joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ac730
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x578704]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov eax, dword [ebx + 0xc]
mov edi, dword [eax + 0x378]
lea eax, [ebp - 0x88]
push eax
mov dword [ebp - 0x88], 0x80
lea eax, [ebp - 0x84]
push eax
mov eax, dword [edi + 0x13c]
push 0
add eax, 4
push eax
push dword [edi + 0x148]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [edi + 0x130], 0
mov dword [edi + 0x134], eax
jne 0x4ac7bc
push dword [ebp - 0x88]
lea eax, [ebp - 0x84]
push eax
lea eax, [edi + 0xb0]
push eax
call fcn.004faeb0
mov eax, dword [ebp - 0x88]
add esp, 0xc
mov dword [edi + 0x130], eax
mov edx, dword [edi + 0x134]
cmp edx, 4
jge 0x4ac7ef
push str.Received_too_short_packet
push ebx
call fcn.004931f0
add esp, 8
mov dword [edi + 0xc], 7
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1d28
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x148]
movzx ecx, byte [eax + 1]
movzx eax, byte [eax]
shl eax, 8
or ecx, eax
mov dword [edi + 0xc], ecx
add ecx, 0xfffffffd
cmp ecx, 3
ja case.default.0x4ac810
jmp dword [ecx*4 + 0x4ac970]
cmp edx, 4
jle case.0x4ac810.4
mov eax, dword [edi + 0x148]
movzx ecx, byte [eax + 2]
movzx eax, byte [eax + 3]
shl ecx, 8
or ecx, eax
movzx eax, word [edi + 0x144]
inc eax
movzx eax, ax
cmp eax, ecx
jne case.0x4ac810.4
lea eax, [edx - 4]
push eax
mov eax, dword [edi + 0x148]
add eax, 4
push eax
push 1
push ebx
call fcn.00493330
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4ac883
push 5
push edi
call fcn.004ad1e0
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1d28
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x134]
sub eax, 4
cdq
add dword [ebx + 0x90], eax
adc dword [ebx + 0x94], edx
push dword [ebx + 0x94]
push dword [ebx + 0x90]
push ebx
call fcn.004a1330
jmp 0x4ac93a
mov eax, dword [edi + 0x148]
lea esi, [edx - 4]
add eax, 4
mov dword [ebp - 0x8c], eax
mov eax, dword [edi + 0x148]
push esi
push dword [ebp - 0x8c]
movzx ecx, byte [eax + 2]
movzx eax, byte [eax + 3]
shl ecx, 8
or ecx, eax
mov dword [edi + 8], ecx
call fcn.004ad310
add esp, 8
cmp eax, esi
jae case.0x4ac810.4
push dword [ebp - 0x8c]
push str.TFTP_error:__s
push ebx
call fcn.004932b0
jmp 0x4ac93a
lea eax, [edx - 2]
push eax
mov eax, dword [edi + 0x148]
add eax, 2
push eax
push edi
call fcn.004ac4f0
add esp, 0xc
test eax, eax
je case.0x4ac810.4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1d28
mov esp, ebp
pop ebp
ret
push str.Internal_error:_Unexpected_packet
push 0x55fdf4
push ebx
call fcn.004931f0
add esp, 0xc
push ebx
call fcn.004a1670
add esp, 4
test eax, eax
je 0x4ac7dc
push 5
push edi
call fcn.004ad1e0
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov eax, 0x2a
pop edi
pop esi
pop ebx
call fcn.004e1d28
mov esp, ebp
pop ebp
ret
Function at 0x4ad1e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [eax + 0x10]
cmp edx, 3
ja case.default.0x4ad1f0
