joyce8/EMBER2024-capa huggingface dataset:
Function at 0x963250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x977808
push 0x967288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x963329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x963329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.009661d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x963329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x963329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x96332c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00963351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x963d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x963d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x963d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x963d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x963d94
push eax
push esi
call fcn.0096620b
add esp, 8
pop esi
ret 0x10

Function at 0x963da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x963e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x963e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x97c320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00965dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x963dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x963e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x963ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x963eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x97c320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00965dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x963eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x963e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x964000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x964131
push esi
call fcn.00967145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00956080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x964131
push 0
push ebp
call fcn.009563a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00956260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x96408b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.009562f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x964121
push 0x97c918
push edi
call fcn.009653f0
push eax
push ebx
push esi
call fcn.00963f60
push 0x97c8f8
push edi
call fcn.009653f0
push eax
push ebx
push esi
call fcn.00963f60
push 0x97c8d8
push edi
call fcn.009653f0
push eax
push ebx
push esi
call fcn.00963f60
push 0x97c8c0
push edi
call fcn.009653f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00963f60
push 0x97c8a0
push edi
call fcn.009653f0
push eax
push ebx
push esi
call fcn.00963f60
push 0x97c888
push edi
call fcn.009653f0
push eax
push ebx
push esi
call fcn.00963f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x9651b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00965140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00965140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00965140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00965140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x965bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x965c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x97787c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x965c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x965c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x40157b
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x401fc0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax], 0
and dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
ret

Function at 0x403f44
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
push esi
sub eax, 0
push edi
je 0x403f61
dec eax
jne 0x4040c4
push 0xe
pop eax
push 8
jmp 0x403f66
push 0xa
pop eax
push 4
mov ecx, dword [ebp + 8]
pop ebx
test ebx, ebx
mov word [ecx], ax
mov word [ecx + 2], bx
lea esi, [ecx + 4]
jle 0x403fd0
lea eax, [ebx + 1]
mov dword [ebp + 0x10], esi
shr eax, 1
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
movzx edi, byte [eax + 2]
xor edx, edx
mov dh, byte [eax]
mov dl, byte [eax + 1]
add eax, 8
shl edx, 8
or edx, edi
movzx edi, byte [eax - 5]
shl edx, 8
or edx, edi
mov edi, dword [ebp + 0x10]
