joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd33e37
Capabilities:
Authenticate hmac

Disassembly:
inc ecx
not ecx
rol eax, 0xca
push eax
sbb dx, 0x8b2b
neg ecx
call fcn.0071ab05
mov eax, dword [edi + edx - 0x59163bb9]
jmp 0xc62858
btc edx, 0x17
lea eax, [eax + edx*2 - 0x291e22c5]
inc dx
and dx, 0x41af
xor eax, 0x840129b6
ror eax, 3
push edx
add cl, 0x81
je 0x7d2bd5
sbb eax, 0x802d213b
shr cl, 3
lea ecx, [ecx + ecx*4 - 0x6bd15acd]
neg eax
ror word [esp + edx*2 - 0x1000017], 0xad
rol eax, 1
btr cx, 0x88
xor eax, 0xecb30da5
bswap eax
lea eax, [eax + edx*8 - 0x17012b9f]
xor dl, dl
mov word [esp + edx - 0x7fffff], cx
xor ebx, eax
add cx, dx
js 0xd40717
rol eax, 1
btr dx, cx
inc dx
jae 0xd2c8a5
movzx ecx, dl
sal dl, 0xe2
lea edi, [edi + edx - 0x59163be0]
xor eax, ebx
sar edx, cl
rol cl, 0xa3
jb 0xc0ac6d
mov edx, 0xa18cf339
shr edx, 0x87
xor edx, edx
movzx ax, byte [esi + edx*2]
mov cl, byte [esi + edx*2 + 2]
shl edx, 0x39
lea edx, [edx + edx*4 + 0x229aa281]
lea esi, [esi + edx*2 - 0x45354500]
adc edx, 0xec9b8838
or dx, dx
sub dl, 0x3b
shr al, cl
shl dx, 0xab
mov word [esi + edx*8 - 0x79b78000], ax
shl dl, 0xa3
lea edi, [edx + edi - 0xf36f004]
mov ecx, edx
mov eax, dword [edi + edx - 0xf36f000]
not cx
xor eax, ebx
call fcn.00c25689
shl cl, 0x64
adc cl, byte [esi + ecx*2 - 0x5ffffff8]
push 0xab8574a5
shr dword [esp + 4], 0x65
adc esi, 6
rol word [esp + 6], 4
rol dword [esp + 1], 0xa1
shrd edx, eax, cl
mov ecx, 0x8a3c933a
ror word [esp + 5], 0x41
shr dword [esp], 0x8f
mov dword [esi], edx
mov eax, ecx
bswap eax
cwde
mov dword [esp + eax - 0x3c8a], ebp
ret 4
adc eax, 0xa9a6308a
sar dl, 0x62
xor eax, 0xf31df69a
jmp 0x7ed61a
mov dword [esp], 0x3023bd24
ror byte [esp + 3], 0x23
shrd dx, ax, cl
mov word [ebp], dx
mov eax, dword [esp]
mov edx, eax
movsx ecx, al
lea edi, [edi + edx - 0x623bd28]
ror dword [esp + eax - 0x623bd24], 0x9f
and eax, 0x8fbd8e28
sub dword [esp + eax*2 - 0xc431840], eax
mov ecx, dword [eax + edi - 0x6218c20]
not edx
sets dl
rol ax, 0xa9
xor ecx, ebx
neg dword [esp + eax - 0x6214118]
neg ecx
inc eax
pop edx
ror ecx, 3
bts ax, dx
setb al
jb 0x7b19e0
cdq
adc al, 0x51
sub al, 0x36
inc ebp
fbstp tbyte [ebp - 0x41e681a]
invalid
adc ebp, eax
movzx eax, dx
mov edx, dword [esi + edx*2 - 0x1000000]
xchg byte [esp + eax + 2], ch
neg cl
sal dword [esp + eax*8], 0xda
add eax, dword [esi + eax*2 + 4]
xchg dword [esp], ecx
jmp 0xc65d0e
Function at 0xd38ee1
Capabilities:
Encrypt data using speck

