joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441710
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, ecx
test eax, eax
jg 0x441731
jl 0x441727
test esi, esi
jne 0x441731
pop edi
xor eax, eax
xor edx, edx
pop esi
pop ecx
ret 0xc
cmp dword [edi + 0x38], 0
push ebx
push ebp
mov ebx, esi
je 0x4417e4
mov ebp, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
nop dword [eax]
mov ecx, edi
call fcn.0041b010
mov esi, eax
mov eax, edx
mov dword [esp + 0x10], eax
test eax, eax
jl 0x4417a1
jg 0x441769
test esi, esi
je 0x4417a1
cmp ebp, eax
jg 0x441779
jl 0x441773
cmp ebx, esi
jae 0x441779
mov esi, ebx
mov dword [esp + 0x10], ebp
mov eax, dword [edi + 0x1c]
push esi
push dword [eax]
push dword [esp + 0x20]
call fcn.00457db0
mov eax, dword [edi + 0x2c]
add esp, 0xc
sub ebx, esi
sbb ebp, dword [esp + 0x10]
sub dword [eax], esi
mov eax, dword [edi + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x18]
jmp 0x4417c0
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x4417d0
mov eax, dword [esp + 0x18]
add ebx, 0xffffffff
mov esi, 1
adc ebp, 0xffffffff
mov byte [eax], cl
add eax, esi
mov dword [esp + 0x18], eax
test ebp, ebp
jg 0x441750
jl 0x4417d0
test ebx, ebx
jne 0x441750
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
sub eax, ebx
sbb edx, ebp
pop ebp
pop ebx
pop edi
pop esi
pop ecx
ret 0xc
mov eax, dword [edi + 0x1c]
mov ecx, dword [eax]
test ecx, ecx
je 0x4417f4
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x4417f6
xor eax, eax
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x10], esi
test eax, eax
je 0x44182c
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
cmovb esi, eax
push esi
push ecx
push ebp
call fcn.00457db0
mov eax, dword [edi + 0x2c]
sub ebx, esi
add ebp, esi
mov dword [esp + 0x1c], ebx
add esp, 0xc
sub dword [eax], esi
mov eax, dword [edi + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0x1c]
cmp dword [edi + 0x4c], 0
je 0x4418d9
mov ecx, dword [edi + 0xc]
lea eax, [edi + 0x3c]
cmp dword [ecx], eax
jne 0x441857
mov eax, dword [edi + 0xc]
mov edx, dword [edi + 0x54]
mov ecx, dword [edi + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [edi + 0x1c]
mov dword [eax], ecx
mov eax, dword [edi + 0x2c]
mov dword [eax], edx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x18], edx
cmp edx, 0xfff
jbe 0x441898
nop word [eax + eax]
push dword [edi + 0x4c]
push 0xfff
push 1
push ebp
call fcn.00463b5c
sub ebx, eax
add esp, 0x10
add ebp, eax
mov dword [esp + 0x18], ebx
mov edx, ebx
cmp eax, 0xfff
jne 0x4418c6
cmp ebx, eax
ja 0x441870
mov ecx, edx
test edx, edx
je 0x4418dd
push dword [edi + 0x4c]
push ebx
push 1
push ebp
call fcn.00463b5c
mov ecx, dword [esp + 0x28]
add esp, 0x10
mov edx, dword [esp + 0x20]
sub ecx, eax
sub esi, ecx
mov eax, esi
pop ebp
pop ebx
pop edi
sbb edx, 0
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x20]
sub esi, ebx
pop ebp
pop ebx
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ecx
ret 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
sub esi, ecx
pop ebp
pop ebx
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ecx
ret 0xc
Function at 0x441e10
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47eda8
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4a5114]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push 0xf0000000
push 1
push 0
push 0
push esi
mov dword [esi], 0
call edi
test eax, eax
jne 0x441e86
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 8
push 1
push 0
push str.Crypto_RNG
push esi
