joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008830
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x10193a7c], 0
mov byte [0x10193a80], 0
mov dword [0x10193a74], 0x1e8d
mov dword [0x10193a78], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov dword [0x10193a70], 0x1186
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x10193a74], 0x2167
mov eax, dword [0x10193a78]
add eax, 1
mov dword [0x10193a78], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10008875
jmp 0x100088c8
mov eax, dword [0x10193a70]
add eax, 0xd50
mov dword [0x10193a74], eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov dword [0x10193a70], 0x1002
mov dword [0x10193a78], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x10193a84], 0
mov dword [0x10193a70], 0x1768
mov edi, dword [0x10193a7c]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x10193a84], esi
mov eax, esi
cdq
idiv ecx
mov dword [0x10193a7c], edx
mov dword [0x10193a70], 0x1c29
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x10193a80], cl
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov dword [0x10193a70], 0x194b
mov cl, byte [0x10193a80]
mov esi, dword [0x10193a7c]
mov byte [ebx + esi], cl
mov esi, dword [0x10193a78]
add esi, 1
mov dword [0x10193a78], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x100088e1
jmp 0x100088b1
Function at 0x10009800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x10193a78], 0
mov dword [0x10193a7c], 0
mov dword [0x10193a88], 0
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
je 0x10009979
jmp 0x10009947
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, 0x100
add ecx, 1
mov edi, eax
add edi, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x10193a78], edx
mov dword [0x10193a70], 0x25ec
mov ecx, dword [ebp - 0x1c]
movzx ebx, byte [ecx + edx]
mov ecx, dword [ebp - 0x30]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x10193a7c], edx
mov dword [0x10193a70], 0x227d
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x10193a80], cl
mov dword [0x10193a70], 0x1d00
mov ebx, dword [ebp - 0x1c]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x10193a80]
mov edx, dword [0x10193a7c]
mov byte [ebx + edx], cl
mov edx, dword [0x10193a78]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x10193a7c]
movzx ecx, byte [ebx + ecx]
add ecx, edx
mov edx, dword [0x10193a74]
and ecx, 0xff
mov dword [0x10193a88], ecx
mov esi, edx
add esi, 0xffffec0a
mov dword [0x10193a70], esi
mov cl, byte [ebx + ecx]
mov esi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x2c]
mov ch, byte [esi + ebx]
mov dword [0x10193a74], 0x1fea
add edx, 0xffffc8e1
mov dword [0x10193a70], edx
xor ch, cl
mov edx, dword [ebp - 0x18]
mov byte [edx + ebx], ch
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x38], edi
je 0x10009977
jmp 0x1000995b
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], eax
jmp 0x1000984f
mov eax, dword [0x10193a7c]
mov ecx, dword [0x10193a78]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
jmp 0x1000984f
jmp 0x10009979
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10009990
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xa8
lea eax, [esp + 0x30]
lea ecx, [esp + 0x40]
mov dword [0x10193a70], 0x2313
mov dword [esp], eax
mov dword [esp + 0x2c], ecx
call fcn.10009170
mov ecx, 0x3ec
lea edx, [0x10009060]
mov esi, dword [esp + 0x30]
mov dword [esp + 0x90], esi
mov dword [esp + 0x68], 0x15ee00
mov esi, dword [0x10193a5c]
mov dword [esp + 0x48], esi
mov esi, dword [0x10193a60]
mov dword [esp + 0x80], esi
mov esi, dword [0x10193a64]
mov dword [esp + 0x94], esi
mov esi, dword [0x10193a68]
mov dword [esp + 0x44], esi
mov esi, dword [0x10193a6c]
mov dword [esp + 0x4c], esi
mov dword [0x10193a70], 0xd17
mov dword [0x10193a74], 0xf21
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], edx
jmp 0x10009a3d
mov eax, dword [esp + 0x1c]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
cmp word [eax], 0x5a4d
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jne 0x10009a74
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov edx, dword [esp + 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
je 0x10009a9d
mov eax, 0xfffffb4e
mov dword [0x10193a70], 0x479
mov ecx, dword [esp + 0x18]
add ecx, 0xfffff000
