joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d94f
Capabilities:
Write file on windows

Disassembly:
push 0x450
mov eax, 0x49ea92
call fcn.00427fa7
mov ebx, ecx
mov esi, dword [ebp + 8]
xor eax, eax
and dword [ebp - 0x430], 0
mov dword [ebp - 0x42c], 7
mov word [ebp - 0x440], ax
and dword [ebp - 4], eax
lea ecx, [ebp - 0x440]
call fcn.0040d10d
cmp dword [ebp - 0x42c], 8
lea eax, [ebp - 0x440]
push 0x4be768
cmovae eax, dword [ebp - 0x440]
push eax
call fcn.0044e1ce
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x40da0d
push 0x400
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.00441690
add esp, 0xc
lea eax, [ebp - 0x440]
cmp dword [ebp - 0x42c], 8
cmovae eax, dword [ebp - 0x440]
push eax
lea eax, [ebp - 0x410]
push str.Cannot_open_file___s_
push eax
call fcn.00407598
add esp, 0xc
lea eax, [ebp - 0x410]
mov dword [ebp - 0x45c], eax
lea eax, [ebp - 0x45c]
push 0x4cf1e0
push eax
call fcn.00442196
and dword [ebp - 0x418], 0
mov dword [ebp - 0x414], 0xf
mov byte [ebp - 0x428], 0
mov byte [ebp - 4], 1
cmp dword [esi + 0x14], 0x10
mov eax, dword [esi + 0x10]
jb 0x40da34
mov esi, dword [esi]
push eax
push esi
lea ecx, [ebp - 0x428]
call fcn.0040d6c8
test eax, eax
je 0x40db00
xor eax, eax
cmp dword [ebx + 0x2c], eax
je 0x40dada
mov dword [ebp - 0x444], 0xf
mov dword [ebp - 0x448], eax
mov byte [ebp - 0x458], al
mov byte [ebp - 4], 2
lea edx, [ebp - 0x428]
cmp dword [ebp - 0x414], 0x10
lea ecx, [ebx + 0x1c]
cmovae edx, dword [ebp - 0x428]
cmp dword [ecx + 0x14], 0x10
jb 0x40da8d
mov ecx, dword [ecx]
lea eax, [ebp - 0x458]
push eax
push dword [ebp - 0x418]
call fcn.0040e30f
cmp dword [ebp - 0x444], 0x10
lea eax, [ebp - 0x458]
push edi
cmovae eax, dword [ebp - 0x458]
push 1
push dword [ebp - 0x448]
push eax
call fcn.0044de27
add esp, 0x18
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x458]
push 0
push 1
call fcn.00407543
jmp 0x40db00
cmp dword [ebp - 0x414], 0x10
lea eax, [ebp - 0x428]
push edi
cmovae eax, dword [ebp - 0x428]
push 1
push dword [ebp - 0x418]
push eax
call fcn.0044de27
add esp, 0x10
push edi
call fcn.0044daa4
pop ecx
lea ecx, [ebx + 4]
lea eax, [ebp - 0x440]
cmp ecx, eax
je 0x40db1e
push 0xffffffffffffffff
push 0
push eax
call fcn.00402579
push 0
push 1
lea ecx, [ebp - 0x428]
call fcn.00407543
push 0
push 1
lea ecx, [ebp - 0x440]
call fcn.00401656
call fcn.00427f51
ret 4
Function at 0x40dbcf
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
lea eax, [esi + 4]
cmp dword [eax + 0x14], 8
jb 0x40dbe1
mov eax, dword [eax]
push 0x4be7a4
push eax
call fcn.0044e1ce
mov dword [ebp - 4], eax
pop ecx
pop ecx
test eax, eax
je 0x40dc61
push ebx
push edi
mov ecx, eax
call fcn.0040cf54
mov ebx, eax
push ebx
call fcn.00427707
push ebx
mov edi, eax
push 0
push edi
call fcn.00441690
push dword [ebp - 4]
push 1
push ebx
push edi
call fcn.0044e8b7
push dword [ebp - 4]
call fcn.0044daa4
add esp, 0x24
cmp dword [esi + 0x2c], 0
je 0x40dc49
lea ecx, [esi + 0x1c]
cmp dword [ecx + 0x14], 0x10
jb 0x40dc39
mov ecx, dword [ecx]
mov esi, dword [ebp + 8]
mov edx, edi
push esi
push ebx
call fcn.0040e30f
pop ecx
pop ecx
jmp 0x40dc55
mov esi, dword [ebp + 8]
mov ecx, esi
push ebx
push edi
call fcn.00407412
push edi
call fcn.00427702
mov eax, dword [esi + 0x10]
pop ecx
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x412ede
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
movsd dword es:[edi], dword [esi]
xchg edi, eax
cld
invalid
inc dword [eax]
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
invalid
push dword [eax]
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
xchg esp, eax
cld
invalid
call dword [eax - 0x18]
xor esi, eax
invalid
call [ecx + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00411f7a
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.00411fb5
mov edx, 0x6863b3ee
add al, 1
add byte [eax], al
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.00411fb5
xor dword [edx + 0x1b], esp
js 0x412f50
movsb byte es:[edi], byte [esi]
cld
invalid
loopne 0x412fd3
and byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
out dx, eax
mov dword [0xe2f045c6], eax
lea eax, [ebp - 0x20]
push eax
call fcn.00411fc5
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00411f7a
add esp, 0xc
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x654]
push eax
push 0x104
call dword [ebp - 0x370]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x28]
movsx eax, byte [ebp + eax - 0x12d]
cmp eax, 0x5c
jne 0x413061
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x550]
movsx eax, byte [ebp + eax - 0x655]
cmp eax, 0x5c
jne 0x413081
mov eax, dword [ebp - 0x550]
dec eax
mov dword [ebp - 0x550], eax
and dword [ebp - 0x338], 0
and dword [ebp - 0x3d0], 0
jmp 0x41309e
invalid
invalid
Function at 0x415fa0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49fb27
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x4d3094]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 1
mov dword [ebp - 0x14], esi
call fcn.00466e70
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 2
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 9
call fcn.00469900
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 0xa
call fcn.00469900
mov byte [esi + 0x5c], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4160a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49fb74
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4d3094]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
xor eax, eax
mov edx, dword [esi + 0x50]
mov ecx, edx
mov ebx, dword [esi + 0x54]
mov edi, ebx
rep stosd dword es:[edi], eax
lea eax, [edx*4]
push ebx
cmp eax, 0x10
jb 0x4160f0
call fcn.00484220
jmp 0x4160f5
call fcn.004842a0
add esp, 4
mov dword [ebp - 4], 1
xor eax, eax
mov edx, dword [esi + 0x3c]
mov ecx, edx
mov ebx, dword [esi + 0x40]
mov edi, ebx
rep stosd dword es:[edi], eax
lea eax, [edx*4]
push ebx
cmp eax, 0x10
jb 0x416121
call fcn.00484220
jmp 0x416126
call fcn.004842a0
add esp, 4
mov dword [ebp - 4], 2
xor al, al
mov edx, dword [esi + 0x30]
mov edi, edx
mov ecx, dword [esi + 0x2c]
rep stosb byte es:[edi], al
push edx
call fcn.004842a0
mov dword [ebp - 4], 3
xor al, al
mov edx, dword [esi + 0x24]
mov edi, edx
mov ecx, dword [esi + 0x20]
rep stosb byte es:[edi], al
push edx
call fcn.004842a0
mov dword [ebp - 4], 4
xor al, al
mov edx, dword [esi + 0x18]
mov edi, edx
mov ecx, dword [esi + 0x14]
rep stosb byte es:[edi], al
push edx
call fcn.004842a0
mov dword [ebp - 4], 5
xor al, al
mov edx, dword [esi + 0xc]
mov edi, edx
mov ecx, dword [esi + 8]
rep stosb byte es:[edi], al
push edx
call fcn.004842a0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419d60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a013e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4d3094]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 0x10]
mov dword [edi + 0xc], 0
call fcn.00469900
mov dword [ebp - 4], 0
mov eax, dword [edi + 8]
mov dword [edi], vtable.CryptoPP::DL_GroupParametersImpl_class_CryptoPP::ModExpPrecomputation__class_CryptoPP::DL_FixedBasePrecomputationImpl_class_CryptoPP::Integer___class_CryptoPP::DL_GroupParameters_IntegerBased_.0
mov dword [edi + 4], vtable.CryptoPP::DL_GroupParametersImpl_class_CryptoPP::ModExpPrecomputation__class_CryptoPP::DL_FixedBasePrecomputationImpl_class_CryptoPP::Integer___class_CryptoPP::DL_GroupParameters_IntegerBased_.1.0
mov eax, dword [eax + 4]
mov dword [eax + edi + 8], vtable.CryptoPP::DL_GroupParametersImpl_class_CryptoPP::ModExpPrecomputation__class_CryptoPP::DL_FixedBasePrecomputationImpl_class_CryptoPP::Integer___class_CryptoPP::DL_GroupParameters_IntegerBased_.2.0
mov eax, dword [edi + 8]
mov eax, dword [eax + 4]
mov dword [eax + edi + 4], 0
mov dword [edi + 0x24], vtable.CryptoPP::ModExpPrecomputation.0
mov dword [edi + 0x28], 0
lea esi, [edi + 0x2c]
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.CryptoPP::DL_FixedBasePrecomputationImpl_class_CryptoPP::Integer_.0
call fcn.00469900
mov byte [ebp - 4], 2
lea ecx, [esi + 0x1c]
mov dword [esi + 0x18], 0
call fcn.00469900
