joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1b4d2389
Capabilities:
Access peb ldr_data

Disassembly:
add esp, 8
and dword [esp], ebx
push ecx
push edx
push edi
push esi
or edi, 0xffffffff
not edi
add edi, dword [ebp + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
push ecx
xor edx, edx
mov ecx, dword [ecx]
cmp ecx, dword [esp]
je 0x1b4d265f
push ebp
push 0xffffffffffffffff
sub esp, 0x32
mov dword [esp + 0x2e], 0x6bc0871c
add esp, 0x2e
sub esp, 4
mov dword [esp], 0x6bbff6e2
push 0xffffffffffffffff
call fcn.1b4c9589
xchg edx, eax
and eax, 0
add eax, 0x75d46dc4
push ecx
and ecx, 0xcfb6d7ec
mov ecx, esp
mov dword [ecx - 0x54], esi
pop ecx
ja 0x1b4d23f3
and eax, eax
xchg edx, eax
mov edx, dword [ecx + edx - 0x75d46dac]
call fcn.1b4d240b
mov byte [0xee69f033], al
invalid
mov eax, ecx
pop esi
mov edi, dword [esp]
add esp, 4
pop edx
xor ecx, ecx
add ecx, 0xffffffff
and ecx, dword [esp]
xor ecx, 0
add esp, 4
pop ebx
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
jno 0x1b4d2653
xor eax, 0
ret 4
xor ecx, ecx
jmp 0x1b4d2627
Function at 0x1b4e1e59
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x1b4e1e7b
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x1b4e1e7b
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x1b4e1e7b
ret
cmp word [ebx + 4], 0x14c
jne 0x1b4e1e7b
test word [ebx + 0x16], 2
je 0x1b4e1e7b
test word [ebx + 0x16], 0x100
je 0x1b4e1e7b
cmp word [ebx + 0x18], 0x10b
jne 0x1b4e1e7b
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x1b4e1e7b
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x1b4e1f07
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x1b4e1e9b
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.1b4c8de6
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x1b4e1e7b
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x1b4e1f07
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x1b4e1e7b
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x1b4e1e7b
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x1b4e1e7b
ret
cmp word [ebx + 4], 0x14c
jne 0x1b4e1e7b
test word [ebx + 0x16], 2
je 0x1b4e1e7b
test word [ebx + 0x16], 0x100
je 0x1b4e1e7b
cmp word [ebx + 0x18], 0x10b
jne 0x1b4e1e7b
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x1b4e1e7b
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x1b4e1f07
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x1b4e1e9b
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.1b4c8de6
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x1b4e1e7b
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x1b4e1fbe
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x1b4e2017
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x1b4e1fbe
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x1b4e1fcd
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1b8e7c70
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x1b4e201e
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1b4c8e94
cmp eax, dword [ebp + 0xc]
pop eax
je 0x1b4e20bd
add edi, 4
add eax, 2
dec ecx
jne 0x1b4e2003
call 0x1b4e206a
loope 0x1b4e2060
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x1b4e20ba
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x1b4e20cb
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x1b4e207e
cmp eax, ecx
ja 0x1b4e207e
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x1b4e2108
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x1b4e20fe
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1b4c9373
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x1b4e1fcd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x1b4e2017
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x1b4e1fbe
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x1b4e1fcd
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1b8e7c70
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x1b4e201e
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1b4c8e94
cmp eax, dword [ebp + 0xc]
pop eax
je 0x1b4e20bd
add edi, 4
add eax, 2
dec ecx
jne 0x1b4e2003
call 0x1b4e206a
loope 0x1b4e2060
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x1b4e20ba
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x1b4e20cb
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x1b4e207e
cmp eax, ecx
ja 0x1b4e207e
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x1b4e2108
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x1b4e20fe
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1b4c9373
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x404650
Capabilities:
Set current directory

