joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4249e0
Capabilities:
Encode data using xor

Disassembly:
adc eax, 0x499b56c3
dec edi
mov al, ah
or bh, cl
jb 0x4249c7
sal byte [ebx - 0x7c], cl
lds esp, [esi + 0x715f6325]
add al, 0x8c
mov ebp, 0xf2be8ded
jns 0x4249bd
dec ecx
mov gs, word [esp + edi*4 - 0x5f]
push esi
cmp ebp, esp
mov esp, 0xec3b56a1
xor eax, 0x4bc10bff
je 0x424a21
std
leave
lcall 0x7a18, 0xc7b22c0e
out 0xe9, al
rcr dword [ebp - 0x2d60e410], 0xa
pop ecx
ror byte [eax + ebx + 0x7d], 0x69
jge 0x424a4b
jge 0x424a4b
loope 0x42499b
rcr byte [ecx - 0x1ce96328], 6
cld
pop edi
std
pop ss
aad 0x1d
mov ecx, 0x18af3846
inc edx
mov ebp, 0x2c42057b
scasb al, byte es:[edi]
nop
push ebp
outsb dx, byte [esi]
aad 0xb
mov ah, 0xbb
and dword [eax], 0xffffffca
int1
loopne 0x424a51
mov byte [edx - 0x17], 0xc0
pop ebx
xchg edx, eax
xchg edi, eax
inc edi
sub al, 0x61
cli
mov dword [0xac535b30], eax
push esi
push esi
sbb eax, 0x1dca2e24
mov dl, 0x4c
and byte [edi + 0x51], ch
sbb eax, 0x6f204cb2
push ecx
rcl byte [esi + edi*4 - 0x68d4b5e1], cl
sahf
xchg edi, eax
aam 0x5b
stosd dword es:[edi], eax
dec esp
ret 0xdc21
dec ebx
insb byte es:[edi], dx
sbb al, 0xe8
movsd dword es:[edi], dword [esi]
out 0x9f, eax
pop ss
popfd
xchg ecx, eax
dec edi
clc
mov edi, 0xb02a3eb7
je 0x424a9c
lea ecx, [eax]
int1
in al, dx
into
mov dx, cx
push es
loop 0x424aa6
xchg edx, eax
lcall 0x8ea6, 0xf2e7d9e4
jbe 0x424a79
clc
outsd dx, dword [esi]
cmp byte [edi + 0x701bf80d], ch
inc esi
jo 0x424ac1
xor al, 0x41
mov dh, 0x9b
fiadd dword [ecx + ebp*2 - 0x74e3472c]
stosd dword es:[edi], eax
mov al, 0x39
lea ebx, [0xbb18af22]
scasb al, byte es:[edi]
pop edx
mov ebx, 0xf0e28cf3
aas
or byte [eax - 0x3e], cl
mov bl, 0x73
ret 0x73b3
inc edi
jo 0x424a4a
js 0x424a99
xchg esp, eax
sub al, 0x25
loope 0x424afe
pop eax
sbb ebx, dword [ebp - 6]
das
mov ah, 0x28
cmp al, 0x5b
sub eax, edi
dec ecx
insd dword es:[edi], dx
xor dword [ecx + 0x10], eax
push edi
jp 0x424aa5
mov byte [0x6c07a84], al
pushal
adc ebx, dword [edx]
call 0xc0d2bbd
mov dl, 0xff
xchg ebx, eax
invalid
stosd dword es:[edi], eax
fisubr dword [ebp + 0x46]
or ebx, dword [edi - 0x3a74736d]
invalid
lahf
xchg ebx, eax
mov word [ebx - 0x2f24003b], cs
loope 0x424af9
inc ebp
xchg esi, eax
cmp esi, ebp
aad 0xda
cmp byte [edx], 0x28
xor esi, esi
jbe 0x424b55
scasd eax, dword es:[edi]
fiadd dword [0x4ecc30ba]
mov esp, dword [edx]
popfd
salc
shr ebp, cl
out 0x66, eax
and edx, edi
enter 0x303b, 0x4e
invalid
pop eax
mov al, byte [0xa5f5b90c]
and ebx, dword ds:[ebx - 0x77]
xor cl, ah
aaa
push edi
mov esi, 0x37b7d111
invalid

Function at 0x4271f0
Capabilities:
Encode data using xor

Disassembly:
wait
jmp dword [eax + 0x79]
inc esp
mov word [ebx + 6], ds
add al, 0xfb
xor ecx, ebx
sbb al, al
sti
fdivr st(2), st(0)
jecxz 0x4271c3
Function at 0x428e30
Capabilities:
Encode data using xor