Disassembly:
push 0xe6a08dbd
push 0x2e9b0d8c
lea esp, [esp + 8]
call eax
mov edx, 0xefade111
lea ebx, [edx + edx*2 - 0x6759f1e0]
shl ebx, 0x69
mov ebp, dword [ebx + ebp - 0x5f62a604]
sal ebx, 0x24
lea ebx, [edx + ebx*2 - 0x5bccfd42]
mov dword [ebp], eax
mov esi, ebp
push edx
push ebx
movsx ecx, dl
mov ebx, dword [esp + ecx*2 - 0x1a]
shr edx, 0x15
mov dword [esp + edx - 0x775], ecx
shl dx, 0x6a
mov ebp, dword [esp + edx - 0xf3f4]
sal edx, cl
shr ecx, 0xf2
mov edi, dword [esp + ecx + 0x10]
mov dword [esp + ecx + 0xc], ecx
mov dword [esp + ecx*8 + 0x10], 0xe1b355ab
xor ecx, edx
mov ecx, dword [edi]
lea eax, [edx*4 + 0x4fbdaa0c]
call fcn.00712ee7
jne 0xd38eeb
mov eax, dword [ebp]
jmp 0x730d6f
lea esp, [esp + 0xc]
je 0xc9fec3
mov eax, 0xdd8cc72e
cwde
xor ax, 0xc49f
mov eax, dword [ebp + ebx*4]
push eax
dec ebx
jmp 0xc9febd

Function at 0xd397e9
Capabilities:
Encrypt data using speck

Disassembly:
cwd
neg ecx
or edx, 0x5f16f807
inc ecx
bswap ecx
and edx, edx
neg ecx
lea eax, [edx + 0x4a995634]
push edx
xchg dx, ax
inc ecx
inc edx
call fcn.0085abbb
movzx cx, byte [esi]
mov dl, byte [esi + 2]
add esi, 2
mov eax, 0xd1238083
dec ax
add cl, dl
movzx edx, al
ror ax, 0xa1
mov word [esi + edx*2 - 0x104], cx
xchg edx, eax
lea edx, [eax + edx*4 - 0x7060d780]
mov ecx, dword [edi + eax - 0x82]
push eax
lea edi, [edi + eax*2 - 0x100]
sbb edx, dword [esp + eax - 0x82]
xor ecx, ebx
imul byte [esp + eax - 0x81]
or dl, byte [esp + eax*8]
ror ecx, 3
dec ecx
ror ecx, 1
shl dl, 0x24
sar dl, 0x62
inc ecx
shr al, 0x21
cwde
xor ebx, ecx
or eax, 0x8e85fdb4
adc ebp, ecx
pop ecx
jmp ebp
mov dword [esp + edx - 0x55cb1000], eax
pop eax
mov dx, word [ecx + edx - 0x55cb1000]
movzx ecx, ax
bt eax, eax
add ecx, ecx
lea esi, [ecx + esi - 0x5ef4]
jbe 0x7e21d9
sar eax, 0xa2
neg ecx
mov word [esi], dx
mov ecx, dword [ebp]
adc ax, ax
neg al
setnp al
adc ebp, 3
movsx edx, al
xor ecx, ebx
jmp 0x75f97d
or edx, eax
xor bl, cl
sal edx, 0xcc
sub eax, 0x331bd088
lea ecx, [esp + ecx + 4]
js 0x7d68b9
mov dword [edi + ecx - 0xca00], edx
inc cx
sal cx, cl
call fcn.007c9e8b
mov edx, 0xe5b1d
mov ecx, 0x2f3e6e2c
lea edi, [edx + edi - 0xe5b21]
xor cl, ch
mov edx, dword [edx + edi - 0xe5b1d]
ror cl, 0x67
xor edx, ebx
lea eax, [ecx*2 - 0x12dc25fc]
neg ax
lea eax, [ecx + eax*4 + 0x2ea9eea7]
xor edx, 0x6e0d4e91
sal cl, 0xc4
shl ax, 0xe4
call fcn.0070e9be
Function at 0xd3a670
Capabilities:
Execute anti-debugging instructions

