joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421609
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4469db
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x45b080]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push esi
push edi
mov eax, dword [0x45b080]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
cmp eax, dword [edi + 0xcc]
je 0x4217ce
movzx esi, ax
mov dword [edi + 0xcc], eax
movzx ebx, word [edi + 0xce]
lea eax, [esi - 8]
cmp eax, 0x9d
ja case.0x421602.9
movzx eax, byte [eax + 0x4217fc]
jmp dword [eax*4 + 0x4217f4]
xor esi, esi
jmp 0x421611
test esi, esi
jne 0x42162a
test ebx, ebx
jne 0x42162a
push 0x452f50
mov dword [edi + 0xcc], ebx
call fcn.004095e0
jmp 0x4217bd
mov eax, dword [0x45c5a8]
mov ecx, 0x45c5a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
mov dword [esp + 0x228], 0
test bl, 8
je 0x42165e
push 6
push str.Win_
lea ecx, [esp + 0x18]
call fcn.00407de0
test bl, 2
je 0x421673
push 7
push str.Ctrl_
lea ecx, [esp + 0x18]
call fcn.00407de0
test bl, 4
je 0x421688
push 8
push str.Shift_
lea ecx, [esp + 0x18]
call fcn.00407de0
test bl, 1
je 0x42169d
push 6
push str.Alt_
lea ecx, [esp + 0x18]
call fcn.00407de0
lea eax, [esi - 0x13]
cmp eax, 0x7d
ja case.0x4216b0.20
movzx eax, byte [eax + 0x4218e4]
jmp dword [eax*4 + 0x42189c]
push str.Pause_Break
jmp 0x421783
push str.Page_Up
jmp 0x421783
push str.Page_Down
jmp 0x421783
push 0x452fd4
jmp 0x421783
push str.Home
jmp 0x421783
push str.Left
jmp 0x421783
push 0x452ff4
jmp 0x421783
push str.Right
jmp 0x421783
push str.Down
jmp 0x421783
push str.Select
jmp 0x421783
push str.Print
jmp 0x421783
push str.Execute
jmp 0x421783
push str.Snapshot
jmp 0x421783
push str.Insert
jmp 0x421783
push str.Delete
jmp 0x421783
push str.Help
jmp 0x421783
push str.Num_Lock
jmp 0x421783
test esi, esi
je 0x42178c
xor eax, eax
push 0x1fc
push eax
mov word [esp + 0x1c], ax
lea eax, [esp + 0x1e]
push eax
call fcn.00437d40
add esp, 0xc
lea eax, [esp + 0x14]
push 0xff
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
shl eax, 0x10
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
call fcn.00407bc0
mov esi, dword [esp + 0x10]
push esi
mov ecx, edi
call fcn.004095e0
add esi, 0xfffffff0
mov dword [esp + 0x228], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4217bd
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push 0
push 2
push 0x19
push dword [edi + 0x1c]
mov ecx, edi
push edi
call fcn.0040cc50
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00432b46
mov esp, ebp
pop ebp
ret 4
Function at 0x42160d
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4469db
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x45b080]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push esi
push edi
mov eax, dword [0x45b080]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
cmp eax, dword [edi + 0xcc]
je 0x4217ce
movzx esi, ax
mov dword [edi + 0xcc], eax
movzx ebx, word [edi + 0xce]
lea eax, [esi - 8]
cmp eax, 0x9d
ja case.0x421602.9
movzx eax, byte [eax + 0x4217fc]
jmp dword [eax*4 + 0x4217f4]
xor esi, esi
jmp 0x421611
test esi, esi
jne 0x42162a
test ebx, ebx
jne 0x42162a
push 0x452f50
mov dword [edi + 0xcc], ebx
call fcn.004095e0
jmp 0x4217bd
mov eax, dword [0x45c5a8]
mov ecx, 0x45c5a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
mov dword [esp + 0x228], 0
test bl, 8
je 0x42165e
push 6
push str.Win_
lea ecx, [esp + 0x18]
