joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ab36
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x412020]
xor eax, ebp
mov dword [ebp + 0x39c], eax
mov eax, dword [ebp + 0x3ac]
push ebx
mov ebx, dword [ebp + 0x3b4]
push esi
mov esi, dword [ebp + 0x3b0]
push edi
mov edi, dword [ebp + 0x3a8]
mov dword [ebp - 0x7c], ebx
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x6c], esi
je 0x40acf9
cmp eax, ebx
je 0x40acf9
cmp ecx, ebx
je 0x40acf9
cmp edx, ebx
je 0x40acf9
cmp esi, ebx
je 0x40acf9
push 0x400
lea eax, [ebp - 0x64]
push ebx
mov esi, 0x80000002
push eax
mov dword [ebp - 0x68], esi
call sub.MSVCR80.dll_memset
push edi
mov edi, dword [sym.imp.MSVCR80.dll_sprintf]
lea eax, [ebp - 0x64]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
push eax
call edi
add esp, 0x18
lea eax, [ebp - 0x68]
push eax
push 0xf003f
push ebx
lea eax, [ebp - 0x64]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40abf9
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push dword [ebp - 0x80]
call sub.MSVCR80.dll_strlen
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop ecx
inc eax
push eax
push dword [ebp - 0x80]
push 2
push ebx
push str.DisplayName
push dword [ebp - 0x68]
call esi
push 4
lea eax, [ebp - 0x70]
push eax
push 4
push ebx
push str.NoModify
push dword [ebp - 0x68]
mov dword [ebp - 0x70], 1
call esi
push 4
lea eax, [ebp - 0x70]
push eax
push 4
push ebx
push str.NoRepair
push dword [ebp - 0x68]
call esi
cmp dword [ebp - 0x7c], ebx
lea eax, [ebp - 0x64]
jne 0x40ac5f
push dword [ebp - 0x6c]
push str.__s_
push eax
call edi
add esp, 0xc
jmp 0x40ac70
push dword [ebp - 0x7c]
push dword [ebp - 0x6c]
push str.__s____U:_s_
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x64]
push eax
call sub.MSVCR80.dll_strlen
pop ecx
inc eax
push eax
lea eax, [ebp - 0x64]
push eax
push 2
push ebx
push str.UninstallString
push dword [ebp - 0x68]
call esi
push dword [ebp - 0x74]
call sub.MSVCR80.dll_strlen
pop ecx
inc eax
push eax
push dword [ebp - 0x74]
push 2
push ebx
push str.Publisher
push dword [ebp - 0x68]
call esi
push dword [ebp - 0x78]
call sub.MSVCR80.dll_strlen
pop ecx
inc eax
push eax
push dword [ebp - 0x78]
push 2
push ebx
push str.Contact
push dword [ebp - 0x68]
call esi
push dword [ebp - 0x6c]
lea eax, [ebp - 0x64]
push str.__s_
push eax
call edi
lea eax, [ebp - 0x64]
push eax
call sub.MSVCR80.dll_strlen
add esp, 0x10
inc eax
push eax
lea eax, [ebp - 0x64]
push eax
push 2
push ebx
push str.DisplayIcon
push dword [ebp - 0x68]
call esi
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x39c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040bfb6
add ebp, 0x3a0
leave
ret
Function at 0x40ad11
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x290
mov eax, 0x40cb00
call fcn.0040c94e
mov esi, dword [ebp + 8]
test esi, esi
je 0x40aeb4
lea eax, [ebp - 0x118]
push esi
push eax
call sub.MSVCR80.dll_strcpy
lea eax, [ebp - 0x118]
push 0x40ef70
push eax
call sub.MSVCR80.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [ebp - 0x134]
mov dword [ebp - 0x27c], eax
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
and dword [ebp - 4], 0
cmp dword [ebp - 0x27c], 0xffffffff
je 0x40ae90
push 0x40ef74
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x40ae75
push 0x40ef78
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x40ae75
push esi
lea ecx, [ebp - 0x134]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x134]
call dword [0x40e1c4]
test byte [ebp - 0x278], 0x10
je 0x40ae59
push 0x40e774
lea ecx, [ebp - 0x134]