mov ebx, eax
call edi
test eax, eax
jne 0x441e86
push 0x28
push 1
push eax
push str.Crypto_RNG
push esi
call edi
test eax, eax
je 0x441ea4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00455e1e
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.CryptAcquireContext
lea ecx, [ebp - 0x28]
call fcn.0040a0a0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x50]
call fcn.00441f70
push 0x4a2604
lea eax, [ebp - 0x50]
push eax
call fcn.00457d33
int3
Function at 0x445c90
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
xor dl, dl
mov ecx, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 8], eax
push ebp
push esi
push edi
test bl, 3
jne 0x445dc1
test al, 3
jne 0x445dc1
mov edi, ecx
mov dword [esp + 0x10], 0
shr edi, 2
xor esi, esi
test edi, edi
je 0x445d7c
cmp edi, 8
jb 0x445d45
mov ebp, dword [esp + 0x20]
mov edx, edi
mov dword [esp + 0x14], ebx
and edx, 0xfffffff8
add eax, 0x10
xorps xmm3, xmm3
sub dword [esp + 0x14], ebp
xorps xmm2, xmm2
mov ebp, dword [esp + 0x14]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ebx + esi*4]
add esi, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [eax + ebp - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp esi, edx
jb 0x445cf4
mov eax, dword [esp + 0x20]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd dword [esp + 0x10], xmm2
cmp esi, edi
jae 0x445d80
mov ebp, ebx
lea edx, [eax + esi*4]
sub ebp, eax
mov dword [esp + 0x14], ebp
mov ebp, edi
mov ebx, dword [esp + 0x14]
sub ebp, esi
mov esi, edi
mov edi, dword [esp + 0x10]
mov eax, dword [edx + ebx]
lea edx, [edx + 4]
xor eax, dword [edx - 4]
or edi, eax
sub ebp, 1
jne 0x445d62
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x10], edi
jmp 0x445d84
xor edi, edi
jmp 0x445d84
mov edi, dword [esp + 0x10]
shl esi, 2
sub ecx, esi
jne 0x445d98
test edi, edi
pop edi
pop esi
pop ebp
sete al
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
add ebx, esi
mov ebp, dword [esp + 0x20]
mov edx, eax
shr eax, 0x10
add ebp, esi
shr edx, 0x18
or dl, al
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x10]
shr eax, 8
or dl, al
mov eax, ebp
or dl, byte [esp + 0x10]
xor edi, edi
test ecx, ecx
je 0x445e80
cmp ecx, 0x20
jb 0x445e5a
mov esi, ecx
xorps xmm3, xmm3
and esi, 0xffffffe0
xorps xmm2, xmm2
mov dword [esp + 0x1c], esi
mov esi, ebx
sub esi, dword [esp + 0x14]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x10]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebp - 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
por xmm3, xmm1
movups xmm1, xmmword [ebx + edi + 0x10]
add edi, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, esi
jb 0x445df5
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or dl, al
mov ebp, dword [esp + 0x14]
cmp edi, ecx
jae 0x445e80
sub ebx, ebp
lea esi, [edi + ebp]
sub ecx, edi
nop dword [eax]
mov al, byte [ebx + esi]
lea esi, [esi + 1]
xor al, byte [esi - 1]
or dl, al
sub ecx, 1
jne 0x445e70
pop edi
pop esi
test dl, dl
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x449330
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
cmp byte [0x4abac4], 0
jne 0x44933e
call fcn.004519a0
cmp byte [0x4abacd], 0
je 0x44935c
push 0
push 0x40
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.004533d0
add esp, 0x10
ret
jmp fcn.00447670
Function at 0x46cef0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046cbb3

Function at 0x46cefb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046cd34

Function at 0x4726f0
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004723b0