Disassembly:
btc ecx, ecx
lea ebp, [ebp + ecx - 0x625223f]
jb 0xc6e50b
shr ecx, 0xfd
imul dl
mov word [ebp + ecx], ax
or ecx, esi
jmp ecx
mov dl, byte [ecx + ebp - 0x62529e8]
sal ax, 0xca
neg eax
or eax, eax
movzx ax, byte [ebp + ecx - 0x62529e6]
imul cx, cx
jo 0x71c088
mov ecx, 0x19308da3
xor edx, ebx
imul ax, cx
ror edx, 1
lea edx, [edx + eax + 0x394cc33]
cwde
and ecx, eax
jg 0xd02207
mov ebp, 0x7aa89c35
call fcn.007daacb
sub edi, 4
mov ecx, 0x1a85551d
mov edx, dword [ecx + edi - 0x1a85551d]
mov eax, ecx
xor edx, ebx
and eax, eax
xor cl, 8
rol edx, 3
not cl
bswap edx
neg edx
push eax
lea edx, [edx + ecx*8 - 0x17aa1117]
rol eax, cl
ror edx, 1
push eax
xor ebx, edx
xchg word [esp + ecx*2 - 0x350aabd0], ax
add esi, edx
mov edx, 0xdf155132
or dword [esp + ecx - 0x1a8555e6], edx
and ecx, 0x77ad2130
mov dx, word [ebp + ecx*2 - 0x250a0240]
mov cl, byte [ebp + eax*2 - 0x2aa8aa38]
xor ax, 0xc884
neg al
lea ebp, [ebp + eax - 0x15549d65]
shr dword [esp + eax*4 - 0x55527599], 0xfc
shr dx, cl
mov word [ebp + eax*4 - 0x5552759c], dx
shr byte [esp + eax - 0x15549d66], 0x83
add byte [esp + eax*2 - 0x2aa93ace], al
mov dword [esp + eax*2 - 0x2aa93ace], esi
ret 4
bswap edx
dec edx
push ecx
jmp 0xcb5977
add edx, edx
lea esi, [esi + edx*2 - 0x771600]
setno dl
xor edx, edx
mov dword ss:[ecx + edx], eax
lea eax, [edx + edx*4 - 0x7fdd958]
adc edx, dword [edx + edi]
movsx ecx, ax
or eax, 0xd68c872c
mov dword [esp + ecx - 0x26a8], eax
lea edi, [edi + ecx*4 - 0x9a9c]
and word [esp + ecx - 0x26a8], cx
xor edx, ebx
cwde
xor edx, 0xa914d124
xor ecx, ecx
jb 0x77a159
or dword [esp + ecx*4], eax
dec edx
shr dword [esp + ecx*8], 0x9d
ror edx, 2
pop ecx
dec edx
btc ecx, 0x93
ror eax, cl
ror edx, 1
btc ecx, ecx
not ecx
not edx
bt eax, eax
sub eax, 0xaf898236
sbb cl, al
bswap edx
xor ebx, edx
add ebp, edx
add ecx, eax
jmp ebp