Disassembly:
imul ecx, dword [ecx + edx], 0xffffffd6
and byte [edx - 0x3c], al
sal dword [ecx], 0xfd
adc al, 0x45
inc ebx
sbb byte [ebx], dl
fbstp tbyte [0x373d5ddc]
push ebx
test eax, 0x1b39e61b
push esi
daa
loopne 0x428e4f
call dword [ecx]
mov al, byte gs:[0x33382913]
adc dword [ebp - 0x60], esp
adc ebp, dword [ecx]
cmp byte [ebx], dh
enter 0x3c39, 0xffffffffffffffba
or eax, eax
add eax, 0xa9b71ad4
push esi
pop eax
cmp al, dh
push esp
outsd dx, dword [esi]
outsb dx, byte [esi]
pop ebp
push esi
pop esi
aam 0xbe
aas
invalid
Function at 0x401370
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46974b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x485f50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x48a71c
call fcn.00409190
test eax, eax
jne 0x401442
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x3b0
call fcn.0041f673
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x4013ef
mov ecx, dword [ebp - 0x1c]
call fcn.0045f3a0
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x28], ecx
jmp 0x4013f6
mov dword [ebp - 0x28], 0
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x18], edx
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
jmp 0x40141c
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x401434
push 0x477268
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, 0x48a71c
call fcn.00401730
mov ecx, 0x48a71c
call fcn.00409190
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401460
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46977b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x485f50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x48a718
call fcn.00409190
test eax, eax
jne 0x401532
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0xb8
call fcn.0041f673
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x4014df
mov ecx, dword [ebp - 0x1c]
call fcn.00464290
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x28], ecx
jmp 0x4014e6
mov dword [ebp - 0x28], 0
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x18], edx
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
jmp 0x40150c
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x401524
push 0x477268
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, 0x48a718
call fcn.00401730
mov ecx, 0x48a718
call fcn.00409190
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401550
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4697ab
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x485f50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x48a714
call fcn.00409190
test eax, eax
jne 0x401622
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0xa0
call fcn.0041f673
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x4015cf
mov ecx, dword [ebp - 0x1c]
call fcn.0045d5e0
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x28], ecx
jmp 0x4015d6
mov dword [ebp - 0x28], 0
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x18], edx
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
jmp 0x4015fc
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x401614
push 0x477268
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, 0x48a714
call fcn.00401730
mov ecx, 0x48a714
call fcn.00409190
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404cf0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46953b
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x485f50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, 0x48a728
call fcn.00409190
test eax, eax
jne 0x404dbf
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x38
call fcn.0041f673
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x404d6c
mov ecx, dword [ebp - 0x1c]
call fcn.00404b70
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x28], ecx
jmp 0x404d73
mov dword [ebp - 0x28], 0
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x18], edx
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
jmp 0x404d99
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
jne 0x404db1
push 0x477250
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, 0x48a728
call fcn.00404ba0
mov ecx, 0x48a728
call fcn.00409190
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40b6d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
xor ecx, ecx
test edx, edx
jbe 0x40b710
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
jmp 0x40b6f0
movzx edi, byte [ecx + esi]
mov ebx, eax
and ebx, 0xff
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x484058]
inc ecx
cmp ecx, edx
jb 0x40b6f0
pop edi
pop esi
pop ebx
ret
Function at 0x40b720
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
push esi
push edi
test ecx, ecx
je 0x40b78f
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40b78f
cmp byte [eax], 0
je 0x40b78f
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x40b78f
mov esi, dword [esp + 0x20]
test esi, esi
je 0x40b78f
lea edx, [esp + 0xc]
push edx
push 0x20019
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b78f
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
push esi
push edi
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
ret
pop edi
xor eax, eax
pop esi
ret

Function at 0x40b7a0
Capabilities:
Delete registry value

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x40b7f4
mov eax, dword [esp + 8]
test eax, eax
je 0x40b7f4
cmp byte [eax], 0
je 0x40b7f4
lea edx, [esp + 4]
push edx
push 0xf003f
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b7f4
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 8]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
ret
xor eax, eax
ret

Function at 0x40b850
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x485f50]
xor eax, esp
mov dword [esp + 0x94], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 2
jne 0x40b8a9
mov eax, dword [esp + 4]
cmp eax, 5
jbe 0x40b8a0
mov eax, 1
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0043c3a4
add esp, 0x98
ret
jne 0x40b8a9
cmp dword [esp + 8], 0
ja 0x40b886
mov ecx, dword [esp + 0x94]
xor ecx, esp
xor eax, eax
call fcn.0043c3a4
add esp, 0x98
ret
Function at 0x40bc40
Capabilities:
Get disk size