Function at 0x417d40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a6ab5
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x612790]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 4
call fcn.00498b49
add esp, 4
test eax, eax
je 0x417d7a
mov dword [eax], esi
jmp 0x417d7c
xor eax, eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x417960
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 0x18], eax
test eax, eax
je 0x417ddf
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x417dd2
push ecx
push eax
call sub.MSVCP140.dll__Thrd_detach
add esp, 8
test eax, eax
jne 0x417dd9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
push eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
push 6
mov dword [ebp - 0x14], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x418070
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a6b8d
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x612790]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 1
test ecx, ecx
je 0x4180cd
mov eax, dword [ecx]
lea edx, [ebp - 0x38]
push edx
call dword [eax]
mov dword [ebp - 0x14], eax
push 0x30
mov byte [ebp - 4], 2
call fcn.00498b49
mov esi, eax
add esp, 4
test esi, esi
je 0x41813a
mov ecx, dword [ebp - 0x40]
lea edi, [esi + 8]
mov dword [esi], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [esi + 4], ecx
mov dword [edi + 0x24], 0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x41813c
lea eax, [ebp - 0x38]
cmp ecx, eax
jne 0x41812e
mov eax, dword [ecx]
push edi
call dword [eax + 4]
mov dword [edi + 0x24], eax
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x41813c
mov edx, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x14], 0
jmp 0x41813c
mov dword [edi + 0x24], ecx
mov dword [ebp - 0x14], 0
jmp 0x41813c
xor esi, esi
mov dword [ebp - 0x4c], esi
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 3
push eax
push 0
push esi
push 0x417770
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 0x48], eax
test eax, eax
je 0x4181db
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 5
test ecx, ecx
je 0x418189
mov edx, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x44]
test ecx, ecx
je 0x4181e9
push ecx
push eax
call sub.MSVCP140.dll__Thrd_detach
add esp, 8
test eax, eax
jne 0x4181f0
mov ecx, dword [ebp + 0x34]
xorps xmm0, xmm0
movlpd qword [ebp - 0x48], xmm0
test ecx, ecx
je 0x4181be
mov edx, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00498b38
mov esp, ebp
pop ebp
ret 0x30
push 6
mov dword [ebp - 0x44], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
push 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
push eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
int3
Function at 0x419ed0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a6f34
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x612790]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0xc]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QObject::constructor_class_QObject__]
lea ecx, [esi + 8]
mov dword [ebp - 4], 0
mov dword [esi], vtable.BAgentWorker.0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QMutex::constructor_void_]
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QMutex::constructor_void_]
push dword [ebp + 8]
lea ecx, [esi + 0x1c]
mov byte [esi + 0x18], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
lea ecx, [esi + 0x20]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
lea ecx, [esi + 0x30]