call dword [0x40e1c4]
push 0x1e
lea eax, [ebp - 0x29c]
push 0
push eax
call sub.MSVCR80.dll_memset
and dword [ebp - 0x29c], 0
mov eax, dword [ebp - 0x130]
add esp, 0xc
cmp dword [ebp - 0x11c], 0x10
mov dword [ebp - 0x298], 3
mov word [ebp - 0x28c], 0x44
jb 0x40ae35
mov dword [ebp - 0x294], eax
jmp 0x40ae41
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x294], ecx
cmp dword [ebp - 0x11c], 0x10
jae 0x40ae50
lea eax, [ebp - 0x130]
push eax
call fcn.0040ad11
pop ecx
jmp 0x40ae75
cmp dword [ebp - 0x11c], 0x10
mov eax, dword [ebp - 0x130]
jae 0x40ae6e
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x27c]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40ad83
push dword [ebp - 0x27c]
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.MSVCR80.dll__rmdir]
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x134]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
call fcn.0040c998
ret
Function at 0x40aeba
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x40af2f
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x40af2f
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
push ebx
push eax
call sub.MSVCR80.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
push dword [ebp - 4]
push dword [ebp + 0xc]
call fcn.0040b36c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40bb9d
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x412020]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0040badc
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x40bbec
cmp dword [ebp - 0x1c], 5
jb 0x40bc04
jmp 0x40bc00
cmp dword [ebp - 0x10], 1
jne 0x40bc04
cmp dword [ebp - 0x1c], 4
ja 0x40bc00
jne 0x40bc04
cmp dword [ebp - 0x18], 0
jbe 0x40bc04
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x40e4dc
call fcn.0040b98f
test eax, eax
jge 0x40bc25
mov byte [0x4161d8], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040bfb6
add ebp, 0x78
leave
ret

Function at 0x40bfb6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x412020]
jne 0x40bfc0
repz ret
jmp fcn.0040c5b0
Function at 0x3853200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x24
mov eax, dword [ecx + 4]
push ebx
push esi
mov dword [esp + 0x14], edx
lea esi, [ecx + 4]
mov edx, dword [ecx]
add esi, 4
xor eax, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], eax
push edi
movd xmm0, edx
mov edi, eax
pshufd xmm0, xmm0, 0
movdqa xmmword [esp + 0x20], xmm0
test al, 3
je 0x3853240
and edi, 0xfffffffc
add edi, 4
mov eax, dword [str.puw]
test eax, eax
jne 0x3853264
mov ecx, 0x802173e5
call fcn.03853df0
mov edx, 0x51a2922a
mov ecx, eax
call fcn.03853d50
mov dword [str.puw], eax
call eax
mov ebx, eax
mov eax, dword [0x385e1fc]
test eax, eax
jne 0x385328c
mov ecx, 0x802173e5
call fcn.03853df0
mov edx, 0xb1fe2c86
mov ecx, eax
call fcn.03853d50
mov dword [0x385e1fc], eax
push edi
push 8
push ebx
call eax
mov dword [esp + 0xc], eax
test eax, eax
je 0x3853342
shr edi, 2
xor edx, edx
lea ecx, [esi + edi*4]
mov edi, eax
mov ebx, ecx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, ecx
mov ecx, eax
cmova ebx, edx
test ebx, ebx
je 0x3853332
cmp ebx, 8
jb 0x3853317
lea eax, [esi - 4]
lea eax, [eax + ebx*4]
cmp ecx, eax
ja 0x38532d6
lea eax, [ecx - 4]
lea eax, [eax + ebx*4]
cmp eax, esi
jae 0x3853317
movdqa xmm1, xmmword [esp + 0x20]
mov eax, ebx
and eax, 7
mov dword [esp + 0xc], ebx
sub dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
lea ecx, [ecx]
movdqu xmm0, xmmword [esi]
add edx, 8
pxor xmm0, xmm1
movdqu xmmword [edi], xmm0
movdqu xmm0, xmmword [esi + 0x10]