jmp dword [edx*4 + 0x4ad244]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004acca0
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004ac980
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004ad440
push str.TFTP_finished
push 0x55fdf4
push ecx
call fcn.004932b0
add esp, 0xc
xor eax, eax
pop ebp
ret
push str.Internal_state_machine_error
push 0x55fdf4
push ecx
call fcn.004931f0
add esp, 0xc
mov eax, 0x47
pop ebp
ret
Function at 0x10010150
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x10010314
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb000]
push edi
jmp 0x1001017a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10010181
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10010170
mov eax, 1
add ebx, ebx
jne 0x10010193
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10010188
jne 0x100101a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10010188
xor ecx, ecx
sub eax, 3
jb 0x100101b8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1001022a
mov ebp, eax
add ebx, ebx
jne 0x100101c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x100101d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x100101f4
inc ecx
add ebx, ebx
jne 0x100101e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x100101d5
jne 0x100101f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x100101d5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10010214
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10010205
jmp 0x10010176
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10010214
add edi, ecx
jmp 0x10010176
pop esi
mov edi, esi
mov ecx, 0x10d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10010232
cmp byte [edi], 1
jne 0x10010232
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10010237
lea edi, [esi + 0xe000]
mov eax, dword [edi]
or eax, eax
je 0x100102a6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x10400]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x10450]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10010264
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x10454]
or eax, eax
je 0x100102a0
mov dword [ebx], eax
add ebx, 4
jmp 0x10010281
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x100102d7
cmp al, 0xef
ja 0x100102ca
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x100102ac
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x100102b9
mov ebp, dword [esi + 0x10458]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1001030b
sub esp, 0xffffff80
jmp 0x10002b40
Function at 0x10490
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov bl, byte [esi]
push ebp
push edi
xor edi, edi
xor ebp, ebp
cmp eax, 1
jbe 0x104cb
mov dl, byte [eax + esi - 1]
dec eax
movzx ecx, dl
ror edi, 3
xor edi, ecx
mov cl, al
add cl, bl
xor cl, dl
movzx edx, cl
rol ebp, 3
xor ebp, edx
mov byte [eax + esi], cl
mov bl, cl
cmp eax, 1
ja 0x104a2
mov eax, dword [esp + 0x10]
mov dword [esi + eax], edi
pop edi
mov dword [esi + eax + 4], ebp
pop ebp
pop ebx
ret 4