call fcn.00407de0
test bl, 2
je 0x421673
push 7
push str.Ctrl_
lea ecx, [esp + 0x18]
call fcn.00407de0
test bl, 4
je 0x421688
push 8
push str.Shift_
lea ecx, [esp + 0x18]
call fcn.00407de0
test bl, 1
je 0x42169d
push 6
push str.Alt_
lea ecx, [esp + 0x18]
call fcn.00407de0
lea eax, [esi - 0x13]
cmp eax, 0x7d
ja case.0x4216b0.20
movzx eax, byte [eax + 0x4218e4]
jmp dword [eax*4 + 0x42189c]
push str.Pause_Break
jmp 0x421783
push str.Page_Up
jmp 0x421783
push str.Page_Down
jmp 0x421783
push 0x452fd4
jmp 0x421783
push str.Home
jmp 0x421783
push str.Left
jmp 0x421783
push 0x452ff4
jmp 0x421783
push str.Right
jmp 0x421783
push str.Down
jmp 0x421783
push str.Select
jmp 0x421783
push str.Print
jmp 0x421783
push str.Execute
jmp 0x421783
push str.Snapshot
jmp 0x421783
push str.Insert
jmp 0x421783
push str.Delete
jmp 0x421783
push str.Help
jmp 0x421783
push str.Num_Lock
jmp 0x421783
test esi, esi
je 0x42178c
xor eax, eax
push 0x1fc
push eax
mov word [esp + 0x1c], ax
lea eax, [esp + 0x1e]
push eax
call fcn.00437d40
add esp, 0xc
lea eax, [esp + 0x14]
push 0xff
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
shl eax, 0x10
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
call fcn.00407bc0
mov esi, dword [esp + 0x10]
push esi
mov ecx, edi
call fcn.004095e0
add esi, 0xfffffff0
mov dword [esp + 0x228], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4217bd
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push 0
push 2
push 0x19
push dword [edi + 0x1c]
mov ecx, edi
push edi
call fcn.0040cc50
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00432b46
mov esp, ebp
pop ebp
ret 4
Function at 0x421970
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x5b
mov ebx, ecx
xor esi, esi
call edi
test ax, ax
js 0x421992
push 0x5c
call edi
test ax, ax
jns 0x421997
mov esi, 8
push 0x11
call edi
test ax, ax
jns 0x4219a3
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x4219af
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x4219bb
or esi, 1
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
cmp eax, 9
jne 0x4219cc
test esi, esi
je 0x421a01
jmp 0x4219ea
test esi, esi
jne 0x4219ea
cmp eax, 8
jne 0x4219e5
push 0
mov ecx, ebx
call fcn.00421590
pop edi
pop esi
pop ebx
pop ebp
ret 4
cmp eax, 0x2e
je 0x4219d5
movzx ecx, si
movzx eax, ax
shl ecx, 0x10
or ecx, eax
push ecx
mov ecx, ebx
mov byte [edx + 4], 1
call fcn.00421590
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x421e60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040d2b0

Function at 0x424ec0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446b4e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x45b080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], 0
mov dword [ebp - 4], 0
mov dword [edi], vtable.FooUI::Styles::FStyleObject.0
mov eax, dword [0x45c5a8]
lea esi, [edi + 8]
mov ecx, 0x45c5a8
mov dword [ebp - 0x14], esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push 0
push 0x452dbc
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00407f10
mov byte [ebp - 4], 2
mov eax, dword [0x45c5a8]
mov ecx, 0x45c5a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0xc], eax
mov byte [ebp - 4], 3
mov eax, dword [0x45c5a8]
lea esi, [edi + 0x10]
mov ecx, 0x45c5a8
mov dword [ebp - 0x14], esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push 0
push 0x452dbc
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.00407f10