Function at 0xd51dfe
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x18]
jne 0x8262d8
mov ecx, 0x8a26f50c
lea edx, [ecx + ecx*2 - 0x44f21af8]
movsx ebx, dl
pop ebx
Function at 0xd59707
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x801643f
mov dword [esp + eax - 0x801643f], 0x83a7a12f
mov ecx, dword [edi + eax*4 - 0x200590fc]
pop edx
xor dx, dx
cdq
xor ecx, ebx
or ax, 0x58ad
lea ecx, [eax + ecx + 0x422f55ee]
sbb dx, 0x5d1c
shr edx, 0x63
mov dword [esp + eax - 0x8017cbf], 0xfabe979f
bswap ecx
sub dword [esp + edx*2 - 0x28b8], edx
push edx
rol ecx, 1
xor edx, dword [esp + eax*2 - 0x1002f97a]
cmovnp eax, dword [esp + eax*2 - 0x1002f97a]
bswap ecx
btc ax, 0x8b
sal dword [esp + 3], 0xc
mul edx
ror ecx, 1
add dx, dx
rol ax, 0x2b
cwde
not ecx
bswap ecx
imul dword [esp + 4]
inc dword [esp + edx*8 - 0x3c4]
ror dword [esp + edx*2 - 0xf0], 0x56
ror ecx, 2
mul word [esp + eax - 0x5b52fffc]
xor ebx, ecx
add ebp, ecx
add eax, dword [esp + eax - 0x5b52fffc]
movzx ax, byte [eax + esi - 0x55870400]
mov cl, byte [esi + edx*2 + 2]
imul dx, dx
inc dword [esp + edx + 3]
shl byte [esp + edx + 7], 0x24
lea esi, [esi + edx + 2]
call fcn.00c4758e
xchg byte [esi], dl
mov bh, 0x94
jecxz 0xd59778
or edi, dword [esi + 0x74]
pop ds
sub eax, 0x7a98e89f
sub eax, 0x5a9b6f38
or dword ss:[ecx + 0x4bd3469], edx
outsb dx, byte ss:[esi]
invalid

Function at 0xd5b831
Capabilities:
Encode data using xor

Disassembly:
cmp edi, ecx
mov dword [esp], 0xb91d3d35
jmp 0xc82105

Function at 0xd64eb8
Capabilities:
Encode data using base64
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
call fcn.00716fdd
jmp 0x89695a
sub edi, 4
mov eax, dword [edi]
mov edx, 0x768642b3
mov ecx, edx
xor eax, ebx
not cl
rol dx, 0xec
sbb eax, 0xc3a44dba
call fcn.008c3792
dec ecx
push 0x21169936
lea esp, [esp + 0x18]
jne 0x83317a
mov ecx, 0x3d836d93
movzx eax, cl
pop edi

Function at 0xd64fdb
Capabilities:
Authenticate hmac
Execute syscall

Disassembly:
inc ecx
xadd ecx, edx
dec ebp
arpl di, di
dec eax
dec ecx
or word [esp + esi*2], si
dec ebp
adc ebx, edi
dec esp
mov dword [esp + esi + 8], ecx
inc dx
rol dword [esp + 0x15], 0x4a
inc ebp
mov ecx, dword [edx + esi*2]
dec eax
xadd ecx, esi
call fcn.007f316a
mov ecx, 0x79328599
sal ecx, cl
and ecx, ecx
mov edx, dword [ecx + edi - 0x32000000]
shr cx, 0x41
xor ecx, ecx
lea eax, [ecx + ecx*4 - 0x2ef91261]
xor cl, byte [ecx + edi + 4]
cwde
jmp 0xc170d4
dec eax
mov dword [esp + esi*2], ecx
inc esp
xor dword [esp + esi + 8], edi
inc esp
mov ecx, edi
dec esp
lea eax, [esi*2 - 0x1977d47f]
dec eax
ror dword [esp + esi], 0xb
dec eax
mov ebp, dword [esp + esi*4 + 8]
btc ecx, 0x3f
jae 0x81bb6c
Function at 0xd781e7
Capabilities:
Encrypt data using speck