mov dword [edi], edx
xor edx, edx
mov dh, byte [eax - 4]
mov dl, byte [eax - 3]
movzx edi, byte [eax - 2]
shl edx, 8
or edx, edi
movzx edi, byte [eax - 1]
shl edx, 8
or edx, edi
mov edi, dword [ebp + 0x10]
add dword [ebp + 0x10], 8
dec dword [ebp + 8]
mov dword [edi + 4], edx
jne 0x403f86
movzx eax, word [ecx]
mov dword [ebp + 0xc], 0x4186b8
mov dword [ebp + 8], ebx
lea eax, [eax*4 + 4]
cmp ebx, eax
mov dword [ebp - 4], eax
jge 0x4040c4
mov edi, ebx
shl edi, 2
mov eax, dword [ebp + 8]
mov ecx, dword [edi + esi - 4]
cdq
idiv ebx
mov dword [ebp + 0x10], ecx
test edx, edx
jne 0x40404d
xor eax, eax
mov al, byte [ebp + 0x12]
mov dh, byte [eax + str.cw]
xor eax, eax
mov al, ch
mov dl, byte [eax + str.cw]
mov eax, ecx
and eax, 0xff
shl edx, 8
movzx eax, byte [eax + str.cw]
shr ecx, 0x18
or edx, eax
movzx eax, byte [ecx + str.cw]
shl edx, 8
or edx, eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
shl eax, 0x18
xor edx, eax
inc dword [ebp + 0xc]
mov dword [ebp + 0x10], edx
cmp ebx, 8
jne 0x4040a0
mov eax, dword [ebp + 8]
push ebx
cdq
pop ecx
idiv ecx
cmp edx, 4
jne 0x4040a0
xor eax, eax
xor ecx, ecx
mov al, byte [ebp + 0x12]
mov cl, byte [eax + str.cw]
mov eax, dword [ebp + 0x10]
shr eax, 0x18
mov ch, byte [eax + str.cw]
xor eax, eax
mov al, byte [ebp + 0x11]
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
mov eax, dword [ebp + 0x10]
and eax, 0xff
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
mov dword [ebp + 0x10], ecx
mov ecx, ebx
mov eax, edi
shl ecx, 2
sub eax, ecx
mov eax, dword [eax + esi]
xor eax, dword [ebp + 0x10]
inc dword [ebp + 8]
mov dword [edi + esi], eax
mov eax, dword [ebp + 8]
add edi, 4
cmp eax, dword [ebp - 4]
jl 0x403ff4
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4040c9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
lea ecx, [eax + 0x14]
movzx eax, word [eax]
shl eax, 2
cmp eax, 4
mov dword [ebp + 8], ecx
jle 0x404190
push ebx
push esi
add eax, 0xfffffffc
push edi
mov dword [ebp - 8], eax
mov ebx, 0x1b1b1b1b
mov edi, 0xfefefefe
mov eax, dword [ebp + 8]
mov esi, 0x80808080
mov ecx, dword [eax]
mov eax, ecx
add ecx, ecx
and eax, esi
and ecx, edi
mov edx, eax
shr edx, 7
sub eax, edx
and eax, ebx
xor eax, ecx
mov ecx, eax
and ecx, esi
mov edx, ecx
shr edx, 7
sub ecx, edx
lea edx, [eax + eax]
and ecx, ebx
and edx, edi
xor ecx, edx
mov edx, ecx
and edx, esi
mov esi, edx
shr esi, 7
sub edx, esi
lea esi, [ecx + ecx]
and edx, ebx
and esi, edi
xor edx, esi
mov esi, edx
mov edx, dword [ebp + 8]
mov dword [ebp - 4], esi
xor esi, dword [edx]
mov edx, dword [ebp - 4]
xor edx, ecx
xor edx, eax
xor eax, esi
mov dword [ebp - 4], edx
mov edx, esi
xor ecx, esi
shl edx, 0x18
shr esi, 8
or edx, esi
mov esi, ecx
shr esi, 0x10
shl ecx, 0x10
or esi, ecx
mov ecx, eax
shr ecx, 0x18
shl eax, 8
xor edx, esi
or ecx, eax
mov eax, dword [ebp + 8]
add dword [ebp + 8], 4
xor edx, ecx
xor edx, dword [ebp - 4]
dec dword [ebp - 8]
mov dword [eax], edx
jne 0x4040f9
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4041f1
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
movzx ecx, word [eax]
push edi
mov edi, dword [ebp + 0x10]
add eax, 4
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], eax
mov esi, edi
sub ebx, edi
mov dword [ebp + 8], 4
push dword [ebx + esi]
call dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
xor eax, dword [ecx]
mov dword [esi], eax
add esi, 4
dec dword [ebp + 8]
jne 0x40421a
and dword [ebp - 8], 0
cmp dword [ebp - 0x10], 0
jle 0x40435d
push 0xfffffffffffffffe
lea ecx, [ebp - 0x2c]
pop eax
mov dword [ebp - 0xc], ecx
push 3
lea edx, [eax - 2]
pop ecx
xor ebx, ebx
and edx, ecx
mov edx, dword [edi + edx*4]
shr edx, 0x18
movzx esi, byte [edx + str.cw]
lea edx, [eax - 1]
and edx, ecx
mov bl, byte [edi + edx*4 + 2]
movzx edx, byte [ebx + str.cw]
mov dword [ebp + 8], edx
mov edx, eax
and edx, ecx
xor ebx, ebx
inc eax
mov bl, byte [edi + edx*4 + 1]
mov dword [ebp - 0x1c], eax
and eax, ecx
movzx edx, byte [ebx + str.cw]
mov eax, dword [edi + eax*4]
mov dword [ebp + 0x10], edx
and eax, 0xff
movzx ebx, byte [eax + str.cw]
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0xc], ebx
dec eax
cmp dword [ebp - 8], eax
jge 0x404306
mov eax, dword [ebp + 8]
xor ebx, edx