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4280a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x460840], 0
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
jne 0x4280bc
mov byte [0x460840], 1
call fcn.00428110
movzx ecx, word [edi]
mov eax, 0x7fed7fed
mov esi, 0xeeeeeeee
test cx, cx
je 0x428102
shl ebx, 8
movzx edx, cx
sub edx, 0x20
add eax, esi
lea ecx, [ebx + edx]
and ecx, 0x3ff
lea edi, [edi + 2]
xor eax, dword [ecx*4 + 0x45efb0]
mov ecx, esi
shl ecx, 5
add ecx, 3
add ecx, edx
add esi, ecx
movzx ecx, word [edi]
add esi, eax
test cx, cx
jne 0x4280d1
pop edi
pop esi
pop ebx
ret
Function at 0x4282e0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446ec6
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x45b080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [ebp - 4], 0
lea edi, [esi + 8]
mov dword [esi], vtable.FooUI::Styles::FTextStyle::FTextStylePrivate.0
mov dword [edi + 4], 0
mov dword [edi], vtable.FooUI::Markup::FResourceObject.0
mov eax, dword [0x45c5a8]
mov ecx, 0x45c5a8
mov dword [ebp - 0x14], edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 8], eax
mov byte [ebp - 4], 1
push 0x68
mov dword [edi], vtable.FooUI::Markup::FFontResource.0
call fcn.00433353
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x42836e
mov ecx, eax
call fcn.004221a0
jmp 0x428370
xor eax, eax
mov dword [edi + 0xc], eax
inc dword [eax + 4]
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 3
call fcn.004243c0
mov dword [esi + 0x28], 0x10
mov word [esi + 0x2c], 0xff
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0xffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42e410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
push esi
mov eax, dword [ebx + 8]
mov esi, eax
and esi, 7
je 0x42e435
cmp eax, esi
jge 0x42e42d
call fcn.0042db50
mov ecx, esi
shr dword [ebx + 0xc], cl
sub dword [ebx + 8], esi
mov edx, dword [ebx + 8]
xor ecx, ecx
test edx, edx
jle 0x42e45e
mov esi, dword [ebx + 0xc]
mov al, byte [ebx + 0xc]
mov byte [ebp + ecx - 4], al
shr esi, 8
sub edx, 8
inc ecx
mov dword [ebx + 0xc], esi
test edx, edx
jg 0x42e441
mov dword [ebx + 8], edx
cmp ecx, 4
jge 0x42e47b
mov esi, dword [ebx + 4]
mov eax, dword [ebx]
cmp eax, esi
jb 0x42e46b
xor edx, edx
jmp 0x42e471
movzx edx, byte [eax]
inc eax
mov dword [ebx], eax
mov byte [ebp + ecx - 4], dl
inc ecx
cmp ecx, 4
jl 0x42e461
mov eax, dword [ebp - 4]
movzx ecx, byte [ebp - 1]
movzx edx, ah
movzx eax, al
shl edx, 8
add edx, eax
movzx eax, byte [ebp - 2]
shl ecx, 8
add ecx, eax
mov eax, edx
xor eax, 0xffff
mov dword [ebp - 8], edx
cmp ecx, eax
je 0x42e4b6
mov dword [0x460630], str.zlib_corrupt
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx]
add eax, edx
cmp eax, dword [ebx + 4]
jbe 0x42e4d1
pop esi
mov dword [0x460630], 0x453fec
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x10]
add eax, edx
cmp eax, dword [ebx + 0x18]
jbe 0x42e4e9
mov ecx, ebx
call fcn.0042db90
test eax, eax
je 0x42e4ae
mov edx, dword [ebp - 8]
mov esi, dword [ebx]
push edi
mov edi, dword [ebx + 0x10]
push edx
push esi
push edi
call fcn.004340d0
mov ecx, dword [ebp - 8]
add esp, 0xc
lea eax, [esi + ecx]
mov dword [ebx], eax
lea eax, [edi + ecx]
pop edi
mov dword [ebx + 0x10], eax
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4326c0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
mov eax, dword [ebx]
mov eax, dword [eax + 0x18]
call eax
test al, al
