joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408a05
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
or esi, 0x15687
call 0x40890c
add byte [eax + 0x50], al
aas
xor esi, dword ss:[0x4c48348]
pop esi
push eax
or eax, 0x1006
or eax, 0x16176
xor eax, 0x11f99
and eax, 0x16bf1
pop eax
lea eax, [ebp - 0x1670]
mov dword [ebp - 0xc90], eax
mov ecx, dword [ebp - 0x4f0]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc8c], edx
xor eax, eax
mov word [ebp - 0x1d8], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push esi
push eax
add esp, 4
xor esi, 0xc1c7
pop esi
push esi
or esi, 0x8093
pop esi
push esi
push eax
add esp, 4
or esi, 0x13561
sub esi, 0x17355
pop esi
push esi
push esi
add esp, 4
add esi, 0x17962
pop esi
mov edx, dword [ebp - 0xc8c]
mov ax, word [edx]
mov word [ebp - 0xffa], ax
mov ecx, dword [ebp - 0xc8c]
add ecx, 2
mov dword [ebp - 0xc8c], ecx
mov dx, word [ebp - 0xffa]
mov word [ebp - 0x1d8], dx
mov eax, dword [ebp - 0xc90]
mov cx, word [eax]
mov word [ebp - 0xffc], cx
mov edx, dword [ebp - 0xc90]
add edx, 2
mov dword [ebp - 0xc90], edx
mov ax, word [ebp - 0xffc]
mov word [ebp - 0x3c], ax
push edi
and edi, 0x1182f
or edi, 0x150bc
pop edi
push ecx
xor ecx, 0x8eeb
pop ecx
push ecx
push edx
add esp, 4
call 0x408a05
add byte [edx + 0x41], cl
aaa
dec ebx
cmp eax, 0xc4833f4f
add al, 0x81
leave
add byte [eax], al
pop ecx
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x408a2c
movzx edx, word [ebp - 0x1d8]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x15f0], edx
jmp 0x408a86
movzx ecx, word [ebp - 0x1d8]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x408954
movzx eax, word [ebp - 0x1d8]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x408954
movzx edx, word [ebp - 0x1d8]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x408a70
mov dword [ebp - 0x15ec], 0xffffffff
jmp 0x408a7a
mov dword [ebp - 0x15ec], 1
mov ecx, dword [ebp - 0x15ec]
mov dword [ebp - 0x15f0], ecx
cmp dword [ebp - 0x15f0], 0
jne 0x408acf
push esi
push ecx
add esp, 4
sub esi, 0x13101
or esi, 0x1322
add esi, 0x28f1
and esi, 0xecf6
pop esi
push eax
xor eax, 0xf5d6
or eax, 0x156bb
add eax, 0xfbad
lodsd eax, dword [esi]
sti
add byte [eax], al
push esi
push edx
add esp, 4
sub esi, 0x977d
xor esi, 0x931f
pop esi
push edi
or edi, 0x72f0
pop edi
push edi
and edi, 0x4cac
call 0x408afd
add byte [0x45444634], bh
inc eax
dec ebx
add esp, 4
pop edi
mov eax, dword [ebp - 0x4f0]
mov ecx, dword [eax]
mov dword [ebp - 0x4f0], ecx
mov edx, dword [ebp - 0x4f0]
cmp edx, dword [ebp - 0xc94]
je 0x408b2d
mov eax, dword [ebp - 0x4f0]
cmp dword [eax + 0x30], 0
jne 0x4088f8
mov dword [ebp - 0x2c0], 0
Function at 0x408afd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
or esi, 0x15687
call 0x40890c
add byte [eax + 0x50], al
aas
xor esi, dword ss:[0x4c48348]
pop esi
push eax
or eax, 0x1006
or eax, 0x16176
xor eax, 0x11f99
and eax, 0x16bf1
pop eax
lea eax, [ebp - 0x1670]
mov dword [ebp - 0xc90], eax
mov ecx, dword [ebp - 0x4f0]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc8c], edx
xor eax, eax
mov word [ebp - 0x1d8], ax
xor ecx, ecx
mov word [ebp - 0x3c], cx
push esi
push eax
add esp, 4
xor esi, 0xc1c7
pop esi
push esi
or esi, 0x8093
pop esi
push esi
push eax
add esp, 4
or esi, 0x13561
sub esi, 0x17355
pop esi
push esi
push esi
add esp, 4
add esi, 0x17962
pop esi
mov edx, dword [ebp - 0xc8c]
mov ax, word [edx]
mov word [ebp - 0xffa], ax
mov ecx, dword [ebp - 0xc8c]
add ecx, 2
mov dword [ebp - 0xc8c], ecx