and ecx, 0xfffff000
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
jmp 0x10009a3d
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x8c], edx
mov dword [0x10193a74], ecx
mov eax, dword [edx + eax + 0x50]
mov dword [esp + 0x74], eax
call fcn.100081e0
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x1c], ecx
jne 0x10009a33
lea eax, [esp + 0x40]
mov ecx, dword [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.100084f0
mov dword [0x10193a74], 0x104e
mov ecx, esp
lea edx, [esp + 0x40]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [esp + 0x1c], eax
jmp 0x10009a33
Function at 0x424b14
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x452e20
call fcn.00425116
push 1
call fcn.00424b97
pop ecx
test al, al
jne 0x4249bd
push 7
call fcn.004257a1
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00424b62
mov byte [ebp - 0x24], al
mov eax, dword [0x461f38]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4249b6
test eax, eax
jne 0x424a27
mov dword [0x461f38], ecx
push 0x42835c
push 0x428344
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x424a0a
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x424b0e
push 0x428340
push 0x4282f0
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x461f38], 2
jmp 0x424a2c
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00424cf4
pop ecx
call fcn.00425795
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x424a5c
push esi
call fcn.00424c67
pop ecx
test al, al
je 0x424a5c
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.004259d3
call esi
call fcn.0042579b
mov esi, eax
cmp dword [esi], edi
je 0x424a7a
push esi
call fcn.00424c67
pop ecx
test al, al
je 0x424a7a
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.004258b6
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_wide_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.004258ec
test al, al
jne 0x424ab3
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x424abc
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.00424d11
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x424b0e
call fcn.0042515c
ret
call fcn.00424823
jmp 0x42499e

Function at 0x4264c9
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
jne 0x4264d8
or eax, 0xffffffff
jmp 0x426515
movzx eax, word [edx]
mov ecx, 0x1505
push esi
xor esi, esi
jmp 0x4264f2
imul ecx, ecx, 0x21
movzx eax, ax
xor ecx, eax
inc esi
movzx eax, word [edx + esi*2]
test ax, ax
jne 0x4264e5
imul eax, ecx, 0x41c64e6d
imul ecx, ecx, 0x10dcd
pop esi
add eax, 0x3039
shr eax, 0x10
inc ecx
and ecx, 0xffff0000
or eax, ecx
pop ebp
ret 4

Function at 0x42e004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x38824b76
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x50854bdb
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x403cd0
Capabilities:
Create mailslot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x43d288]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 1
lea eax, [ebp - 0x18]
mov edi, edx
push eax
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], 0xc
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
push 0xffffffffffffffff
push 0x80
push edi
mov dword [ebp - 0x1c], 1
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x403d65
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.Failed_to_create_mailslot___s_._Error__d
push 0x99
push str.....common_fileio.cpp
push str.ERROR
call fcn.004161a0
add esp, 0x18
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret

Function at 0x4045a0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x43d288]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x4046b3
mov ecx, dword [0x43e4dc]
cmp ecx, 0xffffffff
je 0x4045ed
cmp byte [0x43e4e0], 0
push ecx
je 0x4045e5
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x4045ed
call fcn.0041b71d
add esp, 4
xorps xmm0, xmm0
mov dword [0x43e4dc], esi
movdqu xmmword [ebp - 0x18], xmm0
mov eax, 2
mov word [ebp - 0x18], ax
mov eax, dword [ebp + 8]
push 0x30b
mov dword [ebp - 0x14], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x18]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x40466b
mov ecx, esi
call fcn.00404830
test al, al
jne 0x404658
call fcn.0041aa5e
push dword [eax]
push str.INTERNAL_ERROR___d_._Please__contact_WTware_tech_support.