mov dword [ebp - 0x14], ebx
xor ebx, dword [ebp + 8]
xor eax, esi
mov dword [ebp - 0x18], esi
push eax
xor ebx, esi
call fcn.00404375
movzx eax, al
xor eax, ebx
xor esi, eax
mov eax, dword [ebp + 0x10]
xor eax, dword [ebp + 8]
push eax
call fcn.00404375
push dword [ebp - 0x14]
movzx eax, al
xor eax, ebx
xor dword [ebp + 8], eax
call fcn.00404375
movzx eax, al
xor eax, ebx
xor dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x18]
xor eax, dword [ebp + 0xc]
push eax
call fcn.00404375
movzx eax, al
xor eax, ebx
add esp, 0x10
xor dword [ebp + 0xc], eax
shl esi, 8
or esi, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
add dword [ebp - 0xc], 4
shl esi, 8
or esi, dword [ebp + 0x10]
shl esi, 8
or esi, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp - 0x1c]
lea ecx, [eax + 2]
cmp ecx, 4
jb 0x40424d
lea ecx, [ebp - 0x2c]
push 4
mov eax, edi
sub ecx, edi
pop edx
mov ebx, dword [ebp - 4]
mov esi, dword [ecx + eax]
add dword [ebp - 4], 4
xor esi, dword [ebx]
mov dword [eax], esi
add eax, 4
dec edx
jne 0x40433a
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jl 0x404244
push 4
pop esi
push dword [edi]
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [edi], eax
add edi, 4
dec esi
jne 0x404360
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4058a8
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4058d6
push 0x20
push 0x418494
push esi
call sub.MSVCRT.dll_memcpy
push 0x40
lea eax, [esi + 0x28]
push 0
push eax
call sub.MSVCRT.dll_memset
and dword [esi + 0x20], 0
add esp, 0x18
and dword [esi + 0x24], 0
pop esi
ret
Function at 0x40654e
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll_calloc]
lea eax, [ebx + 2]
push 4
push eax
call edi
mov esi, eax
lea eax, [ebx + 2]
push 4
push eax
call edi
mov edi, eax
push 0x40
lea eax, [ebp - 0x40]
push 0
push eax
call sub.MSVCRT.dll_memset
push dword [ebp + 0x10]
lea eax, [ebp - 0x40]
push dword [ebp + 0xc]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0x28
xor eax, eax
xor byte [ebp + eax - 0x40], 0x36
inc eax
cmp eax, 0x40
jb 0x406595
lea eax, [ebp - 0x40]
lea ecx, [esi + 4]
mov dword [esi], eax
mov eax, ebx
shl eax, 2
push eax
mov dword [edi], 0x40
push dword [ebp + 0x18]
push ecx
call sub.MSVCRT.dll_memcpy
mov eax, ebx
lea ecx, [edi + 4]
shl eax, 2
push eax
push dword [ebp + 0x1c]
push ecx
call sub.MSVCRT.dll_memcpy
push dword [ebp + 0x20]
inc ebx
push edi
push esi
push ebx
call dword [ebp + 8]
push 0x40
lea eax, [ebp - 0x40]
pop ebx
push ebx
push 0
push eax
call sub.MSVCRT.dll_memset
push dword [ebp + 0x10]
lea eax, [ebp - 0x40]
push dword [ebp + 0xc]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0x40
xor eax, eax
xor byte [ebp + eax - 0x40], 0x5c
inc eax
cmp eax, ebx
jb 0x4065fc
mov ecx, dword [ebp + 0x24]
lea eax, [ebp - 0x40]
mov dword [esi], eax
mov eax, dword [ebp + 0x20]
push eax
push edi
mov dword [edi], ebx
push esi
mov dword [esi + 4], eax
push 2
mov dword [edi + 4], ecx
call dword [ebp + 8]
push edi
mov edi, dword [sym.imp.MSVCRT.dll_free]
call edi
push esi
call edi
add esp, 0x18
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40670a
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
movzx eax, byte [esi + 2]
push eax
lea eax, [ebp - 0x20]
push dword [ebp + 0x18]
push eax
call sub.MSVCRT.dll_memcpy
movzx eax, byte [esi]
add esp, 0xc
sub dword [ebp + 0x14], eax
js 0x406793
push eax
lea eax, [ebp - 0x10]
push dword [ebp + 0x10]
push eax
call sub.MSVCRT.dll_memcpy
movzx eax, byte [esi]
add dword [ebp + 0x10], eax
add esp, 0xc
xor ecx, ecx
mov edx, dword [ebp + ecx - 0x20]
xor dword [ebp + ecx - 0x10], edx
add ecx, 4
cmp ecx, 0x10
jl 0x406748
lea ecx, [ebp - 0x10]
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
call dword [esi + 0x10]
movzx eax, byte [esi]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call sub.MSVCRT.dll_memcpy
movzx eax, byte [esi]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x1c]
call sub.MSVCRT.dll_memcpy
movzx eax, byte [esi]
add esp, 0x28
add dword [ebp + 0x1c], eax
jmp 0x40672b
pop esi
leave
ret
Function at 0x4081b3
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
movzx eax, byte [esi + 2]
push eax
lea eax, [ebp - 0x20]
push dword [ebp + 0x18]
push eax