add esi, 0x20
pxor xmm0, xmm1
movdqu xmmword [edi + 0x10], xmm0
add edi, 0x20
cmp edx, eax
jb 0x38532f0
cmp edx, ebx
jae 0x3853332
sub edi, esi
lea ecx, [ecx]
mov eax, dword [esi]
lea esi, [esi + 4]
xor eax, dword [esp + 0x14]
inc edx
mov dword [edi + esi - 4], eax
cmp edx, ebx
jb 0x3853320
mov edx, dword [esp + 0x18]
test edx, edx
je 0x3853340
mov eax, dword [esp + 0x1c]
mov dword [edx], eax
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x38533b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push esi
lea esi, [ecx + 4]
mov dword [esp + 8], edx
lea ebx, [eax + 1]
mov dword [esp + 0x10], eax
add esi, 4
push edi
test bl, 3
je 0x38533d9
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [str.puw]
test eax, eax
jne 0x38533fd
mov ecx, 0x802173e5
call fcn.03853df0
mov edx, 0x51a2922a
mov ecx, eax
call fcn.03853d50
mov dword [str.puw], eax
call eax
mov edi, eax
mov eax, dword [0x385e1fc]
test eax, eax
jne 0x3853425
mov ecx, 0x802173e5
call fcn.03853df0
mov edx, 0xb1fe2c86
mov ecx, eax
call fcn.03853d50
mov dword [0x385e1fc], eax
lea ecx, [ebx + ebx]
push ecx
push 8
push edi
call eax
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
je 0x38534a5
shr ebx, 2
xor eax, eax
push ebp
xor ebp, ebp
mov edx, edi
lea ecx, [esi + ebx*4]
mov ebx, ecx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, ecx
cmova ebx, eax
test ebx, ebx
je 0x385349a
mov edi, dword [esp + 0x10]
lea esp, [esp]
mov ecx, dword [esi]
lea edx, [edx + 8]
xor ecx, edi
lea esi, [esi + 4]
movzx eax, cl
inc ebp
mov word [edx - 8], ax
mov eax, ecx
shr eax, 8
movzx eax, al
mov word [edx - 6], ax
shr ecx, 0x10
movzx eax, cl
mov word [edx - 4], ax
shr ecx, 8
movzx eax, cl
mov word [edx - 2], ax
cmp ebp, ebx
jb 0x3853460
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
xor ecx, ecx
pop ebp
mov word [edi + eax*2], cx
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x38534b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
xor eax, edx
push ebx
push ebp
push esi
lea esi, [ecx + 4]
mov dword [esp + 0xc], edx
lea ebx, [eax + 1]
mov dword [esp + 0x14], eax
add esi, 4
push edi
test bl, 3
je 0x38534da
and ebx, 0xfffffffc
add ebx, 4
mov eax, dword [str.puw]
test eax, eax
jne 0x38534fe
mov ecx, 0x802173e5
call fcn.03853df0
mov edx, 0x51a2922a
mov ecx, eax
call fcn.03853d50
mov dword [str.puw], eax
call eax
mov edi, eax
mov eax, dword [0x385e1fc]
test eax, eax
jne 0x3853526
mov ecx, 0x802173e5
call fcn.03853df0
mov edx, 0xb1fe2c86
mov ecx, eax
call fcn.03853d50
mov dword [0x385e1fc], eax
push ebx
push 8
push edi
call eax
mov ebp, eax
mov dword [esp + 0x14], ebp
test ebp, ebp
je 0x3853592
shr ebx, 2
xor eax, eax
xor edi, edi
mov ecx, ebp
lea edx, [esi + ebx*4]
mov ebx, edx
sub ebx, esi
add ebx, 3
shr ebx, 2
cmp esi, edx
cmova ebx, eax
test ebx, ebx
je 0x385358a
mov ebp, dword [esp + 0x10]
lea esp, [esp]
mov edx, dword [esi]
lea ecx, [ecx + 4]
xor edx, ebp
lea esi, [esi + 4]
mov byte [ecx - 4], dl
mov eax, edx
shr eax, 8
inc edi
shr edx, 0x10
mov byte [ecx - 3], al
mov byte [ecx - 2], dl
shr edx, 8
mov byte [ecx - 1], dl
cmp edi, ebx
jb 0x3853560
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov byte [eax + ebp], 0
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x3853af0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov dword [esp], 0x21c3
mov eax, 0xbacf914d
shl dword [esp], 0xd
add dword [esp], 0xffffee0d
xor dword [esp], 0xc6d3a95b
or dword [esp], 0xe006cb71
push ebx
push esi
mov esi, dword [esp + 8]
mov ebx, ecx
mul esi
mov eax, 0xaaaaaaab