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
mov eax, dword [sym.imp.Qt5Core.dll_struct_QListData::Data_const_QListData::shared_null]
mov dword [esi + 0x34], eax
lea ecx, [esi + 0x38]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
lea ecx, [esi + 0x3c]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 9
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QMutex::constructor_void_]
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 0xa
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QMutex::constructor_void_]
mov dword [esi + 0x50], 0
mov eax, esi
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], closesocket
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], closesocket
mov byte [esi + 0x68], 1
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x430ec0
Capabilities:
Read pipe
Write file on windows
Write pipe

Disassembly:
sub esp, 0x88
push edi
mov edi, ecx
cmp dword [edi + 0x28], 0
je 0x430ed9
mov al, 1
pop edi
add esp, 0x88
ret
push ebp
call fcn.00430e10
mov ebp, eax
test ebp, ebp
jne 0x430ef0
pop ebp
xor al, al
pop edi
add esp, 0x88
ret
push ebx
push esi
mov esi, dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [edi + 0x20]
xorps xmm0, xmm0
mov dword [esp + 0x44], eax
lea eax, [edi + 0x38]
mov dword [esp + 0x4c], eax
lea eax, [edi + 0x3c]
mov dword [esp + 0x50], eax
lea eax, [edi + 0x40]
mov dword [esp + 0x54], eax
mov eax, dword [edi + 0x1c]
push 0
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x14]
push eax
push 0x2c
lea eax, [esp + 0x20]
mov dword [esp + 0x4c], 1
push eax
push 0x2c
lea eax, [esp + 0x54]
mov dword [esp + 0x5c], esi
push eax
push ebp
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
movups xmmword [esp + 0x38], xmm0
mov dword [esp + 0x50], 0
movq qword [esp + 0x48], xmm0
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
je 0x431029
cmp dword [esp + 0x14], 2
jne 0x431029
cmp dword [esp + 0x18], 0
je 0x431029
cmp dword [esp + 0x34], 0
je 0x431029
cmp dword [esp + 0x38], 0
je 0x431029
cmp dword [esp + 0x3c], 0
je 0x431029
lea ecx, [esp + 0x6c]
call fcn.00430d80
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x70], 3
push eax
push 0x2c
lea eax, [esp + 0x78]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x431029
mov eax, dword [esp + 0x34]
mov bl, 1
mov dword [edi + 0x28], eax
mov eax, dword [esp + 0x38]
mov dword [edi + 0x2c], eax
mov eax, dword [esp + 0x3c]
mov dword [edi + 0x30], eax
mov eax, dword [esp + 0x18]
push ebp
mov dword [edi + 0x34], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
pop ebp
pop edi
add esp, 0x88
ret
push ebp
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
pop ebp
pop edi
add esp, 0x88
ret

Function at 0x431190
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x4311e4
push ebx
dec edi
push ebp
mov ebp, dword [esp + 0x10]
shr edi, 4
push esi
mov esi, dword [esp + 0x18]
inc edi
nop dword [eax]
movups xmm0, xmmword [esi]
push ebp
push esi
call fcn.004314d0
add esp, 8
lea ecx, [ebp + 0xf0]
mov edx, 0x10
mov al, byte [ecx]
lea ecx, [ecx + 1]
xor byte [esi], al
inc esi
sub edx, 1
jne 0x4311c8
movups xmmword [ebp + 0xf0], xmm0
sub edi, 1
jne 0x4311b0
pop esi
pop ebp
pop ebx
pop edi
ret
Function at 0x4311f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0xc]
lea eax, [ebp + 0xf0]
mov dword [esp + 0xc], eax
mov edx, eax
test ebx, ebx
je 0x431248
dec ebx
push esi
shr ebx, 4
push edi
mov edi, dword [esp + 0x18]
inc ebx
mov eax, edi
sub edx, edi
mov esi, 0x10
nop
mov cl, byte [edx + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub esi, 1
jne 0x431220
push ebp
push edi
call fcn.00431290
mov edx, edi
add esp, 8
add edi, 0x10
sub ebx, 1
jne 0x431215
mov eax, dword [esp + 0x14]
pop edi
pop esi
movups xmm0, xmmword [edx]
pop ebp
pop ebx
movups xmmword [eax], xmm0
ret
Function at 0x4314d0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov ebx, 4
push esi
mov esi, dword [esp + 0x14]
mov ecx, esi
push edi
lea edx, [ebp + 0xe0]
nop word [eax + eax]
mov edi, 4
mov al, byte [edx]
inc edx
xor byte [ecx], al
inc ecx
sub edi, 1
jne 0x4314f5
sub ebx, 1
jne 0x4314f0
lea eax, [ebp + 0xd0]
mov byte [esp + 0x18], 0xd
mov ebp, eax
movzx eax, byte [esi + 9]
mov edi, esi
mov cl, byte [esi + 0xd]
mov ebx, 4
mov byte [esi + 0xd], al
movzx eax, byte [esi + 5]
mov byte [esi + 9], al
movzx eax, byte [esi + 1]
mov byte [esi + 5], al
movzx eax, byte [esi + 0xa]
mov byte [esi + 1], cl
mov cl, byte [esi + 2]
mov byte [esi + 2], al
movzx eax, byte [esi + 0xe]
mov byte [esi + 0xa], cl
mov cl, byte [esi + 6]
mov byte [esi + 6], al
movzx eax, byte [esi + 7]
mov byte [esi + 0xe], cl
mov cl, byte [esi + 3]
mov byte [esi + 3], al
movzx eax, byte [esi + 0xb]
mov byte [esi + 7], al
movzx eax, byte [esi + 0xf]
mov byte [esi + 0xb], al
mov byte [esi + 0xf], cl
nop dword [eax]
mov ecx, edi
mov edx, 4
nop word [eax + eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x5ebd20]
mov byte [ecx - 4], al
sub edx, 1
jne 0x431580
inc edi
sub ebx, 1
jne 0x431570
mov eax, esi
mov edx, ebp
mov ebx, 4
mov edi, 4
mov cl, byte [edx]
inc edx
xor byte [eax], cl
inc eax
sub edi, 1
jne 0x4315a8
sub ebx, 1
jne 0x4315a3
push esi
call fcn.00431680
mov dl, byte [esp + 0x1c]
add esp, 4
dec dl
sub ebp, 0x10
mov byte [esp + 0x18], dl
test dl, dl
jne 0x431512
movzx eax, byte [esi + 9]
mov edi, esi
mov cl, byte [esi + 0xd]
mov ebx, 4
mov ebp, dword [esp + 0x1c]
mov byte [esi + 0xd], al
movzx eax, byte [esi + 5]
mov byte [esi + 9], al
movzx eax, byte [esi + 1]
mov byte [esi + 5], al
movzx eax, byte [esi + 0xa]
mov byte [esi + 1], cl
mov cl, byte [esi + 2]
mov byte [esi + 2], al
movzx eax, byte [esi + 0xe]
mov byte [esi + 0xa], cl
mov cl, byte [esi + 6]
mov byte [esi + 6], al
movzx eax, byte [esi + 7]
mov byte [esi + 0xe], cl
mov cl, byte [esi + 3]
mov byte [esi + 3], al
movzx eax, byte [esi + 0xb]
mov byte [esi + 7], al
movzx eax, byte [esi + 0xf]
mov byte [esi + 0xb], al
mov byte [esi + 0xf], cl
mov ecx, edi
mov edx, 4
nop dword [eax + eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x5ebd20]
mov byte [ecx - 4], al
sub edx, 1
jne 0x431640
inc edi
sub ebx, 1
jne 0x431631
sub ebp, esi
lea edx, [ebx + 4]
nop
mov ecx, 4
mov al, byte [esi + ebp]
xor byte [esi], al
inc esi
sub ecx, 1
jne 0x431665
sub edx, 1
jne 0x431660
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4318d0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ecx
mov edx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x14]
push edi
movzx eax, byte [esi]
mov byte [edx], al
movzx eax, byte [esi + 1]
mov byte [edx + 1], al
movzx eax, byte [esi + 2]
mov byte [edx + 2], al
movzx eax, byte [esi + 3]
mov byte [edx + 3], al
movzx eax, byte [esi + 4]
mov byte [edx + 4], al
movzx eax, byte [esi + 5]
mov byte [edx + 5], al
movzx eax, byte [esi + 6]
mov byte [edx + 6], al
movzx eax, byte [esi + 7]
mov byte [edx + 7], al
movzx eax, byte [esi + 8]
mov byte [edx + 8], al
movzx eax, byte [esi + 9]
mov byte [edx + 9], al
movzx eax, byte [esi + 0xa]
mov byte [edx + 0xa], al
movzx eax, byte [esi + 0xb]
mov byte [edx + 0xb], al
movzx eax, byte [esi + 0xc]
mov byte [edx + 0xc], al
movzx eax, byte [esi + 0xd]
mov byte [edx + 0xd], al
movzx eax, byte [esi + 0xe]
mov byte [edx + 0xe], al
movzx eax, byte [esi + 0xf]
mov byte [edx + 0xf], al
movzx eax, byte [esi + 0x10]
mov byte [edx + 0x10], al
movzx eax, byte [esi + 0x11]
mov byte [edx + 0x11], al
movzx eax, byte [esi + 0x12]
mov byte [edx + 0x12], al
movzx eax, byte [esi + 0x13]
mov byte [edx + 0x13], al
movzx eax, byte [esi + 0x14]
mov byte [edx + 0x14], al
movzx eax, byte [esi + 0x15]
mov byte [edx + 0x15], al
movzx eax, byte [esi + 0x16]
mov byte [edx + 0x16], al
movzx eax, byte [esi + 0x17]
mov byte [edx + 0x17], al
movzx eax, byte [esi + 0x18]
mov byte [edx + 0x18], al
movzx eax, byte [esi + 0x19]
mov byte [edx + 0x19], al
movzx eax, byte [esi + 0x1a]
mov byte [edx + 0x1a], al
movzx eax, byte [esi + 0x1b]
mov byte [edx + 0x1b], al
movzx eax, byte [esi + 0x1c]
mov byte [edx + 0x1c], al
movzx eax, byte [esi + 0x1d]
mov byte [edx + 0x1d], al
lea eax, [edx + 0x1e]
movzx ecx, byte [esi + 0x1e]
mov byte [eax], cl
movzx ecx, byte [esi + 0x1f]
mov esi, 8
mov byte [edx + 0x1f], cl
mov cl, byte [eax]
mov edi, esi
mov dh, byte [eax + 1]
mov bl, byte [eax - 2]
mov bh, byte [eax - 1]
mov byte [esp + 0xe], cl
mov byte [esp + 0xf], dh
and edi, 7
jne 0x431a1a
movzx ecx, cl
movzx edx, bh
mov bh, byte [ecx + str.cw]
movzx ecx, byte [esp + 0xf]
mov cl, byte [ecx + str.cw]
mov byte [esp + 0xe], cl
movzx ecx, bl
mov cl, byte [ecx + str.cw]
mov byte [esp + 0xf], cl
mov ecx, esi
shr ecx, 3
mov bl, byte [ecx + 0x5ebe20]
xor bl, byte [edx + str.cw]
mov dh, byte [esp + 0xf]
jmp 0x431a4b
cmp edi, 4
jne 0x431a4b
mov dl, byte [esp + 0xe]
movzx ecx, bl
mov bl, byte [ecx + str.cw]
movzx ecx, bh
mov bh, byte [ecx + str.cw]
movzx ecx, dl
mov cl, byte [ecx + str.cw]
mov byte [esp + 0xe], cl
movzx ecx, dh
mov dh, byte [ecx + str.cw]
movzx ecx, byte [eax - 0x1e]
inc esi
mov dl, byte [esp + 0xe]
xor cl, bl
mov byte [eax + 2], cl
movzx ecx, byte [eax - 0x1d]
xor cl, bh
mov byte [eax + 3], cl
movzx ecx, byte [eax - 0x1c]
xor cl, dl
mov byte [eax + 4], cl
movzx ecx, byte [eax - 0x1b]
xor cl, dh
mov byte [eax + 5], cl
add eax, 4
cmp esi, 0x3c
jb 0x4319c1
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x431a90
Capabilities:
Convert ip address from string

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
je 0x431ac2
push 0x915d04
push eax
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
push 0x202
call dword [sym.imp.WS2_32.dll_htons]
mov word [0x915d02], ax
mov eax, 2
mov word [0x915d00], ax
push edi
mov edi, dword [esp + 8]
test edi, edi
je 0x431b6c
cmp byte [edi], 0
je 0x431b6c
push ebx
push 0x180
push 0x10a
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__open]
mov ebx, eax
add esp, 0xc
test ebx, ebx
jns 0x431b22
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
push edi
push 0x5ad
push str.__util_deflog
push str.UTIL_
push str.Error_opening_log_file__s__errno___d.
push 2
push str.UTILS
call fcn.00432050
add esp, 0x20
pop ebx
pop edi
ret
push 2
push 0
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__lseek]
push 2
push ebx
mov dword [0x6125e4], ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__dup2]
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__dup2]
push edi
push 0x5b7
push str.__util_deflog
push str.UTIL_
push str.Log_file__s_has_been_opened.
push 1
push str.UTILS
call fcn.00432050
add esp, 0x38
pop ebx
pop edi
ret
mov eax, 1
pop edi
ret