joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405ee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
jne 0x405f2c
sub esp, 0x10
lea eax, [ebp - 0x18]
xorps xmm0, xmm0
mov dword [ebp - 0x20], eax
mov eax, esp
movq qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x28], xmm0
movups xmm0, xmmword [ebp - 0x28]
push str.got_NULL_c
push str.pvpgn::d2cs::d2gs_calc_checksum
push 0x10
movups xmmword [eax], xmm0
call fcn.00415770
add esp, 0x1c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.00402d10
mov dword [ebp - 8], eax
call fcn.0040f8a0
push esi
mov dword [ebp + 8], eax
call fcn.00402cc0
movzx eax, ax
push esi
mov dword [ebp - 4], eax
call fcn.00402bd0
add esp, 0xc
mov dword [ebp - 0x14], eax
call fcn.0040fa00
mov esi, eax
mov dword [ebp - 0x10], esi
call fcn.0040f8c0
mov edi, esi
mov dword [ebp - 0xc], eax
lea edx, [edi + 1]
nop dword [eax]
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x405f70
mov ebx, 0
sub edi, edx
je 0x405fc6
movzx edx, byte [ebx + esi]
mov eax, dword [ebp - 4]
mov ecx, edx
neg ecx
mov esi, eax
and ecx, 0x1f
and edx, 0x1f
shr esi, cl
mov ecx, edx
shl eax, cl
mov ecx, ebx
neg ecx
or esi, eax
mov eax, dword [ebp - 8]
and ecx, 0x1f
mov edx, eax
shr edx, cl
mov ecx, ebx
and ecx, 0x1f
inc ebx
shl eax, cl
mov ecx, dword [ebp + 8]
or edx, eax
xor esi, edx
xor ecx, esi
mov esi, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
cmp ebx, edi
jb 0x405f80
jmp 0x405fc9
mov ecx, dword [ebp + 8]
mov esi, dword [ebp - 0xc]
mov edi, esi
lea edx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x405fd1
mov ebx, 0
sub edi, edx
je 0x406025
movzx edx, byte [ebx + esi]
mov eax, dword [ebp - 4]
mov ecx, edx
neg ecx
mov esi, eax
and ecx, 0x1f
and edx, 0x1f
shr esi, cl
mov ecx, edx
shl eax, cl
mov ecx, ebx
neg ecx
or esi, eax
mov eax, dword [ebp - 8]
and ecx, 0x1f
mov edx, eax
shr edx, cl
mov ecx, ebx
and ecx, 0x1f
inc ebx
shl eax, cl
mov ecx, dword [ebp + 8]
or edx, eax
xor esi, edx
xor ecx, esi
mov esi, dword [ebp - 0xc]
mov dword [ebp + 8], ecx
cmp ebx, edi
jb 0x405fe1
mov eax, dword [ebp - 0x14]
pop edi
pop esi
xor eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407590
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x460988]
test eax, eax
je 0x407605
mov edx, dword [0x460984]
push edi
xor edi, edi
test edx, edx
je 0x4075e7
push esi
xor esi, esi
nop dword [eax]
mov ecx, dword [esi + eax + 0xc]
test ecx, ecx
je 0x4075de
push 0xcf
push str.C:_builder_source_srcd2csd2ladder.cpp
push ecx
call fcn.00418690
mov eax, dword [0x460988]
add esp, 0xc
mov dword [esi + eax + 0xc], 0
mov edx, dword [0x460984]
inc edi
add esi, 0x10
cmp edi, edx
jb 0x4075b0
pop esi
push 0xd3
push str.C:_builder_source_srcd2csd2ladder.cpp
push eax
call fcn.00418690
add esp, 0xc
mov dword [0x460988], 0
pop edi
mov dword [0x460984], 0
jmp fcn.00407140

Function at 0x40e4d0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
movsx eax, byte [esi]
push eax
call fcn.0042ad71
add esp, 4
push esi
test eax, eax
je 0x40e4f1
call dword [sym.imp.WS2_32.dll_inet_addr]
pop esi
pop ebp
ret
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x40e509
mov eax, dword [eax + 0xc]
test eax, eax
je 0x40e509
mov eax, dword [eax]
pop esi
mov eax, dword [eax]
pop ebp
ret
or eax, 0xffffffff
pop esi
pop ebp
ret
Function at 0x40e510
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x45f91c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push dword [ebp + 0x10]
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
test esi, esi
jns 0x40e579
sub esp, 0x10
lea eax, [ebp - 0x1c]
xorps xmm0, xmm0
mov dword [ebp - 0x24], eax
mov eax, esp
movq qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0x2c], xmm0
movups xmm0, xmmword [ebp - 0x2c]
push str.error_create_listen_socket
push str.pvpgn::d2cs::net_listen
push 0x10
movups xmmword [eax], xmm0
call fcn.00415770
add esp, 0x1c
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217ea
mov esp, ebp
pop ebp
ret
push 4
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 1
push eax
push 4
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x40e5cb
sub esp, 0x10
lea eax, [ebp - 0x1c]
xorps xmm0, xmm0
mov dword [ebp - 0x24], eax