mov dword [esi + 0x30], 0
mov eax, edi
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41f76b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov ebx, dword [edi + 0x2c]
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, ebx
sub edx, dword [edi + 0x6c]
mov dword [ebp - 0xc], edx
cmp dword [edi + 0x6c], eax
jb 0x41f80a
mov ecx, dword [edi + 0x38]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.0043f8e0
mov ecx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
sub dword [edi + 0x5c], ebx
mov edi, ecx
mov dword [ebp - 8], ecx
lea esi, [eax + ecx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x41f7bf
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0x40]
mov edi, ebx
lea esi, [eax + ebx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x41f7e6
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
add edx, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x41f8c5
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 8], ecx
test ecx, ecx
jne 0x41f837
xor eax, eax
jmp 0x41f888
sub eax, ecx
mov dword [esi + 4], eax
mov eax, dword [esi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x41f854
mov edx, dword [esi]
push ecx
mov ecx, dword [esi + 0x30]
call fcn.00420112
jmp 0x41f86c
cmp eax, 2
jne 0x41f870
mov edx, dword [esi]
test edx, edx
jne 0x41f863
xor eax, eax
jmp 0x41f86d
push ecx
mov ecx, dword [esi + 0x30]
call fcn.0041d31d
pop ecx
mov dword [esi + 0x30], eax
push dword [ebp - 8]
push dword [esi]
push dword [ebp - 0xc]
call fcn.0043f8e0
mov eax, dword [ebp - 8]
add esp, 0xc
add dword [esi], eax
add dword [esi + 8], eax
add dword [edi + 0x74], eax
cmp dword [edi + 0x74], 3
jb 0x41f8b0
mov edx, dword [edi + 0x6c]
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx esi, byte [edx + eax]
mov dword [edi + 0x48], esi
movzx eax, byte [edx + eax + 1]
shl esi, cl
xor esi, eax
and esi, dword [edi + 0x54]
mov dword [edi + 0x48], esi
cmp dword [edi + 0x74], 0x106
jae 0x41f8c5
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x41f77c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42323b
Capabilities:
Write file on windows

Disassembly:
push 0x38
mov eax, 0x4a0756
call fcn.00427fa7
mov ebx, ecx
mov eax, dword [ebp + 8]
xor esi, esi
test eax, eax
je 0x423257
cmp word [eax], si
jne 0x423262
lea eax, [ebx + 0x1c]
cmp dword [eax + 0x14], 8
jb 0x423262
mov eax, dword [eax]
push 0x4be768
push eax
call fcn.0044e1ce
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x423326
mov esi, dword [ebx + 0x4c]
xor eax, eax
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x40], al
mov dword [ebp - 4], eax
cmp esi, dword [ebx + 0x50]
je 0x4232b6
mov ecx, dword [esi]
cmp dword [ebx + 0x44], eax
jne 0x4232a2
push edi
call fcn.004226f6
jmp 0x4232ab
lea eax, [ebp - 0x40]
push eax
call fcn.0042273c
add esi, 4
push 0
pop eax
cmp esi, dword [ebx + 0x50]
jne 0x423293
cmp dword [ebx + 0x44], eax
je 0x423312
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
sub esp, 0x18
mov byte [ebp - 4], 1
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
call fcn.00409172
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
call fcn.00423511
test eax, eax
je 0x423303
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push edi
cmovae eax, dword [ebp - 0x28]
push 1
push dword [ebp - 0x18]
push eax
call fcn.0044de27
add esp, 0x10
xor esi, esi
lea ecx, [ebp - 0x28]
push esi
push 1
call fcn.00407543
jmp 0x423314
xor esi, esi
push edi
call fcn.0044daa4
pop ecx
push esi
push 1
lea ecx, [ebp - 0x40]
call fcn.00405e63
call fcn.00427f51
ret 4

Function at 0x4235ae
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x14
push esi
call fcn.0040cf54
push 0x14
pop esi
cmp eax, esi
jae 0x4235c8
xor al, al
jmp 0x423623
push ebx
push edi
xor ebx, ebx
push ebx
push ebx
push dword [ebp + 8]
call fcn.0044fdb1
push dword [ebp + 8]
xor eax, eax
mov word [ebp - 0x10], si
inc eax
mov byte [ebp - 0xc], bl
push eax
mov word [ebp - 0xe], ax
mov edi, 0x58453144
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push esi
