joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005450
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.10003fd7
dec esi
mov esp, 0x858d3f64
aam 0xf8
invalid
Function at 0x40506b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
invalid
jns 0x40508a
Function at 0x40a000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x118
mov eax, dword [0x4c7480]
mov dword [esp + 4], ecx
push esi
push edi
test al, 1

Function at 0x40b580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [esi + 1], al
add byte [ebx + 0x4c8d0c75], cl
and al, 0x20
Function at 0x468b07
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
div byte [ebx]
test byte [ecx + 0x4c75300d], 0
inc esi
mov ecx, 0x4c7530
mov dh, 0xd6
mov eax, dword [ecx]
shr eax, 0x1e
xor eax, dword [ecx]
imul eax, eax, 0x6c078965
add eax, edx
inc edx
mov dword [ecx + 4], eax
add ecx, 4
cmp ecx, 0x4c7eec
jl 0x468b18
mov dword [0x4c4190], esi
mov dword [0x4c7518], esi
pop esi
ret
Function at 0x10004770
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp eax, 0x53167b39
mov eax, 0xa4ea978e
inc eax
mov eax, 0xb693fc9
cmp eax, 0xe9c5de25
mov eax, ebx
mov eax, ebx
mov eax, ecx
mov eax, 0x934a296f
inc eax
nop
cmp eax, 0x1d
mov eax, 0x44edab63
push 3
push 2
push 1
call fcn.1000c200
add esp, 0xc
mov eax, ecx
mov eax, 0x57d61009
mov eax, ebx
inc eax
cmp eax, 0x93e4aac2
cmp eax, 0x30
cmp eax, 5
inc eax
mov eax, ecx
cmp eax, 0x7b
cmp eax, 0x97faf61
inc eax
cmp eax, 0x38bf0183
mov eax, ecx
mov eax, ebx
push 3
push 2
push 1
call fcn.1000c200
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, ecx
cmp eax, 0xbec3991a
cmp eax, 0x4d
inc eax
mov eax, ebx
inc eax
mov eax, ebx
mov eax, ebx
mov eax, ebx
mov eax, ecx
mov eax, 0x47db6c85
mov eax, 0x8186675d
mov eax, ebx
inc eax
nop
cmp eax, 0xffffffc4
nop
nop
nop
push 3
push 2
push 1
call fcn.1000c200
add esp, 0xc
push 0x1002beb4
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
inc eax
cmp eax, 0x4234faee
inc eax
cmp eax, 0xffffffd3
mov eax, 0xcbc6c530
cmp eax, 0xe396d57b
inc eax
inc eax
cmp eax, 0xffffff81
mov eax, ecx
inc eax
inc eax
mov eax, 0xac76b01b
inc eax
mov eax, ecx
inc eax
inc eax
nop
nop
nop
push 3
push 2
push 1
call fcn.1000c200
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x1003e22c], eax
mov eax, ecx
mov eax, 0x7e190460
nop
mov eax, ecx
mov eax, 0x24aeaa9c
cmp eax, 0x1e4700f3
inc eax
mov eax, 0x8b98656d
mov eax, ecx
mov eax, ebx
mov eax, 0xdb943ae4
mov eax, ecx
cmp eax, 0x21
mov eax, ebx
push 3
push 2
push 1
call fcn.1000c200
add esp, 0xc
cmp dword [0x1003e22c], 0
jne 0x1000491f
push 0x41030
push str.DllWrap
push str.miss
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 0x61490394
mov eax, ecx
mov eax, ebx
mov eax, 0x327ee307
cmp eax, 0xc19b3933
inc eax
mov eax, ecx
cmp eax, 0x75
mov eax, ebx
cmp eax, 0xcad2ab6a
nop
cmp eax, 0x1b
mov eax, ecx
cmp eax, 0xffffffb2
nop
push 3
push 2
push 1
call fcn.1000c200
add esp, 0xc
cmp dword [0x1003e22c], 0
je 0x10004931
mov dword [ebp - 4], 1
jmp 0x10004938
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4020b5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x416050]
jne 0x4020bf
repz ret
jmp fcn.00403246

Function at 0x409e09
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040381a
and dword [ebp - 4], 0
cmp dword [0x417e40], 0
mov ebx, eax
jne 0x409eba
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409f6b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409f6b
push eax
call fcn.004037a8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x417e40], eax
call esi
push eax
call fcn.004037a8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x417e44], eax
call esi
push eax
call fcn.004037a8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x417e48], eax
call esi
push eax
call fcn.004037a8
pop ecx
mov dword [0x417e50], eax
test eax, eax
je 0x409eba
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004037a8
pop ecx
mov dword [0x417e4c], eax
mov eax, dword [0x417e4c]
cmp eax, ebx
je 0x409f12
cmp dword [0x417e50], ebx
je 0x409f12
push eax
call fcn.00403823
push dword [0x417e50]
mov esi, eax
call fcn.00403823
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409f12
test edi, edi
je 0x409f12
call esi
test eax, eax
je 0x409f09
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409f09
test byte [ebp - 0xc], 1
jne 0x409f12
or dword [ebp + 0x10], 0x200000
jmp 0x409f4b
mov eax, dword [0x417e44]
cmp eax, ebx
je 0x409f4b
push eax
call fcn.00403823
