joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8093b0
Capabilities:
Accept command line arguments
Delete directory
Get common file path

Disassembly:
mov eax, 0x10f4
call fcn.0040f290
cmp dword [0x2975ac4], 0x37
jne 0x8094c6
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x403460
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
call dword [sym.imp.KERNEL32.dll_RequestDeviceWakeup]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogW]
push 0
lea eax, [esp + 0xf4]
push eax
push 0x403470
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
lea ecx, [esp + 0x8f4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 0x28]
push edx
push 0
lea eax, [esp + 0x34]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
lea ecx, [esp + 0x24]
push ecx
push 0x4034c8
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
lea edx, [esp + 0x4f0]
push edx
push 0
push 0x4034d8
push 0x4034e8
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0
push 0x403538
push 0x403598
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
xor eax, eax
xor ecx, ecx
lea edx, [esp + 0x14]
mov word [esp + 4], ax
mov dword [esp + 6], eax
mov dword [esp + 0xa], eax
mov dword [esp + 0xe], eax
mov word [esp + 0x12], ax
mov dword [esp + 0x16], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov word [esp + 0x22], ax
push edx
lea eax, [esp + 8]
mov word [esp + 0x18], cx
push eax
lea ecx, [esp + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
mov edx, dword [0x2975ac8]
mov dword [esp], edx
mov eax, 0x5d1
add dword [esp], eax
mov eax, dword [esp]
mov cl, byte [eax + esi]
mov edx, dword [0x82b854]
mov byte [edx + esi], cl
add esp, 0x10f4
ret
Function at 0x809560
Capabilities:
Manipulate console buffer

Disassembly:
sub esp, 0xc0
mov eax, dword [esp + 0xc4]
mov ecx, dword [eax]
mov edx, dword [0x823374]
push ebx
push ebp
push esi
mov esi, dword [eax + 4]
mov eax, dword [0x823370]
push edi
mov dword [esp + 0x28], eax
mov eax, dword [0x823378]
mov dword [esp + 0x24], edx
mov edx, dword [0x82337c]
mov edi, 0xc6ef3720
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], 0x20
jmp 0x8095bb
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, ecx
shl eax, 4
add eax, dword [esp + 0x2c]
lea ebx, [edi + ecx]
shr ecx, 5
cmp dword [0x2975ac4], 0x1b
mov dword [esp + 0x10], eax
mov ebp, ecx
jne 0x8095ef
push 0
lea eax, [esp + 0x4c]
push eax
push 0x403430
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov eax, dword [esp + 0x10]
add ebp, dword [esp + 0x20]
mov dword [0x296ba74], 0
xor ebp, ebx
xor ebp, eax
sub esi, ebp
mov edx, esi
shl edx, 4
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x28]
add dword [esp + 0x10], eax
add edi, esi
cmp dword [0x2975ac4], 0x1be
jne 0x809636
lea eax, [esp + 0x30]
push eax
push 0
lea ecx, [esp + 0x3c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov edx, esi
shr edx, 5
add edx, dword [esp + 0x24]
mov dword [0x296ba78], 0xff6b3619
xor edx, edi
xor dword [esp + 0x10], edx
mov dword [0x296ba7c], 0xffffffff
mov eax, dword [esp + 0x10]
sub dword [esp + 0x14], eax
lea eax, [esp + 0x18]
call fcn.008094f0
dec dword [esp + 0x1c]
jne 0x8095b3
cmp dword [0x2975ac4], 0x8d4
jne 0x8096a8
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [esp + 0xd4]
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
mov dword [eax + 4], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc0
ret 4
mov eax, dword [esp + 0xd4]
mov edx, dword [esp + 0x14]
pop edi
mov dword [eax + 4], esi
pop esi
pop ebp
mov dword [eax], edx
pop ebx
add esp, 0xc0
ret 4

Function at 0x8096d0
Capabilities:
Manipulate console buffer

Disassembly:
mov eax, dword [0x2975ac4]
sub esp, 8
push ebx
push esi
mov esi, dword [0x82b854]
shr eax, 3
push edi
test eax, eax
je 0x809712
mov ebx, dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov edi, eax
cmp dword [0x2975ac4], 0x1c
jne 0x809706
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0
