to_create_mailslot___s_._Error__d
push 0x99
push str.....common_fileio.cpp
push str.ERROR
call fcn.00416950
add esp, 0x18
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x404c40
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x442288]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x404d53
mov ecx, dword [0x4434dc]
cmp ecx, 0xffffffff
je 0x404c8d
cmp byte [0x4434e0], 0
push ecx
je 0x404c85
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x404c8d
call fcn.0041f10e
add esp, 4
xorps xmm0, xmm0
mov dword [0x4434dc], esi
movdqu xmmword [ebp - 0x18], xmm0
mov eax, 2
mov word [ebp - 0x18], ax
mov eax, dword [ebp + 8]
push 0x30b
mov dword [ebp - 0x14], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x18]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x404d0b
mov ecx, esi
call fcn.00404ee0
test al, al
jne 0x404cf8
call fcn.0041e449
push dword [eax]
push str.INTERNAL_ERROR___d_._Please__contact_WTware_tech_support.
push 0x1cd
push str.....common_fstream.cpp
push str.ERROR
call fcn.00416950
add esp, 0x14
mov al, 1
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041e406
mov esp, ebp
pop ebp
ret 0xc
call fcn.0041e449
lea ecx, [ebp - 0x28]
push dword [eax]
lea eax, [ebp + 8]
push 0x30b
push eax
call fcn.004013b0
push eax
push str.Connection_with__s:_d_failed__errno__d.
push 0x1e6
push str.....common_fstream.cpp
push str.ERROR
call fcn.00416950
add esp, 0x1c
xor al, al
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041e406
mov esp, ebp
pop ebp
ret 0xc
call fcn.0041e449
push dword [eax]
push str.INTERNAL_ERROR___d_._Please__contact_WTware_tech_support.
push 0x1be
push str.....common_fstream.cpp
push str.ERROR
call fcn.00416950
mov ecx, dword [ebp - 8]
add esp, 0x14
xor ecx, ebp
xor al, al
pop esi
call fcn.0041e406
mov esp, ebp
pop ebp
ret 0xc
Function at 0x404d90
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x442288]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4434e4]
push ebx
push esi
push edi
mov ebx, dword [eax]
mov edi, dword [ebp + 8]
cmp ebx, 0xffffffff
je 0x404ebc
mov esi, dword [ebp + 0xc]
test esi, esi
jle 0x404e3a
push 0
push esi
push edi
push ebx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x404e32
call fcn.0041e449
cmp dword [eax], 0xb
jne 0x404e5d
lea eax, [ebp - 0x118]
mov dword [ebp - 0x10c], ebx
push eax
push 0
lea eax, [ebp - 0x110]
mov dword [ebp - 0x110], 1
push eax
push 0
lea eax, [ebx + 1]
mov dword [ebp - 0x118], 1
push eax
mov dword [ebp - 0x114], 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x404e4f
jne 0x404e36
push str.Close_stalled_TCP_connection.
call fcn.004168b0
add esp, 4
jmp 0x404e71
add edi, eax
sub esi, eax
test esi, esi
jg 0x404dc0
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e406
mov esp, ebp
pop ebp
ret 8
call fcn.0041e449
push dword [eax]
push str.Close_TCP_connection_while_sending_data._select___failed__errno__d.
jmp 0x404e69
call fcn.0041e449
push dword [eax]
push str.Close_TCP_connection_while_sending_data__errno__d.
call fcn.004168b0
add esp, 8
mov eax, dword [0x4434dc]
cmp eax, 0xffffffff
je 0x404ebc
cmp byte [0x4434e0], 0
push eax
je 0x404eaa
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x4434dc], 0xffffffff
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e406
mov esp, ebp
pop ebp
ret 8
call fcn.0041f10e
add esp, 4
mov dword [0x4434dc], 0xffffffff
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e406
mov esp, ebp
pop ebp
ret 8

Function at 0x404ee0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp ecx, 0xffffffff
je 0x404f30
push 4
lea eax, [ebp - 4]
mov dword [ebp - 4], 1
push eax
push 1
push 6
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x404f0d
mov al, 1
mov esp, ebp
pop ebp
ret
call fcn.0041e449
push dword [eax]
push str.INTERNAL_ERROR___d_._Please__contact_WTware_tech_support.
push 0x46e
push str.....common_fstream.cpp
push str.ERROR
call fcn.00416950
add esp, 0x14
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x405310
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42fc08
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x442288]
xor eax, esp
mov dword [esp + 0x58], eax
push esi
mov eax, dword [0x442288]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0xffffffff
mov byte [esp + 0x10], 0
mov dword [esp + 0x14], eax
push 0x40
lea eax, [esp + 0x20]
mov dword [esp + 0x74], 0
push 0
push eax
call fcn.00429200
add esp, 0xc
push 0
push esi
call fcn.0041ecb5
add esp, 8
cmp eax, 0xffffffff
jne 0x4053b3
mov eax, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x405496
cmp byte [esp + 0x10], 0
push eax
je 0x4053a6
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x405496
call fcn.0041f10e
add esp, 4
jmp 0x405496
sub esp, 8
lea ecx, [esp + 0x14]
push esi
call fcn.00404b00
test al, al
je 0x405386
cmp dword [esp + 0xc], 0xffffffff
je 0x40548d
push 0x3f
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
push dword [eax]
call fcn.0041f283
add esp, 0xc
test eax, eax
jle 0x40548d
cmp eax, 0x40
jae 0x4054b5
mov byte [esp + eax + 0x1c], 0
xor eax, eax
lea esp, [esp]
cmp byte [esp + eax + 0x1c], 0
je 0x405431
cmp byte [esp + eax + 0x1d], 0
je 0x405430
cmp byte [esp + eax + 0x1e], 0
je 0x40542b
cmp byte [esp + eax + 0x1f], 0
je 0x405426
add eax, 4
cmp eax, 0x40
jb 0x405400
jmp 0x405431
add eax, 3
jmp 0x405431
add eax, 2
jmp 0x405431
inc eax
test eax, eax
jle 0x4054e5
cmp byte [esp + eax + 0x1b], 0xa
jne 0x40544b
dec eax
cmp eax, 0x40
jae 0x4054b5
mov byte [esp + eax + 0x1c], 0
push 0
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esp + 0x20]
call fcn.00401750
add esp, 4
cmp eax, 2
je 0x4054ba
call fcn.0041e449
push dword [eax]
push str.INTERNAL_ERROR___d_._Please__contact_WTware_tech_support.
push 0x28a
push str.....commonmisc3.cpp
push str.ERROR
call fcn.00416950
add esp, 0x14
lea ecx, [esp + 0xc]
call fcn.00405a20
or eax, 0xffffffff
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.0041e406
mov esp, ebp
pop ebp
ret
call fcn.0041eea6
mov eax, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x4054df
cmp byte [esp + 0x10], 0
push eax
je 0x4054d7
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [esp + 0x18]
jmp 0x405499
call fcn.0041f10e
add esp, 4
mov eax, dword [esp + 0x18]
jmp 0x405499
call fcn.0041e449
push dword [eax]
push str.INTERNAL_ERROR___d_._Please__contact_WTware_tech_support.
push 0x284
jmp 0x40547b
Function at 0x405900
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42fc38
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x442288]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
push 0
push edi
call fcn.0041ecb5
add esp, 8
cmp eax, 0xffffffff
jne 0x405950
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0xffffffff
mov byte [ebp - 0x14], 0
mov dword [ebp - 0x10], eax
sub esp, 8
mov dword [ebp - 4], 0
mov ecx, eax
push edi
call fcn.00404b00
test al, al
je 0x4059cc
mov eax, dword [ebp - 0x18]
cmp eax, 0xffffffff
je 0x4059cf
mov eax, dword [ebp - 0x10]
push 0x3f
push esi
push dword [eax]
call fcn.0041f283
mov edx, eax
add esp, 0xc
test edx, edx
jle 0x4059cc
xor ecx, ecx
test edx, edx
jle 0x4059c1
jmp 0x4059a0
mov al, byte [ecx + esi]
cmp al, 0xa
je 0x4059bf
cmp al, 7
je 0x4059bf
cmp al, 0xd
je 0x4059bf
inc ecx
cmp ecx, edx
jl 0x4059a0
mov eax, dword [ebp - 0x18]
mov bl, 1
mov byte [edx + esi], 0
jmp 0x4059d1
mov edx, ecx
mov eax, dword [ebp - 0x18]
mov bl, 1
mov byte [edx + esi], 0
jmp 0x4059d1
mov eax, dword [ebp - 0x18]
xor bl, bl
cmp eax, 0xffffffff
je 0x4059ff
cmp byte [ebp - 0x14], 0
push eax
je 0x4059f7
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0041f10e
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405a70
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x442288]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push 0
push 0x80
push 3
push 0
push 1
push connect
push edi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x405ba4
test eax, eax
je 0x405ba4
push 0
push eax
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0xc], eax
test eax, eax
jne 0x405aee
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e406
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push 0
push 2
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 4], eax
test eax, eax
jne 0x405b4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
lea ecx, [ebp - 0x408]
call fcn.004057f0
push eax
push str.mm_file_map___s__failed__x
push 0x2a
push str.....commonmm_file.cpp
push str.ERROR
call fcn.00416950
add esp, 0x18
mov ecx, esi
call fcn.00402860
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e406
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
test eax, eax
jne 0x405ada
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.map_file__x
push 0x33
push str.....commonmm_file.cpp
push str.ERROR
call fcn.00416950
add esp, 0x14
mov ecx, esi
call fcn.00402860
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e406
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
lea ecx, [ebp - 0x408]
call fcn.004057f0
push eax
push str.mm_file_open___s__failed__x
push 0x17
push str.....commonmm_file.cpp
push str.ERROR
call fcn.00416950
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
xor al, al
pop edi
pop esi
call fcn.0041e406
mov esp, ebp
pop ebp
ret 8
Function at 0x40f830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], 8
lea edi, [ecx + 1]
sub ecx, edx
lea eax, [edx + 3]
mov dword [ebp - 8], ecx
lea ecx, [ecx]
movzx ecx, byte [edi - 1]
lea eax, [eax + 4]
movzx esi, byte [eax - 7]
lea edi, [edi + 4]
movzx edx, byte [eax - 5]
xor esi, ecx
movzx ecx, byte [edi - 3]
xor edx, ecx
mov ecx, dword [ebp - 8]
or esi, edx
movzx edx, byte [ecx + eax - 4]
movzx ecx, byte [eax - 4]
xor edx, ecx
movzx ecx, byte [edi - 4]
or esi, edx
movzx edx, byte [eax - 6]
xor edx, ecx
or esi, edx
or ebx, esi
dec dword [ebp - 4]
jne 0x40f850
lea eax, [ebx - 1]
shr eax, 8
pop edi
and eax, 1
pop esi
dec eax
pop ebx
mov esp, ebp
pop ebp
ret