mov eax, esp
movq qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0x2c], xmm0
movups xmm0, xmmword [ebp - 0x2c]
push str.error_set_socket_option_SO_REUSEADDR
push str.pvpgn::d2cs::net_listen
push 0x10
movups xmmword [eax], xmm0
call fcn.00415770
add esp, 0x1c
push dword [ebp + 0xc]
xorps xmm0, xmm0
mov eax, 2
movups xmmword [ebp - 0x14], xmm0
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
push dword [ebp + 8]
mov word [ebp - 0x12], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jns 0x40e651
sub esp, 0x10
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, esp
push str.error_bind_listen_socket
xorps xmm0, xmm0
movq qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0x2c], xmm0
movups xmm0, xmmword [ebp - 0x2c]
push str.pvpgn::d2cs::net_listen
push 0x10
movups xmmword [eax], xmm0
call fcn.00415770
add esp, 0x1c
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217ea
mov esp, ebp
pop ebp
ret
push 0xa
push esi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
jns 0x40e670
sub esp, 0x10
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, esp
push str.error_listen_socket
jmp 0x40e615
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004217ea
mov esp, ebp
pop ebp
ret
Function at 0x40e690
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push 0
push dword [ebp + 8]
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
test esi, esi
jns 0x40e6fb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.0041f720
mov dword [ebp - 8], eax
sub esp, 0xc
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, esp
push str.error_creating_socket__psock_socket:__
mov dword [ebp - 0x18], 0xa
mov dword [ebp - 0x14], 0
movups xmm0, xmmword [ebp - 0x18]
push str.pvpgn::d2cs::net_socket
push 0x10
movups xmmword [eax], xmm0
call fcn.00415770
add esp, 0x1c
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
push 4
lea eax, [ebp + 8]
mov dword [ebp + 8], 1
push eax
push 8
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x40e763
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.0041f720
mov dword [ebp - 8], eax
sub esp, 0xc
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, esp
push str.error_set_socket_option_KEEPALIVE__psock_setsockopt:__
mov dword [ebp - 0x18], 0xa
mov dword [ebp - 0x14], 0
movups xmm0, xmmword [ebp - 0x18]
push str.pvpgn::d2cs::net_socket
push 0x10
movups xmmword [eax], xmm0
call fcn.00415770
add esp, 0x1c
push 0x8004667e
push esi
call fcn.0041fa10
add esp, 8
test eax, eax
jns 0x40e7cd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.0041f720
mov dword [ebp - 8], eax
sub esp, 0xc
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, esp
push str.error_set_socket_mode_to_non_block__psock_ctl:__
mov dword [ebp - 0x18], 0xa
mov dword [ebp - 0x14], 0
movups xmm0, xmmword [ebp - 0x18]
push str.pvpgn::d2cs::net_socket
push 0x10
movups xmmword [eax], xmm0
call fcn.00415770
add esp, 0x1c
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41bbe0
Capabilities:
Convert ip address from string
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x45f91c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x18], esi
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
jne 0x41bc46
sub esp, 0x10
movq qword [ebp - 0x1c], xmm0
lea eax, [ebp - 0x1c]
movlpd qword [ebp - 0x14], xmm0
mov dword [ebp - 0xc], eax
mov eax, esp
movups xmm0, xmmword [ebp - 0x14]
push str.got_NULL_hoststr
push str.pvpgn::host_lookup
push 0x10
movups xmmword [eax], xmm0
call fcn.00415770
add esp, 0x1c
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217ea
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x41bc8d
sub esp, 0x10
movq qword [ebp - 0x1c], xmm0
lea eax, [ebp - 0x1c]
movlpd qword [ebp - 0x14], xmm0
mov dword [ebp - 0xc], eax
mov eax, esp
movups xmm0, xmmword [ebp - 0x14]
push str.got_NULL_ipaddr
push str.pvpgn::host_lookup
push 0x10
movups xmmword [eax], xmm0
call fcn.00415770
add esp, 0x1c
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217ea
mov esp, ebp
pop ebp
ret
mov eax, 2
movups xmmword [ebp - 0x14], xmm0
push 0
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
call fcn.0041fa30
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x41bce9
