joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42aee4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
xor edx, edx
push ebx
push esi
push edi
xor esi, esi
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], edx
dec eax
cmp eax, 0x29
jl 0x42b05a
mov ecx, eax
sub ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jge 0x42af1b
mov dword [ebp - 0xc], 1
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp - 8]
add ecx, 0x14
mov dword [ebp - 4], ecx
lea ebx, [eax - 0x14]
push 0x7a
push 0x4972f4
push ebx
call fcn.00410fb8
add esp, 0xc
mov esi, eax
test esi, esi
jne 0x42af5d
push 0x7d
push 0x49730c
push 0x41
push 0x7a
push 4
call fcn.00435320
add esp, 0x14
or eax, 0xffffffff
jmp 0x42b080
push ebx
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 4]
push edx
push 0x14
push ecx
call fcn.0042b17c
add esp, 0x10
mov eax, dword [ebp - 8]
lea edx, [ebp + eax - 0x24]
cmp eax, 0x14
jge 0x42af90
mov ecx, eax
mov edi, dword [ebp + 0x10]
sub ecx, dword [ebp - 8]
inc eax
mov cl, byte [edi + ecx]
xor byte [edx], cl
inc edx
cmp eax, 0x14
jl 0x42af7c
push 0x14
lea eax, [ebp - 0x24]
push eax
push ebx
push esi
call fcn.0042b17c
mov edx, esi
add esp, 0x10
mov dword [ebp - 0x10], edx
xor eax, eax
mov ecx, dword [ebp - 4]
cmp ebx, eax
mov edx, ecx
jle 0x42afc0
mov cl, byte [edx]
mov edi, dword [ebp - 0x10]
xor byte [edi], cl
inc eax
inc dword [ebp - 0x10]
inc edx
cmp ebx, eax
jg 0x42afb0
push 0
call fcn.004371d0
push eax
lea eax, [ebp - 0x38]
push 0
push eax
mov edx, dword [ebp + 0x20]
push edx
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.00437080
add esp, 0x18
lea eax, [ebp - 0x38]
push 0x14
push eax
push esi
call fcn.004062f8
add esp, 0xc
test eax, eax
jne 0x42b05a
cmp dword [ebp - 0xc], 0
jne 0x42b05a
mov eax, 0x14
lea edx, [esi + 0x14]
cmp ebx, eax
jle 0x42b00e
cmp byte [edx], 0
jne 0x42b00e
inc eax
inc edx
cmp ebx, eax
jg 0x42b003
cmp byte [esi + eax], 1
jne 0x42b05a
mov ecx, eax
inc eax
cmp ebx, ecx
jle 0x42b05a
sub ebx, eax
cmp ebx, dword [ebp + 0xc]
jle 0x42b03f
push 0x9b
push 0x497324
push 0x6d
push 0x7a
push 4
call fcn.00435320
add esp, 0x14
or ebx, 0xffffffff
jmp 0x42b04f
push ebx
add eax, esi
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00406030
add esp, 0xc
push esi
call fcn.00411178
pop ecx
mov eax, ebx
jmp 0x42b080
push 0xa8
push str..crypto_rsa_rsa_oaep.c
push 0x79
push 0x7a
push 4
call fcn.00435320
add esp, 0x14
test esi, esi
je 0x42b07d
push esi
call fcn.00411178
pop ecx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42b21c
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
cmp edx, dword [ebp + 0x18]
jne 0x42b237
mov cl, byte [eax]
cmp cl, 0x6a
je 0x42b258
cmp cl, 0x6b
je 0x42b258
push 0x72
push 0x49736c
push 0x89
push 0x80
push 4
call fcn.00435320
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
mov cl, byte [eax]
inc eax
cmp cl, 0x6b
jne 0x42b2c9
lea esi, [edx - 3]
xor ecx, ecx
cmp esi, ecx
jle 0x42b29f
mov dl, byte [eax]
inc eax
cmp dl, 0xba
je 0x42b29f
cmp dl, 0xbb
je 0x42b29a
push 0x81
push 0x497384
push 0x8a
push 0x80
push 4
call fcn.00435320
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
inc ecx
cmp esi, ecx
jg 0x42b269
sub esi, ecx
test ecx, ecx
jne 0x42b2cc
push 0x8a
push 0x49739c
push 0x8a
push 0x80
push 4
call fcn.00435320