Disassembly:
sub esp, 0x224
mov eax, dword [0x485f50]
xor eax, esp
mov dword [esp + 0x220], eax
push 0x103
lea eax, [esp + 0x1d]
push 0
push eax
mov byte [esp + 0x24], 0
call fcn.0043cea0
push 0x103
lea ecx, [esp + 0x12d]
push 0
push ecx
mov byte [esp + 0x134], 0
call fcn.0043cea0
mov edx, dword [esp + 0x240]
push edx
lea eax, [esp + 0x34]
push eax
call fcn.0040bae0
movsx ecx, byte [esp + 0x38]
push ecx
lea edx, [esp + 0x140]
push 0x46a8c0
push edx
call fcn.0040bae0
add esp, 0x2c
lea eax, [esp]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x40bceb
or eax, 0xffffffff
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.0043c3a4
add esp, 0x224
ret
mov ecx, dword [esp]
mov eax, dword [esp + 4]
mov dword [esp], ecx
mov ecx, eax
and eax, 0x7fffffff
mov dword [esp + 4], eax
fild qword [esp]
and ecx, 0x80000000
mov dword [esp + 4], ecx
mov dword [esp], 0
fild qword [esp]
fchs
faddp st(1)
fld qword [0x46a8b8]
fmul st(1), st(0)
fmulp st(1)
fild dword [esp + 0x22c]
fcompp
fnstsw ax
test ah, 5
jp 0x40bd4f
mov eax, 1
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.0043c3a4
add esp, 0x224
ret
mov ecx, dword [esp + 0x220]
xor ecx, esp
xor eax, eax
call fcn.0043c3a4
add esp, 0x224
ret