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x41bce9
mov eax, dword [eax]
mov eax, dword [eax]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [edi], eax
mov eax, dword [ebx]
test eax, eax
cmovne esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217ea
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10]
push eax
push esi
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x41bd19
push dword [ebp - 0x10]
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [edi], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217ea
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
push eax
push str.could_not_lookup_host___
push str.pvpgn::host_lookup
push 0x10
call fcn.00401760
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.004217ea
mov esp, ebp
pop ebp
ret
Function at 0x41c230
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x41c2b8
jne 0x41c252
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2714
je 0x41c2b5
call esi
cmp eax, 0x2afa
je 0x41c2b5
call esi
cmp eax, 0x2733
je 0x41c2b5
call esi
cmp eax, 0x2749
je 0x41c2ad
call esi
cmp eax, 0x2746
je 0x41c2ad
call esi
push eax
call fcn.0042ca0c
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push str.___receive_error__closing_connection___psock_recv:__
push str.pvpgn::net_recv
push 2
call fcn.0041c1d0
add esp, 0x18
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41c470
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
jne 0x41c4ca
mov eax, dword [ebp + 8]
sub esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, esp
push str.___got_NULL_packet__closing_connection_
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x14], 0
movups xmm0, xmmword [ebp - 0x18]
push str.pvpgn::net_send_packet
push 0x10
movups xmmword [eax], xmm0
call fcn.00415770
add esp, 0x1c
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 0x10]
test edi, edi
jne 0x41c4ef
mov eax, dword [ebp + 8]
sub esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, esp
push str.___got_NULL_currsize__closing_connection_
jmp 0x41c49c
push ebx
call fcn.00419bc0
mov ecx, eax
add esp, 4
mov dword [ebp + 0xc], ecx
cmp ecx, 1
jae 0x41c52c
lea eax, [ebp + 8]
push eax
push str.___packet_to_send_is_empty__skipping_it_
push str.pvpgn::net_send_packet
push 0x10
call fcn.00409a00
add esp, 0x10
mov dword [edi], 0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi]
mov esi, ecx
push eax
push ebx
sub esi, eax
call fcn.00419b10
mov ecx, dword [ebp + 8]
add esp, 8
mov dword [ebp - 4], ecx
push 0
push esi
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x41c5bf
je 0x41c4c0
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2714
je 0x41c5cc
call esi
cmp eax, 0x2afa
je 0x41c5cc
call esi
cmp eax, 0x2733
je 0x41c5cc
call esi
cmp eax, 0x2747
je 0x41c5cc
call esi
cmp eax, 0x2746
je 0x41c4c0
call esi
push eax
call fcn.0042ca0c
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 4]
push eax
push str.___could_not_send_data__closing_connection___psock_send:__
push str.pvpgn::net_send
push 2
call fcn.0041c1d0
add esp, 0x18
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add dword [edi], eax
mov eax, dword [ebp + 0xc]
cmp eax, dword [edi]
je 0x41c51a
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41e0c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446566
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x45f91c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x214]
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x204]
mov dword [ebp - 0x21c], 0x44be6c
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x208], 0x1f4
mov dword [ebp - method.fmt::internal::MemoryBuffer_char__500__class_std::allocator_char__.virtual_0], vtable.fmt::internal::MemoryBuffer_char__500__class_std::allocator_char__.0
movups xmm0, xmmword [ebp + 0x10]
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x234], 0
movups xmmword [ebp - 0x244], xmm0
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
push dword [ebp + 0xc]
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.004164e0
lea ecx, [ebp - 0x228]
call fcn.00414510
mov eax, dword [ebp - 0x218]
push esi
push dword [eax + 8]
push 1
push dword [eax + 4]
call fcn.0042c7f8
