joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10066f0
Capabilities:
Encode data using xor

Disassembly:
xor ecx, dword [0x100bf9a]
dec esi
neg eax
xor edx, dword [0x100bf32]
sub ebx, dword [0x100be6c]
xor edi, dword [0x100becc]
ror ecx, 8
xor ecx, edx
not esi
add ecx, dword [0x100bfaa]
xchg ebx, eax
sub edx, dword [0x100bee9]
or dword [0x100bd88], ecx
ror esi, 0x12
sub ecx, dword [0x100bfa9]
inc esi
and dword [0x100bd97], ecx
dec esi
rol esi, 0x12
or dword [0x100bd38], esi
xchg ebx, eax
not esi
xor ecx, edx
rol ecx, 8
neg eax
inc esi
not dword [eax]
inc esi
xchg edi, edx
xor esi, 0xe9f2530
not esi
xchg edi, eax
sub edi, dword [0x100bfc2]
invalid
invalid
invalid
invalid
invalid
xchg esi, esi
dec edx
add ecx, dword [0x100bf27]
neg edi
ror ebx, 0x1f
dec esi
xor eax, 0x11370030
xor ecx, dword [0x100bf38]
inc edi
xor esi, eax
neg edx
add esi, dword [0x100bfbf]
sub esi, 0xd88228c
rol eax, 0x1a
not esi
xor ebx, edi
xor ecx, edx
xor esi, 0x1862c083
xor esi, 0x1862c083
bound ebx, qword [eax]
xor ecx, edx
xor ebx, edi
not esi
ror eax, 0x1a
add esi, 0xd88228c
neg edx
xor esi, eax
dec edi
xor eax, 0x11370030
inc esi
rol ebx, 0x1f
neg edi
inc edx
xchg esi, esi
xor ebx, 0x2441ff4c
xor edx, 0xc0e1cf0
rol esi, 1
sub ecx, 4
jne 0x10063fa
add eax, 0x3c848ce8
insd dword es:[edi], dx
xor eax, eax
adc al, 0xe8
push eax
mov cl, 0x5b
sub al, 0xeb
add dh, byte [ebp + 0x6c78f2ab]
xlatb
stosd dword es:[edi], eax
salc
mov cl, 0x1f
or eax, 0x29cfe4c
jl 0x100672f
rcl eax, 0xdd
add edi, esp
arpl word [edx], sp
ja 0x1006784
add dl, byte [ecx]
stosd dword es:[edi], eax
stosb byte es:[edi], al
dec esp
call 0x44887a0e
push es
add al, byte [ecx - 0x2f06540e]
add ebx, edx
in al, dx
invalid
invalid
jecxz 0x10067a8
Function at 0x4058be
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add ebx, 0x10fd7
pop ebx
push edi
and edi, 0xe81
sub edi, 0x16662
xor edi, 0x494b
add edi, 0x89e
pop edi
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x405958
Function at 0x405be9
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x180]
add ecx, 1
mov dword [ebp - 0x180], ecx
add esp, 4
pop ecx
mov eax, dword [ebp - 0x6f8]
add eax, dword [ebp - 0x180]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x180]
movsx eax, byte [ebp + edx - 0x820]
cmp ecx, eax
je 0x405c32
mov ecx, dword [ebp - 0x6f8]
add ecx, dword [ebp - 0x180]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x180]
movsx ecx, byte [ebp + eax - 0x820]
cmp edx, ecx
jne 0x405c39
jmp 0x405b7f
jmp 0x405c40
Function at 0x401530
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x120
lea ebx, [ebp - 0x10c]
mov dword [esp + 4], ebx
mov dword [esp], 0xfc
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edx, ebx
sub esp, 8
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x401557
mov ecx, eax
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
add al, al
sbb edx, 3
mov dword [edx], 0x2e626461
mov dword [edx + 4], 0x676f6c
mov dword [esp + 4], 0x4ac020
mov dword [esp], 0x4ac023
call sub.msvcrt.dll_fopen
test eax, eax
mov esi, eax
je 0x4015df
mov edx, dword [esi]
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [eax], edx
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov edx, dword [esi + 8]
mov dword [eax + 8], edx
mov edx, dword [esi + 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [esi + 0x10]
mov dword [eax + 0x10], edx
mov edx, dword [esi + 0x14]
mov dword [eax + 0x14], edx
mov edx, dword [esi + 0x18]
mov dword [eax + 0x18], edx
mov edx, dword [esi + 0x1c]
mov dword [eax + 0x1c], edx
mov dword [esp], ebx
mov dword [esp + 4], 0x4ac027
call sub.msvcrt.dll_fopen
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0
test eax, eax
mov ebx, eax
cmove ebx, esi
mov dword [esp], ebx
call sub.msvcrt.dll_setvbuf
mov edx, dword [ebx]
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [eax + 0x20], edx
mov edx, dword [ebx + 4]
mov dword [eax + 0x24], edx
mov edx, dword [ebx + 8]
mov dword [eax + 0x28], edx
mov edx, dword [ebx + 0xc]
mov dword [eax + 0x2c], edx