pop ecx
test eax, eax
je 0x409f4b
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409f4b
mov eax, dword [0x417e48]
cmp eax, ebx
je 0x409f4b
push eax
call fcn.00403823
pop ecx
test eax, eax
je 0x409f4b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x417e40]
call fcn.00403823
pop ecx
test eax, eax
je 0x409f6b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409f6d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40e4a0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x411ae4
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x416050]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x40]
xor ebx, ebx
mov dword [esp + 0x20], ebx
mov eax, ebp
mov dword [esp + 0x38], 2
call fcn.0040cf00
mov eax, 1
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 0x20019
push ebx
lea eax, [esp + 0x54]
mov dword [esp + 0x24], ebx
call fcn.0040cda0
mov ecx, dword [esp + 0x50]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x40e5c4
lea edx, [esp + 0x14]
push edx
push ebx
lea eax, [esp + 0x24]
push eax
push ebx
lea eax, [esp + 0x64]
mov dword [esp + 0x24], ebx
call fcn.0040cda0
mov ecx, dword [esp + 0x28]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
push ecx
call esi
cmp eax, ebx
jne 0x40e5b9
mov eax, dword [esp + 0x14]
cmp eax, ebx
jbe 0x40e5b9
add eax, 2
push eax
call fcn.004020aa
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x40e5b9
lea edx, [esp + 0x14]
push edx
push edi
lea eax, [esp + 0x24]
push eax
push ebx
lea eax, [esp + 0x64]
call fcn.0040cda0
mov ecx, dword [esp + 0x28]
push eax
push ecx
call esi
cmp eax, ebx
jne 0x40e5b0
mov eax, dword [esp + 0x14]
cmp eax, 1
jbe 0x40e5b0
shr eax, 1
dec eax
mov edx, edi
lea esi, [esp + 0x24]
call fcn.0040ceb0
mov esi, ebp
mov byte [esp + 0x38], 3
call fcn.0040d060
lea ecx, [esp + 0x24]
mov byte [esp + 0x38], 2
call fcn.0040cef0
push edi
call fcn.00402985
add esp, 4
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x48]
mov byte [esp + 0x38], 1
call fcn.0040cef0
lea ecx, [esp + 0x54]
mov byte [esp + 0x38], bl
call fcn.0040cef0
mov eax, ebp
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0xdb38c4
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdb38ce
pushal
call 0xdb38d4
pop ebp
sub ebp, 0x10
sub ebp, 0x9b38c4
jmp 0xdb38ea
mov eax, 0x9b38c4
add eax, ebp
add eax, 0x4c
mov ecx, 0x5bc
mov edx, 0x6be773d2
xor byte [eax], dl
inc eax
dec ecx
jne 0xdb3901
jmp 0xdb3914
pop ecx
pop ds
pop ecx
pop ebx
out dx, al
rcl dl, cl
rcl byte [ebx + 0x13], cl
sub dl, dl
rcl dl, cl
rcr dword [edi], 1
push 0xffffffffffffffd4
rcl dl, cl
shr byte [eax - 6], cl
rcl dl, cl
shl byte [0x591ad130], cl
push ebx
invalid
Function at 0x4e54c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x83000]
push edi
jmp 0x4e54da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4e54e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e54d0
mov eax, 1
add ebx, ebx
jne 0x4e54f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4e5504
jne 0x4e5523
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e5523
dec eax
add ebx, ebx
jne 0x4e5510
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4e54e8
add ebx, ebx
jne 0x4e551f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4e5575
xor ecx, ecx
sub eax, 3
jb 0x4e553b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4e55aa
sar eax, 1
mov ebp, eax
jmp 0x4e5546
add ebx, ebx
jne 0x4e5546
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e5514
inc ecx
add ebx, ebx
jne 0x4e5554
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e5514
add ebx, ebx
jne 0x4e5561
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4e5556
jne 0x4e5572
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4e5556
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4e5594
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4e5586
jmp 0x4e54d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4e5594
add edi, ecx
jmp 0x4e54d6
pop esi
lea edi, [esi + 0xdd000]
mov ecx, 4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4e55b6
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4e55bb
lea edi, [esi + 0xde000]
mov eax, dword [edi]
or eax, eax
je 0x4e562c
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xeb550]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xeb6f4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4e55e1
mov ecx, edi
jns 0x4e5610
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xeb6fc]
or eax, eax
je 0x4e5626
mov dword [ebx], eax