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
lea esi, [edx - 2]
cmp byte [eax + esi], 0xcc
je 0x42b2f6
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.00435320
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
push esi
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00406030
add esp, 0xc
mov eax, esi
pop esi
pop ebp
ret
Function at 0x437e04
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor ecx, ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
test esi, esi
je 0x437e1d
cmp dword [esi + 8], 0
jne 0x437e24
xor eax, eax
jmp 0x437f17
mov edx, dword [esi + 4]
and edx, 0x100
mov dword [ebp - 8], edx
mov eax, dword [esi]
test eax, eax
jne 0x437e3f
mov dword [ebp - 4], 1
jmp 0x437e9c
mov dword [ebp - 4], eax
xor eax, eax
mov edx, dword [esi + 8]
cmp dword [ebp - 8], 0
mov al, byte [edx]
jne 0x437e5d
cmp eax, 0x7f
jle 0x437e5d
mov ebx, 1
xor ecx, ecx
jmp 0x437e99
cmp dword [ebp - 8], 0
je 0x437e99
cmp eax, 0x80
jle 0x437e73
mov ebx, 1
mov cl, 0xff
jmp 0x437e99
cmp eax, 0x80
jne 0x437e99
mov eax, 1
mov edx, dword [esi + 8]
inc edx
jmp 0x437e95
cmp byte [edx], 0
je 0x437e93
mov ebx, 1
mov cl, 0xff
jmp 0x437e99
inc eax
inc edx
cmp eax, dword [esi]
jl 0x437e85
add dword [ebp - 4], ebx
cmp dword [ebp + 0xc], 0
jne 0x437ea7
mov eax, dword [ebp - 4]
jmp 0x437f17
mov edx, dword [ebp + 0xc]
test ebx, ebx
mov edx, dword [edx]
je 0x437eb3
mov byte [edx], cl
inc edx
cmp dword [esi], 0
jne 0x437ebd
mov byte [edx], 0
jmp 0x437f0c
cmp dword [ebp - 8], 0
jne 0x437ed5
mov eax, dword [esi]
push eax
mov ecx, dword [esi + 8]
push ecx
push edx
call fcn.00406030
add esp, 0xc
jmp 0x437f0c
mov eax, dword [esi]
mov ecx, dword [esi + 8]
add ecx, eax
mov ebx, eax
dec ebx
dec ecx
add edx, ebx
jmp 0x437eea
mov byte [edx], 0
dec edx
dec ecx
dec eax
cmp byte [ecx], 0
je 0x437ee4
mov bl, byte [ecx]
dec ecx
xor bl, 0xff
dec eax
inc ebx
mov byte [edx], bl
dec edx
test eax, eax
jle 0x437f0c
mov bl, byte [ecx]
dec ecx
xor bl, 0xff
dec eax
mov byte [edx], bl
dec edx
test eax, eax
jg 0x437efe
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
add dword [eax], edx
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x437f20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
cmp dword [ebp + 8], 0
je 0x437f36
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x437f54
push 2
call fcn.0043c250
pop ecx
mov esi, eax
test eax, eax
jne 0x437f4b
xor eax, eax
jmp 0x43809e
mov dword [esi + 4], 2
jmp 0x437f59
mov edx, dword [ebp + 8]
mov esi, dword [edx]
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax]
mov eax, dword [ebp + 0x10]
add eax, ebx
mov dword [ebp - 4], eax
push 0xc7
push 0x4a7920
mov edx, dword [ebp + 0x10]
inc edx
push edx
call fcn.00410fb8
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x437f90
mov eax, 0x41
jmp 0x43806a
cmp dword [ebp + 0x10], 0
mov edx, dword [ebp - 8]
jne 0x437fa5
mov dword [esi + 4], 2
jmp 0x43803a
test byte [ebx], 0x80
je 0x438013
mov dword [esi + 4], 0x102
cmp byte [ebx], 0xff
jne 0x437fc0
cmp dword [ebp + 0x10], 1
je 0x437fc0
inc ebx
dec dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
lea ecx, [eax - 1]
add ebx, ecx
add edx, ecx
jmp 0x437fd2
mov byte [edx], 0
dec edx
dec eax
dec ebx
cmp byte [ebx], 0
jne 0x437fdb
test eax, eax
jne 0x437fcc
test eax, eax
jne 0x437ff4