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov dword [esp + 8], esi
add dword [esp + 8], 0x86d
xor dword [esp + 8], 0x2a29b567
xor dword [esp + 8], 0x2c0b8419
mov dword [esp + 0xc], 0x6024
mov ecx, dword [esp + 0xc]
mul ecx
shr edx, 5
mov dword [esp + 0xc], edx
xor dword [esp + 0xc], 0x206
mov dword [esp + 0xc], 0x7624
shl dword [esp + 0xc], 5
add dword [esp + 0xc], 0xcdd4
xor dword [esp + 0xc], 0xf9244
cmp byte [ebx], 0
je 0x3853c06
push edi
lea esp, [esp]
mov edi, dword [esp + 0xc]
lea ebx, [ebx + 1]
mov dword [esp + 0x10], 0x6024
mov eax, 0xaaaaaaab
mov ecx, dword [esp + 0x10]
mul ecx
shr edx, 5
mov dword [esp + 0x10], edx
xor dword [esp + 0x10], 0x206
movzx ecx, byte [esp + 0x10]
mov esi, dword [esp + 0xc]
mov dword [esp + 0x10], 0x7624
shl dword [esp + 0x10], 5
add dword [esp + 0x10], 0xcdd4
xor dword [esp + 0x10], 0xf9244
shl esi, cl
movzx ecx, byte [esp + 0x10]
mov edx, dword [esp + 0xc]
movsx eax, byte [ebx - 1]
mov dword [esp + 0xc], eax
add dword [esp + 0xc], esi
shl edx, cl
add dword [esp + 0xc], edx
sub dword [esp + 0xc], edi
cmp byte [ebx], 0
jne 0x3853b90
pop edi
mov eax, dword [esp + 8]
pop esi
pop ebx
add esp, 8
ret
Function at 0x3853d50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [esp + 4], edx
push ebp
push esi
push edi
mov eax, dword [ebx + 0x3c]
xor esi, esi
add eax, 0x78
add eax, ebx
mov dword [esp + 0x1c], eax
mov edi, dword [eax]
mov eax, dword [edi + ebx + 0x1c]
add edi, ebx
add eax, ebx
mov dword [esp + 0x18], eax
mov ebp, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
add ebp, ebx
add eax, ebx
mov dword [esp + 0x14], eax
cmp dword [edi + 0x18], esi
jbe 0x3853dac
lea esp, [esp]
mov ecx, dword [ebp + esi*4]
add ecx, ebx
call fcn.03853af0
xor eax, 0x15977d8f
cmp eax, dword [esp + 0x10]
je 0x3853db6
inc esi
cmp esi, dword [edi + 0x18]
jb 0x3853d90
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
movzx eax, word [eax + esi*2]
mov ecx, dword [ecx + eax*4]
add ecx, ebx
cmp ecx, edi
jb 0x3853de4
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 4]
add eax, edi
cmp ecx, eax
jae 0x3853de4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
jmp 0x3853f80
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x10
ret
sub esp, 0x104
lea edx, [esp]
push esi
mov esi, ecx
push edi
mov al, byte [esi]
test al, al
je 0x3853fa6
cmp al, 0x2e
je 0x3853fa3
inc esi
mov byte [edx], al
inc edx
mov al, byte [esi]
test al, al
jne 0x3853f93
jmp 0x3853fa6
mov byte [edx], 0
mov eax, dword [0x385dd94]
test eax, eax
jne 0x3853fca
mov ecx, 0x802173e5
call fcn.03853df0
mov edx, 0xe2afc2b8
mov ecx, eax
call fcn.03853d50
mov dword [0x385dd94], eax
lea ecx, [esp + 8]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x3854011
mov eax, dword [0x385df8c]
test eax, eax
jne 0x3853ffb
mov ecx, 0x802173e5
call fcn.03853df0
mov edx, 0xcabcc663
mov ecx, eax
call fcn.03853d50
mov dword [0x385df8c], eax
lea ecx, [esp + 8]
push ecx
call eax
mov edi, eax
test edi, edi
jne 0x3854011
pop edi
pop esi
add esp, 0x104
ret
lea ecx, [esi + 1]
call fcn.03853af0
xor eax, 0x15977d8f
mov ecx, edi
mov edx, eax
call fcn.03853d50
pop edi
pop esi
add esp, 0x104
ret
Function at 0x3853df0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
sub esp, 0x10
mov eax, dword fs:[0x30]
push ebx
push ebp
push esi
mov ebx, dword [eax + 0xc]
add ebx, 0xc
mov dword [esp + 0x18], ecx
push edi
mov dword [esp + 0x18], ebx
mov ebp, dword [ebx]
cmp ebp, ebx
je 0x3853f65
jmp 0x3853e20
mov esi, dword [ebp + 0x30]
mov eax, 0xbacf914d
mov dword [esp + 0x10], 0x21c3