Function at 0x40bea0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x464dfb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x485f50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [0x487ae0]
test eax, eax
jne 0x40bf3a
push 0x190
mov dword [ebp - 4], eax
call fcn.0041f673
mov ecx, eax
add esp, 4
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 1
test ecx, ecx
je 0x40bef8
call fcn.0041ccd0
jmp 0x40befa
xor eax, eax
mov esi, eax
test eax, eax
jne 0x40bf1d
jmp 0x40bf12
push 0x477268
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x487ae0]
cmp esi, eax
je 0x40bf33
test eax, eax
je 0x40bf33
push eax
call fcn.0041f6a2
add esp, 4
mov eax, esi
mov dword [0x487ae0], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40cba0
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
lea eax, [esp + 0xc]
push eax
push 2
push 0
push esi
push edi
call ebx
test eax, eax
je 0x40cbe9
push esi
push edi
call fcn.0040ca30
add esp, 8
test eax, eax
jne 0x40cbd8
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
lea ecx, [esp + 0xc]
push ecx
push 2
push 0
push esi
push edi
call ebx
test eax, eax
jne 0x40cbd1
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0xc]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
test esi, esi
pop esi
sete al
pop ebx
pop ecx
ret
Function at 0x40e880
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4652a1
mov eax, dword fs:[0]
push eax
mov eax, 0x10a4
call fcn.004405d0
mov eax, dword [0x485f50]
xor eax, esp
mov dword [esp + 0x10a0], eax
push ebx
push esi
push edi
mov eax, dword [0x485f50]
xor eax, esp
push eax
lea eax, [esp + 0x10b4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x10c4]
test eax, eax
je 0x40e988
cmp byte [eax], 0
je 0x40e988
push 0x46ab50
push eax
or edi, 0xffffffff
xor esi, esi
call fcn.0043cbf8
mov ebx, eax
add esp, 8
mov dword [esp + 0x10], ebx
mov dword [esp + 0x10bc], 2
test ebx, ebx
je 0x40e981
push ebx
call fcn.004414c8
add esp, 4
test eax, eax
jne 0x40e976
nop
push ebx
push 0x1000
lea eax, [esp + 0xb8]
push 1
push eax
call fcn.004414ab
add esp, 0x10
test eax, eax
jle 0x40e969
push edi
push eax
lea ecx, [esp + 0xb8]
push ecx
call fcn.0040b6d0
mov edi, eax
inc esi
mov eax, 0x66666667
imul esi
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov eax, esi
add esp, 0xc
sub eax, edx
jne 0x40e969
push 1
call fcn.004143c0
add esp, 4
push ebx
call fcn.004414c8
add esp, 4
test eax, eax
je 0x40e910
push ebx
not edi
call fcn.0043cc86
add esp, 4
mov eax, edi
jmp 0x40ea3c
push 1
push 2
lea ecx, [esp + 0x38]
call fcn.00407d10
lea ecx, [esp + 0x30]
push 0x46ab98
push ecx
mov dword [esp + 0x10c4], 0
call fcn.004052a0
add esp, 8
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x34]
call fcn.004048a0
mov esi, 0x10
mov byte [esp + 0x10bc], 1
cmp dword [eax + 0x18], esi
jb 0x40e9d7
mov eax, dword [eax + 4]
jmp 0x40e9da
add eax, 4
push eax
push str.BaseLib::CRC32File
push 0x4e4
push str..common_function.cpp
push 0xf0000000
call fcn.00404cf0
mov ecx, eax
call fcn.004155d0
cmp dword [esp + 0x2c], esi
jb 0x40ea0e
mov eax, dword [esp + 0x18]
push eax
call fcn.0041f6a2
add esp, 4
lea ecx, [esp + 0x7c]
mov dword [esp + 0x10bc], 0xffffffff
call fcn.00405530
lea ecx, [esp + 0x7c]
push ecx
mov dword [esp + 0x80], vtable.std::ios_base.0
call fcn.004563aa
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x10b4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10a0]
xor ecx, esp
call fcn.0043c3a4
add esp, 0x10b0
ret
Function at 0x412e00
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
mov ebx, ecx
cmp dword [ebx + 0x1c], 0
push esi
push edi
jne 0x412e12
call fcn.00412880
mov eax, dword [ebx + 0x18]
mov ebp, dword [eax]
mov edi, dword [ebx + 4]
mov dword [esp + 0x10], 1
mov esi, dword [ebx + 0x18]
mov eax, dword [ebx + 4]
test edi, edi
je 0x412e30
cmp edi, eax
je 0x412e35
call fcn.0043c958
cmp ebp, esi
je 0x412ec5
test edi, edi
jne 0x412e60
call fcn.0043c958
xor eax, eax
cmp ebp, dword [eax + 0x14]
jne 0x412e52
call fcn.0043c958
mov esi, dword [ebp + 8]
cmp dword [esi + 0x1c], 0x10
jb 0x412e64
mov eax, dword [esi + 8]
jmp 0x412e67
mov eax, dword [edi]
jmp 0x412e48
lea eax, [esi + 8]
mov ecx, dword [esp + 0x18]
push ecx
push eax
call fcn.0044163e
add esp, 8
test eax, eax
jne 0x412ea4
mov edx, dword [esi]
push edx
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, 0xffffffff
je 0x412e9d
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x412e9d
mov dword [esp + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x412ec1
call fcn.0043c958
xor eax, eax
cmp ebp, dword [eax + 0x14]
jne 0x412eb9
call fcn.0043c958
mov ebp, dword [ebp]
jmp 0x412e22
mov eax, dword [edi]
jmp 0x412eaf
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x413170
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor eax, eax
test edx, edx
jle 0x413189
mov ecx, dword [esp + 4]
mov edi, edi
xor byte [eax + ecx], 2
inc eax
cmp eax, edx
jl 0x413180
ret