mov dx, word [ebp - 0xffa]
mov word [ebp - 0x1d8], dx
mov eax, dword [ebp - 0xc90]
mov cx, word [eax]
mov word [ebp - 0xffc], cx
mov edx, dword [ebp - 0xc90]
add edx, 2
mov dword [ebp - 0xc90], edx
mov ax, word [ebp - 0xffc]
mov word [ebp - 0x3c], ax
push edi
and edi, 0x1182f
or edi, 0x150bc
pop edi
push ecx
xor ecx, 0x8eeb
pop ecx
push ecx
push edx
add esp, 4
call 0x408a05
add byte [edx + 0x41], cl
aaa
dec ebx
cmp eax, 0xc4833f4f
add al, 0x81
leave
add byte [eax], al
pop ecx
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x408a2c
movzx edx, word [ebp - 0x1d8]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x15f0], edx
jmp 0x408a86
movzx ecx, word [ebp - 0x1d8]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x408954
movzx eax, word [ebp - 0x1d8]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x408954
movzx edx, word [ebp - 0x1d8]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x408a70
mov dword [ebp - 0x15ec], 0xffffffff
jmp 0x408a7a
mov dword [ebp - 0x15ec], 1
mov ecx, dword [ebp - 0x15ec]
mov dword [ebp - 0x15f0], ecx
cmp dword [ebp - 0x15f0], 0
jne 0x408acf
push esi
push ecx
add esp, 4
sub esi, 0x13101
or esi, 0x1322
add esi, 0x28f1
and esi, 0xecf6
pop esi
push eax
xor eax, 0xf5d6
or eax, 0x156bb
add eax, 0xfbad
lodsd eax, dword [esi]
sti
add byte [eax], al
push esi
push edx
add esp, 4
sub esi, 0x977d
xor esi, 0x931f
pop esi
push edi
or edi, 0x72f0
pop edi
push edi
and edi, 0x4cac
call 0x408afd
add byte [0x45444634], bh
inc eax
dec ebx
add esp, 4
pop edi
mov eax, dword [ebp - 0x4f0]
mov ecx, dword [eax]
mov dword [ebp - 0x4f0], ecx
mov edx, dword [ebp - 0x4f0]
cmp edx, dword [ebp - 0xc94]
je 0x408b2d
mov eax, dword [ebp - 0x4f0]
cmp dword [eax + 0x30], 0
jne 0x4088f8
mov dword [ebp - 0x2c0], 0

Function at 0x408b4d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lodsd eax, dword [esi]
sti
add byte [eax], al
pop eax
mov edx, dword [ebp - 0x4f0]
mov dword [ebp - 0x2c0], edx
jmp 0x408b37
push ebx
xor ebx, 0x38d1
call 0x408b4d
add byte [0x3e4b3a49], bh
dec ebx
inc esi
inc ebx
add esp, 4
or ebx, 0xb78e
call 0x408b65
add byte [edi], bh
cmp dword [esp + edi + 0x49], ecx
cmp eax, 0x833a504b
les eax, [ebx + ebx*2]
mov ecx, dword [ebp - 0x2c0]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x320], edx
push ebx
xor ebx, 0x30c6
sub ebx, 0xe184
xor ebx, 0x7ae3
pop ebx
Function at 0x408b65
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lodsd eax, dword [esi]
sti
add byte [eax], al
pop eax
mov edx, dword [ebp - 0x4f0]
mov dword [ebp - 0x2c0], edx
jmp 0x408b37
push ebx
xor ebx, 0x38d1
call 0x408b4d
add byte [0x3e4b3a49], bh
dec ebx
inc esi
inc ebx
add esp, 4
or ebx, 0xb78e
call 0x408b65
add byte [edi], bh
cmp dword [esp + edi + 0x49], ecx
cmp eax, 0x833a504b
les eax, [ebx + ebx*2]
mov ecx, dword [ebp - 0x2c0]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x320], edx
push ebx
xor ebx, 0x30c6
sub ebx, 0xe184
xor ebx, 0x7ae3
pop ebx

Function at 0x408b8c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push eax
add esp, 4
sub ecx, 0x11678
and ecx, 0x13b8b
add ecx, 0x9edb
sahf
add byte [eax], al
and ecx, 0xe64e
pop ecx
mov dword [ebp - 0x780], 0

Function at 0x408bb4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x15f4], eax
cmp dword [ebp - 0x15f4], 0
jne 0x408bda
mov ecx, dword [ebp - 0x780]
mov dword [ebp - 0x4f4], ecx
jmp 0x408ecb
mov edx, dword [ebp - 0x15f4]
mov eax, dword [ebp - 0x320]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x15f8], eax
jne 0x408c02