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x30], edx
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x34], edx
mov edx, dword [ebx + 0x18]
mov dword [eax + 0x38], edx
mov edx, dword [ebx + 0x1c]
mov dword [eax + 0x3c], edx
mov edx, dword [ebx]
mov dword [eax + 0x40], edx
mov edx, dword [ebx + 4]
mov dword [eax + 0x44], edx
mov edx, dword [ebx + 8]
mov dword [eax + 0x48], edx
mov edx, dword [ebx + 0xc]
mov dword [eax + 0x4c], edx
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x50], edx
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x54], edx
mov edx, dword [ebx + 0x18]
mov dword [eax + 0x58], edx
mov edx, dword [ebx + 0x1c]
mov dword [eax + 0x5c], edx
call sub.msvcrt.dll__getpid
mov dword [esp + 4], str.____adb_starting__pid__d______n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.0049e490
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x4016b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [esp], 0x401520
lea ebx, [ebp - 0x20]
call fcn.00490420
mov dword [esp + 4], 1
mov dword [esp], 0x401510
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
sub esp, 8
call fcn.004100d0
mov dword [0x4ee064], 1
call fcn.0040cec0
mov dword [esp], 0x15b3
call fcn.004121d0
call fcn.00414140
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], str.tcp:_d
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.0041f9c0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4ac052
mov dword [esp], ebx
call fcn.004147c0
test eax, eax
jne 0x401855
mov edx, dword [ebp + 8]
test edx, edx
jne 0x401810
test byte [0x4ee060], 1
je 0x4017eb
mov ebx, dword [sym.imp.msvcrt.dll__errno]
call ebx
mov esi, dword [eax]
mov dword [esp], 0x4ee068
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
call sub.msvcrt.dll__getpid
mov dword [esp + 0x10], edi
mov dword [esp + 8], str.adb_main
mov dword [esp + 4], 0x4ac064
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.0049e490
call ebx
mov dword [eax], esi
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.Event_loop_starting_n
add eax, 0x40
mov dword [esp], eax
call fcn.0049e490
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4ee068
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
call ebx
mov dword [eax], esi
call fcn.00419760
call fcn.0040cf00
mov eax, dword [ebp - 0x20]
lea ecx, [eax - 0xc]
cmp ecx, 0x4abf34
jne 0x401861
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0xfffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [ebp - 0x1c]
sub esp, 4
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x4ac060
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
call fcn.00401530
jmp 0x40174f
mov dword [esp], 1
call sub.msvcrt.dll_exit
cmp dword [0x4a746c], 0
jne 0x40188a
mov edx, dword [eax - 4]
lea ebx, [edx - 1]
mov dword [eax - 4], ebx
mov eax, edx
test eax, eax
jg 0x401803
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call fcn.004a0b50
push eax
jmp 0x401803
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
mov eax, edx
jmp 0x401875
Function at 0x401d40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
sub esp, 0x22c
test eax, eax
js 0x401f46
lea esi, [ebp - 0x218]
jmp 0x401dbb
mov dword [esp + 8], 0x200
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.00417970
test byte [0x4ee060], 1
mov ebx, eax
jne 0x401e70
test ebx, ebx
jle 0x401f46
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], esi
add eax, 0x20
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
mov dword [esp], eax
call sub.msvcrt.dll_fflush
test byte [0x4ee060], 1
je 0x401d60
call dword [sym.imp.msvcrt.dll__errno]
mov ebx, dword [eax]
mov dword [esp], 0x4ee068
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x21c], eax
call sub.msvcrt.dll__getpid
mov edx, dword [ebp - 0x21c]
mov dword [esp + 8], str.read_and_dump
mov dword [esp + 4], 0x4ac173
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.0049e490
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], ebx
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], edi