add ebx, 4
jmp 0x4e55fe
call dword [esi + 0xeb6f8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4e565d
cmp al, 0xef
ja 0x4e5650
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4e5632
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4e563f
mov ebp, dword [esi + 0xeb700]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4e5691
sub esp, 0xffffff80
jmp 0x426bf7
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x47c200
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x16000]
push edi
or ebp, 0xffffffff
jmp 0x47c222
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x47c229
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47c218
mov eax, 1
add ebx, ebx
jne 0x47c23b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x47c230
jne 0x47c24c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x47c230
xor ecx, ecx
sub eax, 3
jb 0x47c260
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x47c2d2
mov ebp, eax
add ebx, ebx
jne 0x47c26b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x47c278
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x47c29c
inc ecx
add ebx, ebx
jne 0x47c288
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x47c27d
jne 0x47c299
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x47c27d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x47c2bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x47c2ad
jmp 0x47c21e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x47c2bc
add edi, ecx
jmp 0x47c21e
pop esi
lea edi, [esi + 0x7a000]
mov eax, dword [edi]
or eax, eax
je 0x47c31b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7c000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7c050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x47c2d9
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7c058]
or eax, eax
je 0x47c315
mov dword [ebx], eax
add ebx, 4
jmp 0x47c2f6
call dword [esi + 0x7c054]
mov ebp, dword [esi + 0x7c05c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x47c34f
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x405dd0
Capabilities:
Initialize winsock library
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [0x415004]
xor eax, esp
mov dword [esp + 0x198], eax
push ebx
push esi
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_signal]
push edi
mov edi, dword [ebp + 0xc]
push 0x405dc0
push 2
call esi
push 0x405dc0
push 0xf
call esi
add esp, 0x10
lea eax, [esp + 0x10]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x405e41
push eax
push str.WSAStartup_failed_with_error:__d_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.004014d0
add esp, 0xc
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call fcn.004067b0
mov edx, dword [ebp + 8]
mov esi, eax
push edi
mov ecx, esi
call fcn.004067e0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x405e6a
xor ecx, ecx
test ebx, ebx
cmovg ecx, ebx
push ecx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ecx, esi
call fcn.00406540
mov eax, dword [esi + 0x18]
push eax
mov eax, dword [eax]
call eax
add esp, 4
test al, al
je 0x405e98
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x198]
xor ecx, esp
call fcn.0040d125
mov esp, ebp
pop ebp
ret
cmp dword [0x415410], 0
mov edi, dword [esi + 0x14]
jne 0x405ec1
mov eax, dword [edi + 0xc]
push 2
push edi
call eax
add esp, 8
test eax, eax
js 0x405ebe
cmp dword [0x415410], 0
je 0x405ea4
jmp 0x405ec1
or ebx, 0xffffffff
mov eax, dword [edi + 0x10]
push edi
call eax
mov ecx, dword [esi + 0x10]
add esp, 4
call fcn.00406c10
mov ecx, dword [esi + 0x18]
call fcn.004050c0
mov edi, dword [esi + 0x14]
test edi, edi
je 0x405f04
mov ecx, dword [edi + 0x2c]
call fcn.0040a9d0
push 0x30
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call edi
add esp, 4
jmp 0x405f0a
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push dword [esi]
call edi
add esp, 4
push dword [esi + 4]
call edi
add esp, 4
push dword [esi + 8]
call edi
add esp, 4
xorps xmm0, xmm0
movups xmmword [esi], xmm0
movq qword [esi + 0x10], xmm0
push esi
mov dword [esi + 0x18], 0
call edi
add esp, 4
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x1a4]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040d125
mov esp, ebp
pop ebp
ret
Function at 0x40a560
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov esi, edx
push eax
mov edi, dword [ebx + 0x2c]
lea eax, [ebp - 0x10]
push eax
push 0
mov dword [ebp - 4], esi
mov ecx, dword [edi + 0x1c]
mov dword [edi + 0x3c], esi
call fcn.00401c90