je 0x43276d
mov eax, dword [ebp + 8]
test eax, eax
je 0x43276d
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x43270c
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push esi
call fcn.00432b38
add esp, 4
lea ecx, [ebp - 4]
push 0
push ecx
push esi
push eax
push edi
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebx]
push esi
mov esi, dword [ebp + 8]
mov eax, dword [eax + 4]
push esi
mov ecx, ebx
call eax
mov bl, al
test esi, esi
je 0x432757
push esi
call fcn.00433596
add esp, 4
pop esi
test edi, edi
je 0x432763
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43f613
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45b080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00438058
mov dword [ebp - 0x14], eax
cmp dword [0x45eb70], edi
jne 0x43f704
push 0x800
push edi
push 0x44a704
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x43f691
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x43f7e4
push 0x44a704
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x43f7e4
push 0x44a71c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43f7e4
push eax
call ebx
push 0x44a728
push esi
mov dword [0x45eb70], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x45eb74], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x45eb78], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x45eb80], eax
test eax, eax
je 0x43f701
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x45eb7c], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x43f729
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x43f71c
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x43f73e
push 4
pop eax
jmp 0x43f7e6
cmp dword [ebp - 0x14], edi
je 0x43f73e
push dword [0x45eb70]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x43f723
mov eax, dword [0x45eb7c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x43f79c
cmp dword [0x45eb80], esi
je 0x43f79c
push eax
call ebx
push dword [0x45eb80]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x43f79c
test eax, eax
je 0x43f79c
call ecx
test eax, eax
je 0x43f791
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x43f791
test byte [ebp - 8], 1
jne 0x43f79c
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x43f7cc
mov eax, dword [0x45eb74]
cmp eax, esi
je 0x43f7c9
push eax
call ebx
test eax, eax
je 0x43f7c9
call eax
mov edi, eax
test edi, edi
je 0x43f7c9
mov eax, dword [0x45eb78]
cmp eax, esi
je 0x43f7c9
push eax
call ebx
test eax, eax
je 0x43f7c9
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x45eb70]
call ebx
test eax, eax
je 0x43f7e4
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x43f7e6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00432b46
leave
ret
Function at 0x4098b7
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x4098d5
mov eax, 0x52fe24
push eax
push 1
mov ebx, 0x465200
call fcn.00464ca3
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4098ff
mov eax, 0
jmp 0x409973
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x409960
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x409949
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x409938
xor ecx, eax
xor edx, ebx
dec edi
jne 0x409929
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
mov esp, ebp
pop ebp
ret 4
Function at 0x413eb7
Capabilities:
Contain obfuscated stackstrings
Decode data using base64 via vbmi lookup table
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0x84