Function at 0x104e0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov dl, byte [esi]
push ebp
push edi
lea eax, [ecx - 8]
xor edi, edi
xor ebp, ebp
cmp eax, 1
jle 0x1051e
push ebx
dec eax
mov bl, dl
mov dl, byte [eax + esi]
mov cl, al
add cl, bl
xor cl, dl
mov byte [eax + esi], cl
movzx ecx, cl
ror edi, 3
xor edi, ecx
movzx ecx, dl
rol ebp, 3
xor ebp, ecx
cmp eax, 1
jg 0x104f5
mov ecx, dword [esp + 0x10]
pop ebx
cmp dword [esi + ecx - 8], edi
jne 0x10534
cmp dword [esi + ecx - 4], ebp
jne 0x10534
pop edi
mov eax, 1
pop ebp
ret 4
pop edi
xor eax, eax
pop ebp
ret 4

Function at 0x10540
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
mov cl, byte [eax]
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
lea edx, [esi - 8]
xor edi, edi
xor ebp, ebp
cmp edx, 1
jle 0x10599
push ebx
mov ebx, dword [esp + 0x18]
sub ebx, eax
lea esi, [edx + eax]
mov dword [esp + 0x10], ebx
dec edx
dec esi
mov bl, cl
mov cl, byte [esi]
mov al, dl
add al, bl
mov ebx, dword [esp + 0x10]
xor al, cl
mov byte [ebx + esi], al
movzx eax, al
ror edi, 3
xor edi, eax
movzx eax, cl
rol ebp, 3
xor ebp, eax
cmp edx, 1
jg 0x10568
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
pop ebx
mov cl, byte [eax]
mov edx, dword [esp + 0x14]
mov byte [edx], cl
cmp dword [eax + esi - 8], edi
jne 0x105b9
cmp dword [eax + esi - 4], ebp
jne 0x105b9
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret 0xc
Function at 0x10ad0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x30
push ebx
push ebp
push esi
push edi
push str.RegDeleteKeys
xor ebp, ebp
push str.__s__
mov dword [esp + 0x24], 0xc0000001
mov dword [esp + 0x1c], ebp
xor esi, esi
xor edi, edi
call fcn.00012710
mov ebx, dword [esp + 0x4c]
add esp, 8
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x34], eax
xor eax, eax
push eax
push eax
push eax
push eax
push ebx
mov dword [esp + 0x40], 0x18
mov dword [esp + 0x44], ebx
mov dword [esp + 0x4c], 0x40
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, 0x8000001a
je 0x10bd4
cmp eax, 0xc0000023
jne 0x10b6f
test esi, esi
je 0x10b54
push 0
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, dword [esp + 0x18]
push 0
push edx
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
test esi, esi
je 0x10be3
mov edi, dword [esp + 0x18]
jmp 0x10bb8
test eax, eax
jl 0x10be3
lea ecx, [esp + 0x28]
lea eax, [esi + 0x10]
push ecx
mov dword [esp + 0x28], eax
mov ax, word [esi + 0xc]
push 0xf003f
lea edx, [esp + 0x1c]
push edx
mov word [esp + 0x2e], ax
mov word [esp + 0x2c], ax
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jl 0x10be3
mov eax, dword [esp + 0x14]
push eax
call fcn.00010ad0
test eax, eax
jl 0x10be3
mov dword [esp + 0x14], 0
inc ebp
lea ecx, [esp + 0x18]
push ecx
push edi
push esi
push 0
push ebp
push ebx
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, 0x8000001a
jne 0x10b40
push ebx
call dword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
test eax, eax
jl 0x10be3
xor esi, esi
jmp 0x10be7
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10bf6
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 4

Function at 0x10c10
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x20
push 5
push 0x18
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jl 0x10c38
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
xor eax, eax
add esp, 0x20
ret 4
Function at 0x12430
Capabilities:
Create thread
Encode data using xor

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
push 0
push 0x28
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ebx, eax
test ebx, ebx
je 0x1255f
mov esi, 0x15298
or edx, 0xffffffff
sub esi, ebx
mov edi, 0xa
lea esp, [esp]
mov ecx, dword [esi + eax]
mov ebp, ecx
xor ebp, edx
mov dword [eax], ebp
add eax, 4
sub edi, 1
mov edx, ecx
jne 0x12460
push ebx
lea eax, [esp + 0x24]
xor esi, esi
push eax
mov dword [0x16f0c], esi
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0x40
push 7
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x2c]
push eax
mov dword [esp + 0x48], ecx
push 1
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x48], 0x18
mov dword [esp + 0x4c], esi
mov dword [esp + 0x54], 0x40
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
call dword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
mov eax, dword [esp + 0x14]
je 0x124ed
cmp eax, esi
je 0x12557
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push esi
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
mov edi, dword [sym.imp.ntoskrnl.exe_ZwClose]
cmp eax, esi
je 0x124fa
push eax
call edi
push esi
push 0x12240
push esi
push esi
push esi
push 0x2000000
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
test eax, eax
jl 0x12557
mov ecx, dword [esp + 0x1c]
push esi
lea eax, [esp + 0x1c]
push eax
push esi
push esi
push 0x1f03ff
push ecx
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
jl 0x1254c
mov edx, dword [esp + 0x18]
push esi
push esi
push esi
push esi
push edx
call dword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov ecx, dword [esp + 0x18]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, dword [esp + 0x1c]
cmp eax, esi
je 0x12557
push eax
call edi
push esi
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret

Function at 0x12660
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [0x16f0c], 0
je 0x126fc
push esi
push 0
push 8
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
test esi, esi
je 0x126fb
mov eax, dword [esp + 0xc]
mov dword [esi], eax
call dword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
push esi
push 0x12570
push 0
push 0
push 0
push 0x2000000
lea ecx, [esp + 0x1c]
push ecx
mov dword [esi + 4], eax
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
test eax, eax
jl 0x126fb
mov eax, dword [esp + 4]
push 0
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 0x1f03ff
push eax
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
jl 0x126ec
mov ecx, dword [esp + 0xc]
push 0
push 0
push 0
push 0
push ecx
call dword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov ecx, dword [esp + 0xc]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, dword [esp + 4]
test eax, eax
je 0x126fb
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop esi
pop ecx
ret 4
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x434fa0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x28000]
push edi
jmp 0x434fba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x434fc1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x434fb0
mov eax, 1
add ebx, ebx
jne 0x434fd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x434fc8
jne 0x434fe4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x434fc8
xor ecx, ecx
sub eax, 3
jb 0x434ff8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43506a
mov ebp, eax
add ebx, ebx
jne 0x435003
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x435010
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x435034
inc ecx
add ebx, ebx
jne 0x435020
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x435015
jne 0x435031
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x435015
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x435054
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x435045
jmp 0x434fb6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x435054
add edi, ecx
jmp 0x434fb6
pop esi
mov edi, esi
mov ecx, 0x91a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x435072
cmp byte [edi], 9
jne 0x435072
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x435077
lea edi, [esi + 0x32000]
mov eax, dword [edi]
or eax, eax
je 0x4350ef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4b13c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4b204]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4350a4
mov ecx, edi
jns 0x4350d3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4b208]
or eax, eax
je 0x4350e9
mov dword [ebx], eax
add ebx, 4
jmp 0x4350c1
call dword [esi + 0x4b218]
mov ebp, dword [esi + 0x4b20c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x435123
sub esp, 0xffffff80
jmp 0x41382f
Function at 0x406de9
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00406f99
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x406ee7
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x406e8a
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x406ecd
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x406ea1
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x406ebc
test al, 0x40
je 0x406eb3
mov ecx, dword [edi + 0x20]
jmp 0x406eba
test al, 0x80
je 0x406ecd
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x406ecd
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x406e59
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x40db97
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x40dbb5
mov eax, 0x65c4ba
push eax
push 1
mov ebx, 0x520db0
call fcn.00520700
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40dbdf
mov eax, 0
jmp 0x40dc53
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x40dc40
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x40dc29
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x40dc18
xor ecx, eax
xor edx, ebx
dec edi
jne 0x40dc09
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
mov esp, ebp
pop ebp
ret 4

Function at 0x4102f1
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.0041013c
and eax, 1
xor eax, 1
test eax, eax
je 0x41032a
mov edx, 0
mov eax, 0
jmp 0x410364
push 0x33
call 0x410331
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret

Function at 0x410368
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.0041013c
and eax, 1
xor eax, 1
test eax, eax
je 0x4103a1
mov edx, 0
mov eax, 0
jmp 0x4103d9
push 0x33
call 0x4103a8
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret 0x14

Function at 0x4103df
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
call fcn.0041013c
and eax, 1
xor eax, 1
test eax, eax
je 0x41040c
mov eax, 0
jmp 0x410441
push 0x33
call 0x410413
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret 0x14

Function at 0x410571
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.0041013c
and eax, 1
xor eax, 1
test eax, eax
je 0x410592
jmp 0x410633
cmp dword [ebp + 8], 0
jne 0x41059c
cmp dword [ebp + 0xc], 0
je 0x4105c6
cmp dword [ebp + 0x10], 0
jne 0x4105ac
cmp dword [ebp + 0x14], 0
je 0x4105c6
cmp dword [ebp + 0x18], 0
jne 0x4105bc
cmp dword [ebp + 0x1c], 0
je 0x4105c6
xor eax, eax
jmp 0x4105cb
mov eax, 1
test eax, eax
je 0x4105d8
jmp 0x410633
push 0x33
call 0x4105df
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret 0x18

Function at 0x410cb6
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
call fcn.0041013c
and eax, 1
xor eax, 1
test eax, eax
je 0x410ce3
mov eax, 0
jmp 0x410d16
push 0x33
call 0x410cea
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret 0x14
Function at 0x410d38
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
call fcn.0041013c
and eax, 1
xor eax, 1
test eax, eax
je 0x410d65
mov eax, 0
jmp 0x410dad
mov dword [ebp - 4], 0
push 0x33
call 0x410d73
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret 0x10

Function at 0x410de7
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
call fcn.0041013c
and eax, 1
xor eax, 1
test eax, eax
je 0x410e2e
mov edx, 0
mov eax, 0
jmp 0x410f30
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
push 0x33
call 0x410e51
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret 0x1c