call ebx
push esi
call fcn.00809560
add esi, 8
dec edi
jne 0x8096f0
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x1002a8d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp + 0x14]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp + 0x14], esi
push dword [ebp + 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1002ae8
mov eax, dword [ebp + 0x14]
cmp eax, 2
jb 0x1002ae3
shr eax, 1
xor ecx, ecx
cmp cx, word [edi + eax*2 - 2]
jne 0x1002ae3
mov eax, dword [ebp + 0x10]
dec eax
je 0x1002adf
dec eax
jne 0x1002ae3
push esi
push edi
call fcn.01002996
test eax, eax
jne 0x1002ae8
xor eax, eax
jmp 0x1002ae8
mov eax, 0x3f7
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x1002d87
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1003220
call fcn.01002f44
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x10043c8
push ebx
push esi
push edi
call dword [sym.imp.API_MS_Win_Core_Interlocked_L1_1_0.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1002b9c
cmp eax, esi
jne 0x1002b8f
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1002b9f
push 0x3e8
call dword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_Sleep]
jmp 0x1002b76
xor esi, esi
inc esi
mov eax, dword [0x10043c4]
cmp eax, esi
jne 0x1002bb2
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1002bed
mov eax, dword [0x10043c4]
test eax, eax
jne 0x1002be7
mov dword [0x10043c4], esi
push 0x1001188
push 0x100117c
call fcn.01002af3
pop ecx
pop ecx
test eax, eax
je 0x1002bed
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1002cb7
mov dword [0x1004078], esi
mov eax, dword [0x10043c4]
cmp eax, esi
jne 0x1002c11
push 0x1001178
push 0x1001170
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10043c4], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1002c1e
push ebx
push edi
call dword [sym.imp.API_MS_Win_Core_Interlocked_L1_1_0.dll_InterlockedExchange]
cmp dword [0x10043cc], ebx
je 0x1002c3f
push 0x10043cc
call fcn.01002eb9
pop ecx
test eax, eax
je 0x1002c3f
push ebx
push 2
push ebx
call dword [0x10043cc]
push dword [0x1004060]
push dword [0x1004064]
push dword [0x100405c]
call fcn.010018dc
add esp, 0xc
mov dword [0x1004074], eax
cmp dword [0x1004068], ebx
jne 0x1002c9d
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1004078], ebx
jne 0x1002cab
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1004074]
call fcn.01002f89
ret
call 0x1094000
jmp 0x1002b54
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x44df7b9c
nop
nop
nop
nop
test eax, eax
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..text_1
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x32c6599c
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4012f1
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x402238
call fcn.004015c0
xor ebx, ebx
cmp dword [0x403394], ebx
jne 0x4010cf
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x403388
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x401109
cmp eax, esi
jne 0x4010fc
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x40110c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4010e3
xor esi, esi
inc esi
mov eax, dword [0x403384]
cmp eax, esi
jne 0x40111f
push 0x1f
call sub.MSVCR100.dll__amsg_exit
pop ecx
jmp 0x40115a
mov eax, dword [0x403384]
test eax, eax
jne 0x401154
mov dword [0x403384], esi
push 0x4020c4
push 0x4020b8
call sub.MSVCR100.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40115a
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x401231
mov dword [0x40304c], esi
mov eax, dword [0x403384]
cmp eax, esi
jne 0x40117e
push 0x4020b4
push 0x4020ac
call sub.MSVCR100.dll__initterm
pop ecx
pop ecx
mov dword [0x403384], 2
cmp dword [ebp - 0x1c], ebx
jne 0x40118b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x403398], ebx
je 0x4011ac
push 0x403398
call fcn.004014f0
pop ecx
test eax, eax
je 0x4011ac
push ebx
push 2
push ebx
call dword [0x403398]
mov eax, dword [0x403034]