call sub.MSVCRT.dll_memcpy
movzx eax, byte [esi]
add esp, 0xc
sub dword [ebp + 0x14], eax
js 0x40823b
push eax
lea eax, [ebp - 0x10]
push dword [ebp + 0x10]
push eax
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x10]
push eax
movzx eax, byte [esi]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
call dword [esi + 0x14]
add esp, 0x1c
xor eax, eax
mov ecx, dword [ebp + eax - 0x20]
xor dword [ebp + eax - 0x10], ecx
add eax, 4
cmp eax, 0x10
jl 0x4081fd
movzx eax, byte [esi]
push eax
lea eax, [ebp - 0x20]
push dword [ebp + 0x10]
push eax
call sub.MSVCRT.dll_memcpy
movzx eax, byte [esi]
add dword [ebp + 0x10], eax
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x1c]
call sub.MSVCRT.dll_memcpy
movzx eax, byte [esi]
add esp, 0x18
add dword [ebp + 0x1c], eax
jmp 0x4081d4
pop esi
leave
ret

Function at 0x40921d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x40923b
push 0xa0
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4092b9
push 0x360
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
jne 0x409251
push 8
jmp 0x409233
lea eax, [ebp - 0x208]
push 0x104
push eax
push dword [ebp + 8]
call fcn.0040bb02
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4092af
test al, 0x10
je 0x4092af
lea eax, [ebp - 0x208]
push 0x41a9fc
push eax
call dword [sym.imp.MSVCRT.dll_wcscat]
pop ecx
lea eax, [esi + 8]
pop ecx
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
and byte [esi + 0x25c], 0
mov dword [esi + 4], eax
jmp 0x4092b9
push esi
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
xor esi, esi
mov eax, esi
pop esi
leave
ret

Function at 0x4093cc
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x10], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x40b6bb
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret
Function at 0x40c197
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
push 0x20
push edi
push esi
call sub.MSVCRT.dll_memset
mov eax, dword [ebp + 0xc]
or dword [esi + 0xc], 0xffffffff
or dword [esi + 8], 0xffffffff
add esp, 0xc
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x190]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp dword [0x41e0c8], edi
jne 0x40c1e6
call fcn.0040e5e0
inc dword [0x41e0c8]
mov eax, dword [ebp + 0x14]
push ebx
cmp eax, edi
jne 0x40c1fa
mov eax, dword [0x41a17c]
mov ebx, 0x41a174
jmp 0x40c1fd
mov ebx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
cmp ecx, edi
je 0x40c206
mov dword [ebx], ecx
mov dword [esi + 0x14], eax
shl eax, 2
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov dword [esi + 0x18], eax
cmp dword [0x41a17c], 0
pop ecx
jle 0x40c247
push esi
push dword [ebx + edi*4]
call fcn.0040d450
mov ecx, dword [esi + 0x18]
mov dword [ecx + edi*4], eax
mov eax, dword [esi + 0x18]
mov eax, dword [eax + edi*4]
push eax
mov ecx, dword [eax + 8]
call dword [ecx]
add esp, 0xc
inc edi
cmp edi, dword [0x41a17c]
jl 0x40c220
cmp dword [ebp + 0x1c], 0
pop ebx
je 0x40c25b
push dword [ebp + 0x1c]
call dword [sym.imp.MSVCRT.dll__strdup]
pop ecx
mov dword [esi + 0x1c], eax
mov edi, str..._.._mongoose_mongoose.c
push edi
push str..._.._mongoose_mongoose.c:2331
push 4
call fcn.00408f0f
add esp, 0xc
test eax, eax
je 0x40c27f
push str.
call fcn.00408faa
pop ecx
push edi
push str..._.._mongoose_mongoose.c:2332
push 4
call fcn.00408f0f
add esp, 0xc
test eax, eax
je 0x40c2a0
push esi
push str.init_mgr_p
call fcn.00408faa
pop ecx
pop ecx
pop edi
pop esi
leave
ret

Function at 0x40d6c2
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
push dword [ebp + 0x10]
mov dword [ebp - 4], 0x10
mov dword [ebp - 8], 1
movzx eax, word [edi]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x40d74d
lea eax, [ebp - 8]
push 4
push eax
push 4
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x40d743
push dword [ebp - 4]
push edi
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x40d743
cmp dword [ebp + 0xc], 2
je 0x40d72e
push bind
push esi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
jne 0x40d743
push esi
call fcn.0040d4c1
pop ecx
lea eax, [ebp - 4]
push eax
push edi
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
jmp 0x40d74d
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or esi, 0xffffffff
mov eax, esi
pop edi
pop esi
leave
ret