mov dword [esp + 4], str.read_and_dump__:_pre_adb_read_fd_d__n
add eax, 0x40
mov dword [esp], eax
call fcn.0049e490
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4ee068
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], ebx
jmp 0x401d60
mov edx, dword [sym.imp.msvcrt.dll__errno]
mov dword [ebp - 0x224], edx
call edx
mov eax, dword [eax]
mov dword [esp], 0x4ee068
mov dword [ebp - 0x21c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x220], eax
call sub.msvcrt.dll__getpid
mov edx, dword [sym.imp.msvcrt.dll__iob]
mov ecx, dword [ebp - 0x220]
mov dword [esp + 8], str.read_and_dump
mov dword [esp + 4], 0x4ac173
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
lea eax, [edx + 0x40]
mov dword [esp], eax
call fcn.0049e490
mov edx, dword [ebp - 0x224]
mov dword [ebp - 0x220], edx
call edx
mov ecx, dword [ebp - 0x21c]
mov dword [eax], ecx
mov edx, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edi
mov dword [esp + 4], str.read_and_dump__:_post_adb_read_fd_d_:_len_d_n
lea eax, [edx + 0x40]
mov dword [esp], eax
call fcn.0049e490
mov edx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [edx + 0x40]
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4ee068
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [ebp - 0x220]
sub esp, 4
call edx
mov ecx, dword [ebp - 0x21c]
test ebx, ebx
mov dword [eax], ecx
jg 0x401d8b
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40cec0
Capabilities:
Create thread

Disassembly:
sub esp, 0x1c
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x40df10
call dword [sym.imp.msvcrt.dll__beginthread]
cmp eax, 0xffffffff
je 0x40cef0
add esp, 0x1c
ret
mov dword [esp], 0x4b0ae0
call fcn.0040a810
add esp, 0x1c
ret
Function at 0x411f10
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [ebp + 0xc]
mov dword [esp], str.ADBHOST
call sub.msvcrt.dll_getenv
test eax, eax
je 0x411fd7
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.004183d0
test eax, eax
mov ebx, eax
js 0x411fd7
test byte [0x4ee060], 8
jne 0x411fff
lea edi, [ebp - 0x1c]
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov dword [esp + 4], 6
mov dword [esp], ebx
mov dword [ebp - 0x1c], 1
call fcn.00418d60
mov eax, dword [ebp + 8]
mov dword [esp + 4], str.emulator__d
mov dword [esp], edi
mov dword [esp + 8], eax
call fcn.0041f9c0
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], 1
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00410fc0
mov eax, dword [ebp - 0x1c]
lea ecx, [eax - 0xc]
cmp ecx, 0x4abf34
jne 0x4120a7
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 1
mov dword [esp], esi
call fcn.00417cd0
mov ebx, eax
mov eax, 0xffffffff
test ebx, ebx
js 0x411fcf
test byte [0x4ee060], 8
je 0x411f5b
mov edi, dword [sym.imp.msvcrt.dll__errno]
call edi
mov eax, dword [eax]
mov dword [esp], 0x4ee068
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x30], eax
call sub.msvcrt.dll__getpid
mov ecx, dword [ebp - 0x30]
mov dword [esp + 8], str.local_connect_arbitrary_ports
mov dword [esp + 4], 0x4b1840
mov dword [esp + 0x10], ecx
mov ecx, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 0xc], eax
lea eax, [ecx + 0x40]
mov dword [esp], eax
call fcn.00411760
call edi
mov edx, dword [ebp - 0x2c]
mov dword [eax], edx
mov ecx, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.client:_connected_on_remote_on_fd__d_n
lea eax, [ecx + 0x40]
mov dword [esp], eax
call fcn.00411760
mov ecx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [ecx + 0x40]
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4ee068
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
call edi
mov edx, dword [ebp - 0x2c]
mov dword [eax], edx
jmp 0x411f5b
cmp dword [0x4a746c], 0
jne 0x4120d4
mov edx, dword [eax - 4]
lea ebx, [edx - 1]
mov dword [eax - 4], ebx
mov eax, edx
test eax, eax
jg 0x411fcd
lea eax, [ebp - 0x1d]
mov dword [esp], eax
call fcn.004a0b50
push eax
jmp 0x411fcd
or edx, 0xffffffff
lock xadd dword [eax - 4], edx
mov eax, edx
jmp 0x4120bb
Function at 0x4121d0
Capabilities:
Create thread

Disassembly:
push ebp