mov ecx, dword [sym.imp.MSVCR100.dll___initenv]
mov dword [ecx], eax
push dword [0x403034]
push dword [0x403038]
push dword [0x403030]
call section..text
add esp, 0xc
mov dword [0x403048], eax
cmp dword [0x40303c], ebx
jne 0x401217
push eax
call dword [sym.imp.MSVCR100.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.MSVCR100.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x40304c], ebx
jne 0x401225
call dword [sym.imp.MSVCR100.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x403048]
call fcn.00401605
ret
call 0x492000
jmp 0x4010ae
Function at 0x43dc80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x21000]
push edi
jmp 0x43dc9a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x43dca1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x43dc90
mov eax, 1
add ebx, ebx
jne 0x43dcb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x43dca8
jne 0x43dcc4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43dca8
xor ecx, ecx
sub eax, 3
jb 0x43dcd8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43dd4a
mov ebp, eax
add ebx, ebx
jne 0x43dce3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x43dcf0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x43dd14
inc ecx
add ebx, ebx
jne 0x43dd00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x43dcf5
jne 0x43dd11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43dcf5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x43dd34
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43dd25
jmp 0x43dc96
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x43dd34
add edi, ecx
jmp 0x43dc96
pop esi
mov edi, esi
mov ecx, 0xb4b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43dd52
cmp byte [edi], 0xc
jne 0x43dd52
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x43dd57
lea edi, [esi + 0x3a000]
mov eax, dword [edi]
or eax, eax
je 0x43ddc6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3e5c0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3e678]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43dd84
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3e680]
or eax, eax
je 0x43ddc0
mov dword [ebx], eax
add ebx, 4
jmp 0x43dda1
call dword [esi + 0x3e67c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x43ddf7
cmp al, 0xef
ja 0x43ddea
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x43ddcc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x43ddd9
mov ebp, dword [esi + 0x3e684]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x43de2b
sub esp, 0xffffff80
jmp 0x40678a
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x53b607f7
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x5f7d5865
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ecx
pcmpeqd xmm3, xmm3
mov eax, 0xfffc0003
push edx
movd xmm4, eax
mov eax, 8
push edi
psrlq xmm3, 0x10
movd xmm5, eax
pshufd xmm4, xmm4, 0
pcmpeqw xmm6, xmm6
pshufd xmm5, xmm5, 0
pxor xmm7, xmm7
psllw xmm6, 0xf
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
sub eax, 8
jl 0x4011d4
test edi, 0xf
jne 0x401120
jmp 0x401060
movq xmm0, qword [ecx]
add edi, 0x10
movq xmm1, qword [ecx + 8]
add ecx, 0x10
pxor xmm0, xmm6
pxor xmm1, xmm6
punpcklwd xmm0, xmm7
movdqa xmm2, xmmword [edx]
punpcklwd xmm1, xmm7
psubd xmm2, xmm0
pslld xmm0, 4
psubd xmm0, xmm2
movdqa xmm2, xmmword [edx + 0x10]
psubd xmm0, xmm2
psubd xmm2, xmm1
pslld xmm1, 4
psubd xmm1, xmm2
movdqa xmm2, xmmword [edx + 0x20]
psubd xmm0, xmm2
psubd xmm1, xmm2
movdqa xmm2, xmm0
paddd xmm0, xmm4
pand xmm2, xmm5
psubd xmm1, xmmword [edx + 0x30]
add edx, 0x20
pcmpeqd xmm2, xmm5
psubd xmm0, xmm2
movdqa xmm2, xmm1
paddd xmm1, xmm4
pand xmm2, xmm5
psrad xmm0, 3
pcmpeqd xmm2, xmm5
psubd xmm1, xmm2
movdqa xmm2, xmm3
psrad xmm1, 3
pandn xmm2, xmmword [edi - 0x10]
packssdw xmm0, xmm1
pand xmm0, xmm3
por xmm2, xmm0
movdqa xmmword [edi - 0x10], xmm2
sub eax, 8
jge 0x401060
jmp 0x4011d4
movq xmm0, qword [ecx]
add edi, 0x10