push 0x1cd
push str.....common_fstream.cpp
push str.ERROR
call fcn.004161a0
add esp, 0x14
mov al, 1
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret 0xc
call fcn.0041aa5e
lea ecx, [ebp - 0x28]
push dword [eax]
lea eax, [ebp + 8]
push 0x30b
push eax
call fcn.00401390
push eax
push str.Connection_with__s:_d_failed__errno__d.
push 0x1e6
push str.....common_fstream.cpp
push str.ERROR
call fcn.004161a0
add esp, 0x1c
xor al, al
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret 0xc
call fcn.0041aa5e
push dword [eax]
push str.INTERNAL_ERROR___d_._Please__contact_WTware_tech_support.
push 0x1be
push str.....common_fstream.cpp
push str.ERROR
call fcn.004161a0
mov ecx, dword [ebp - 8]
add esp, 0x14
xor ecx, ebp
xor al, al
pop esi
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4046f0
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x43d288]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 0x11c], eax
push ebx
push esi
mov eax, dword [eax + 8]
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [eax]
cmp ebx, 0xffffffff
je 0x40480d
mov esi, dword [ebp + 0xc]
test esi, esi
jle 0x404793
push 0
push esi
push edi
push ebx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x40478b
call fcn.0041aa5e
cmp dword [eax], 0xb
jne 0x4047b6
lea eax, [ebp - 0xc]
mov dword [ebp - 0x114], ebx
push eax
push 0
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 1
push eax
push 0
lea eax, [ebx + 1]
mov dword [ebp - 0xc], 1
push eax
mov dword [ebp - 8], 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x4047a8
jne 0x40478f
push str.Close_stalled_TCP_connection.
call fcn.00415f40
add esp, 4
jmp 0x4047ca
add edi, eax
sub esi, eax
test esi, esi
jg 0x404726
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret 8
call fcn.0041aa5e
push dword [eax]
push str.Close_TCP_connection_while_sending_data._select___failed__errno__d.
jmp 0x4047c2
call fcn.0041aa5e
push dword [eax]
push str.Close_TCP_connection_while_sending_data__errno__d.
call fcn.00415f40
add esp, 8
mov esi, dword [ebp - 0x11c]
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x40480d
cmp byte [esi + 4], 0
push eax
je 0x4047ff
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi], 0xffffffff
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret 8
call fcn.0041b71d
add esp, 4
mov dword [esi], 0xffffffff
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret 8

Function at 0x404830
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x43d288]
xor eax, ebp
mov dword [ebp - 4], eax
cmp ecx, 0xffffffff
je 0x404894
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 1
push 6
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x404871
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret
call fcn.0041aa5e
push dword [eax]
push str.INTERNAL_ERROR___d_._Please__contact_WTware_tech_support.