mov ecx, dword [ebp - 0x780]
mov dword [ebp - 0x4f4], ecx
jmp 0x408ecb
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x15f8]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x15fc], edx
cmp dword [ebp - 0x15fc], 0
jne 0x408c34
mov eax, dword [ebp - 0x780]
mov dword [ebp - 0x4f4], eax
jmp 0x408ecb
mov ecx, dword [ebp - 0x320]
add ecx, dword [ebp - 0x15fc]
mov dword [ebp - 0x774], ecx
jne 0x408c59
mov edx, dword [ebp - 0x780]
mov dword [ebp - 0x4f4], edx
jmp 0x408ecb
mov eax, dword [ebp - 0x774]
mov ecx, dword [ebp - 0x320]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x1dd0], ecx
mov edx, dword [ebp - 0x774]
mov eax, dword [ebp - 0x320]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x1dd4], eax
mov ecx, dword [ebp - 0x774]
mov edx, dword [ebp - 0x320]
add edx, dword [ecx + 0x1c]
push ecx
sbb al, 0x89
xchg ebp, eax
sub dl, ah
invalid
inc edi
test dword [eax + 0xfffff8], ecx
add byte [eax], al
add bl, ch
invalid

Function at 0x4246e4
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x4c090c
mov eax, esi
mov edx, 8
test al, 1
je 0x424700
shr eax, 1
xor eax, 0xedb88320
jmp 0x424702
shr eax, 1
dec edx
jne 0x4246f3
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4246ec
pop esi
ret

Function at 0x424718
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x4c0908], 0
jne 0x424742
call fcn.004246e4
mov dword [esp], 0x4c0908
mov edx, dword [esp]
mov eax, 1
lock xchg dword [edx], eax
mov eax, edi
test esi, esi
je 0x42476c
mov edx, 0xff
and edx, ebx
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x4c090c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x424748
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x402e90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6200d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
mov esi, ecx
push 1
push eax
mov dword [esp + 0xc], esi
call fcn.00409dc0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x10], 0
mov dword [esi + 0x40], 1
mov dword [esi], 0x63472c
mov word [esi + 4], 3
mov dword [esi + 0x30], ecx
je 0x402ef8
mov edx, dword [eax + 8]
cmp byte [edx + 4], 0x50
jne 0x402ef8
mov ecx, dword [eax + 0x1cc]
test ecx, ecx
je 0x402ef8
mov eax, ecx
push eax
mov ecx, esi
call fcn.0040a2a0
lea eax, [esi + 0x24]
lea ecx, [esi + 0x20]
push eax
push ecx
mov ecx, esi
call fcn.00403910
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc

Function at 0x406b90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x620318
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
push edi
mov esi, ecx
push 1
push eax
mov dword [esp + 0x10], esi
call fcn.00409dc0
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov dword [esi + 0x20], ecx
mov ecx, dword [esi + 8]
xor edi, edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi], 0x634c58
mov word [esi + 4], 8
mov dword [esi + 0x24], edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x54], edi
mov edx, dword [ecx + 8]
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, esi
mov al, byte [edx + 0x172]
mov dword [esp + 0x18], edi
mov byte [esi + 0x58], al
call fcn.0040a2a0
mov edx, dword [esp + 0x20]
mov ecx, esi
push edx
call fcn.0040a320
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x5c], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x40e010
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x620676
push eax
mov ax, word [esp + 0x1c]
mov dword fs:[0], esp
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
mov word [esi + 0x1c], ax
mov ax, word [esp + 0x20]
movsx ecx, ax
shl ecx, 2
push ecx
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi], 0x635998
mov word [esi + 4], ax
mov word [esi + 6], di
call fcn.0061317d
mov dword [esi + 8], eax
mov ax, word [esp + 0x28]
movsx ebx, ax
mov word [esi + 0xc], ax
mov word [esi + 0xe], di
lea edx, [ebx + ebx*2]
lea eax, [edx*8 + 4]
push eax
call fcn.0061317d
add esp, 8
mov dword [esp + 0x2c], eax
cmp eax, edi
mov dword [esp + 0x18], edi
je 0x40e0ac
push fcn.00410e80
push 0x410e60
lea ebp, [eax + 4]
push ebx
push 0x18
push ebp
mov dword [eax], ebx
call fcn.00613686
mov eax, ebp
jmp 0x40e0ae
xor eax, eax
mov dword [esi + 0x10], eax
mov ax, word [esp + 0x28]
movsx ebx, ax
or ebp, 0xffffffff
mov word [esi + 0x14], ax
lea ecx, [ebx + ebx*2]
mov dword [esp + 0x18], ebp
mov word [esi + 0x16], di
lea edx, [ecx*4 + 4]
push edx
call fcn.0061317d
add esp, 4
mov dword [esp + 0x2c], eax
cmp eax, edi
mov dword [esp + 0x18], 1
je 0x40e10a
push 0x40a650
push 0x40a630
lea ebp, [eax + 4]
push ebx
push 0xc
push ebp
mov dword [eax], ebx
call fcn.00613686
mov eax, ebp
or ebp, 0xffffffff
jmp 0x40e10c
xor eax, eax
mov dword [esi + 0x18], eax
mov dword [esp + 0x18], ebp
movsx eax, word [esi + 0x1c]
shl eax, 4
push eax
call fcn.0061317d
add esp, 4
xor ecx, ecx
cmp word [esi + 0x1c], di
mov dword [esi + 0x20], eax
jle 0x40e160
xor eax, eax
mov edx, dword [esi + 0x20]
inc ecx
mov dword [eax + edx], edi
mov edx, dword [esi + 0x20]
mov dword [eax + edx + 4], ebp
mov edx, dword [esi + 0x20]
mov word [eax + edx + 8], di
mov edx, dword [esi + 0x20]
mov word [eax + edx + 0xa], di
mov edx, dword [esi + 0x20]
mov dword [eax + edx + 0xc], edi
add eax, 0x10
movsx edx, word [esi + 0x1c]
cmp ecx, edx
jl 0x40e130
movsx eax, word [esi + 0x1c]
shl eax, 3
push eax
call fcn.0061317d
mov dword [esi + 0x24], eax
add esp, 4
xor eax, eax
cmp word [esi + 0x1c], di
jle 0x40e19b
mov ecx, dword [esi + 0x24]
inc eax
mov word [ecx + eax*8 - 8], di
mov edx, dword [esi + 0x24]
mov word [edx + eax*8 - 6], di
mov ecx, dword [esi + 0x24]
mov dword [ecx + eax*8 - 4], edi
movsx edx, word [esi + 0x1c]
cmp eax, edx
jl 0x40e17b
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0x10
Function at 0x4204d0
Capabilities:
Check mutex on windows

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x28]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x42058a
mov eax, dword [esi + 0x28]
lea ecx, [eax + 0x7a]
push ecx
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, eax
test edi, edi
je 0x420566
push 0x66a9e0
mov ecx, esi
call fcn.00424c60
test al, al
je 0x42053d
push 0
push 0
push 0x10
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, dword [esi + 0x3c]
test esi, esi
je 0x420598
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov eax, 1
pop esi
ret
push edi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x420551
push 1
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call dword [sym.imp.USER32.dll_GetLastActivePopup]
push eax
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x420585
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [esi + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x3c], 0
pop edi
xor eax, eax
pop esi
ret
mov esi, dword [esi + 0x3c]
test esi, esi
je 0x420598
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov eax, 1
pop esi
ret

Function at 0x424f30
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, ecx
push esi
mov ecx, dword [0x6833d0]
push eax
lea esi, [ebx + 0x10c]
mov edx, dword [ecx + 0x28]
add edx, 0xe49
push edx