movq xmm1, qword [ecx + 8]
add ecx, 0x10
pxor xmm0, xmm6
pxor xmm1, xmm6
punpcklwd xmm0, xmm7
movdqa xmm2, xmmword [edx]
punpcklwd xmm1, xmm7
psubd xmm2, xmm0
pslld xmm0, 4
psubd xmm0, xmm2
movdqa xmm2, xmmword [edx + 0x10]
psubd xmm0, xmm2
psubd xmm2, xmm1
pslld xmm1, 4
psubd xmm1, xmm2
movdqa xmm2, xmmword [edx + 0x20]
psubd xmm0, xmm2
psubd xmm1, xmm2
movdqa xmm2, xmm0
paddd xmm0, xmm4
pand xmm2, xmm5
psubd xmm1, xmmword [edx + 0x30]
add edx, 0x20
pcmpeqd xmm2, xmm5
psubd xmm0, xmm2
movdqa xmm2, xmm1
paddd xmm1, xmm4
pand xmm2, xmm5
psrad xmm0, 3
pcmpeqd xmm2, xmm5
psubd xmm1, xmm2
movdqu xmm2, xmmword [edi - 0x10]
psrad xmm1, 3
packssdw xmm0, xmm1
movdqa xmm1, xmm3
pand xmm0, xmm3
pandn xmm1, xmm2
por xmm1, xmm0
movdqu xmmword [edi - 0x10], xmm1
sub eax, 8
jge 0x401120
add eax, 8
jle 0x40122d
movq xmm0, qword [ecx]
pxor xmm0, xmm6
punpcklwd xmm0, xmm7
movdqa xmm1, xmmword [edx]
psubd xmm1, xmm0
pslld xmm0, 4
paddd xmm1, xmmword [edx + 0x10]
psubd xmm0, xmmword [edx + 0x20]
movq xmm2, qword [edi]
psubd xmm0, xmm1
paddd xmm4, xmm0
pand xmm0, xmm5
pcmpeqd xmm0, xmm5
psubd xmm4, xmm0
psrad xmm4, 3
packssdw xmm4, xmm4
pand xmm4, xmm3
pandn xmm3, xmm2
por xmm4, xmm3
movq qword [edi], xmm4
pop edi
pop edx
pop ecx
ret
Function at 0x628a79
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x630398
cmp edx, dword [eax]
je 0x628a9b
add eax, 8
inc ecx
cmp eax, 0x630428
jl 0x628a8c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x630398]
jne 0x628bc9
mov eax, dword [0x638d28]
cmp eax, 1
je 0x628ba3
test eax, eax
jne 0x628acc
cmp dword [0x6302c4], 1
je 0x628ba3
cmp edx, 0xfc
je 0x628bc9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x628b03
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00629460
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.006298f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x628b46
lea eax, [ebp - 0x1a4]
push eax
call fcn.006298f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62d93c
push edi
call fcn.0062b7c0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00629460
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00629470
lea eax, [ebp - 0xa0]
push 0x62d91c
push eax
call fcn.00629470
push dword [esi + 0x63039c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00629470
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062b734
add esp, 0x2c
pop edi
jmp 0x628bc9
lea eax, [ebp + 8]
lea esi, [esi + 0x63039c]
push 0
push eax
push dword [esi]
call fcn.006298f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4c8000
Capabilities:
Read .ini file

Disassembly:
push str.msdfmap.ini
pop eax
pushal
mov ebx, eax
push 7
pop edi
dec edi
push 0
call fcn.004c8648
push 0
call fcn.004c8484
test edi, edi
jne 0x4c800c
push ebx
add ebx, 0x18
push 0x10
mov esi, ebx
push ebx
add ebx, 0x20
push ebx
push ebx
add ebx, 0x1c
push ebx
mov eax, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call eax
lodsb al, byte [esi]
lodsb al, byte [esi]
lodsb al, byte [esi]
cmp al, 0x65
je 0x4c8448
popal
ret
push ebp
mov ebp, esp
sub esp, 0x60
mov esi, 0x4ca1c8
mov dword [ebp - 0x40], edi
push 0
call fcn.004c82a0
push esi
push dword [esi + 0x2c]
push eax
call fcn.004c84c8
pop esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
push dword [esi - 0x60]
pop ecx
call ecx
add esp, 0x60
pop ebp
ret
Function at 0x4054f0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x43aace
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebp
mov ebp, ecx
push 1
push 0
mov dword [esp + 0x10], ebp
call fcn.004219b0
lea ecx, [ebp + 0x1cc]
mov dword [esp + 0x24], 0
call fcn.004216d0
lea ecx, [ebp + 0x1e4]
mov byte [esp + 0x24], 1
call fcn.004216d0
lea ecx, [ebp + 0x1fc]
mov byte [esp + 0x24], 2
call fcn.004216d0
lea ecx, [ebp + 0x214]
mov byte [esp + 0x24], 3
call fcn.004216d0
lea ecx, [ebp + 0x22c]
mov byte [esp + 0x24], 4
call fcn.004216d0
lea ecx, [ebp + 0x244]
mov byte [esp + 0x24], 5
call fcn.004216d0