mov edx, dword [ebp - 8]
add esp, 0x10
test edx, edx
je 0x40a5b0
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x40a5ad
mov eax, dword [edx + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
mov dword [edx + 0xc], eax
mov dword [ecx], edx
mov edx, dword [edx + 8]
mov dword [ebp - 8], edx
mov eax, dword [edi + 0x2c]
mov ecx, dword [edi + 0x28]
test edx, edx
jne 0x40a613
push edx
push eax
push ecx
push esi
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
jns 0x40a629
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2733
je 0x40a6f1
call esi
push eax
push str.recv_failed_with_error__d_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.004014d0
push dword [ebp - 4]
mov eax, dword [ebx + 4]
push ebx
call eax
add esp, 0x14
mov dword [edi + 0x3c], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push ecx
push edx
call dword [sym.imp.libssl_1_1.dll_SSL_read]
mov esi, eax
add esp, 0xc
test esi, esi
jle 0x40a6b6
push esi
push dword [ebp - 4]
push str.ss.recv_fd_d_len_zd
push ebx
call fcn.00409820
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x10]
mov ecx, dword [edi + 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
call fcn.00401c90
mov edx, dword [ebp - 0x10]
add esp, 0x20
test edx, edx
jne 0x40a65f
xor eax, eax
jmp 0x40a679
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x40a676
mov eax, dword [edx + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov dword [edx + 0xc], eax
mov dword [ecx], edx
mov eax, dword [edx + 8]
test esi, esi
je 0x40a69b
push esi
push dword [edi + 0x28]
mov esi, dword [ebp - 4]
push eax
mov eax, dword [ebx + 0x24]
push esi
push ebx
call eax
add esp, 0x14
test al, al
jne 0x40a69e
mov edx, dword [ebp - 8]
jmp 0x40a5b3
mov esi, dword [ebp - 4]
mov eax, dword [ebx + 4]
push esi
push ebx
call eax
add esp, 8
mov dword [edi + 0x3c], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push dword [ebp - 8]
call dword [sym.imp.libssl_1_1.dll_SSL_get_error]
add esp, 8
cmp eax, 2
je 0x40a6f1
push esi
push dword [ebp - 8]
call dword [sym.imp.libssl_1_1.dll_SSL_get_error]
add esp, 8
cmp eax, 3
je 0x40a6f1
push str.ssl_recv_failed
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
push dword [ebp - 4]
mov eax, dword [ebx + 4]
push ebx
call eax
add esp, 0xc
mov dword [edi + 0x3c], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100105eb
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
mov dword [esp + 0xc], 0x5840
cmp dword [esp + 0xc], 0x590f
push esi
push edi
jle 0x1001067a
xor esi, esi
mov dword [esp + 0x10], esi
xor edi, edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov esi, edx
mov eax, esi
lea ecx, [esp + 0x18]
and eax, ebx
cdq
push edx
push eax
call fcn.1000f9a1
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10010634
mov eax, dword [eax]
push eax
call fcn.10057526
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.100111e9
inc ebx
cmp ebx, 0x42a8
jl 0x1001061a
mov esi, dword [esp + 0x10]
inc edi
cmp edi, 0x3b90
jl 0x10010611
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x26ee
jl 0x1001060f
push 0
push 0x1f08
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
cmp dword [esp + 0x14], 0x5691
jge 0x1001068f
push 0x1000db40
call fcn.10057526
pop ecx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10033045
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100330b4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10033091
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1003308f
push 0
push 0
call dword [sym.imp.USER32.dll_CopyRect]
jmp 0x100330b2
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x100330b2
push 0x101d
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x100330df
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
push 0xb1b
push dword [ebp - 0x20]
push 0x51c9
push 0
push 0x6aaa
push dword [ebp - 0x24]
call fcn.10049060
add esp, 0x18
mov esp, ebp
pop ebp
ret

Function at 0x100331ac
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100331f3
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0
call fcn.1004ef18
add esp, 0x18
jmp 0x10033264
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1003325c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1003323d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x1003325a
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.10010f08
mov dword [eax], 6
jmp 0x10033232
jmp 0x10033264
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esp, ebp
pop ebp
ret