mov eax, dword [ebp - 0x210]
lea ecx, [ebp - 0x204]
add esp, 0x10
mov dword [ebp - method.fmt::internal::MemoryBuffer_char__500__class_std::allocator_char__.virtual_0], vtable.fmt::internal::MemoryBuffer_char__500__class_std::allocator_char__.0
cmp eax, ecx
je 0x41e1f1
cmp dword [ebp - 0x208], 0x1000
jb 0x41e1e8
test al, 0x1f
jne 0x41e20b
mov ecx, dword [eax - 4]
cmp ecx, eax
jae 0x41e20b
sub eax, ecx
cmp eax, 4
jb 0x41e20b
cmp eax, 0x23
ja 0x41e20b
mov eax, ecx
push eax
call fcn.00421880
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004217ea
mov esp, ebp
pop ebp
ret
call fcn.0042cd3a
int3
Function at 0x41e220
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446566
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x45f91c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 1
call fcn.004270c8
mov esi, eax
mov dword [ebp - 0x21c], 0x44be6c
lea eax, [ebp - 0x214]
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x218], eax
add esp, 4
lea eax, [ebp - 0x204]
mov dword [ebp - 0x208], 0x1f4
mov dword [ebp - 0x210], eax
mov dword [ebp - method.fmt::internal::MemoryBuffer_char__500__class_std::allocator_char__.virtual_0], vtable.fmt::internal::MemoryBuffer_char__500__class_std::allocator_char__.0
movups xmm0, xmmword [ebp + 0xc]
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x234], 0
movups xmmword [ebp - 0x244], xmm0
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
push dword [ebp + 8]
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.004164e0
lea ecx, [ebp - 0x228]
call fcn.00414510
mov eax, dword [ebp - 0x218]
push esi
push dword [eax + 8]
push 1
push dword [eax + 4]
call fcn.0042c7f8
mov eax, dword [ebp - 0x210]
lea ecx, [ebp - 0x204]
add esp, 0x10
mov dword [ebp - method.fmt::internal::MemoryBuffer_char__500__class_std::allocator_char__.virtual_0], vtable.fmt::internal::MemoryBuffer_char__500__class_std::allocator_char__.0
cmp eax, ecx
je 0x41e35a
cmp dword [ebp - 0x208], 0x1000
jb 0x41e351
test al, 0x1f
jne 0x41e374
mov ecx, dword [eax - 4]
cmp ecx, eax
jae 0x41e374
sub eax, ecx
cmp eax, 4
jb 0x41e374
cmp eax, 0x23
ja 0x41e374
mov eax, ecx
push eax
call fcn.00421880
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004217ea
mov esp, ebp
pop ebp
ret
call fcn.0042cd3a
int3

Function at 0x41efe0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, 0x10624dd3
imul esi
push edi
sar edx, 6
mov edi, ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [0x460e4c], eax
imul eax, eax, 0x3e8
push 0x8004
sub esi, eax
mov dword [0x460e50], esi
push dword [edi + 0x18]
push dword [edi + 0x10]
call fcn.00423690
push 0x8004
push dword [edi + 0x1c]
push dword [edi + 0x14]
call fcn.00423690
mov eax, dword [edi + 0xc]
add esp, 0x18
inc eax
push 0x460e4c
push 0
push dword [edi + 0x14]
push dword [edi + 0x10]
push eax
call dword [sym.imp.WS2_32.dll_select]
mov dword [edi + 8], eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x420440
Capabilities:
Delete service
Query service status

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446778
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x45f91c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x420523
mov ecx, str.d2cs
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4204a0
sub ecx, edx
push ecx
push str.d2cs
lea ecx, [ebp - 0x28]
call fcn.0040c330
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x5d]
call fcn.0041fc70
cmp dword [eax + 0x14], 8
jb 0x4204d6
mov eax, dword [eax]
push 0x10004
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
lea ecx, [ebp - 0x40]
mov esi, eax
call fcn.0041fc00
lea ecx, [ebp - 0x28]
call fcn.00414fb0
test esi, esi
je 0x42051c
lea eax, [ebp - 0x5c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x420515
cmp dword [ebp - 0x58], 1
jne 0x420515
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004217ea
mov esp, ebp
pop ebp
ret

Function at 0x421b66
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x45ccb0
call fcn.004228c0
push 1
call fcn.00422038
pop ecx
test al, al
jne 0x421a17
push 7
call fcn.004226f5
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00422003
mov byte [ebp - 0x24], al
mov eax, dword [0x461148]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x421a10