mov edx, dword [ebp - 8]
mov byte [edx], 1
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
mov byte [eax + edx], 0
inc dword [ebp + 0x10]
jmp 0x43803a
mov cl, byte [ebx]
dec ebx
xor cl, 0xff
dec eax
inc ecx
mov byte [edx], cl
dec edx
test eax, eax
jle 0x43803a
mov cl, byte [ebx]
dec ebx
xor cl, 0xff
dec eax
mov byte [edx], cl
dec edx
test eax, eax
jg 0x438003
jmp 0x43803a
mov dword [esi + 4], 2
cmp byte [ebx], 0
jne 0x438029
cmp dword [ebp + 0x10], 1
je 0x438029
inc ebx
dec dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
push eax
push ebx
mov edx, dword [ebp - 8]
push edx
call fcn.00406030
add esp, 0xc
mov eax, dword [esi + 8]
test eax, eax
je 0x438048
push eax
call fcn.00411178
pop ecx
mov edx, dword [ebp - 8]
mov dword [esi + 8], edx
mov ecx, dword [ebp + 0x10]
mov dword [esi], ecx
cmp dword [ebp + 8], 0
je 0x43805e
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [edx], ecx
mov eax, esi
jmp 0x43809e
push 0x103
push 0x4a7936
push eax
push 0xc2
push 0xd
call fcn.00435320
add esp, 0x14
test esi, esi
je 0x43809c
cmp dword [ebp + 8], 0
je 0x438095
mov edx, dword [ebp + 8]
cmp esi, dword [edx]
je 0x43809c
push esi
call fcn.0043c2a0
pop ecx
xor eax, eax
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4bf146
Capabilities:
Encode data using xor

Disassembly:
pushal
push dword [esp + 8]
call fcn.004c6047
insb byte es:[edi], dx
dec ecx
mov ecx, 0xf38d3776
jnp 0x4bf154
aaa
invalid
or esi, ebp
push ss
mov dword [ecx], ebx
or edi, ebp
in eax, 0x70
push ebp
arpl word [ebx], bp
call [ebx]
pop ss
sub cl, byte [eax + 0x3c]
mov bl, 0x15
mov esi, 0xb82e8e1a
xor bh, byte [esi - 0x53c55bc6]
mov esi, 0xac3aa43a
and dh, byte [esi + 0x241e7726]
stosb byte es:[edi], al
mov bl, 0x39
xor dword [eax + 0x2fee2f7], ebx
add byte [eax], cl
nop
pushal
jb 0x4bf174
pop esi
retf 0x2dc2

Function at 0x4d13a5
Capabilities:
Packed with generic packer

Disassembly:
mov ebp, dword [ebp + 0xcecf8]
pushfd
lea ebp, [ebp + 0x1fa57f43]
jmp 0x4caec3
popal
cmp eax, 0x81f8dae6
mov esi, 0xe98bc360
adc dh, byte [ebx]
add byte [eax], al
call fcn.004d223f
and al, 0x28
pushfd
call fcn.004c0641
jecxz 0x4cae8d
xor al, 0xba
lea esi, ss:[eax + esi*8 + 0x70]
out dx, al
jo 0x4caeb5
invalid
mov dword [esp + 0x18], ebp
lea ebp, [esp - 0x174fbd5a]
movzx bp, bl
mov ebp, 0x404f4d
pushal
pushfd
jmp 0x4bc9ba
Function at 0x4ecc97
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x24]
je 0x4e6e73
bt bp, bp
bt si, 0xe
bsf dx, ax
shld si, ax, cl
mov esi, dword [eax + 0x3c]
bswap dx
sar edx, 0xf
bswap dx
add esi, eax
bt dx, dx
btc dx, 2
mov edx, dword [esi + 0x78]
cmp ch, ch
cmp dh, bh
cmc
test edx, edx
push 0xabd5f230
lea esp, [esp + 4]
je 0x4e6e73
clc
sub cl, 0x69
add edx, eax
rcr cl, 2
push esp
mov word [esp], 0x25a
test cl, bl
mov ecx, dword [esi + 0x7c]
jmp 0x4e59f6
aam 0xf5
and bp, 0x9f12
stc
or ebp, 0x9944c11d
mov ebp, esp
pushfd
rol ax, cl
sub esp, 0xc
aad 0xd
not eax
push esi
aam 0xfe
ror ah, cl
push edi
daa
push ebx
bsr ax, sp
movsx ax, al
dec ah
neg al
push edx
sbb ah, 0x4d
mov eax, dword [ebp + 8]
pushal
jmp 0x4ede18
jmp 0x4ec0c6
test al, 0x48
clc
pushfd
add ecx, edx
pushfd
stc
stc
cmc
mov dword [ebp - 0x10], ecx
add ch, 5
add cl, bl
bswap cx
mov ecx, dword [ebp + 0xc]
test bh, dl
test al, bh
cmp ecx, 0xffff
jmp 0x4ecadf
stc
stc