shl dword [esp + 0x10], 0xd
add dword [esp + 0x10], 0xffffee0d
xor dword [esp + 0x10], 0xc6d3a95b
or dword [esp + 0x10], 0xe006cb71
mov ecx, dword [esp + 0x10]
mul ecx
mov eax, 0xaaaaaaab
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
mov dword [esp + 0x10], ecx
add dword [esp + 0x10], 0x86d
xor dword [esp + 0x10], 0x2a29b567
xor dword [esp + 0x10], 0x2c0b8419
mov dword [esp + 0x14], 0x6024
mov ecx, dword [esp + 0x14]
mul ecx
shr edx, 5
mov dword [esp + 0x14], edx
xor dword [esp + 0x14], 0x206
mov dword [esp + 0x14], 0x7624
shl dword [esp + 0x14], 5
add dword [esp + 0x14], 0xcdd4
xor dword [esp + 0x14], 0xf9244
cmp word [esi], 0
je 0x3853f4b
mov ebx, dword [esp + 0x10]
mov eax, 0xaaaaaaab
mov dword [esp + 0x14], 0x6024
mov ecx, dword [esp + 0x14]
mul ecx
shr edx, 5
mov dword [esp + 0x14], edx
xor dword [esp + 0x14], 0x206
movzx ecx, byte [esp + 0x14]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x14], 0x7624
shl dword [esp + 0x14], 5
add dword [esp + 0x14], 0xcdd4
xor dword [esp + 0x14], 0xf9244
shl edx, cl
movzx ecx, byte [esp + 0x14]
mov edi, dword [esp + 0x10]
movzx eax, word [esi]
shl edi, cl
cmp eax, 0x41
jb 0x3853f2a
cmp eax, 0x5a
ja 0x3853f2a
add eax, 0x20
mov dword [esp + 0x10], eax
add esi, 2
add dword [esp + 0x10], edx
add dword [esp + 0x10], edi
sub dword [esp + 0x10], ebx
cmp word [esi], 0
jne 0x3853ec1
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
xor eax, 0xf5f9597
cmp eax, dword [esp + 0x1c]
je 0x3853f6f
mov ebp, dword [ebp]
cmp ebp, ebx
jne 0x3853e20
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x3854240
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub esp, 0x14
push ebp
mov ebp, ecx
mov dword [esp + 0x10], ebp
push edi
cmp edx, 0x40
jb 0x38543de
mov eax, 0x5a4d
cmp word [ebp], ax
jne 0x38543de
mov edi, dword [ebp + 0x3c]
add edi, ebp
mov dword [esp + 0x18], edi
cmp dword [edi], 0x4550
jne 0x38543de
mov eax, 0x10b
cmp word [edi + 0x18], ax
jne 0x38543de
mov eax, dword [0x385dda8]
test eax, eax
jne 0x38542ab
mov ecx, 0x802173e5
call fcn.03853df0
mov edx, 0x2c46dbc5
mov ecx, eax
call fcn.03853d50
mov dword [0x385dda8], eax
push ebx
push 0x40
push 0x3000
push dword [edi + 0x50]
push 0
call eax
mov ebx, eax
test ebx, ebx
je 0x38543d5
movzx ecx, word [edi + 0x14]
push esi
lea esi, [edi + 0x18]
add esi, ecx
movzx ecx, word [edi + 6]
mov dword [esp + 0x18], esi
lea ecx, [ecx + ecx*4]
lea eax, [esi + ecx*8]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x54]
mov dword [esp + 0x10], eax
mov eax, dword [0x385e03c]
test eax, eax
jne 0x385430b
mov ecx, 0xdd71b583
call fcn.03853df0
mov edx, 0x282aa2f8
mov ecx, eax
call fcn.03853d50
mov dword [0x385e03c], eax
push dword [esp + 0x10]
push ebp
push ebx
call eax
mov ecx, dword [esp + 0x20]
add esp, 0xc
cmp esi, ecx
jae 0x385438e
sub ecx, dword [esp + 0x18]
mov eax, 0xcccccccd
dec ecx
add esi, 0x10
mul ecx
mov ecx, edx
shr ecx, 5
inc ecx
mov edi, ecx
mov ebp, dword [esi]
cmp dword [esi - 8], ebp
mov eax, dword [esi + 4]
cmovb ebp, dword [esi - 8]
add eax, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [esi - 4]
add eax, ebx
mov dword [esp + 0x14], eax
mov eax, dword [0x385e03c]
test eax, eax
jne 0x3854376
mov ecx, 0xdd71b583
call fcn.03853df0
mov edx, 0x282aa2f8
mov ecx, eax
call fcn.03853d50
mov dword [0x385e03c], eax
push ebp
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call eax
add esp, 0xc
add esi, 0x28
dec edi
jne 0x3854335
mov edi, dword [esp + 0x20]
mov edx, edi
mov ecx, ebx
call fcn.03854510
mov edx, edi
mov ecx, ebx
call fcn.03854420