test eax, eax
jne 0x421a81
mov dword [0x461148], ecx
push 0x447270
push 0x44724c
call fcn.00432a28
pop ecx
pop ecx
test eax, eax
je 0x421a64
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x421b60
push 0x447248
push 0x447224
call fcn.004329cc
pop ecx
pop ecx
mov dword [0x461148], 2
jmp 0x421a86
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.004221a5
pop ecx
call fcn.004226e9
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x421ab6
push esi
call fcn.0042211b
pop ecx
test al, al
je 0x421ab6
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.0042247e
call esi
call fcn.004226ef
mov esi, eax
cmp dword [esi], edi
je 0x421ad4
push esi
call fcn.0042211b
pop ecx
test al, al
je 0x421ad4
push dword [esi]
call fcn.00432d38
pop ecx
call fcn.00432ee2
mov edi, dword [eax]
call fcn.00432edc
mov esi, eax
call fcn.004329b3
push eax
push edi
push dword [esi]
call main
add esp, 0xc
mov esi, eax
call fcn.00432c47
test al, al
jne 0x421b04
push esi
call fcn.00432d70
test bl, bl
jne 0x421b0d
call fcn.00432d13
push 0
push 1
call fcn.004221c2
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x421b60
call fcn.00422906
ret
call fcn.00422630
jmp 0x4219f8
Function at 0x425b4c
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x451964
push 0x45195c
push str.FlsAlloc
push 0
call fcn.00425acc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x425b7e
push dword [ebp + 8]
mov ecx, esi
call fcn.0042247e
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x425bc0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x451974
push 0x45196c
push str.FlsGetValue
push 2
call fcn.00425acc
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x425bf1
mov ecx, esi
call fcn.0042247e
call esi
jmp 0x425bf7
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x425bfa
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x45197c
push 0x451974
push str.FlsSetValue
push 3
call fcn.00425acc
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x425c2e
mov ecx, esi
call fcn.0042247e
call esi
jmp 0x425c34
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret

Function at 0x43780c
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043778f

Function at 0x438e80
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00438cfd

Function at 0x440821
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004404c3
Function at 0x10002ba8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edx, ecx
mov edi, dword [ebp + 8]
mov ecx, dword [ecx + 4]
xor eax, eax
sub ecx, edi
jb 0x10002cae
mov ebx, dword [edx]
cmp ebx, ecx
ja 0x10002cae
mov esi, ebx
shr esi, 3
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x18], eax
cmp eax, esi
jbe 0x10002cbb
mov ecx, ebx
and ecx, 7
mov eax, dword [edx + 8]
mov dword [ebp - 0x1c], eax
movzx eax, byte [eax + esi]
cmp edi, 1
jne 0x10002c0c
xor cl, 7
movzx ecx, cl
mov esi, eax
xor eax, eax
bt esi, ecx
setb al
xor edi, edi
inc edi
jmp 0x10002caa
test ecx, ecx
je 0x10002c3f
mov dword [ebp - 0x10], eax
mov eax, 8
sub eax, ecx
mov dword [ebp - 0x20], eax
sub eax, edi
mov dword [ebp - 0x14], eax
jae 0x10002c9b
xor edi, edi
dec edi
mov eax, dword [ebp - 0x20]
mov ecx, eax
shl edi, cl
mov ecx, dword [ebp + 8]
sub ecx, eax
not edi
mov eax, dword [ebp - 0x10]
and eax, edi
shl eax, cl
inc esi
jmp 0x10002c43
xor eax, eax
mov ecx, edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], edx
cmp ecx, 8
jb 0x10002c76
xor ebx, ebx
mov edi, dword [ebp - 0x18]
sub edi, esi
cmovb edi, ebx
lea ebx, [ecx - 8]
shr ebx, 3
cmp edi, ebx
jbe 0x10002cb8
add ecx, 0xfffffff8
mov edx, dword [ebp - 0x1c]
movzx edx, byte [edx + esi]
shl edx, cl
or eax, edx
inc esi
cmp ecx, 7
ja 0x10002c5e
test ecx, ecx
mov edi, dword [ebp + 8]
je 0x10002c93
cmp dword [ebp - 0x18], esi
jbe 0x10002cbe
mov edx, dword [ebp - 0x1c]
movzx edx, byte [edx + esi]
mov bl, 8
sub bl, cl
mov ecx, ebx
shr edx, cl
or eax, edx
mov edx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
jmp 0x10002caa
mov eax, 0xff
shr eax, cl
and eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
shr eax, cl
add ebx, edi
mov dword [edx], ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
int3
int3
int3