Disassembly:
mov ebx, 0xd280522d
movzx ebx, byte [eax]
xor ebx, ecx
push 0xe1300699
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x7b8b90]
call 0xd781e7
movzx edx, cl
sar byte [esp + edx - 0xa5], cl
pop edx
pop ecx
ja fcn.00899e4f
rol eax, 0xaf
lea edi, [eax + edi - 0x51143ddd]
movsx ecx, al
cwde
shr cl, 0x25
mov edx, dword [edi + eax*4 - 0xf764]
xor edx, ebx
dec ax
lea ecx, [ecx + ecx - 0x215ff7d4]
not edx
xor edx, 0x5a348c83
btr eax, ecx
setae cl
rol edx, 3
lea eax, [eax*8 + 0x7e09faa1]
neg edx
xor ebx, edx
not ecx
rol al, 0xa3
add ebp, edx
mov edx, ecx
jmp ebp
ror dl, 0xa7
xor ecx, ebx
sub edx, edx
xor dl, al
cwde
rol ecx, 3
shr ax, 0xaa
ror eax, 0xfa
neg ecx
bt dx, ax
btr dx, 0x98
xor ecx, 0x6f237984
and eax, 0x2e8bdc35
not ecx
lea edx, [edx + edx*8 - 0x7249c2d6]
neg dl
rol ecx, 2
inc eax
div dl
xor ecx, 0xe88d4493
bswap ecx
dec al
mul edx
xor ecx, 0xd91bd60b
mul dl
or al, al
shl ax, 0x63
lea ecx, [ecx + eax*2 + 0x41290205]
ror eax, 0xc6
inc edx
dec eax
xor ebx, ecx
btr dx, ax
cmovb eax, edx
xchg dh, dl
add esi, ecx
mov dx, word [ebp + edx - 0x541d]
bts ax, ax
lea eax, [eax*8 - 0x7d66f767]
mov ax, word [ebp + 2]
mov ecx, 0xd0ad491a
setb cl
not cl
mov cl, byte [ebp + 4]
call fcn.00d2fb8f
dec ecx
add ebp, 4
push 0x148765a0
pop eax
dec eax
mov dword [esp + eax - 0x14876590], eax
xor edi, ebp
call fcn.00c494d6
mov ecx, 0x28ada6b7
mov edx, dword [esi + ecx*2 - 0x515b4d6e]
dec cl
rol ecx, cl
mov eax, dword [esi + 4]
add ecx, ecx
sal cl, 0xe7
call fcn.00d554db
mov ecx, 0xcda4a024
lea ecx, [ecx*8 - 0x13d581eb]
lea edi, [edi + ecx - 0x594f7f39]
movsx eax, cx
lea edx, [ecx + eax*4 + 0x260d9696]
mov edx, dword [edi + eax - 0x7f35]
xor edx, ebx
neg edx
sal ecx, 0x95
jp 0x8109ea
push 0x20b0cf2e
mov dword [esp + 4], 0x6b9ab48a
shr ecx, 8
push 0x8c393f8e
xor ecx, ebx
inc eax
xor ecx, 0x65a9efbd
inc dword [esp + 0xa]
setg byte [esp + 0xb]
neg byte [esp + 0xd]
dec edx
push 0xe726f296
push 0xb71e69aa
lea esp, [esp + 0x18]
jne 0x818354
mov edx, 0xe9009ca4
shl edx, 0x84
je 0xc16a63
pop ebx
not ecx
mov dword [esi], ecx
mov eax, 0x7bb2a228
jmp 0xbeeb6d
Function at 0x40614d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
xor ebx, ebx
push ebx
mov edi, 0xfffe
call fcn.0040231c
mov esi, eax
pop ecx
cmp esi, ebx
je 0x4061ce
push ebx
push esi
push 0x7fff
push ebx
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
je 0x4061c7
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
je 0x4061c7
lea eax, [ebp - 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], 0x18
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], 0x40
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ntdll.dll_ZwDeleteFile]
test eax, eax
lea eax, [ebp - 0xc]
push eax
setns bl
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
push esi
call fcn.0040241e
pop ecx
pop edi
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x4061d5
Capabilities:
Set file attributes