pop esi
test eax, eax
jne 0x38543d5
mov eax, dword [0x385e024]
test eax, eax
jne 0x38543c9
mov ecx, 0x802173e5
call fcn.03853df0
mov edx, 0xef65a2d8
mov ecx, eax
call fcn.03853d50
mov dword [0x385e024], eax
push 0x8000
push 0
push ebx
call eax
xor ebx, ebx
mov eax, ebx
pop ebx
pop edi
pop ebp
add esp, 0x14
ret
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
Function at 0x41d7e5
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5286a6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5e1390]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esi + 0x30]
xor al, al
mov ecx, dword [esi + 0x2c]
mov edi, edx
rep stosb byte es:[edi], al
push edx
call fcn.004fc4ab
pop ecx
and dword [ebp - 4], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x41d82f
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41ea44
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
call fcn.0041f62e
lea edx, [ebx + 0x60]
xor eax, eax
mov byte [edx + 0x49], al
mov dword [edx + 0x50], 0x10
test al, al
jne 0x41ea75
mov eax, edx
mov byte [edx + 0x49], 1
neg eax
and eax, 0xf
add eax, edx
push 8
mov dword [edx + 0x54], eax
mov esi, 0x5bc588
mov edi, dword [ebx + 0xb4]
mov eax, ebx
pop ecx
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword [ebx], vtable.CryptoPP::SHA256.0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x420624
Capabilities:
Create thread

Disassembly:
push 0x28
mov eax, 0x529fea
call fcn.004e4550
push str.ConnectionManager::Start
push str._s:_enter
push 1
xor esi, esi
push esi
call fcn.00439ccd
add esp, 0x10
mov edi, 0x5ea330
mov ecx, edi
push 1
call fcn.00420524
push ecx
push dword [0x5ea340]
lea ecx, [ebp - 0x2c]
call fcn.0045c49f
xor ecx, ecx
mov dword [ebp - 4], esi
cmp byte [ebp + 8], cl
movzx eax, byte [0x5ea630]
cmove eax, ecx
sub esp, 0x18
mov ecx, esp
mov byte [0x5ea630], al
call fcn.0045826b
call fcn.00456600
add esp, 0x18
mov dword [0x5ea620], eax
call fcn.004581a8
mov byte [0x5ea625], al
call fcn.0044fbf1
push 0xe1
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x5ea344]
test eax, eax
jne 0x42070c
cmp dword [0x5ea614], eax
jne 0x42070c
push 1
mov ecx, edi
call fcn.004203e9
push esi
push esi
push edi
push 0x420770
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [0x5ea614], eax
test eax, eax
jne 0x4206fe
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.Start:_CreateThread_failed___d_
push esi
push esi
call fcn.00439ccd
add esp, 0x10
mov ecx, edi
push esi
call fcn.004203e9
push str.ConnectionManager::Start
push str._s:_exit
push 1
jmp 0x420713
push eax
push str.Invalid_connection_manager_state_in_Start___d_
push esi
push esi
call fcn.00439ccd
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.0045c53a
call fcn.004e44fa
ret 4
Function at 0x42346d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, 0x5e1e10
mov dword [0x5e1e0c], 0x5ea330
xor esi, esi
cmp dword [ebp + 8], ecx
je 0x423492
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
call fcn.00416900
mov eax, dword [0x5ea61c]
test eax, eax
je 0x4234a7
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
jne 0x4234f2
push esi
push esi
push 0x5e1e0c
push 0x4234f7
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [0x5ea61c], eax
test eax, eax
jne 0x4234f2
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.ConnectionManager::SendFeedback
push str._s:_CreateThread_failed___d_
push esi
push esi
call fcn.00439ccd
add esp, 0x14
push esi
push esi
push 0x466
push dword [0x5e97b0]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
pop ebp
ret 4