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.0044e8b7
add esp, 0x1c
test eax, eax
je 0x42360c
cmp dword [ebp - 0x14], edi
je 0x423610
xor al, al
jmp 0x423621
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x42361f
push 5
pop ecx
lea esi, [ebp - 0x14]
rep movsd dword es:[edi], dword [esi]
mov al, 1
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x423dea
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4d3094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x18], esi
test edi, edi
je 0x423e5c
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x423e10
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
mov dword [ebp - 0x1c], eax
cmp eax, 0x3fffffff
jg 0x423e5c
add eax, eax
call fcn.00427f10
mov esi, esp
test esi, esi
je 0x423e59
mov ecx, dword [ebp - 0x1c]
push ebx
push ebx
mov byte [esi], bl
lea eax, [ecx + ecx]
push eax
push esi
push 0xffffffffffffffff
push edi
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, esi
mov esi, dword [ebp - 0x18]
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
push 2
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop eax
push 0x7b
mov word [ebp - 0x14], ax
call dword [sym.imp.WSOCK32.dll_htons]
push ebx
mov word [ebp - 0x12], ax
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
jne 0x423e9c
push ebx
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x423ec5
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [esi]
call dword [sym.imp.WSOCK32.dll_connect]
neg eax
sbb eax, eax
inc eax
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00427425
mov esp, ebp
pop ebp
ret 8
xor eax, eax
jmp 0x423eaf

Function at 0x423ec9
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x4d3094]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
push esi
push edi
mov edi, 0x3e8
mov esi, dword [ebp + 8]
div edi
xor edi, edi
mov dword [ebp - 0x110], eax
inc edi
mov eax, dword [ecx]
xor ecx, ecx
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0x110]
push eax
push ecx
push ecx
lea eax, [ebp - 0x108]
mov dword [ebp - 0x10c], edx
push eax
push ecx
mov dword [ebp - 0x108], edi
call dword [sym.imp.WSOCK32.dll_select]
cmp eax, 0xffffffff
jne 0x423f2c
xor eax, eax
jmp 0x423f37
xor ecx, ecx
test eax, eax
mov eax, edi
setne cl
mov dword [esi], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00427425
mov esp, ebp
pop ebp
ret 8
Function at 0x4241dc
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x4a0808
call fcn.00427fde
mov ebx, edx
push 0x801
call fcn.00427707
xor edi, edi
mov esi, eax
mov dword [ebp - 4], edi
mov dword [esp], 0x801
push edi
push esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], 0x800
call fcn.00441690
add esp, 0xc
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x14]
push eax
push 0x20019
push edi
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp dword [ebp - 0x14], edi
je 0x42426e
lea eax, [ebp - 0x1c]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 0x18], 1
jne 0x424265
push esi
call fcn.00405e00
pop ecx
mov ecx, dword [ebp + 0xc]
push eax
push esi
call fcn.00405d87
inc edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x424279
push esi
call fcn.00427702
pop ecx
mov eax, edi
call fcn.00427f3c
ret

Function at 0x42a1fc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x459d59
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00459bcf

Function at 0x46010d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045fc60

Function at 0x4685f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a1af8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4d3094]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
call dword [eax + 0x24]
mov esi, eax
mov dword [ebp - 0x10], esi
push dword [ebp + 0x14]
mov eax, dword [edi]
mov ecx, edi
push dword [ebp + 0x10]
mov dword [ebp - 4], 0
push esi
call dword [eax + 0x28]
push dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 8]
call dword [eax + 0xc]
mov eax, dword [edi]
mov ecx, edi
push esi
mov eax, dword [eax + 0x30]
call eax
mov edx, dword [esi]
mov ecx, esi