Disassembly:
push ecx
mov al, byte [esp + 8]
mov byte [esp + 3], dl
mov edx, ecx
push ebx
mov ebx, dword [0x4e30fc]
test al, al
je 0x404678
inc dword [0x4e5b94]
add ebx, 0x108
mov dword [0x4e30fc], ebx
mov ecx, 0x42
push esi
mov esi, 0x4e5870
push edi
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x2c], edx
pop edi
pop esi
test al, al
je 0x40469d
push 0
mov ecx, 0x4e7d50
call fcn.0042aa30
cmp dword [0x4e5ba4], 0
xorps xmm0, xmm0
movlpd qword [0x4e8850], xmm0
je 0x4046bc
push 0x4e5980
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp byte [esp + 7], 0
jne 0x40473f
mov cl, byte [ebx + 0xee]
test cl, cl
jne 0x4046f1
cmp byte [esp + 0x10], 0x65
sete cl
mov byte [ebx + 0xee], cl
jne 0x4046f1
mov dword [ebx], 0xffffffff
mov dword [ebx + 4], 0xffffffff
mov dword [ebx + 0x24], 0xffffffff
cmp dword [0x4e885c], 0
je 0x404703
cmp dword [0x4e8858], 0
jne 0x404707
test cl, cl
je 0x40473f
mov byte [ebx + 0xec], 0
test cl, cl
jne 0x40473f
cmp dword [0x4e885c], 0
jge 0x404728
mov dword [ebx + 0xe0], 0xffffffff
pop ebx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0xdc], eax
mov eax, dword [0x4e885c]
mov dword [ebx + 0xe0], eax
pop ebx
pop ecx
ret
Function at 0x405f10
Capabilities:
Write clipboard data

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0
jne 0x405f32
call fcn.00406240
test eax, eax
jne 0x405f32
push str.Cant_open_clipboard_for_writing.
mov ecx, esi
call fcn.00406040
pop esi
ret 4
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x405f78
cmp dword [esi + 0x18], eax
je 0x405f68
cmp dword [esi + 8], eax
je 0x405f55
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [esi + 8], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], 0
mov dword [esi], 0
push 0x4ba184
mov ecx, esi
call fcn.00406040
pop esi
ret 4
mov eax, dword [esi + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test eax, eax
je 0x405fba
mov ecx, dword [esi + 0xc]
push ebx
xor bl, bl
test ecx, ecx
je 0x405fab
cmp word [ecx], 0
push eax
sete bl
call edi
mov eax, dword [esi + 4]
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
test bl, bl
pop ebx
push eax
je 0x405fee
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
cmp dword [esi + 0x18], 0
je 0x405fe4
cmp dword [esi + 8], 0
je 0x405fd1
push dword [esi]
call edi
mov dword [esi + 8], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], 0
mov dword [esi], 0
pop edi
mov eax, 1
pop esi
ret 4
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x406003
mov dword [esi + 4], 0
jmp 0x405fba
cmp dword [esi + 0x18], 0
je 0x40602d
cmp dword [esi + 8], 0
je 0x40601a
push dword [esi]
call edi
mov dword [esi + 8], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], 0
mov dword [esi], 0
push 0x4ba1a4
mov ecx, esi
call fcn.00406040
pop edi
pop esi
ret 4

Function at 0x406130
Capabilities:
Read clipboard data

Disassembly:
sub esp, 0x20c
push ebx
push esi
mov esi, dword [esp + 0x21c]
push edi
test esi, esi
je 0x40614a
mov dword [esi], 0
mov ebx, dword [esp + 0x21c]
lea eax, [ebx - 0xc000]
cmp eax, 0x3fff
ja 0x406220
push 0x104
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClipboardFormatNameW]
push 0xb
lea eax, [esp + 0x10]
push str.Link_Source
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x406212
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
lea eax, [esp + 0xc]
push str.ObjectLink
push eax
call edi
add esp, 8
test eax, eax
je 0x406212
lea eax, [esp + 0xc]
push str.OwnerLink
push eax
call edi
add esp, 8
test eax, eax
je 0x406212
lea eax, [esp + 0xc]
push str.Native
push eax
call edi
add esp, 8
test eax, eax
je 0x406212
lea eax, [esp + 0xc]
push str.Embed_Source
push eax
call edi
add esp, 8
test eax, eax
je 0x406212
lea eax, [esp + 0xc]
push str.MSDEVColumnSelect
push eax
call edi
add esp, 8
test eax, eax
je 0x406208
lea eax, [esp + 0xc]
push str.MSDEVLineSelect
push eax
call edi
add esp, 8
test eax, eax
jne 0x406227
test esi, esi
je 0x406212
mov dword [esi], 1
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x20c
ret 8
xor eax, eax
mov word [esp + 0xc], ax
push ebx
call dword [sym.imp.USER32.dll_GetClipboardData]
pop edi
pop esi
pop ebx
add esp, 0x20c
ret 8
Function at 0x406240
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
push ebx
mov ebx, ecx
cmp dword [ebx + 0x18], 0
je 0x406250
mov eax, 1
pop ebx
ret
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
push dword [0x4e5ba8]
mov edi, dword [sym.imp.USER32.dll_OpenClipboard]
mov ebp, eax
call edi
test eax, eax
jne 0x4062be
nop
mov eax, dword [0x4e3104]
cmp eax, 0xffffffff
je 0x40628f
test eax, eax
je 0x4062cf
call esi
mov ecx, dword [0x4e3104]
add ecx, ebp
sub ecx, eax
cmp ecx, 5
jle 0x4062cf
mov edx, 1
mov dword [0x4e30f4], 0
mov ecx, 0x8000012f
call fcn.00401a20
push dword [0x4e5ba8]
mov dword [0x4e30f4], 1
call edi
test eax, eax
je 0x406270
pop edi
pop esi
pop ebp
mov dword [ebx + 0x18], 1
mov eax, 1
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x406530
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x81c
push ebx
push ebp
push esi
push edi
push 0x401
lea eax, [esp + 0x28]
mov dword [esp + 0x1c], edx
mov ebx, ecx
mov dword [esp + 0x14], 0
push 0
push eax
mov dword [esp + 0x28], ebx
call sub.VCRUNTIME140.dll_memset
push 0x401
lea eax, [esp + 0x438]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x400
push ebx
lea eax, [esp + 0x44]
push 0x401
push eax
mov dword [esp + 0x3c], eax
lea ebp, [esp + 0x450]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
add esp, 0x28
mov eax, dword [esp + 0x83c]
mov edi, eax
push ebx
mov byte [ebp], 0
mov dword [eax], 0
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x406712
cmp word [ebx + 8], 2
jne 0x4065ff
cmp word [ebx + 0xa], 4
jne 0x4065ff
mov esi, dword [ebx + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x4065ff
push dword [eax]
mov edx, dword [esp + 0x834]
push dword [esp + 0x838]
mov ecx, dword [esp + 0x20]
call fcn.004064b0
mov dword [edi], eax
test eax, eax
je 0x406697
add esi, 4
lea edi, [eax + 0x1c]
mov eax, dword [esi]
test eax, eax
jne 0x4065d0
push 0x400
push dword [ebx]
push 0x401
push ebp
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov eax, dword [esp + 0x84c]
xor esi, esi
add esp, 0x10
cmp dword [eax], esi
jne 0x4066ab
mov ecx, ebp
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406630
sub ecx, edx
je case.0x406722.11003
mov ebx, dword [esp + 0x14]
mov eax, ebp
mov ecx, ebx
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x406667
test dl, dl
je 0x406663
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x406667
add ecx, 2
add eax, 2
test dl, dl
jne 0x406647
xor eax, eax
jmp 0x40666c
sbb eax, eax
or eax, 1
test eax, eax
je case.0x406722.11003
mov esi, dword [esp + 0x10]
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x10
je case.0x406722.11003
mov eax, ebx
mov dword [esp + 0x14], ebp
mov ebx, dword [esp + 0x1c]
mov ebp, eax
jmp 0x406595
mov esi, 8
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x81c
ret 0x10
cmp dword [esp + 0x838], esi
je 0x406756
mov ecx, ebp
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4066c0
sub ecx, edx
lea ebx, [ecx + 1]
push ebx
push 1
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov edi, eax
add esp, 8
test edi, edi
je 0x4066ea
push ebp
push ebx
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
mov ecx, dword [esp + 0x83c]
mov eax, dword [ecx]
mov dword [eax + 0x14], edi
mov eax, dword [ecx]
mov ecx, 8
pop edi
cmp dword [eax + 0x14], esi
cmove esi, ecx
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x81c
ret 0x10
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x406722.11001
jmp dword [eax*4 + 0x406768]
mov esi, 0x2afa
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x81c
ret 0x10
mov esi, 0x2afb
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x81c
ret 0x10
mov esi, 0x2af9
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x81c
ret 0x10
Function at 0x406d60
Capabilities:
Get common file path