mov eax, 0x411790
mov ebp, esp
push edi
push esi
push ebx
mov ebx, 0x412100
sub esp, 0x2c
mov esi, dword [0x4ee064]
test esi, esi
cmove ebx, eax
test byte [0x4ee060], 8
jne 0x412220
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.msvcrt.dll__beginthread]
cmp eax, 0xffffffff
je 0x4122d1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [sym.imp.msvcrt.dll__errno]
call esi
mov edi, dword [eax]
mov dword [esp], 0x4ee068
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x1c], eax
call sub.msvcrt.dll__getpid
mov edx, dword [ebp - 0x1c]
mov dword [esp + 8], str.local_init
mov dword [esp + 4], 0x4b1840
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00411760
call esi
mov edx, 0x4b1a17
mov dword [eax], edi
mov ecx, dword [0x4ee064]
mov eax, 0x4b1a10
mov dword [esp + 4], str.transport:_local__s_init_n
test ecx, ecx
cmove eax, edx
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.00411760
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4ee068
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
call esi
mov dword [eax], edi
jmp 0x4121f7
mov edx, dword [0x4ee064]
mov eax, 0x4b1a10
mov dword [esp], str.cannot_create_local_socket__s_thread
test edx, edx
mov edx, 0x4b1a17
cmove eax, edx
mov dword [esp + 4], eax
call fcn.0040a810
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x418d60
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 8]
call fcn.004157b0
test eax, eax
je 0x418d81
cmp dword [eax], 0x4b3690
je 0x418e44
test byte [0x4ee060], 0x80
mov esi, 0xffffffff
jne 0x418da0
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [sym.imp.msvcrt.dll__errno]
call ebx
mov edi, dword [eax]
mov dword [esp], 0x4ee068
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x1c], eax
call sub.msvcrt.dll__getpid
mov ecx, dword [ebp - 0x1c]
mov dword [esp + 8], str.adb_setsockopt
mov dword [esp + 4], 0x4b2138
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.0049e490
call ebx
mov dword [eax], edi
mov eax, dword [ebp + 8]
mov dword [esp + 4], str.adb_setsockopt:_invalid_fd__d_n
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.0049e490
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov dword [esp], 0x4ee068
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
call ebx
mov dword [eax], edi
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp + 0x18]
mov dword [esp + 0x10], edx
mov edx, dword [ebp + 0x14]
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
sub esp, 0x14
mov esi, eax
jmp 0x418d8f
Function at 0x425770
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test esi, esi
je 0x42587b
xor eax, eax
lea esi, [esi]
cmp esi, 2
jbe 0x425800
movzx ebp, byte [ebx]
add edx, 4
add eax, 4
movzx edi, byte [ebx + 1]
add ebx, 3
shl ebp, 0x10
shl edi, 8
or ebp, edi
movzx edi, byte [ebx - 1]
or ebp, edi
mov edi, ebp
shr edi, 0x12
movzx ecx, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edi, ebp
shr edi, 0xc
and edi, 0x3f
mov byte [edx - 4], cl
movzx ecx, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edi, ebp
shr edi, 6
and edi, 0x3f
mov byte [edx - 3], cl
movzx ecx, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 2], cl
mov ecx, ebp
and ecx, 0x3f
sub esi, 3
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 1], cl
jne 0x425790
mov ecx, edx
jmp 0x42583b
movzx ecx, byte [ebx]
shl ecx, 0x10
cmp esi, 2
je 0x425843
mov ebx, ecx
shr ecx, 0xc
shr ebx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movzx ebx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], cl
mov ecx, 0x3d
mov byte [edx], bl
mov byte [edx + 2], cl
add eax, 4
lea ecx, [edx + 4]
mov byte [edx + 3], 0x3d
mov byte [ecx], 0
pop ebx
pop esi
pop edi
pop ebp
ret
movzx ebx, byte [ebx + 1]
shl ebx, 8
or ebx, ecx
mov ecx, ebx
shr ecx, 0x12
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], cl
mov ecx, ebx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
shr ebx, 6
and ebx, 0x3f
mov byte [edx + 1], cl
movzx ecx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x42582e
mov ecx, edx
xor eax, eax
jmp 0x42583b