push 0x66a7b8
push esi
call fcn.00613634
push 0x8000
push esi
call fcn.00614875
mov esi, eax
add esp, 0x18
test esi, esi
jl 0x424fdd
push 0x108
push ebx
push esi
call fcn.0061467f
mov eax, dword [ebx + 0x104]
add esp, 0xc
test eax, eax
jle 0x424fc3
push 0x208
push eax
call fcn.006132aa
mov ecx, dword [ebx + 0x104]
mov dword [ebx + 0x108], eax
mov edx, ecx
shl edx, 6
add edx, ecx
shl edx, 3
push edx
push eax
push esi
call fcn.0061467f
add esp, 0x14
push esi
call fcn.006145cc
add esp, 4
mov eax, ebx
pop esi
pop ebx
ret 4
push esi
mov dword [ebx + 0x108], 0
call fcn.006145cc
add esp, 4
mov eax, ebx
pop esi
pop ebx
ret 4
push edi
mov edi, str.FILE_NOT_FOUND
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebx + 4]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov dword [ebx + 0x104], 0
mov dword [ebx], 0
mov dword [ebx + 0x108], 0
pop esi
pop ebx
ret 4
Function at 0x4264c9
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x620c4b
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
push esi
mov esi, ecx
push edi
mov dword [esi], eax
call fcn.00426860
lea ecx, [esi + 4]
push ecx
push 0x101
call dword [sym.imp.WSOCK32.dll_WSAStartup]
push 0x504
call fcn.0061317d
add esp, 4
mov dword [esp + 0x18], eax
xor edi, edi
cmp eax, edi
mov dword [esp + 0x10], edi
je 0x42651e
push 0x4d4f40
push 0x426580
lea edi, [eax + 4]
push 8
push 0xa0
push edi
mov dword [eax], 8
call fcn.00613686
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
mov dword [esi + 0x220], edi
mov dword [esi + 0x214], 1
call fcn.00426640
push 0xff
call fcn.0061317d
add esp, 4
mov edi, eax
mov ecx, esi
push edi
call fcn.00426760
push edi
mov ecx, esi
call fcn.00426660
push edi
call fcn.00613172
mov ecx, dword [esp + 0xc]
add esp, 4
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x426660
Capabilities:
Resolve dns

Disassembly:
push ebx
mov ebx, ecx
lea eax, [ebx + 0x194]
test eax, eax
jne 0x426671
pop ebx
ret 4
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
jne 0x426680
pop ebx
ret 4
mov ecx, dword [esp + 8]
push edi
mov byte [ecx], 0
mov edx, dword [eax + 4]
mov dword [ebx + 0x21c], 0
mov edi, dword [edx]
test edi, edi
je 0x4266e8
push ebp
push esi
mov eax, dword [ebx + 0x21c]
mov ecx, dword [ebx + 0x220]
add edx, 4
lea eax, [eax + eax*4]
shl eax, 5
lea ebp, [eax + ecx + 0x20]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebx + 0x21c]
inc esi
mov dword [ebx + 0x21c], esi
mov edi, dword [edx]
test edi, edi
jne 0x42669d
pop esi
pop ebp
mov eax, dword [ebx + 0x21c]
pop edi
pop ebx
ret 4
Function at 0x426760
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, ecx
lea eax, [ebx + 0x194]
test eax, eax
jne 0x426777
pop ebx
add esp, 0x1c
ret 4
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
jne 0x426789
pop ebx
add esp, 0x1c
ret 4
mov ecx, dword [esp + 0x24]
push ebp
mov byte [ecx], 0
mov ebp, dword [eax + 0xc]
mov dword [ebx + 0x218], 0
mov eax, dword [ebp]
test eax, eax
je 0x426851
push esi
push edi
xor edx, edx
xor ecx, ecx
mov dl, byte [eax + 3]
mov cl, byte [eax + 2]
push edx
push ecx
xor edx, edx
xor ecx, ecx
mov dl, byte [eax + 1]
mov cl, byte [eax]
push edx
push ecx
lea edx, [esp + 0x20]
push str._d._d._d._d_n
push edx
call fcn.00613634
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
add ebp, 4
mov esi, edi
mov edi, dword [esp + 0x30]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x218]
mov ecx, dword [ebx + 0x220]
lea edi, [esp + 0x10]
lea edx, [eax + eax*4]
xor eax, eax
shl edx, 5
add edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebx + 0x218]
inc esi
mov dword [ebx + 0x218], esi
mov eax, dword [ebp]
test eax, eax
jne 0x4267ab
pop edi
pop esi
mov eax, dword [ebx + 0x218]
pop ebp
pop ebx
add esp, 0x1c
ret 4
Function at 0x427150
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
test eax, eax
je 0x42718a
mov al, byte [esi + 0x14]
mov ecx, dword [esi + 8]
inc al
push 1
mov byte [esi + 0x14], al
lea eax, [esp + 0xb]
push eax
push ecx
call fcn.0061467f
add esp, 0xc
test eax, eax
jle 0x42718f
mov dl, byte [esp + 7]
mov al, byte [esi + 0x14]
cmp dl, al
mov eax, 2
jne 0x42718f
mov eax, 1
pop esi
pop ecx
ret

Function at 0x427250
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
jle 0x427365
mov eax, dword [esi + 8]
mov dword [esp + 0xc], 0xffffffff
push eax
call fcn.00614b45
mov edx, dword [esi + 8]
lea ecx, [esp + 0x10]
push 4
push ecx
push edx
mov edi, eax
call fcn.0061467f
add esp, 0x10
test eax, eax
jle 0x42736a
cmp dword [esp + 0xc], 1
je 0x4272bb
mov eax, dword [esi + 8]
push 0
push edi
push eax
call fcn.00614b56
mov ecx, dword [esp + 0x20]
add esp, 0xc
mov eax, 4
pop edi
pop esi
mov dword [ecx], 0
pop ebx
pop ecx
ret 0xc
mov ecx, esi
call fcn.00427150
cmp eax, 1
jne 0x42736a
mov edi, dword [esp + 0x18]
mov edx, dword [esi + 8]
push 4
push edi
push edx
call fcn.0061467f
add esp, 0xc
test eax, eax
jle 0x42736a
mov eax, dword [edi]
push eax
push 1
call fcn.006132aa
mov ebx, dword [esp + 0x1c]
mov dword [ebx], eax
mov ecx, dword [edi]
mov edx, dword [esi + 8]
push ecx
push eax
push edx
call fcn.0061467f
mov edi, eax
add esp, 0x14
test edi, edi
jg 0x427326
mov eax, dword [ebx]
push eax
call fcn.00613327
add esp, 4
mov eax, edi
mov dword [ebx], 0
pop edi
pop esi
pop ebx
pop ecx
ret 0xc
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 8]
push 4
push ecx
push edx
call fcn.0061467f
mov esi, eax
add esp, 0xc
test esi, esi
jg 0x427359
mov eax, dword [ebx]
push eax
call fcn.00613327
add esp, 4
mov eax, esi
mov dword [ebx], 0
pop edi
pop esi
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, 6
pop edi
pop esi
pop ebx
pop ecx
ret 0xc
Function at 0x427460
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
jle 0x427555
mov eax, dword [esi + 8]
mov dword [esp + 8], 0xffffffff
push eax
call fcn.00614b45
mov edx, dword [esi + 8]
lea ecx, [esp + 0xc]
push 4
push ecx
push edx
mov edi, eax
call fcn.0061467f
add esp, 0x10
test eax, eax
jle 0x42755a
cmp dword [esp + 8], 2
je 0x4274bf
mov eax, dword [esi + 8]
push 0
push edi
push eax
call fcn.00614b56
add esp, 0xc
mov eax, 4
pop edi
pop esi
pop ecx
ret 0xc
mov ecx, esi
call fcn.00427150
cmp eax, 1
jne 0x42755a
mov edi, dword [esp + 0x10]
mov ecx, dword [esi + 8]
push 4
push edi
push ecx
call fcn.0061467f
add esp, 0xc
test eax, eax
jle 0x42755a
mov eax, dword [esi + 0x550]
test eax, eax
je 0x42751e
mov edx, dword [esp + 0x14]
mov eax, dword [esi + 8]
push 4
push edx
push eax
call fcn.0061467f
add esp, 0xc
test eax, eax
jle 0x42755a
mov ecx, dword [esp + 0x18]
mov edx, dword [esi + 8]
push 4
push ecx
push edx
call fcn.0061467f
add esp, 0xc
test eax, eax
jle 0x42755a
mov eax, dword [esi + 0xc]
dec eax
mov dword [esi + 0xc], eax
jne 0x42754a
mov eax, dword [esi + 0x550]
test eax, eax
je 0x427535
push 0
jmp 0x427538
mov eax, dword [edi]
push eax
mov ecx, esi
call fcn.004276a0
cmp eax, 1
jne 0x42755a
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], ecx
pop edi
mov eax, 1
pop esi
pop ecx
ret 0xc
mov eax, 6
pop edi
pop esi
pop ecx
ret 0xc