Disassembly:
sub esp, 0x234
cmp dword [0x4e9cdc], 0
mov ax, cx
push ebx
push ebp
push esi
push edi
mov word [esp + 0x12], ax
mov dword [esp + 0x14], str.getaddrinfo
mov dword [esp + 0x18], 0x4067d0
mov dword [esp + 0x1c], str.getnameinfo
mov dword [esp + 0x20], 0x406b70
mov dword [esp + 0x24], str.freeaddrinfo
mov dword [esp + 0x28], fcn.00406780
je 0x406dc0
movzx eax, ax
mov eax, dword [eax*8 + 0x4e4edc]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x234
ret
push 0x104
lea eax, [esp + 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x406ec5
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea eax, [esp + 0x13c]
push eax
lea eax, [esp + 0x30]
push 0x10c
push eax
call esi
add esp, 0xc
lea eax, [esp + 0x2c]
push str.ws2_32
push 0x10c
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test edi, edi
je 0x406e3c
push str.getaddrinfo
push edi
call ebx
test eax, eax
jne 0x406e88
push edi
call ebp
lea eax, [esp + 0x13c]
push eax
lea eax, [esp + 0x30]
push 0x10c
push eax
call esi
add esp, 0xc
lea eax, [esp + 0x2c]
push str.wship6
push 0x10c
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406ec5
push str.getaddrinfo
push edi
call ebx
test eax, eax
je 0x406ec2
xor esi, esi
nop word [eax + eax]
push dword [esp + esi*8 + 0x14]
push edi
call ebx
mov dword [esp + esi*8 + 0x18], eax
test eax, eax
je 0x406ec2
inc esi
cmp esi, 3
jl 0x406e90
mov eax, dword [esp + 0x18]
mov dword [0x4e4edc], eax
mov eax, dword [esp + 0x20]
mov dword [0x4e4ee4], eax
mov eax, dword [esp + 0x28]
mov dword [fcn.00406780], eax
jmp 0x406ec5
push edi
call ebp
movzx eax, word [esp + 0x12]
pop edi
pop esi
pop ebp
mov eax, dword [eax*8 + 0x4e4edc]
mov dword [0x4e9cdc], 1
pop ebx
add esp, 0x234
ret

Function at 0x4070e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x38], 2
jne 0x4070ed
xor eax, eax
pop esi
ret
call fcn.00407050
test eax, eax
jne 0x4070eb
mov ecx, esi
pop esi
jmp fcn.00407100
Function at 0x40aee0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x4e4b04]
test eax, eax
je 0x40af06
push str.stderr
push dword [ebp + 8]
mov ecx, 0x4e4ac8
call fcn.0040adc0
mov eax, dword [0x4e4b04]
cmp eax, 2
je 0x40af14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov esp, ebp
pop ebp
ret 4

Function at 0x40afe0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40
lea eax, [esp + 4]
push esi
push edi
mov edi, ecx
push 0xa
push eax
mov eax, dword [edi + 0x30]
add eax, 0x26
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itoa]
add esp, 0xc
lea eax, [esp + 0xc]
push 0
push eax
call dword [sym.imp.VCRUNTIME140.dll_strchr]
push str.__xml_version_1.0__encoding_UTF_8___
push 0x4bafa4
lea esi, [eax + 1]
push esi
call fcn.0040c750
add esp, 0x14
add esi, eax
lea eax, [esp + 0xc]
sub esi, eax
push 0
push esi
push eax
push dword [edi + 0x10]
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, 0xffffffff
je 0x40b094
cmp dword [edi + 0x34], 0
jne 0x40b094
mov eax, dword [edi + 0x30]
lea ecx, [edi + 0x28]
inc eax
push eax
call fcn.0040bd40
test eax, eax
jne 0x40b094
mov ecx, dword [edi + 0x30]
add ecx, dword [edi + 0x28]
mov al, byte [0x4b9c10]
push 0
mov byte [ecx], al
inc dword [edi + 0x30]
push dword [edi + 0x30]
push dword [edi + 0x28]
push dword [edi + 0x10]
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, 0xffffffff
je 0x40b094
mov dword [edi + 0x30], 0
xor eax, eax
mov dword [edi + 0x34], 0
pop edi
pop esi
mov esp, ebp
pop ebp
mov ecx, 0x4e4ac8
call fcn.0040b5d0
push 0x10014
push dword [0x4e882c]
push str.An_internal_error_has_occurred_in_the_debugger_engine._nContinue_running_the_script_without_the_debugger_
push dword [0x4e5ba8]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x40b0cc
push 0
push eax
mov ecx, 0x4e7d50
call fcn.0042b020
pop edi
mov eax, 0x3e6
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40bb00
Capabilities:
Encode data using base64