lea ecx, [ebp + 0x25c]
mov byte [esp + 0x24], 6
call fcn.004216d0
lea ecx, [ebp + 0x3a28]
mov byte [esp + 0x24], 7
call fcn.0041ab80
lea ecx, [ebp + 0x3b2c]
call fcn.0041c1b0
push 0x40
lea ecx, [ebp + 0x3fc4]
mov byte [esp + 0x28], 8
call fcn.00401370
push 0x40
lea ecx, [ebp + 0x4000]
mov byte [esp + 0x28], 9
call fcn.00401370
push 0x40
lea ecx, [ebp + 0x403c]
mov byte [esp + 0x28], 0xa
call fcn.00401370
push 0x40
lea ecx, [ebp + 0x4078]
mov byte [esp + 0x28], 0xb
call fcn.00401370
push 0x40
lea ecx, [ebp + 0x40b4]
mov byte [esp + 0x28], 0xc
call fcn.00401370
mov eax, dword [esp + 0x2c]
mov ecx, ebp
push eax
mov byte [esp + 0x28], 0xd
mov dword [ebp], 0x43c478
call fcn.00405850
mov eax, dword [esp + 0x30]
lea ecx, [esp + 4]
lea edx, [esp + 0xc]
push ecx
push edx
mov dword [ebp + 0x168], eax
mov byte [ebp + 0x16c], 1
mov dword [esp + 0xc], 0x10
push eax
call dword [sym.imp.WSOCK32.dll_getpeername]
cmp eax, 0xffffffff
je 0x4056a3
mov eax, dword [esp + 0x13]
mov ecx, dword [esp + 0x12]
mov edx, dword [esp + 0x11]
and eax, 0xff
push eax
mov eax, dword [esp + 0x14]
and ecx, 0xff
and edx, 0xff
push ecx
and eax, 0xff
push edx
push eax
lea ecx, [ebp + 0x58]
push str._d._d._d._d
push ecx
call fcn.004309ee
mov edx, dword [esp + 0x26]
add esp, 0x18
and edx, 0xffff
mov eax, ebp
mov dword [ebp + 0x54], edx
pop ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 8
push esi
push edi
mov edi, 0x441114
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x58]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x24]
pop edi
mov dword [ebp + 0x54], 0
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret 8
Function at 0x406b60
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x21c
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x15c]
test ecx, ecx
je 0x406b7e
push str.Connection_initiated
call fcn.00415a20
push 0
push 1
push 2
call dword [sym.imp.WSOCK32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0x168], eax
jne 0x406bb4
push 1
push str.Error_creating_socket
lea ecx, [esp + 0x10]
call fcn.00416690
lea eax, [esp + 8]
push 0x43dbf8
push eax
call fcn.004305d1
lea edi, [esi + 0x58]
push edi
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
jne 0x406c0f
push edi
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
jne 0x406c04
push edi
lea ecx, [esp + 0x28]
push str.Failed_to_get_server_address___s_._nDid_you_type_the_host_name_correctly_
push ecx
call fcn.004309ee
add esp, 0xc
lea edx, [esp + 0x24]
lea ecx, [esp + 8]
push 1
push edx
call fcn.00416690
lea eax, [esp + 8]
push 0x43dbf8
push eax
call fcn.004305d1
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [esp + 0x18], eax
mov cx, word [esi + 0x54]
mov word [esp + 0x14], 2
push ecx
call dword [sym.imp.WSOCK32.dll_htons]
mov word [esp + 0x16], ax
mov eax, dword [esi + 0x168]
lea edx, [esp + 0x14]
push 0x10
push edx
push eax
call dword [sym.imp.WSOCK32.dll_connect]
cmp eax, 0xffffffff
jne 0x406c77
add esi, 0x3b38
lea ecx, [esp + 0x24]
push esi
push str.Failed_to_connect_to_server___.255s_
push ecx
call fcn.004309ee
add esp, 0xc
lea edx, [esp + 0x24]
lea ecx, [esp + 8]
push 1
push edx
call fcn.00416690
lea eax, [esp + 8]
push 0x43dbf8
push eax
call fcn.004305d1
mov ecx, dword [esi + 0x54]
push ecx
push edi
push str.Connected_to__s_port__d_n
push 0
push 0x44a3a0
call fcn.004063e0
mov ecx, dword [esi + 0x15c]
add esp, 0x14
test ecx, ecx
je 0x406ca4
push str.Connection_established
call fcn.00415a20
pop edi
pop esi
add esp, 0x21c
ret

Function at 0x406d00
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x10
mov ecx, dword [ecx + 0x168]
lea eax, [esp]
push 4
push eax
push 1
push 6
push ecx
mov dword [esp + 0x14], 1
call dword [sym.imp.WSOCK32.dll_setsockopt]
test eax, eax
je 0x406d46
push 1
push str.Error_disabling_Nagles_algorithm
lea ecx, [esp + 0xc]
call fcn.00416690
lea edx, [esp + 4]
push 0x43dbf8
push edx
call fcn.004305d1
add esp, 0x10