push ebx
mov ebx, dword [esp + 0x98]
push esi
xor ecx, ecx
xor esi, esi
xor edx, edx
push edi
mov dword [esp + 0xc], 0x7f7f7f7f
mov dword [esp + 0x10], 0x7f7f7f7f
mov dword [esp + 0x14], 0x7f7f7f7f
mov dword [esp + 0x18], 0x7f7f7f7f
mov dword [esp + 0x1c], 0x7f7f7f7f
mov dword [esp + 0x20], 0x7f7f7f7f
mov dword [esp + 0x24], 0x7f7f7f7f
mov dword [esp + 0x28], 0x7f7f7f7f
mov dword [esp + 0x2c], 0x7f7f7f7f
mov dword [esp + 0x30], 0x7f7f7f7f
mov dword [esp + 0x34], 0x3e7f7f7f
mov dword [esp + 0x38], 0x3f7f7f7f
mov dword [esp + 0x3c], 0x37363534
mov dword [esp + 0x40], 0x3b3a3938
mov dword [esp + 0x44], 0x7f7f3d3c
mov dword [esp + 0x48], 0x7f7f407f
mov dword [esp + 0x4c], 0x201007f
mov dword [esp + 0x50], 0x6050403
mov dword [esp + 0x54], 0xa090807
mov dword [esp + 0x58], 0xe0d0c0b
mov dword [esp + 0x5c], 0x1211100f
mov dword [esp + 0x60], 0x16151413
mov dword [esp + 0x64], 0x7f191817
mov dword [esp + 0x68], 0x7f7f7f7f
mov dword [esp + 0x6c], 0x1c1b1a7f
mov dword [esp + 0x70], 0x201f1e1d
mov dword [esp + 0x74], 0x24232221
mov dword [esp + 0x78], 0x28272625
mov dword [esp + 0x7c], 0x2c2b2a29
mov dword [esp + 0x80], 0x302f2e2d
mov dword [esp + 0x84], 0x7f333231
mov dword [esp + 0x88], 0x7f7f7f7f
test ebx, ebx
je 0x414104
mov edi, dword [esp + 0x9c]
mov edi, edi
mov eax, ebx
sub eax, edx
cmp eax, 2
jb 0x414001
cmp byte [edx + edi], 0xd
jne 0x414001
cmp byte [edx + edi + 1], 0xa
je 0x41403a
mov al, byte [edx + edi]
cmp al, 0xa
je 0x41403a
cmp al, 0x3d
jne 0x414016
inc ecx
cmp ecx, 2
ja 0x414112
cmp al, 0x7f
ja 0x414112
movzx eax, al
mov al, byte [esp + eax + 0xc]
cmp al, 0x7f
je 0x414112
cmp al, 0x40
jae 0x414039
test ecx, ecx
jne 0x414112
inc esi
inc edx
cmp edx, ebx
jb 0x413feb
test esi, esi
je 0x414104
mov ecx, dword [esp + 0x98]
lea eax, [esi + esi*2]
mov esi, dword [esp + 0x94]
lea eax, [eax*2 + 7]
shr eax, 3
test esi, esi
je 0x414123
cmp dword [ecx], eax
jb 0x414123
xor eax, eax
xor ebx, ebx
push ebp
mov ebp, 3
mov dword [esp + 0x90], eax
test edx, edx
je 0x4140f3
lea esp, [esp]
mov al, byte [edi]
cmp al, 0xd
je 0x4140ef
cmp al, 0xa
je 0x4140ef
movzx eax, al
mov cl, byte [esp + eax + 0x10]
xor eax, eax
cmp cl, 0x40
sete al
shl ebx, 6
sub ebp, eax
movzx eax, cl
mov ecx, dword [esp + 0x90]
and eax, 0x3f
inc ecx
or ebx, eax
mov dword [esp + 0x90], ecx
cmp ecx, 4
jne 0x4140ef
xor eax, eax
mov dword [esp + 0x90], eax
test ebp, ebp
je 0x4140da
mov eax, ebx
shr eax, 0x10
mov byte [esi], al
inc esi
cmp ebp, 1
jbe 0x4140e7
mov eax, ebx
shr eax, 8
mov byte [esi], al
inc esi
cmp ebp, 2
jbe 0x4140ef
mov byte [esi], bl
inc esi
inc edi
dec edx
jne 0x41408b
sub esi, dword [esp + 0x98]
mov eax, dword [esp + 0x9c]
pop ebp
mov dword [eax], esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov dword [ecx], eax
or eax, 0xffffffff
pop ebx
add esp, 0x84
ret 0x10
Function at 0x416ed1
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x416eef
mov eax, 0x52fe24
push eax
push 1
mov ebx, 0x465200
call fcn.00464ca3
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x416f19
mov eax, 0
jmp 0x416f8d
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x416f7a
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x416f63
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x416f52
xor ecx, eax
xor edx, ebx
dec edi
jne 0x416f43
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
mov esp, ebp
pop ebp
ret 4