cmp ecx, dword [edx + 0x14]
call fcn.004e9d35
test al, 0xe4
aam 0xfb
xor al, 0x8d
aam 0x50
aam 0x4e
fcomp qword [esi + ebx*8 + 0x54]
fimul dword [esi - 0x28]
and al, 0xd4
inc esp
inc esi
push 0xffffffffffffff87
pushfd
adc edi, dword [ebx + edx*4 - 0x7b]
adc eax, dword [0x7349eb29]
mov eax, 0xd49cbe9
wait
push 0xba2a2888
xchg edx, eax
push edi
pushfd
mov dl, 0x2d
sub al, 0xe6
cmpsb byte cs:[esi], byte es:[edi]
sbb dword [ebp - 0x64], eax
sub al, 0xdb
push esi
mov dword [0xb448e5a1], eax
invalid
cmp dl, 0xf4
repne scasb al, byte es:[edi]
pushal
lea esp, [esp + 0x24]
jne 0x4ebbce
movsx ax, cl
call fcn.004e979e
test eax, eax
call fcn.004ec043
cmp dword [0x8d34f8fb], edx
mov ebp, 0xaf31d929
and dword [ecx - 0x5ec04ac3], esp
xor dword [edi + 0x451c3125], edi
and ebp, dword [edx - 0x56d0d647]
scasd eax, dword es:[edi]
lodsd eax, dword [esi]
mov word [0xefcffcdb], fs
jnp 0x4e6ee7
movsd dword es:[edi], dword [esi]
push edi
wait
outsd dx, dword gs:[esi]
in eax, 0xc4
pop ds
or ch, byte [edx + ecx*8 + 0x74]
xor byte [eax + 0x57d4a65c], dl
jmp 0x1d63d48d
pushfd
sub ecx, dword [edx + 0x10]
jmp 0x4e6c82
lea esp, [esp + 0xc]
jbe 0x4e41ba
stc
mov edi, dword [edx + 0x24]
movzx cx, dl
neg bl
add edi, eax
pushfd
movzx bx, bl
mov ebx, dword [edx + 0x20]
dec cx
add ebx, eax
mov ecx, dword [esp]
pop ecx
lea ecx, [ebx*4 + 0x165fe16e]
mov dword [ebp - 8], 0
test bx, di
sal cx, 0xc
mov ecx, dword [edx + 0x18]
cmp cx, sp
push 0x1e9f6ee7
push edx
clc
cmp ecx, dword [ebp - 8]
pushal
push edi
pushfd
lea esp, [esp + 0x30]
jbe 0x4e6e73
or si, 0x4d45
xor di, cx
lea esi, [eax - 0x767b684b]
sub ecx, 1
not si
xchg si, di
mov dword [ebp - 4], ecx
lea eax, [edi*8 + 0x57b641e1]
movzx ax, dl
sub ax, bp
test di, 0x757f
push ebp
movsx ax, bl
aam 0xe9
clc
jae 0x4e37eb
mov ebp, esp
bts ax, 0xc
sub esp, 0x10
test dx, 0xb1c4
bts ax, sp
push esi
and ah, 0x72
bts ax, si
aam 0x6a
push edi
test al, 0x8e
add eax, 0xb33f02c3
push ebx
daa
push edx
rcr al, 1
aaa
mov eax, dword [ebp + 8]
test ah, 9
stc
pushal
mov word [esp + 4], bx
test eax, eax
pushfd
jmp 0x4e2a66
cmc
jmp 0x4e6f00
Function at 0xd8e058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00d8e1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd8e07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd8e06a
add dl, dl
jne 0xd8e089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd8e0dc
xor eax, eax
add dl, dl
jne 0xd8e096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd8e17d
add dl, dl
jne 0xd8e0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd8e0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd8e0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd8e0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd8e0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd8e075
mov eax, 1
add dl, dl
jne 0xd8e0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd8e0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd8e0e1
sub eax, ebx
mov ebx, 1
jne 0xd8e128
mov ecx, 1
add dl, dl
jne 0xd8e10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd8e119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd8e105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd8e075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd8e13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd8e14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd8e136
cmp eax, 0x7d00
jae 0xd8e16d
cmp eax, 0x500
jb 0xd8e168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd8e075
cmp eax, 0x7f
ja 0xd8e170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd8e075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd8e19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd8e075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4025e4
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4070b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov edi, ecx
inc esi
push esi
push 0
push 0
push 6
push esi
push 2
pop eax
push eax
call dword [sym.imp.WS2_32.dll_WSASocketW]
or ebx, 0xffffffff
mov dword [edi + 0x20], eax
cmp eax, ebx
je 0x4026f0
push 4
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], esi
push ecx
push esi
push 6
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, ebx
je 0x4026f0
push 4
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], esi
push eax
push 0xfffffffffffffffb
push 0xffff
push dword [edi + 0x20]
call dword [sym.imp.WS2_32.dll_setsockopt]
push dword [edi + 0x20]
call sub.webengine4.dll_AttachHandleToThreadPool
mov esi, eax
test esi, esi
jne 0x402705
movzx ecx, word [edi + 0x1c]
push 2
pop eax
push ecx
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
cmp byte [edi + 0x2a], 0
mov word [ebp - 0x12], ax
je 0x402683
and dword [ebp - 0x10], esi
jmp 0x402691
push 0x7f000001
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0x10], eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0x20]
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, ebx
jne 0x4026de
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x271d
jne 0x4026f0
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push 4
push eax
push 0xfffffffffffffffb
push 0xffff
push dword [edi + 0x20]
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0x20]
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, ebx
je 0x4026f0
push closesocket
push dword [edi + 0x20]
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, ebx
jne 0x402705
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
test esi, esi
jle 0x402705
movzx esi, si
or esi, 0x80070000
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405280
mov esp, ebp
pop ebp
ret
Function at 0x402718
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4070b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 1
xor edi, edi
mov ebx, ecx
push edi
push edi
push 6
push 1
push 0x17
pop eax
push eax
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov dword [ebx + 0x20], eax
cmp eax, 0xffffffff
je 0x40282e
push 4
xor edx, edx
lea ecx, [ebp - 0x28]
push ecx
inc edx
push edx
push 6
push eax
mov dword [ebp - 0x28], edx
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x40282e
push 4
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 1
push eax
push 0xfffffffffffffffb
push 0xffff
push dword [ebx + 0x20]
call dword [sym.imp.WS2_32.dll_setsockopt]
push dword [ebx + 0x20]
call sub.webengine4.dll_AttachHandleToThreadPool
mov esi, eax
test esi, esi
jne 0x402843
mov dword [ebp - 0x1c], edi
lea edi, [ebp - 0x18]
mov word [ebp - 0x1e], ax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp - 8], esi
cmp byte [ebx + 0x2a], 0
jne 0x4027b6
mov byte [ebp - 9], 1
push 0x17
pop eax
mov word [ebp - 0x20], ax
movzx eax, word [ebx + 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1e], ax
lea eax, [ebp - 0x20]
push 0x1c
push eax
push dword [ebx + 0x20]
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x40281b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x271d
jne 0x40282e
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
push 4
push eax
push 0xfffffffffffffffb
push 0xffff
push dword [ebx + 0x20]
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x1c
lea eax, [ebp - 0x20]
push eax
push dword [ebx + 0x20]
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x40282e
push closesocket
push dword [ebx + 0x20]
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x402843
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
test esi, esi
jle 0x402843
movzx esi, si
or esi, 0x80070000
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405280
mov esp, ebp
pop ebp
ret

Function at 0x402856
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, ecx
cmp byte [esi + 0x28], 0
je 0x402869
xor eax, eax
jmp 0x4028e2
push ebx
push edi
call fcn.004029fa
mov edi, eax
test edi, edi
jne 0x4028d7
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp byte [esi + 0x2b], 0
mov ecx, esi
mov ebx, dword [ebp - 0x14]
je 0x402892
call fcn.00402718
jmp 0x402897
call fcn.004025e4
mov edi, eax
test edi, edi
jne 0x4028d7
imul eax, ebx, 3
mov byte [esi + 0x28], 1
mov ebx, eax
mov dword [ebp - 4], eax
test ebx, ebx
jle 0x4028c2
mov ecx, esi
call fcn.00402577
mov edi, eax
test edi, edi
jne 0x4028d7
dec ebx
test ebx, ebx
jg 0x4028ad
mov eax, dword [ebp - 4]
push eax
push 0x4011b0
push 0x40000434
call sub.webengine4.dll_XspLogEvent
add esp, 0xc
jmp 0x4028de
mov ecx, esi
call fcn.004028e7
mov eax, edi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4029fa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetServices_aspnet_stateParameters
push reloc.WS2_32.dll_bind
mov edi, ecx
mov dword [ebp - 4], ebx
mov esi, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x402a30
jg 0x402a7c
mov esi, eax
jmp 0x402a5c
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push 0x40122c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402a2a
cmp dword [ebp - 0xc], ebx
setne al
mov byte [edi + 0x2a], al
cmp dword [ebp - 4], ebx
je 0x402a6a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x402a73
mov byte [edi + 0x2a], bl
mov esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx esi, ax
or esi, 0x80070000
jmp 0x402a5c

Function at 0x402a87
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push str.SYSTEMCurrentControlSetServices_aspnet_stateParameters
push reloc.WS2_32.dll_bind
mov edi, ecx
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x402aba
jg 0x402b16
mov esi, eax
jmp 0x402af4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push 0x401210
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402ab4
mov eax, dword [ebp - 8]
test eax, eax
jle 0x402aeb
cmp eax, 0x7fffffff
jle 0x402af1
push 0xf
pop eax
mov dword [ebp - 8], eax
mov dword [edi + 0x14], eax
cmp dword [ebp - 4], 0
je 0x402b03
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x402b0e
mov dword [edi + 0x14], 0xf
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
movzx esi, ax
or esi, 0x80070000
jmp 0x402af4