Function at 0x413220
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x465b28
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x485f50]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [esp + 0x24]
push 0x46ab50
push eax
call fcn.0043cbf8
mov esi, eax
add esp, 8
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], 0
test esi, esi
je 0x4132ee
push 2
push 0
push esi
call fcn.00441ad1
push esi
call fcn.004419d9
push 0
push 0
push esi
mov ebx, eax
call fcn.00441ad1
mov edi, dword [esp + 0x44]
mov ecx, dword [edi]
push ecx
call fcn.0041f6a2
add esp, 0x20
push ebx
mov ecx, edi
call fcn.004131a0
mov dword [edi], eax
test eax, eax
je 0x4132e5
mov edx, dword [edi + 4]
push edx
push 0
push eax
call fcn.0043cea0
mov edi, dword [edi]
add esp, 0xc
test edi, edi
je 0x4132e5
push esi
push 1
push ebx
push edi
call fcn.004414ab
push esi
call fcn.0043cc86
add esp, 0x14
mov eax, 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
push esi
call fcn.0043cc86
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x413520
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x465bcc
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x485f50]
xor eax, esp
push eax
lea eax, [esp + 0xbc]
mov dword fs:[0], eax
mov eax, dword [esp + 0xd0]
xor ebx, ebx
mov dword [esp + 0x14], ebx
cmp eax, ebx
je 0x413649
cmp byte [eax], bl
je 0x413649
push 0x46ab50
push eax
call fcn.0043cbf8
mov esi, eax
add esp, 8
mov dword [esp + 0x14], esi
mov dword [esp + 0xc4], 2
cmp esi, ebx
je 0x413622
push 2
push ebx
push esi
call fcn.00441ad1
push esi
call fcn.004419d9
push ebx
push ebx
push esi
mov ebp, eax
call fcn.00441ad1
add esp, 0x1c
lea eax, [ebp + 2]
push eax
lea ecx, [esp + 0x1c]
call fcn.004131a0
mov edi, eax
mov dword [esp + 0x18], edi
cmp edi, ebx
je 0x4135d3
mov ecx, dword [esp + 0x1c]
push ecx
push ebx
push edi
call fcn.0043cea0
add esp, 0xc
mov byte [esp + 0xc4], 3
cmp edi, ebx
je 0x413611
push esi
push 1
push ebp
push edi
call fcn.004414ab
mov ebx, dword [esp + 0xdc]
add esp, 0x10
push edi
mov ecx, ebx
call fcn.00408210
push edi
call fcn.0041f6a2
push esi
call fcn.0043cc86
add esp, 8
mov eax, ebx
jmp 0x41371d
push ebx
mov byte [esp + 0xc8], 2
call fcn.0041f6a2
add esp, 4
mov edi, dword [esp + 0xcc]
push 0x4772d0
mov ecx, edi
call fcn.00408210
cmp esi, ebx
je 0x413642
push esi
call fcn.0043cc86
add esp, 4
mov eax, edi
jmp 0x41371d
push 1
push 2
lea ecx, [esp + 0x44]
call fcn.00407d10
lea edx, [esp + 0x3c]
push 0x46b56c
push edx
mov dword [esp + 0xcc], ebx
call fcn.004052a0
add esp, 8
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x40]
call fcn.004048a0
mov esi, 0x10
mov byte [esp + 0xc4], 1
cmp dword [eax + 0x18], esi
jb 0x413694
mov eax, dword [eax + 4]
jmp 0x413697
add eax, 4
push eax
push str.BaseLib::ReadFileToString
push 0x46
push str..common_stdfile.cpp
push 0xf0000000
call fcn.00404cf0
mov ecx, eax
call fcn.004155d0
cmp dword [esp + 0x38], esi
jb 0x4136c8
mov ecx, dword [esp + 0x24]
push ecx
call fcn.0041f6a2
add esp, 4
lea ecx, [esp + 0x88]
mov dword [esp + 0xc4], 0xffffffff
call fcn.00405530
lea edx, [esp + 0x88]
push edx
mov dword [esp + 0x8c], vtable.std::ios_base.0
call fcn.004563aa
mov esi, dword [esp + 0xd0]
add esp, 4
push ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push 0x4772d0
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00408130
mov eax, esi
mov ecx, dword [esp + 0xbc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb4
ret

Function at 0x414230
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x41425e
push esi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call fcn.00441f07
mov dword [eax], esi
or eax, 0xffffffff
pop esi
ret
Function at 0x4142e0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
jne 0x41431d
push esi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call fcn.00441f07
mov dword [eax], esi
or eax, 0xffffffff
pop esi
ret

Function at 0x414320
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x414358
push esi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call fcn.00441f07
mov dword [eax], esi
or eax, 0xffffffff
pop esi
ret

Function at 0x414410
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, bind
test al, 1
je 0x414425
mov esi, 0x40000000
jmp 0x41442e
test al, 2
je 0x41442e
mov esi, 0xc0000000
mov ecx, eax
and ecx, 0x500
mov edx, 3
cmp ecx, 0x500
jne 0x41444a
mov edx, 1
jmp 0x41447b
mov ecx, eax
and ecx, 0x300
cmp ecx, 0x300
jne 0x414461
mov edx, 2
jmp 0x41447b
test eax, 0x100
je 0x41446f
mov edx, 4
jmp 0x41447b
test eax, 0x200
je 0x41447b
mov edx, 5
xor ecx, ecx
test al, 0x40
je 0x414486
mov ecx, 0x4000100
test eax, eax
jns 0x414490
or ecx, 0x80000000
test eax, 0x40000000
je 0x41449d
or ecx, 0x40000000
test eax, 0x20000000
je 0x4144aa
or ecx, 0x20000000
test eax, 0x10000000
je 0x4144b7
or ecx, 0x10000000
test eax, 0x8000000
je 0x4144c4
or ecx, 0x8000000
test eax, 0x4000000
je 0x4144d1
or ecx, 0x4000000
test eax, 0x2000000
je 0x4144de
or ecx, 0x2000000
test eax, 0x1000000
je 0x4144eb
or ecx, 0x1000000
mov eax, dword [esp + 0x10]
push 0
push ecx
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [esp + 0x20]
push edx
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
pop esi
ret