joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003da90
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], 0x1c
mov eax, 1
ret

Function at 0x1003daf0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], 0x20
mov eax, 1
ret
Function at 0x1003faa0
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x40], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x44], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x30
mov eax, 1
ret

Function at 0x1003fb40
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x40], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x44], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
mov eax, 1
ret
Function at 0x10047740
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov ecx, dword [eax + 4]
push edi
cmp ecx, dword [ebx + 4]
jge 0x10047759
mov edi, ebx
mov ebx, eax
jmp 0x1004775b
mov edi, eax
mov esi, dword [esp + 0x10]
mov eax, dword [edi + 4]
cmp eax, dword [esi + 8]
jle 0x10047771
push eax
push esi
call fcn.10022770
add esp, 8
mov ecx, dword [ebx + 4]
xor eax, eax
test ecx, ecx
jle 0x10047795
push ebp
mov edx, dword [edi]
mov ecx, dword [ebx]
mov edx, dword [edx + eax*4]
mov ebp, dword [ecx + eax*4]
mov ecx, dword [esi]
xor edx, ebp
mov dword [ecx + eax*4], edx
mov ecx, dword [ebx + 4]
inc eax
cmp eax, ecx
jl 0x1004777b
pop ebp
cmp eax, dword [edi + 4]
jge 0x100477ac
mov edx, dword [edi]
mov ecx, dword [esi]
mov edx, dword [edx + eax*4]
mov dword [ecx + eax*4], edx
mov ecx, dword [edi + 4]
inc eax
cmp eax, ecx
jl 0x1004779a
mov edi, dword [edi + 4]
test edi, edi
mov dword [esi + 4], edi
jle 0x100477d2
mov eax, dword [esi]
lea eax, [eax + edi*4 - 4]
mov ecx, dword [eax]
sub eax, 4
test ecx, ecx
jne 0x100477d2
mov edx, dword [esi + 4]
dec edx
mov ecx, edx
mov dword [esi + 4], edx
test ecx, ecx
jg 0x100477bc
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x10049c50
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x18
call fcn.1004a590
mov eax, dword [esp + 0x20]
push ebx
push ebp
push esi
lea esi, [eax - 1]
push edi
mov edi, dword [esp + 0x38]
lea ecx, [esi - 0x29]
cmp edi, ecx
jle 0x10049c8f
push 0x2d
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0x79
push 4
call fcn.10026890
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
cmp esi, 0x29
jge 0x10049cb3
push 0x33
push str..crypto_rsa_rsa_oaep.c
push 0x78
push 0x79
push 4
call fcn.10026890
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
lea eax, [esi - 0x14]
push 0x37
push str..crypto_rsa_rsa_oaep.c
push eax
mov dword [esp + 0x1c], eax
call fcn.10027ca0
add esp, 0xc
mov dword [esp + 0x30], eax
test eax, eax
jne 0x10049cf1
push 0x3a
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x79
push 4
call fcn.10026890
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov ebx, dword [esp + 0x2c]
push 0
mov byte [ebx], 0
lea ebp, [ebx + 1]
add ebx, 0x15
call fcn.10035380
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push 0
push ebx
push edx
push eax
call fcn.10035150
mov ecx, esi
xor eax, eax
sub ecx, edi
lea edi, [ebx + 0x14]
sub ecx, 0x29
push 0x14
mov edx, ecx
push ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x58]
mov eax, ebx
sub eax, ecx
mov edx, ecx
add eax, esi
mov esi, dword [esp + 0x54]
shr ecx, 2
lea edi, [eax - 0x14]
mov byte [eax - 0x15], 1
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.10023630
add esp, 0x20
test eax, eax
jg 0x10049d6e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
call fcn.10035380
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x30]
push eax
push 0x14
push ebp
push edi
push esi
call fcn.10049fd0
add esp, 0x14
test edi, edi
jle 0x10049da0
mov eax, ebx
sub esi, ebx
mov ecx, edi
mov dl, byte [esi + eax]
xor byte [eax], dl
inc eax
dec ecx
jne 0x10049d93
mov esi, dword [esp + 0x30]
call fcn.10035380
push eax
push edi
push ebx
lea eax, [esp + 0x20]
push 0x14
push eax
call fcn.10049fd0
lea eax, [esp + 0x28]
add esp, 0x14
sub eax, ebp
mov ecx, 0x14
mov dl, byte [eax + ebp]
mov bl, byte [ebp]
xor bl, dl
mov byte [ebp], bl
inc ebp
dec ecx
jne 0x10049dc2
push esi
call fcn.10027f20
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x10049df0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x2c
call fcn.1004a590
mov eax, dword [esp + 0x40]
push ebx
xor ebx, ebx
dec eax
push ebp
push esi
cmp eax, 0x29
push edi
mov dword [esp + 0x10], ebx
jl 0x10049f94
mov ecx, dword [esp + 0x4c]
mov edi, eax
sub edi, ecx
jns 0x10049e26
mov dword [esp + 0x10], 1
xor edi, edi
mov esi, dword [esp + 0x48]
lea ebp, [eax - 0x14]
push 0x7a
sub esi, edi
push str..crypto_rsa_rsa_oaep.c
push ebp
add esi, 0x14
call fcn.10027ca0
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x10049e68
push 0x7d
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x7a
push 4
call fcn.10026890
add esp, 0x14
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
call fcn.10035380
push eax
push ebp
push esi
lea eax, [esp + 0x20]
push 0x14
push eax
call fcn.10049fd0
add esp, 0x14
cmp edi, 0x14
mov eax, edi
jge 0x10049ea1
mov edx, dword [esp + 0x48]
mov ecx, eax
sub ecx, edi
mov cl, byte [ecx + edx]
mov dl, byte [esp + eax + 0x14]
xor dl, cl
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x14
jl 0x10049e86
call fcn.10035380
push eax
lea edx, [esp + 0x18]
push 0x14
push edx
push ebp
push ebx
call fcn.10049fd0
add esp, 0x14
test ebp, ebp
jle 0x10049ecf
mov eax, ebx
sub esi, ebx
mov edi, ebp
mov cl, byte [esi + eax]
mov dl, byte [eax]
xor dl, cl
mov byte [eax], dl
inc eax
dec edi
jne 0x10049ec2
push 0
call fcn.10035380
mov ecx, dword [esp + 0x58]
push eax
mov eax, dword [esp + 0x60]
lea edx, [esp + 0x30]
push 0
push edx
push eax
push ecx
call fcn.10035150
add esp, 0x18
mov ecx, 5
lea edi, [esp + 0x28]
mov esi, ebx
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x10049f94
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x10049f94
mov eax, 0x14
cmp ebp, eax
jle 0x10049f25
cmp byte [eax + ebx], 0
jne 0x10049f25
inc eax
cmp eax, ebp
jl 0x10049f1a
cmp byte [eax + ebx], 1
jne 0x10049f94
mov ecx, eax
inc eax
cmp ecx, ebp
jge 0x10049f94
mov ecx, dword [esp + 0x44]
sub ebp, eax
cmp ecx, ebp
jge 0x10049f6a
push 0x9b
push str..crypto_rsa_rsa_oaep.c
push 0x6d
push 0x7a
push 4
call fcn.10026890
add esp, 0x14
or ebp, 0xffffffff
push ebx
call fcn.10027f20
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
mov edi, dword [esp + 0x40]
mov ecx, ebp
mov edx, ecx
lea esi, [eax + ebx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.10027f20
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
push 0xa8
push str..crypto_rsa_rsa_oaep.c
push 0x79
push 0x7a
push 4
call fcn.10026890
add esp, 0x14
test ebx, ebx
je 0x10049fb9
push ebx
call fcn.10027f20
add esp, 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x2c
ret
Function at 0x1004a480
Capabilities:
Check for software breakpoints