Disassembly:
push edi
push 0x80
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x406206
mov ecx, edi
inc edi
cmp ecx, 0x14
jg 0x40621a
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 2
neg eax
sbb eax, eax
inc eax
jne 0x40621a
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call fcn.0040614d
pop ecx
xor ecx, ecx
test al, al
setne cl
mov eax, ecx
test eax, eax
je 0x4061e6
pop edi
ret

Function at 0x40621c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1448
call fcn.00406a20
push ebx
push esi
lea eax, [ebp - 0x40]
push eax
push dword [ebp + 8]
xor ebx, ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
cmp esi, ebx
je 0x40632d
push edi
push esi
call fcn.00402384
mov edi, eax
pop ecx
cmp edi, ebx
je 0x40632c
push edi
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
mov esi, dword [sym.imp.VERSION.dll_VerQueryValueW]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x40874c
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call esi
cmp dword [ebp - 8], 4
jb 0x406325
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], str.Comments
mov dword [ebp - 0x38], 0x408794
mov dword [ebp - 0x34], 0x4087b0
mov dword [ebp - 0x30], 0x4087c8
mov dword [ebp - 0x2c], 0x4087e0
mov dword [ebp - 0x28], 0x408800
mov dword [ebp - 0x24], 0x408820
mov dword [ebp - 0x20], 0x408840
mov dword [ebp - 0x1c], str.PrivateBuild
mov dword [ebp - 0x18], 0x40887c
mov dword [ebp - 0x14], 0x408894
mov dword [ebp - 0x10], str.SpecialBuild
push dword [ebp + eax*4 - 0x3c]
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
lea eax, [ebp - 0x1448]
push str.StringFileInfo_04x_04x_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1448]
push eax
push edi
call esi
test eax, eax
je 0x406325
push dword [ebp - 0xc]
call fcn.004029a5
pop ecx
mov ebx, eax
push edi
call fcn.0040241e
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x1432583
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x20
push esi
mov esi, ecx
or eax, 0xffffffff
mov dword [esi + 0x90], eax
mov dword [esi + 0xb4], eax
lea eax, [esp + 4]
push eax
mov dword [esi + 0x2c], 0x33
mov dword [esi + 0x30], 0x64
mov dword [esi + 0x34], 0x3c
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [esp + 0xc]
shr ecx, 2
mov dword [esi + 0x38], ecx
mov eax, 1
mov dword [esi + 0xc0], 0x112
mov dword [esi + 0xc4], 0x201
mov dword [esi + 0xbc], eax
mov dword [esi + 0x98], 0
mov ecx, 2
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x40], eax
mov byte [esi + 0x28], 3
pop esi
add esp, 0x20
ret
Function at 0x1438280
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x74
mov edx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x80]
mov eax, edx
shr eax, 0x10
and eax, 0x7fff
test ecx, ecx
mov dword [esp], str.DISCONNECT_REASON_NETENGINE_ERROR
mov dword [esp + 4], str.DISCONNECT_REASON_INTENTIONAL_KILL
mov dword [esp + 8], str.DISCONNECT_REASON_STALE_SESSION
mov dword [esp + 0xc], str.DISCONNECT_REASON_CLOSED_BY_PEER
mov dword [esp + 0x10], str.DISCONNECT_REASON_ENGINE_SHUTDOWN
mov dword [esp + 0x14], str.DISCONNECT_OVERLAPPED
mov dword [esp + 0x18], str.DISCONNECT_SENDCOUNT
mov dword [esp + 0x1c], str.NERR_GOOD
mov dword [esp + 0x20], str.NERR_TIMEOUT
mov dword [esp + 0x24], str.NERR_UNKNOWN
mov dword [esp + 0x28], str.NERR_SESSION_LOST
mov dword [esp + 0x2c], str.NERR_BUFFER_FULL
mov dword [esp + 0x30], str.NERR_TOO_MANY_OUTSTANDING
mov dword [esp + 0x34], str.NERR_NODATA_TO_SEND
mov dword [esp + 0x38], str.NERR_NO_MSGTARGET
mov dword [esp + 0x3c], str.NERR_INVALID_SOCKET