Disassembly:
push ecx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebp, ecx
mov dword [esp + 8], ebp
test esi, esi
je 0x40bc65
cmp byte [esp + 0x18], 0
jne 0x40bb48
lea ecx, [esi - 1]
mov eax, 0xaaaaaaab
mul ecx
mov eax, dword [ebp + 8]
mov ecx, ebp
shr edx, 1
lea eax, [eax + edx*4]
add eax, 5
push eax
call fcn.0040bd40
test eax, eax
je 0x40bb48
pop esi
mov eax, 0x3e6
pop ebp
pop ecx
ret 0xc
push ebx
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x40bc64
mov edx, dword [ebp + 8]
add edx, dword [ebp]
push edi
xor edi, edi
mov dword [esp + 0x20], edx
cmp esi, 0xffffffff
jne 0x40bb79
mov esi, ebx
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x40bb70
sub esi, ecx
cmp esi, 2
jbe 0x40bc01
mov ebp, dword [esp + 0x20]
lea ecx, [esi - 3]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
inc edx
movzx ecx, byte [ebx]
sub esi, 3
movzx eax, byte [ebx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebx + 2]
shl ecx, 8
add ebx, 3
or ecx, eax
mov eax, ecx
shr eax, 0x12
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + ebp], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + ebp + 1], al
mov eax, ecx
shr eax, 6
and ecx, 0x3f
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + ebp + 2], al
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + ebp + 3], al
add edi, 4
sub edx, 1
jne 0x40bb93
mov ebp, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
test esi, esi
je 0x40bc5c
movzx ecx, byte [ebx]
shl ecx, 0x10
cmp esi, 1
jbe 0x40bc19
movzx eax, byte [ebx + 1]
shl eax, 8
or ecx, eax
mov eax, ecx
shr eax, 0x12
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + edx], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + edx + 1], al
cmp esi, 1
jbe 0x40bc4e
shr ecx, 6
and ecx, 0x3f
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x40bc50
mov al, 0x3d
mov byte [edi + edx + 2], al
mov byte [edi + edx + 3], 0x3d
add edi, 4
mov byte [edi + edx], 0
add dword [ebp + 8], edi
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
pop ecx
ret 0xc
Function at 0x40c3b0
Capabilities:
Query environment variable

Disassembly:
push esi
push edi
push 0
push 0
push dword [esp + 0x14]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test edi, edi
jne 0x40c408
mov edi, dword [esi + 4]
test edi, edi
je 0x40c430
mov eax, dword [edi + 0x10]
add eax, 0xffffffff
mov dword [edi + 0x10], eax
jne 0x40c3f6
mov eax, dword [edi + 4]
test eax, eax
je 0x40c3eb
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
push 0x14
push edi
call fcn.004b6495
add esp, 8
pop edi
mov dword [esi + 4], 0
mov eax, esi
mov byte [esi + 8], 0
pop esi
ret 4
push 0
mov ecx, esi
call fcn.0040c910
mov ecx, dword [esi + 4]
push edi
call fcn.0040c770
mov eax, dword [esi + 4]
push edi
push dword [eax]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, dword [esi + 4]
mov dword [ecx + 8], eax
pop edi
mov eax, esi
pop esi
ret 4
Function at 0x40cfd0
Capabilities:
Resume thread
Suspend thread

Disassembly:
cmp byte [0x4e8844], 0
push esi
je 0x40d063
mov esi, dword fs:[0x24]
cmp dword [0x4e7484], esi
je 0x40cff9
push dword [0x4e7cf8]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edx, dword [esp + 8]
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d003
sub ecx, edi
sar ecx, 1
push 3
push ecx
push edx
mov ecx, 0x4e7d50
call fcn.0043b220
pop edi
test eax, eax
jne 0x40d03e
cmp dword [0x4e7484], esi
je 0x40d039
push dword [0x4e7cf8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
or eax, 0xffffffff
pop esi
ret
push 1
push 0
push 0xffffffffffffffff
push dword [esp + 0x18]
mov ecx, eax
call fcn.004a05c0
cmp dword [0x4e7484], esi
je 0x40d063
push dword [0x4e7cf8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
pop esi
ret