Disassembly:
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp eax, edx
push esi
jne 0x1004a555
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x1004a4a3
cmp al, 0x6b
jne 0x1004a555
cmp al, 0x6b
lea esi, [ecx + 1]
jne 0x1004a511
lea eax, [edx - 3]
xor edx, edx
test eax, eax
jle 0x1004a4c5
mov cl, byte [esi]
inc esi
cmp cl, 0xba
je 0x1004a4c5
cmp cl, 0xbb
jne 0x1004a4ee
inc edx
cmp edx, eax
jl 0x1004a4b3
sub eax, edx
test edx, edx
jne 0x1004a514
push 0x8a
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.10026890
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x81
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.10026890
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
lea eax, [edx - 2]
cmp byte [eax + esi], 0xcc
je 0x1004a53d
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.10026890
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov ecx, eax
push edi
mov edi, dword [esp + 0xc]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
push 0x72
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.10026890
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
Function at 0x407853
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43ca90]
jne 0x40785d
repz ret
jmp fcn.00409be7

Function at 0x40862b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43ca90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004056bf
and dword [ebp - 0x14], 0
cmp dword [0x4540f8], 0
mov dword [ebp - 0x18], eax
jne 0x4086de
push 0x402a1c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408786
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402a10
push ebx
call edi
test eax, eax
je 0x408786
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x402a00
push ebx
mov dword [0x4540f8], eax
call edi
push eax
call esi
push 0x4029ec
push ebx
mov dword [0x4540fc], eax
call edi
push eax
call esi
push 0x4029d0
push ebx
mov dword [0x454100], eax
call edi
push eax
call esi
mov dword [0x454108], eax
test eax, eax
je 0x4086de
push 0x4029b8
push ebx
call edi
push eax
call esi
mov dword [0x454104], eax
mov eax, dword [0x454104]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x408737
cmp dword [0x454108], ecx
je 0x408737
push eax
call esi
push dword [0x454108]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x408737
test ebx, ebx
je 0x408737
call edi
test eax, eax
je 0x40872e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40872e
test byte [ebp - 8], 1
jne 0x408737
or dword [ebp + 0x10], 0x200000
jmp 0x40876a
mov eax, dword [0x4540fc]
cmp eax, dword [ebp - 0x18]
je 0x40876a
push eax
call esi
test eax, eax
je 0x40876a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40876a
mov eax, dword [0x454100]
cmp eax, dword [ebp - 0x18]
je 0x40876a
push eax
call esi
test eax, eax
je 0x40876a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4540f8]
call esi
test eax, eax
je 0x408786
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408788
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407853
leave
ret
Function at 0x40c6c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x40c6cf
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0040c3e1
pop ebp
rol bh, cl
enter 0x458d, 0xffffffffffffffc0
push eax
call fcn.0040c3f1
push eax
push esi
push dword [ebp + 8]
call fcn.0040c3a6
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.0040c3e1
int3