mov dword [esp + 0x40], str.NERR_INVALID_SESSION
mov dword [esp + 0x44], str.NERR_FAILED_TO_TRANSFILE
mov dword [esp + 0x48], str.NERR_INVALID_SEQUENCE
mov dword [esp + 0x4c], str.NERR_INVALID_CHECKSUM
mov dword [esp + 0x50], str.NERR_INVALID_MSGSIZE
mov dword [esp + 0x54], str.NERR_FAILED_TO_ACCEPT
mov dword [esp + 0x58], str.NERR_INVALID_TARGET_FILE
mov dword [esp + 0x5c], str.NERR_NET_ACCESSED_BEFORE_HANDSHAKE
mov dword [esp + 0x60], str.NERR_INVALID_MSG_HEADER
mov dword [esp + 0x64], str.NERR_COMPLETION_TARGET_MISMATCH
mov dword [esp + 0x68], str.NERR_TARGET_TASK_LOST
mov dword [esp + 0x6c], str.NERR_FAILED_TO_CREATE_SESSION
mov dword [esp + 0x70], str.NERR_PEER_DOESNT_RESPONSE
je 0x1438400
test dx, dx
jne 0x14383c7
mov edx, dword [0x1561574]
movzx edx, word [edx]
push edx
movzx edx, word [ecx + 6]
movzx ecx, word [ecx + 4]
push edx
push ecx
mov ecx, dword [esp + 0x84]
movzx edx, ax
mov eax, dword [esp + edx*4 + 0x28]
push eax
push str.DISCONNECT_REASON_NETENGINE_ERROR
push ecx
push str.Session_Lost___d_:__s_:__s__OutletID__d___InletID__d___MyselfID__d_
push 0x2000001
call fcn.0144e9a0
add esp, 0x20
add esp, 0x74
ret
mov eax, dword [0x1561574]
movzx eax, word [eax]
push eax
movzx eax, word [ecx + 6]
movzx ecx, word [ecx + 4]
push eax
push ecx
mov ecx, dword [esp + 0x84]
movzx edx, dx
mov eax, dword [esp + edx*4 + 0xc]
push eax
push ecx
push str.Session_Lost___d_:__s__OutletID__d___InletID__d___MyselfID__d_
push 0x2000001
call fcn.0144e9a0
add esp, 0x1c
add esp, 0x74
ret
test dx, dx
mov ecx, dword [esp + 0x78]
jne 0x143842d
movzx edx, ax
mov eax, dword [esp + edx*4 + 0x1c]
push eax
push str.DISCONNECT_REASON_NETENGINE_ERROR
push ecx
push str.Session_Lost___d_:__s_:__s
push 0x2000001
call fcn.0144e9a0
add esp, 0x14
add esp, 0x74
ret
movzx edx, dx
mov eax, dword [esp + edx*4]
push eax
push ecx
push str.Session_Lost___d_:__s
push 0x2000001
call fcn.0144e9a0
add esp, 0x10
add esp, 0x74
ret
Function at 0x14440e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1509dfb
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x153e8e8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.ServerFramework::COverlapJob.0
mov dword [esp + 0x14], 0xffffffff
cmp dword [esi + 0x30], 0x10
jb 0x1444128
mov eax, dword [esi + 0x1c]
push eax
call fcn.014e1d06
add esp, 4
xor eax, eax
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], eax
mov byte [esi + 0x1c], al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x144c4c0
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x2808
call fcn.014e2fc0
mov eax, dword [0x153e8e8]
xor eax, esp
mov dword [esp + 0x2804], eax
push ebp
mov ebp, dword [esp + 0x2814]
push esi
mov esi, dword [esp + 0x2814]
push edi
push 0x151cfcc
lea eax, [esp + 0x10]
push esi
push eax
mov dword [esp + 0x18], 0
call fcn.014e2f61
mov edi, eax
add esp, 0xc
test edi, edi
je 0x144c562
push 0x27ff
lea ecx, [esp + 0x15]
push 0
push ecx
mov byte [esp + 0x1c], 0
call fcn.014e21d0
push ebp
push edi
push esi
push str.ServerFramework::SaveRawLogToFile
push str._s__File__s__Open_Failed._ErrorCode__d___Log:__s_
lea edx, [esp + 0x30]
push 0x2800
push edx
call fcn.01432af0
add esp, 0x28
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x2804]
xor ecx, esp
call fcn.014e18ea
add esp, 0x2808
ret
mov ecx, dword [esp + 0xc]
push ecx
push ebp
call fcn.014e2d48
mov edx, dword [esp + 0x14]
push edx
call fcn.014e2ccc
mov ecx, dword [esp + 0x281c]
add esp, 0xc
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.014e18ea
add esp, 0x2808
ret