push 0x46e
push str.....common_fstream.cpp
push str.ERROR
call fcn.004161a0
add esp, 0x14
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret
Function at 0x404b30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42b0c8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x43d288]
xor eax, esp
mov dword [esp + 0x58], eax
push esi
mov eax, dword [0x43d288]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0xffffffff
mov byte [esp + 0x14], 0
mov dword [esp + 0x18], eax
push 0x40
lea eax, [esp + 0x20]
mov dword [esp + 0x74], 0
push 0
push eax
call fcn.00426a30
add esp, 0xc
push 0
push esi
call fcn.0041b2c5
add esp, 8
cmp eax, 0xffffffff
jne 0x404bd3
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x404cb6
cmp byte [esp + 0x14], 0
push eax
je 0x404bc6
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x404cb6
call fcn.0041b71d
add esp, 4
jmp 0x404cb6
sub esp, 8
lea ecx, [esp + 0x18]
push esi
call fcn.00404440
test al, al
je 0x404ba6
cmp dword [esp + 0x10], 0xffffffff
je 0x404cad
push 0x3f
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
push dword [eax]
call fcn.0041b892
add esp, 0xc
test eax, eax
jle 0x404cad
cmp eax, 0x40
jae 0x404cd5
mov byte [esp + eax + 0x1c], 0
xor eax, eax
lea esp, [esp]
cmp byte [esp + eax + 0x1c], 0
je 0x404c51
cmp byte [esp + eax + 0x1d], 0
je 0x404c50
cmp byte [esp + eax + 0x1e], 0
je 0x404c4b
cmp byte [esp + eax + 0x1f], 0
je 0x404c46
add eax, 4
cmp eax, 0x40
jb 0x404c20
jmp 0x404c51
add eax, 3
jmp 0x404c51
add eax, 2
jmp 0x404c51
inc eax
test eax, eax
jle 0x404d05
cmp byte [esp + eax + 0x1b], 0xa
jne 0x404c6b
dec eax
cmp eax, 0x40
jae 0x404cd5
mov byte [esp + eax + 0x1c], 0
push 0
lea edx, [esp + 0x10]
mov dword [esp + 0x10], 0xffffffff
lea ecx, [esp + 0x20]
call fcn.00401760
add esp, 4
cmp eax, 2
je 0x404cda
call fcn.0041aa5e
push dword [eax]
push str.INTERNAL_ERROR___d_._Please__contact_WTware_tech_support.
push 0x28a
push str.....commonmisc3.cpp
push str.ERROR
call fcn.004161a0
add esp, 0x14
lea ecx, [esp + 0x10]
call fcn.00405070
or eax, 0xffffffff
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret
call fcn.0041b4b6
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x404cff
cmp byte [esp + 0x14], 0
push eax
je 0x404cf7
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [esp + 0xc]
jmp 0x404cb9
call fcn.0041b71d
add esp, 4
mov eax, dword [esp + 0xc]
jmp 0x404cb9
call fcn.0041aa5e
push dword [eax]
push str.INTERNAL_ERROR___d_._Please__contact_WTware_tech_support.
push 0x284
jmp 0x404c9b
Function at 0x404f70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b0f8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x43d288]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
push 0
push edi
call fcn.0041b2c5
add esp, 8
cmp eax, 0xffffffff
jne 0x404fb6
xor al, al
jmp 0x405050
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0xffffffff
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x14], eax
sub esp, 8
mov dword [ebp - 4], 0
mov ecx, eax
push edi
call fcn.00404440
test al, al
je 0x40502d
mov eax, dword [ebp - 0x1c]
cmp eax, 0xffffffff
je 0x405030
mov eax, dword [ebp - 0x14]
push 0x3f
push esi
push dword [eax]
call fcn.0041b892
mov edx, eax
add esp, 0xc
test edx, edx
jle 0x40502d
xor ecx, ecx
test edx, edx
jle 0x405022
mov al, byte [esi + ecx]
cmp al, 0xa
je 0x405020
cmp al, 7
je 0x405020
cmp al, 0xd
je 0x405020
inc ecx
cmp ecx, edx
jl 0x405001
mov eax, dword [ebp - 0x1c]
mov bl, 1
mov byte [esi + edx], 0
jmp 0x405032
mov edx, ecx
mov eax, dword [ebp - 0x1c]
mov bl, 1
mov byte [esi + edx], 0
jmp 0x405032
mov eax, dword [ebp - 0x1c]
xor bl, bl
cmp eax, 0xffffffff
je 0x40504e
cmp byte [ebp - 0x18], 0
push eax
je 0x405046
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x40504e
call fcn.0041b71d
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret
Function at 0x4050c0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push 0
push 0x80
push 3
push 0
push 1
push bind
push edi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4051c8
test eax, eax
je 0x4051c8
push 0
push eax
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0xc], eax
test eax, eax
jne 0x40512a
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push 0
push 2
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 4], eax
test eax, eax
jne 0x405181
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
lea ecx, [ebp - 0x400]
call fcn.00404e60
push eax
push str.mm_file_map___s__failed__x
push 0x2a
push str.....commonmm_file.cpp
push str.ERROR
call fcn.004161a0
add esp, 0x18
mov ecx, esi
call fcn.00402860
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
test eax, eax
jne 0x405120
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.map_file__x
push 0x33
push str.....commonmm_file.cpp
push str.ERROR
call fcn.004161a0
add esp, 0x14
mov ecx, esi
call fcn.00402860
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
cmp byte [ebp + 0xc], 0
jne 0x4051fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
lea ecx, [ebp - 0x400]
call fcn.00404e60
push eax
push str.mm_file_open___s__failed__x
push 0x17
push str.....commonmm_file.cpp
push str.ERROR
call fcn.004161a0
add esp, 0x18
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x40ee70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], 8
lea edi, [ecx + 1]
sub ecx, edx
lea eax, [edx + 3]
mov dword [ebp - 8], ecx
lea ecx, [ecx]
movzx ecx, byte [edi - 1]
lea eax, [eax + 4]
movzx esi, byte [eax - 7]
lea edi, [edi + 4]
movzx edx, byte [eax - 5]
xor esi, ecx
movzx ecx, byte [edi - 3]
xor edx, ecx
mov ecx, dword [ebp - 8]
or esi, edx
movzx edx, byte [ecx + eax - 4]
movzx ecx, byte [eax - 4]
xor edx, ecx
movzx ecx, byte [edi - 4]
or esi, edx
movzx edx, byte [eax - 6]
xor edx, ecx
or esi, edx
or ebx, esi
dec dword [ebp - 4]
jne 0x40ee90
lea eax, [ebx - 1]
shr eax, 8
pop edi
and eax, 1
pop esi
dec eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414a20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov byte [ebp - 2], 0
mov byte [ebp - 1], 1
mov eax, 0x20
movzx edx, byte [eax + esi - 1]
dec eax
mov ecx, edx
movzx ebx, byte [eax + 0x432130]
sub ecx, ebx
xor ebx, edx
sar ecx, 8
dec ebx
and cl, byte [ebp - 1]
or byte [ebp - 2], cl
sar ebx, 8
and byte [ebp - 1], bl
test eax, eax
jne 0x414a35
cmp byte [ebp - 2], al
pop esi
sete al
neg eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x414a70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
add ecx, 2
mov dword [ebp - 4], 0
push esi
mov dword [ebp - 8], ecx
mov eax, 0x431fb2
push edi
jmp 0x414a90
xor bl, bl
mov esi, ecx
mov edi, 8
lea esp, [esp]
movzx ecx, byte [eax - 1]
lea esi, [esi + 4]
xor cl, byte [esi - 5]
mov dl, byte [eax - 2]
xor dl, byte [esi - 6]
or dl, cl
movzx ecx, byte [eax + 1]
xor cl, byte [esi - 3]
or dl, cl
movzx ecx, byte [eax]
xor cl, byte [esi - 4]
add eax, 4
or dl, cl
or bl, dl
dec edi
jne 0x414aa0
test bl, bl
je 0x414aec
mov ecx, dword [ebp - 4]
add ecx, 0x20
mov dword [ebp - 4], ecx
cmp ecx, 0x180
mov ecx, dword [ebp - 8]
jb 0x414a90
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x414f70
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a8
mov eax, dword [0x43d288]
xor eax, esp
mov dword [esp + 0x1a4], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
lea eax, [esp + 0x194]
mov dword [esp + 0x194], str.WTware_HTTP
push eax
mov dword [esp + 0x19c], 0x414f00
mov dword [esp + 0x1a0], 0
mov dword [esp + 0x1a4], 0
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x414feb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR:_StartServiceCtrlDispatcher____failed:__d
call fcn.00415f40
add esp, 8
mov ecx, dword [esp + 0x1a4]
xor eax, eax
xor ecx, esp
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret