joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461186
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x463250
call fcn.004615c8
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x4611c6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4611c6
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4611de
cmp eax, 0x20b
je 0x4611cb
mov dword [ebp - 0x1c], ebx
jmp 0x4611f2
cmp dword [ecx + 0x84], 0xe
jbe 0x4611c6
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x4611ec
cmp dword [ecx + 0x74], 0xe
jbe 0x4611c6
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.NSCRT.dll___set_app_type]
pop ecx
or dword [0x480474], 0xffffffff
or dword [0x480478], 0xffffffff
call dword [sym.imp.NSCRT.dll___p__fmode]
mov ecx, dword [0x4750d4]
mov dword [eax], ecx
call dword [sym.imp.NSCRT.dll___p__commode]
mov ecx, dword [0x4750d0]
mov dword [eax], ecx
mov eax, dword [sym.imp.NSCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x480470], eax
call fcn.00461528
call fcn.0045683d
cmp dword [0x472150], ebx
jne 0x461252
push fcn.0045683d
call dword [sym.imp.NSCRT.dll___setusermatherr]
pop ecx
call fcn.004615b6
push 0x4720ac
push 0x4720a8
call sub.NSCRT.dll__initterm
push 0x46156c
call fcn.0046114a
mov eax, dword [0x4750cc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x4750c8]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.NSCRT.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jge 0x4612a6
push 8
call sub.NSCRT.dll__amsg_exit
pop ecx
push 0x4720a4
push section..data
call sub.NSCRT.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.NSCRT.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x461324
cmp al, bl
je 0x4612d0
cmp dword [ebp - 0x20], ebx
jne 0x461324
mov al, byte [esi]
cmp al, bl
je 0x4612e0
cmp al, 0x20
ja 0x4612e0
inc esi
mov dword [ebp - 0x24], esi
jmp 0x4612d0
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x58], 1
je 0x4612fc
movzx eax, word [ebp - 0x54]
jmp 0x4612ff
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.0044a5e6
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], ebx
jne 0x46131c
push esi
call dword [sym.imp.NSCRT.dll_exit]
call dword [sym.imp.NSCRT.dll__cexit]
jmp 0x461379
cmp al, 0x22
jne 0x461333
xor ecx, ecx
cmp dword [ebp - 0x20], ebx
sete cl
mov dword [ebp - 0x20], ecx
movzx eax, al
push eax
call dword [sym.imp.NSCRT.dll__ismbblead]
pop ecx
test eax, eax
je 0x461346
inc esi
mov dword [ebp - 0x24], esi
inc esi
jmp 0x4612be
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00461603
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x34a02a04
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
mov ecx, 0x37c37e97
nop
nop
nop
nop
nop
test eax, eax
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x509d0767
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x659262c
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x66cc15f1
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x67784014]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x66cc1657
mov eax, dword [0x67784014]
mov dword [0x6778400c], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xc]
add eax, edx
mov dword [0x67784008], eax
mov eax, dword [0x67784008]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x10], eax
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [0x67784004], eax
nop
leave
ret

Function at 0x66cc169e
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x67784008]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x67784008]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x10], 0
jmp 0x66cc1722
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x67784004]
add eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, dword [0x6778400c]
add eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
add dword [ebp - 0xc], 0x28
add dword [ebp - 0x10], 1
mov eax, dword [0x67784008]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x66cc16dc
nop
leave
ret

Function at 0x66cc1e10
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], 0x67783040
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.66cc1e70
Function at 0x66cc1e70
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x67784378]
test esi, esi
jle 0x66cc1f5d
mov edi, dword [0x6778437c]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x66cc1ea4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x66cc1f56
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x66cc1e90
mov dword [esp], eax
mov esi, eax
call fcn.66cc2610
test eax, eax
mov edi, eax
je 0x66cc1f9a
mov esi, dword [0x6778437c]
lea ebx, [ebx + ebx*2]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.66cc2720
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x6778437c]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x66cc1f7a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x66cc1f4f
sub eax, 0x40
and eax, 0xffffffbf
je 0x66cc1f4f
mov eax, dword [esp + 0x20]
add ebx, dword [0x6778437c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x66cc1f64
add dword [0x67784378], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x66cc1eae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.66cc1e10
mov eax, dword [0x6778437c]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.66cc1e10
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.66cc1e10
lea esi, [esi]

Function at 0x66cc2280
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x67784388
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x67784380]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x66cc22d5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x66cc22ce
test esi, esi
je 0x66cc22ce
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x66cc22b0
mov dword [esp], 0x67784388
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403ddc
Capabilities:
Encode data using xor

Disassembly:
inc dword [eax - 0x3fcccf3e]
mov al, cl
mov byte [esi + eax], dl
mov eax, ebx
mov ebx, 0xa0d
add byte [ecx - 0x27740409], bl
dec ecx
test ebx, ebx
jne 0x403dd4
mov cl, 0x1c
mov eax, dword [0x454004]
mov edx, eax
and edx, 0xf
jp 0x4580ca9c
add byte [ebx], dh
fisttp dword [edx + 0x1e1488d9]
shr eax, 4
dec ecx
test eax, eax
jne 0x403e00
pop edi
pop esi
pop ebx
ret

Function at 0x410a0a
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
test edx, edx
je 0x410a14
xor ecx, ecx
mov cl, byte [eax + 1]
mov eax, dword [eax + ecx + 0xb]
mov eax, dword [eax]
mov cl, byte [eax + 1]
lea esi, [eax + ecx + 0xf]
mov edi, dword [eax + ecx + 7]
xor eax, eax
mov cl, byte [esi]
cmp ecx, dword [edx - 4]
jne 0x410a0b
mov bl, byte [ecx + edx - 1]
xor bl, byte [ecx + esi]
test bl, 0xdf
jne 0x410a09
dec ecx
jne 0x4109f8
jmp 0x410a17
mov cl, byte [esi]
inc eax
lea esi, [ecx + esi + 1]
cmp eax, edi
jle 0x4109f1
or eax, 0xffffffff
pop edi
pop esi
pop ebx
ret

Function at 0x41be7d
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41be83
ret
Function at 0x4398fa
Capabilities:
Get number of processors

Disassembly:
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
mov dword [ebp - 4], eax
mov esi, dword [0x455160]
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 1
xor eax, eax
push ebp
push 0x4397d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00431ada
add dword [ebp - 0xc], 4
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00432cf6
mov eax, dword [esi]
call fcn.0044ec1e
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4c]
add edx, dword [ebp - 0x14]
cmp eax, edx
jge 0x43984c
mov eax, dword [esi]
call fcn.0044ec1e
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x4c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
call fcn.0044ec2a
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x48]
add edx, dword [ebp - 0x18]
cmp eax, edx
jge 0x439870
mov eax, dword [esi]
call fcn.0044ec2a
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.0044ec12
cmp eax, dword [ebp - 0x18]
jle 0x439889
or cl, byte [ebx + 0x538fe806]
add dword [eax], eax
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.0044ec07
cmp eax, dword [ebp - 0xc]
jle 0x4398a0
or cl, byte [ebx + 0x536de806]
add dword [eax], eax
mov dword [ebp - 0xc], eax
push 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call fcn.00438288
push eax
call fcn.00406a08
call fcn.00406250
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x214]
cmp eax, 0xfa
jbe 0x439965
mov eax, ebx
call fcn.00404434
cmp eax, 0x64
jge 0x439965
cmp dword [0x454a28], 0
je 0x439965
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1016
call fcn.00406a38
cmp dword [ebp - 8], 0
je 0x439965
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1018
call fcn.00406a38
cmp dword [ebp - 8], 0
je 0x439928
mov bl, 2
jmp 0x439943
lea edx, [ebp - 0x20]
mov eax, dword [0x456b3c]
call fcn.0043ca30
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jle 0x439941
xor ebx, ebx
jmp 0x439943
mov bl, 1
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x454b30]
or eax, 0x40000
push eax
push 0x64
mov eax, dword [ebp - 4]
call fcn.00438288
push eax
call dword [0x454a28]
mov eax, dword [0x455024]
mov eax, dword [eax]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 4]
call 0x4359bc
push 4
mov eax, dword [ebp - 4]
call fcn.00438288
push eax
call fcn.00406a30
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x7c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4397e0
call fcn.00406250
mov edx, dword [ebp - 4]
mov dword [edx + 0x214], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 0
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x72970283
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x23a919e0
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x4a92f7d
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x3dde0b99
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401330
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44c
mov eax, dword [0x407060]
xor eax, ebp
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
mov dword [esp + 0x450], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [esp + 0x14], eax
jne 0x401372
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x448]
xor ecx, ebp
call fcn.00403dfb
mov esp, ebp
pop ebp
ret
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
xor eax, eax
cmp ebx, 0xffffffff
mov dword [esp + 0xc], ebx
je 0x401454
mov ecx, 0x8a
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
push ecx
push ebx
mov dword [esp + 0x20], 0x22c
mov dword [esp + 0x18], eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x401449
mov ebx, dword [sym.imp.MSVCR71.dll_wcscpy]
lea esp, [esp]
xor eax, eax
mov word [esp + 0x248], 0
mov ecx, 0x81
lea edi, [esp + 0x24a]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x3c]
stosw word es:[edi], ax
push edx
lea eax, [esp + 0x24c]
push eax
call ebx
lea ecx, [esp + 0x250]
push ecx
call dword [sym.imp.MSVCR71.dll__wcsupr]
lea edx, [esp + 0x254]
push edx
push esi
call fcn.00401070
add esp, 0x14
test eax, eax
jne 0x401423
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4013c0
jmp 0x401445
mov esi, dword [esp + 0x14]
test esi, esi
je 0x40143d
lea edx, [esp + 0x248]
push edx
call fcn.00401000
add esp, 4
mov dword [esi], eax
mov dword [esp + 0x10], 1
mov ebx, dword [esp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x454]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403dfb
mov esp, ebp
pop ebp
ret
Function at 0x401550
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x250
mov eax, dword [0x407060]
xor eax, ebp
push esi
push edi
mov dword [esp + 0x254], eax
xor eax, eax
mov word [esp + 0x48], 0
mov ecx, 0x81
lea edi, [esp + 0x4a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [esp + 0x4c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x401690
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x405248
lea ecx, [esp + 0x4c]
push ecx
mov edx, ecx
push edx
call esi
push str.lsp_check.exe
lea eax, [esp + 0x4c]
push eax
mov ecx, eax
push ecx
call esi
lea edx, [esp + 0x48]
push edx
call fcn.0040383d
add esp, 4
test eax, eax
je 0x401690
xor eax, eax
mov ecx, 0xf
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], eax
lea ecx, [esp + 0xc]
lea eax, [esp + 0x48]
push ecx
mov dword [esp + 0x10], 0x3c
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x1c], 0x405220
mov dword [esp + 0x2c], 1
mov dword [esp + 0x20], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x401690
mov edx, dword [esp + 0x44]
push 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x401666
mov ecx, dword [esp + 0x44]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x401690
cmp dword [esp + 8], 0xffffffff
jne 0x401690
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x24c]
xor ecx, ebp
call fcn.00403dfb
mov esp, ebp
pop ebp
ret
cmp eax, 0x102
jne 0x401690
mov edx, dword [esp + 0x44]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x24c]
xor ecx, ebp
call fcn.00403dfb
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x254]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.00403dfb
mov esp, ebp
pop ebp
ret
Function at 0x4028f0
Capabilities:
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x404259
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [0x407060]
xor eax, esp
push esi
mov esi, dword [esp + 0x38]
push edi
mov edi, dword [esp + 0x38]
push str.spictl.phub.sandai.net
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], eax
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
cmp dword [esp + 0x20], 0x10
mov eax, dword [esp + 0xc]
mov word [esi], 0x22b0
jae 0x402940
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
mov dword [esp + 0x30], 0xffffffff
jne 0x402961
lea ecx, [esp + 8]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
xor eax, eax
jmp 0x402979
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
lea ecx, [esp + 8]
mov dword [edi], edx
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, 1
mov ecx, dword [esp + 0x28]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x20]
pop esi
xor ecx, esp
call fcn.00403dfb
add esp, 0x2c
ret

Function at 0x4029a0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
sub esp, 0x18
mov eax, dword [0x407060]
xor eax, esp
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x28]
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x38]
push 6
push 1
push 2
mov dword [esp + 0x30], eax
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x402a0c
lea ecx, [esp + 0x10]
push ecx
push 0x8004667e
push eax
mov dword [esp + 0x1c], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push edi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov edx, dword [esi]
push 0x33
push edi
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x402a21
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00403dfb
add esp, 0x18
ret
mov eax, dword [ebx]
xor ecx, ecx
mov cx, word [ebp]
mov dword [esp + 0x18], eax
mov word [esp + 0x14], 2
push ecx
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
lea edx, [esp + 0x18]
mov word [esp + 0x1a], ax
mov eax, dword [esi]
push edx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x402a62
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2733
jne 0x402a0c
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00403dfb
add esp, 0x18
ret
Function at 0x402a80
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
test ebp, ebp
push edi
je 0x402acf
cmp dword [esp + 0xc], 0xffffffff
je 0x402acf
mov edi, dword [esp + 0x14]
test edi, edi
jle 0x402acf
push esi
xor esi, esi
test edi, edi
jle 0x402ac4
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_recv]
mov edx, dword [esp + 0x14]
push 0
mov eax, edi
sub eax, esi
push eax
lea ecx, [esi + ebp]
push ecx
push edx
call ebx
test eax, eax
jle 0x402ac3
add esi, eax
cmp esi, edi
jl 0x402aa7
pop ebx
xor eax, eax
cmp esi, edi
pop esi
pop edi
sete al
pop ebp
ret
pop edi
xor eax, eax
pop ebp
ret
Function at 0x402f80
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10
mov eax, dword [0x407060]
xor eax, esp
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 1], eax
mov dword [esp + 5], eax
push ebx
lea ecx, [esp + 4]
test ecx, ecx
mov word [esp + 0xd], ax
push ebp
mov ebp, dword [esp + 0x20]
mov byte [esp + 8], 0
mov byte [esp + 0x13], al
je 0x402ff9
mov ebx, dword [esp + 0x1c]
cmp ebx, 0xffffffff
je 0x402ff9
push esi
push edi
mov edi, dword [sym.imp.WS2_32.dll_recv]
xor esi, esi
push 0
mov edx, 0xc
sub edx, esi
push edx
lea eax, [esp + esi + 0x18]
push eax
push ebx
call edi
test eax, eax
jle 0x402fe4
add esi, eax
cmp esi, 0xc
jl 0x402fc7
xor eax, eax
cmp esi, 0xc
sete al
pop edi
pop esi
test eax, eax
je 0x402ff9
cmp dword [esp + 8], 0xd
jae 0x40300c
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.00403dfb
add esp, 0x10
ret
mov ecx, dword [esp + 0x10]
mov dword [ebp], ecx
mov ecx, dword [esp + 0x14]
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00403dfb
add esp, 0x10
ret