Function at 0x40c790
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp + 8]
call fcn.0040c3a6
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0040c3f1
push eax
push esi
push dword [ebp + 8]
call fcn.0040c3a6
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0040c3f1
push eax
push esi
push dword [ebp + 8]
call fcn.0040c3a6
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0040c3e1
pushfd
das
cdq
nop
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
Function at 0x40cac0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40cab8
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40cad6
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov dword [ecx + eax], 0x948b0000
invalid
or byte [ecx], al
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
add byte [eax], al
invalid
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40cb34
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40cb1b
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40cb24
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40cb2e
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe fcn.0040cb10
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40ca9a
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40cb81
dec eax
je 0x40cb78
sub eax, 3
je 0x40cb6f
mov dword [ebp - 4], 0x40
jmp 0x40cb9e
mov dword [ebp - 4], 4
jmp 0x40cb84
mov dword [ebp - 4], 0x20
jmp 0x40cb84
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x40cbd0
invalid
invalid
Function at 0x40cad0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40cab8
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40cad6
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov dword [ecx + eax], 0x948b0000
invalid
or byte [ecx], al
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
add byte [eax], al
invalid
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40cb34
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40cb1b
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40cb24
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40cb2e
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe fcn.0040cb10
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40ca9a
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40cb81
dec eax
je 0x40cb78
sub eax, 3
je 0x40cb6f
mov dword [ebp - 4], 0x40
jmp 0x40cb9e
mov dword [ebp - 4], 4
jmp 0x40cb84
mov dword [ebp - 4], 0x20
jmp 0x40cb84
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x40cbd0
invalid
invalid

Function at 0x40cc10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x350], 0x62
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
invalid
invalid
mov dh, 0xfc
invalid
invalid

Function at 0x40e5b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
enter 0xffffffffffff8b34, 0xfffffffffffffff8
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.0040c3e1
outsb dx, byte [esi]
mov ecx, dword [ebp + 0x49]
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x40e5ce
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x40e5ce
call fcn.0040c3e1
cmp ebx, dword [edx + ebp*8 + 0x245a8b8e]
add ebx, edi
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.0040c3e1
sub dword [ecx + 0x875ff8f], ebp
push dword [ebp + 4]
push dword [ebp]
call fcn.0040cbe1
retf
Function at 0x415a20
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a3540
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4cf084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00477147
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00459e9f
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov ebx, dword [ebp + 8]
mov dword [edi + 0xc], eax
add esp, 8
mov dword [edi + 0x10], ecx
lea eax, [edi + 0x14]
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], esi
mov dword [ecx], 0
mov ecx, ebx
mov eax, dword [edi + 0x20]
not ecx
and ecx, 1
shl ecx, 2
mov edx, ecx
mov dword [eax], 0
or edx, 2
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, ebx
and al, 2
mov dword [edi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, ebx
mov dword [edi + 0x38], 0
cmovne edx, ecx
mov ecx, edx
or ecx, 8
and al, 8
cmove ecx, edx
mov eax, ecx
or eax, 0x10
and bl, 4
cmove eax, ecx
mov dword [edi + 0x3c], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x419a00
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4cf084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov esi, edx
push 0
mov dword [ebp - 8], edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 1
push 0
push 0
push dword [ebp + 8]
push esi
push edi
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov edi, eax
call fcn.00472b40
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebx], eax
mov dword [ebx + 4], esi
cmp edi, 0xffffffff
jne 0x419a62
or eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00477136
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 8], 0x17
jne 0x419a80
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x1b
push 0x29
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
call fcn.00472b40
mov ecx, dword [ebp - 4]
mov dword [ebx + 4], eax
xor ecx, ebp
mov eax, edi
mov dword [ebx], 0
pop edi
pop esi
pop ebx
call fcn.00477136
mov esp, ebp
pop ebp
ret
Function at 0x419e80
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4cf084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ebx
push edi
mov edi, dword [ebp + 0xc]
cmp esi, 0xffffffff
jne 0x419ec7
call fcn.00472b40
mov dword [edi + 4], eax
or eax, esi
mov dword [edi], 0x2719
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00477136
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebx]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
mov ecx, dword [ebp - 8]
mov ebx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax], ecx
call fcn.00472b40
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi], eax
mov dword [edi + 4], esi
test ebx, ebx
jne 0x419f0c
call fcn.00472b40
mov dword [edi], ebx
mov dword [edi + 4], eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00477136
mov esp, ebp
pop ebp
ret