Function at 0x490c10
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x490c48
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x490c3e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x490c4a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x490c30
xor eax, eax
pop ebx
pop esi
ret

Function at 0x491a80
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x491ab4
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [0x4f0884], eax
call fcn.0049e420
test eax, eax
sete al
movzx eax, al
mov dword [0x4a7478], eax
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x491aa3

Function at 0x491bc0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x3c
mov eax, dword [eax + 0xc]
mov edi, dword [esi + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [edx]
mov dword [ebp - 0x20], edi
jmp 0x491bec
mov dword [0x4f0888], ecx
mov eax, dword [ebx]
mov eax, dword [eax]
mov dword [ebx], eax
test eax, eax
je 0x491ca8
mov edi, dword [eax + 0x18]
mov eax, dword [ebp - 0x20]
mov edx, dword [esi + 4]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], eax
mov eax, dword [esi]
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0xa
mov dword [esp], 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c]
call eax
test eax, eax
jne 0x491d00
test edi, edi
je 0x491c6b
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0xa
mov dword [esp], 1
call edi
cmp eax, 7
je 0x491d10
cmp eax, 8
jne 0x491d00
mov eax, dword [ebx]
mov ecx, dword [eax]
mov eax, dword [0x4a7478]
test eax, eax
js 0x491ce6
test eax, eax
je 0x491be0
mov eax, dword [0x4f0884]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x491be6
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x491be6
mov eax, dword [esi]
mov edi, dword [ebp - 0x20]
mov edx, dword [esi + 4]
mov dword [esp + 0x14], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0x1a
mov dword [esp], 1
call eax
test eax, eax
jne 0x491d00
lea esp, [ebp - 0xc]
mov al, 5
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x24], ecx
call fcn.00491ac0
mov eax, dword [0x4a7478]
mov ecx, dword [ebp - 0x24]
jmp 0x491c78
lea esp, [ebp - 0xc]
mov eax, 2
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 7
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x491f20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [0x4a7478]
mov ebx, dword [ebp + 8]
test eax, eax
js 0x492002
test eax, eax
mov edi, dword [0x4f0888]
jne 0x491fa0
test edi, edi
mov dword [ebp - 0x1c], edi
je 0x491f93
mov eax, edi
lea esi, [ebp - 0x1c]
nop
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x491f87
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [esp + 4], 1
mov dword [esp], 1
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
call ecx
cmp eax, 6
je 0x491fd0
cmp eax, 8
jne 0x491ff5
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
test eax, eax
mov dword [ebp - 0x1c], eax
jne 0x491f50
mov eax, 5
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [0x4f0884]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov edi, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
jmp 0x491f43
mov eax, dword [ebp - 0x1c]
mov edx, esi
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x1c], edi
mov dword [ebx + 0x10], eax
mov eax, ebx
call fcn.004919d0
cmp eax, 7
jne 0x491f98
mov eax, esi
call fcn.00491b50
lea esp, [ebp - 0xc]
mov eax, 3
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00491ac0
mov eax, dword [0x4a7478]
jmp 0x491f39

Function at 0x492140
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x492180
mov edx, dword [0x4a7478]
test edx, edx
js 0x4921c4
test edx, edx
mov eax, dword [0x4f0888]
jne 0x492198
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00491bc0
cmp eax, 7
je 0x492190
call sub.msvcrt.dll_abort
lea esi, [esi]
mov dword [esp], ebx
call fcn.00491f20
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x1c]
call fcn.00491b50
mov esi, dword [0x4f0884]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
sub esp, 4
jmp 0x492166
call fcn.00491ac0
mov edx, dword [0x4a7478]
jmp 0x49215d