Function at 0x144da40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push edi
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x18]
push eax
push 0x40
mov esi, ecx
push edi
push esi
mov ebx, edx
call ebp
push edi
push esi
push ebx
call fcn.014e32e0
lea eax, [ebx + edi]
mov ecx, esi
sub ecx, eax
add esp, 0xc
lea edx, [ecx + edi - 5]
mov dword [eax + 1], edx
mov edx, dword [esp + 0x18]
mov byte [eax], 0xe9
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push edx
sub eax, esi
push edi
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call ebp
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x144e230
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.kernel32
call esi
push str.ntdll
mov dword [0x1561070], eax
call esi
mov ecx, dword [0x1561070]
test ecx, ecx
mov dword [0x1561074], eax
jne 0x144e260
mov eax, 3
pop esi
ret
test eax, eax
jne 0x144e26b
mov eax, 4
pop esi
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x151d6ec
push ecx
call esi
test eax, eax
mov dword [0x156106c], eax
jne 0x144e295
mov eax, dword [0x1561070]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 5
pop esi
ret
mov ecx, dword [0x1561070]
push str.LoadLibraryW
push ecx
call esi
test eax, eax
mov dword [0x1561068], eax
jne 0x144e2c0
mov edx, dword [0x1561070]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 6
pop esi
ret
mov eax, dword [0x1561074]
push str.LdrLoadDll
push eax
call esi
test eax, eax
mov dword [0x1561064], eax
jne 0x144e2ea
mov ecx, dword [0x1561074]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 7
pop esi
ret
push 0x40
push 0x1000
push 0xa
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [0x1561064]
push 5
push 0x144e210
mov edx, eax
mov dword [0x1561060], eax
call fcn.0144da40
xor eax, eax
pop esi
ret

Function at 0x144e760
Capabilities:
Hash data using djb2

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov eax, dword [ebx + 0x14]
push esi
xor esi, esi
test eax, eax
push edi
mov edi, 0x1505
jbe 0x144e7a9
cmp esi, eax
push ebp
lea ebp, [ebx + 4]
jbe 0x144e782
call fcn.014e11fd
cmp dword [ebx + 0x18], 0x10
jb 0x144e78d
mov eax, dword [ebp]
jmp 0x144e78f
mov eax, ebp
movsx eax, byte [eax + esi]
mov ecx, edi
shl ecx, 5
add ecx, edi
add eax, ecx
mov edi, eax
mov eax, dword [ebx + 0x14]
add esi, 1
cmp esi, eax
jb 0x144e782
pop ebp
mov eax, edi
pop edi
pop esi
and eax, 0x7fffffff
pop ebx
ret
Function at 0x1453ff0
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [0x1561080], 2
je 0x145400e
mov eax, dword [0x156174c]
test eax, eax
je 0x1454042
mov eax, dword [eax + 0xbc]
mov dword [0x1561468], eax
call fcn.01453f80
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
lea ecx, [esp]
push ecx
push 0
push 0
push 0x1453950
push 0
push 0
mov dword [0x1561470], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x156146c], eax
pop ecx
ret