push 1
mov bl, al
call dword [edx]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4842b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
xor edx, edx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x20]
mov ecx, esi
shr ecx, 2
push edi
test ecx, ecx
je 0x484375
mov edi, dword [esp + 0x20]
cmp ecx, 8
jb 0x484350
mov ebx, ecx
lea eax, [edi + 0x10]
mov esi, ebp
and ebx, 0xfffffff8
sub esi, edi
xorps xmm3, xmm3
mov dword [esp + 0x10], esi
movaps xmm2, xmm3
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x10]
nop word [eax + eax]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ebp + edx*4]
add edx, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [edi + eax - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp edx, ebx
jb 0x484300
mov edi, dword [esp + 0x20]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd ebx, xmm2
cmp edx, ecx
jae 0x484375
mov esi, ebp
lea edi, [edi + edx*4]
sub esi, dword [esp + 0x20]
sub ecx, edx
add edx, ecx
mov eax, dword [edi + esi]
lea edi, [edi + 4]
xor eax, dword [edi - 4]
or ebx, eax
sub ecx, 1
jne 0x484361
mov esi, dword [esp + 0x24]
shl edx, 2
sub esi, edx
jne 0x48438b
pop edi
xor eax, eax
test ebx, ebx
pop esi
pop ebp
sete al
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x20]
add ebp, edx
add ecx, edx
mov eax, ebx
shr eax, 0x10
mov edx, ebx
shr edx, 0x18
xor edi, edi
or dl, al
mov dword [esp + 0x20], ecx
mov eax, ebx
shr eax, 8
or dl, al
or dl, bl
mov dword [esp + 0x10], edx
test esi, esi
je 0x484465
cmp esi, 0x20
jb 0x484449
mov ebx, esi
mov edx, ebp
and ebx, 0xffffffe0
xorps xmm3, xmm3
sub edx, ecx
mov eax, ecx
mov dword [esp + 0x14], edx
movaps xmm2, xmm3
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ecx - 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
por xmm3, xmm1
movups xmm1, xmmword [edi + ebp + 0x10]
add edi, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, ebx
jb 0x4843e0
por xmm2, xmm3
mov ecx, dword [esp + 0x20]
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or dl, al
cmp edi, esi
jae 0x484465
sub ebp, dword [esp + 0x20]
add ecx, edi
sub esi, edi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
or dl, al
sub esi, 1
jne 0x484455
pop edi
pop esi
test dl, dl
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x484480
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 0x10]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, edx
shr edi, 2
test edi, edi
je 0x484527
cmp edi, 8
jb 0x484500
lea eax, [esi - 4]
lea eax, [eax + edi*4]
lea ecx, [ebp - 4]
lea ecx, [ecx + edi*4]
cmp ebp, eax
ja 0x4844b9
cmp ecx, esi
jae 0x484500
mov ecx, edi
lea eax, [ebp + 0x10]
mov edx, esi
and ecx, 0xfffffff8
sub edx, ebp
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x10]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [esi + ebx*4]
add ebx, 8
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm1, xmmword [eax + ebp - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp ebx, ecx
jb 0x4844d1
mov ebp, dword [esp + 0x18]
cmp ebx, edi
jae 0x484527
lea ecx, [ebx*4]
mov edx, esi
sub edi, ebx
add ecx, ebp
sub edx, ebp
add ebx, edi
mov eax, dword [ecx + edx]
lea ecx, [ecx + 4]
xor dword [ecx - 4], eax
sub edi, 1
jne 0x484515
mov edx, dword [esp + 0x20]
shl ebx, 2
sub edx, ebx
je 0x4845a4
add ebp, ebx
add esi, ebx
xor edi, edi
test edx, edx
je 0x4845a4
cmp edx, 0x20
jb 0x48458b
lea eax, [esi - 1]
lea ecx, [ebp - 1]
add eax, edx
add ecx, edx
cmp ebp, eax
ja 0x48454f
cmp ecx, esi
jae 0x48458b
mov ecx, edx
mov ebx, esi
and ecx, 0xffffffe0
mov eax, ebp
sub ebx, ebp
nop word [eax + eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebx - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm1, xmmword [esi + edi + 0x10]
add edi, 0x20
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp edi, ecx
jb 0x484560
cmp edi, edx
jae 0x4845a4
sub esi, ebp
lea ecx, [edi + ebp]
sub edx, edi
mov al, byte [ecx + esi]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x484596
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret