joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436de0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b6eff
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4e43e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0xc], 0
je 0x436e35
mov dword [esi], 0x4c6bdc
mov dword [esi + 0x50], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [esi]
lea edi, [esi + 4]
push 0
push edi
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + esi - 4], eax
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.0043b7a0
mov eax, dword [esi]
push 8
mov dword [ebp - 4], 2
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov dword [ebp + 0xc], edi
lea eax, [ecx - 0x50]
mov dword [ecx + esi - 4], eax
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0042a2d7
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x436eb1
xorps xmm0, xmm0
movq qword [ebx], xmm0
push 1
mov byte [ebp - 4], 3
call fcn.0048e7f9
add esp, 4
mov dword [ebx + 4], eax
jmp 0x436eb3
xor ebx, ebx
lea eax, [edi + 4]
mov dword [edi + 0x34], ebx
mov dword [edi + 0xc], eax
lea ecx, [edi + 8]
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov ebx, dword [ebp + 8]
mov ecx, ebx
not ecx
mov dword [edi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
and ecx, 1
mov dword [edi + 0x38], 0
shl ecx, 2
mov eax, ebx
mov edx, ecx
or edx, 8
and al, 8
cmove edx, ecx
mov eax, edx
or eax, 0x10
and bl, 4
cmove eax, edx
mov dword [edi + 0x3c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4387f0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7206
mov eax, dword fs:[0]
push eax
sub esp, 0x108
mov eax, dword [0x4e43e0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ecx + 8]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 4], 0
test esi, esi
je 0x4388dd
test edi, edi
je 0x438909
mov edx, dword [ebp + 0x10]
test edx, 0xf
jne 0x438935
lea eax, [edx - 0x10]
cmp dword [ebp + 0xc], eax
jbe 0x438961
cmp byte [ecx + 0x10], 0
je 0x43898d
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], edx
push eax
push edi
push 0
push 1
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov ecx, eax
test ecx, ecx
je 0x4389b9
jmp 0x4388b5
mov eax, dword [ebp - 0x18]
mov dword [ebx], eax
test ecx, ecx
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042a265
mov esp, ebp
pop ebp
ret 0x10
push 0x80090003
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Decrypt_1_:_Key_is_not_valid
lea ecx, [ebp - 0xc0]
call fcn.00437140
push 0x4dc4cc
lea eax, [ebp - 0xc0]
push eax
call fcn.00441bed
push 0x6f8
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Decrypt_1_:_Buffer_is_NULL
lea ecx, [ebp - 0xcc]
call fcn.00437140
push 0x4dc4cc
lea eax, [ebp - 0xcc]
push eax
call fcn.00441bed
push 0x80090005
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Decrypt_1_:_Data_size_is_not_a_multple_of_block_size
lea ecx, [ebp - 0xd8]
call fcn.00437140
push 0x4dc4cc
lea eax, [ebp - 0xd8]
push eax
call fcn.00441bed
push 0x80090028
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Decrypt_1_:_Buffer_is_too_small
lea ecx, [ebp - 0xe4]
call fcn.00437140
push 0x4dc4cc
lea eax, [ebp - 0xe4]
push eax
call fcn.00441bed
push 0x80090027
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Decrypt_1_:_IV_has_not_been_set
lea ecx, [ebp - 0xf0]
call fcn.00437140
push 0x4dc4cc
lea eax, [ebp - 0xf0]
push eax
call fcn.00441bed
push 0x98
lea ecx, [ebp - 0xb0]
call fcn.0043abc0
push 1
push 2
lea ecx, [ebp - 0xb0]
call fcn.00436de0
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 1
push str.Decrypt_1_:_CryptDecrypt_failed__
push eax
call fcn.00436350
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 8
call esi
push eax
call fcn.00439400
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.00436350
add esp, 0xc
lea eax, [ebp - 0xb0]
push str.__0x
push eax
call fcn.00436350
add esp, 8
mov ecx, eax
push 0x43b770
call fcn.004380d0
mov edi, eax
call esi
push eax
mov ecx, edi
call fcn.00437da0
push 0x4c6c84
push eax
call fcn.00436350
add esp, 8
mov dword [ebx], 0
lea eax, [ebp - 0x114]
lea ecx, [ebp - 0xb0]
push eax
call fcn.0043c0e0
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0043ad20
push eax
lea ecx, [ebp - 0xfc]
call fcn.00437140
push 0x4dc4cc
lea eax, [ebp - 0xfc]
push eax
call fcn.00441bed
push 0
push 0
call fcn.00441bed
int3
Function at 0x438e10
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7286
mov eax, dword fs:[0]
push eax
sub esp, 0xfc
mov eax, dword [0x4e43e0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edx, dword [ecx + 8]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 4], 0
test edx, edx
je 0x438ef9
test esi, esi
je 0x438f25
mov ebx, dword [ebp + 0x10]
mov eax, ebx
and eax, 0xfffffff0
add eax, 0x10
cmp dword [ebp + 0xc], eax
jb 0x438f51
cmp byte [ecx + 0x10], 0
je 0x438f7d
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
push esi
push 0
push 1
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov ecx, eax
test ecx, ecx
je 0x438fa9
jmp 0x438ed1
mov eax, dword [ebp - 0x18]
mov dword [edi], eax
test ecx, ecx
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042a265
mov esp, ebp
pop ebp
ret 0x10
push 0x80090003
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Encrypt_1_:_Key_is_not_valid
lea ecx, [ebp - 0xc0]
call fcn.00437140
push 0x4dc4cc
lea eax, [ebp - 0xc0]
push eax
call fcn.00441bed
push 0x6f8
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Encrypt_1_:_Buffer_is_NULL
lea ecx, [ebp - 0xcc]
call fcn.00437140
push 0x4dc4cc
lea eax, [ebp - 0xcc]
push eax
call fcn.00441bed
push 0x80090028
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Encrypt_1_:_Buffer_is_too_small
lea ecx, [ebp - 0xd8]
call fcn.00437140
push 0x4dc4cc
lea eax, [ebp - 0xd8]
push eax
call fcn.00441bed
push 0x80090027
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Encrypt_1_:_IV_has_not_been_set
lea ecx, [ebp - 0xe4]
call fcn.00437140
push 0x4dc4cc
lea eax, [ebp - 0xe4]
push eax
call fcn.00441bed
push 0x98
lea ecx, [ebp - 0xb0]
call fcn.0043abc0
push 1
push 2
lea ecx, [ebp - 0xb0]
call fcn.00436de0
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 1
push str.Encrypt_1_:_CryptEncrypt_failed__
push eax
call fcn.00436350
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 8
call esi
push eax
call fcn.00439400
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.00436350
add esp, 0xc
lea eax, [ebp - 0xb0]
push str.__0x
push eax
call fcn.00436350
add esp, 8
mov ecx, eax
push 0x43b770
call fcn.004380d0
mov ebx, eax
call esi
push eax
mov ecx, ebx
call fcn.00437da0
push 0x4c6c84
push eax
call fcn.00436350
add esp, 8
mov dword [edi], 0
lea eax, [ebp - 0x108]
lea ecx, [ebp - 0xb0]
push eax
call fcn.0043c0e0
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0043ad20
push eax
lea ecx, [ebp - 0xf0]
call fcn.00437140
push 0x4dc4cc
lea eax, [ebp - 0xf0]
push eax
call fcn.00441bed
push 0
push 0
call fcn.00441bed
int3
Function at 0x439810
Capabilities:
Encrypt data using aes via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7328
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x4e43e0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov eax, dword [edi + 8]
lea ebx, [edi + 8]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x18], ecx
test eax, eax
je 0x43986a
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [ebp - 0x18]
mov dword [ebx], 0
mov byte [edi + 0x10], 0
cmp dword [edi + 4], 0
mov dword [ebp - 4], 0
je 0x439999
test ecx, ecx
je 0x4399b4
mov esi, dword [ebp + 0xc]
cmp esi, 0x10
je 0x439899
cmp esi, 0x18
je 0x439899
cmp esi, 0x20
jne 0x4399cf
push 0x2c
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.004421e0
add esp, 0xc
mov dword [ebp - 0x44], 0x208
mov byte [ebp - 4], 1
cmp esi, 0x10
je 0x4398e0
cmp esi, 0x18
je 0x4398d2
cmp esi, 0x20
jne 0x4399ea
mov dword [ebp - 0x40], 0x6610
mov eax, esi
jmp 0x4398ec
mov dword [ebp - 0x40], 0x660f
mov eax, 0x18
jmp 0x4398ec
mov dword [ebp - 0x40], 0x660e
mov eax, 0x10
push esi
push dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0043c550
add esp, 0x10
test eax, eax
jne 0x439a05
push ebx
push 0
push 0
lea eax, [esi + 0xc]
push eax
lea eax, [ebp - 0x44]
push eax
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x439a26
push 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 1
push eax
push 4
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x439a47
jmp 0x439963
mov al, 1
lea ecx, [ebp - 0x44]
mov edx, 4
nop dword [eax]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub edx, 1
jne 0x439970
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042a265
mov esp, ebp
pop ebp
ret 8
push str.SetKey:_Provider_is_not_valid
lea ecx, [ebp - 0x58]
call fcn.00437140
push 0x4dc4cc
lea eax, [ebp - 0x58]
push eax
call fcn.00441bed
push str.SetKey:_Key_buffer_is_NULL
lea ecx, [ebp - 0x64]
call fcn.00437140
push 0x4dc4cc
lea eax, [ebp - 0x64]
push eax
call fcn.00441bed
push str.SetKey:_Key_size_is_not_valid
lea ecx, [ebp - 0x70]
call fcn.00437140
push 0x4dc4cc
lea eax, [ebp - 0x70]
push eax
call fcn.00441bed
push str.SetKey:_Key_size_is_not_valid
lea ecx, [ebp - 0x7c]
call fcn.00437140
push 0x4dc4cc
lea eax, [ebp - 0x7c]
push eax
call fcn.00441bed
push str.SetKey:_Unable_to_copy_key
lea ecx, [ebp - 0x88]
call fcn.00437140
push 0x4dc4cc
lea eax, [ebp - 0x88]
push eax
call fcn.00441bed
push str.SetKey:_Import_key_failed
lea ecx, [ebp - 0x94]
call fcn.00437140
push 0x4dc4cc
lea eax, [ebp - 0x94]
push eax
call fcn.00441bed
push str.SetKey:_Set_CBC_mode_failed
lea ecx, [ebp - 0xa0]
call fcn.00437140
push 0x4dc4cc
lea eax, [ebp - 0xa0]
push eax
call fcn.00441bed
push 0
push 0
call fcn.00441bed
int3
Function at 0x43b7a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7528
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x4e43e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.0042a2d7
mov edi, eax
add esp, 4
test edi, edi
je 0x43b844
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0048e7f9
add esp, 4
mov dword [edi + 4], eax
jmp 0x43b846
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.00436ab0
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov bl, al
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x43b8a7
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x43b8a7
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov byte [esi + 0x40], bl
jne 0x43b90e
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
je 0x43b90e
push 1
test cl, 4
jne 0x43b931
test cl, 2
je 0x43b8ea
lea eax, [ebp - 0x14]
push eax
call fcn.0043b960
add esp, 8
push eax
push str.ios_base::failbit_set
jmp 0x43b943
lea eax, [ebp - 0x1c]
push eax
call fcn.0043b960
add esp, 8
lea ecx, [ebp - 0x44]
push eax
push str.ios_base::eofbit_set
call fcn.004374b0
push 0x4dc450
lea eax, [ebp - 0x44]
jmp 0x43b953
cmp byte [ebp + 0xc], 0
je 0x43b91d
push esi
call fcn.0048fc1d
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x14]
push eax
call fcn.0043b960
add esp, 8
push eax
push str.ios_base::badbit_set
lea ecx, [ebp - 0x30]
call fcn.004374b0
push 0x4dc450
lea eax, [ebp - 0x30]
push eax
call fcn.00441bed
int3
Function at 0x43f3e0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call fcn.0043f9f0
add esp, 8
test al, al
je 0x43f405
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x43f405
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x43f9f0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x440e60
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x440e8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x440e8b
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
pop esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x47ed86
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047e560

Function at 0x47ed91
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047e79b

Function at 0x47f8d7
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047f65e

Function at 0x487466
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048706b

Function at 0x487471
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004871ec

Function at 0x498213
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
sub eax, edx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0xc], edx
sbb esi, esi
not esi
and esi, eax
je 0x498242
movzx eax, byte [edx]
xor eax, dword [ecx]
imul eax, eax, 0x1000193
inc edx
inc edi
mov dword [ecx], eax
cmp edi, esi
jne 0x49822d
jmp 0x498244
mov eax, dword [ecx]
pop edi
pop esi
pop ebp
ret 8
Function at 0xebb924
Capabilities:
Encode data using xor

Disassembly:
jmp 0xebb92e
pushal
call 0xebb934
pop ebp
sub ebp, 0x10
sub ebp, 0xabb924
jmp 0xebb94a
mov eax, 0xabb924
add eax, ebp
add eax, 0x4c
mov ecx, 0x595
mov edx, 0x397b4ebb
xor byte [eax], dl
inc eax
dec ecx
jne 0xebb961
jmp 0xebb974
add eax, 0x3079a678
jbe 0xebb9a7
xor byte [esi + 0x30], dh
xor al, byte [edi + 0x3abbbbbb]
jp 0xebb9c2
mov ebx, 0x76b8bbbb
add edi, dword [edi + 0x1bbbbbb]
xchg ebx, eax
mov ebx, 0x9301bbbb
mov ebx, 0xbb9301bb
mov ebx, 0xb8594cbb
jae 0xebb9c3
mov ebx, 0x594cbbbb
mov eax, 0xb73a3073
mov ebx, 0x7eb8bbbb
jmp 0xebb987
cmp dh, byte [edi - 0x47444445]
jle 0xebb986
jmp 0xebb970
xchg edi, eax
lahf
shl dword [edi], cl
aam 0x58
push ebx
mov esi, 0x52bbbbbb
invalid
mov bl, 0xbb
mov bl, 0xbb
mov ebx, 0xb72e30bb
mov ebx, 0x3630bbbb
stosd dword es:[edi], eax
mov ebx, 0x527abbbb
mov ecx, 0x7938b98a
mov edi, 0x4f3eb4f2
inc esp
inc esp
inc esp
xor byte [edi - 0x6020c961], dl
mov edi, 0x30bbb779
aaa
lahf
mov edi, 0xd3bbbbbb
out 0xa3, eax
wait
mov ebx, 0x301b7dd3
mov ebx, 0xea9f97ba
push ebx
mov esi, 0x52bbbbbb
cmp byte [ecx - 0x20c94445], 0x9f
inc edi
xor dl, byte [edi + 0x44e6ef9f]
into
mov bh, 0x44
into
mov bl, 0x53
fnstsw word [ebx + 0x630bbbb]
mov bl, 0xbb
mov ebx, 0x887288bb
imul edi, dword [eax], 0xb4f3be53
aas
cmc
mov ebx, 0x33b4bbbb
mov ebx, 0x30ddbbbb
cmpsd dword [esi], dword es:[edi]
cmp byte [ebx], 0x40
push ebx
mov ah, 0x3f
mov eax, dword [0x3bbbbbbb]
inc eax
push edx
mov ah, 0x3f
stosb byte es:[edi], al
mov ebx, 0x3addbbbb
inc eax
inc esp
sahf
mov ah, 0x3f
scasb al, byte es:[edi]
mov ebx, 0x52fabbbb
ja 0xebbaa2
inc esp
inc esp
xchg edx, eax
test dword [edx - 0x4185c746], 0x52bf5338
push es
inc esp
inc esp
inc esp
xchg edx, eax
out dx, eax
cmp byte [ecx + 0x38bd7a38], 0x51
mov edi, 0x52be5338
adc byte [esp + eax*2 + 0x44], al
out 0x79, al
mov bh, 0xbb
out dx, al
xor byte [edi - 0x13], dl
in al, dx
out dx, al
xor dh, cl
mov bh, 0x30
invalid
mov ebx, 0xbbb900bb
mov ebx, 0xb469b9bb
mov esi, 0x31bbbbbb
lodsd eax, dword [esi]
std
test eax, 0x6338b469
inc esp
inc esp
inc esp
mov ecx, 0xbe3eb469
mov ebx, 0xad31bbbb
std
test eax, 0xd138b469
mov ebx, 0x7b88bbbb
mov ecx, 0xbe3eb469
mov ebx, 0xad31bbbb
std
test eax, 0x9138b469
mov edx, 0x69b9bbbb
mov ah, 0x3e
mov esi, 0x31bbbbbb
lodsd eax, dword [esi]
std
test eax, 0xb97ba869
imul esi, dword [esi + edi - 0x44444442], 0xa9fdad31
imul ebp, dword [eax - 0x4b964685], 0xbbbbbe3e
mov ebx, 0xa9fdad31
imul ebp, dword [eax - 0x4b964685], 0xbbbbbe3e
mov ebx, 0xa9fdad31
imul ebp, dword [eax - 0x42c04b85], 0x30bbbbbb
nop
arpl word [ecx], si
mov eax, 0xfcbc33
mov ecx, 0x52bbbbbb
retf
Function at 0x406980
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
push str.ldplayerAudio_start
push 0x40
lea edi, [esi + 0x40]
mov dword [edi], 0x65
push str.LDPlayerAudio::start
call fcn.00419410
add esp, 0xc
lea eax, [esi + 0xc4]
push 0x10
push eax
push 0
push 0x84
push edi
push dword [esi + 0x1c]
call dword [sym.imp.WS2_32.dll_sendto]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x84
jne 0x406ab8
lea eax, [ebp - 0x108]
mov dword [ebp - 0x108], 0x10
push eax
lea eax, [esi + 0xc4]
push eax
push 0
push 0x100
lea eax, [ebp - 0x104]
push eax
push dword [esi + 0x1c]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [edi], 0x65
jne 0x406a1a
mov dword [edi], 0x64
cmp byte [esi + 0xd8], 0
jne 0x406acf
cmp eax, 8
jb 0x406a7c
cmp dword [ebp - 0x104], 0xc8
jne 0x406a70
mov eax, dword [ebp - 0x100]
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x108], eax
mov eax, dword [esi + 0xd4]
mov dword [ebp - 0x10c], eax
test ecx, ecx
je 0x406ae0
mov eax, dword [ecx]
lea edx, [ebp - 0x108]
push edx
lea edx, [ebp - 0x10c]
push edx
call dword [eax + 8]
jmp 0x406a93
call ebx
push eax
push str.LDPlayerAudio::readAudio_erro_1__d
push 0x5a
jmp 0x406a86
call ebx
push eax
push str.LDPlayerAudio::readAudio_erro_2__d
push 0x5e
push str.LDPlayerAudio::start
call fcn.00419410
add esp, 0x10
push 0x10
lea eax, [esi + 0xc4]
push eax
push 0
push 0x84
push edi
push dword [esi + 0x1c]
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0x84
je 0x4069e0
call ebx
push eax
push str.LDPlayerAudio::readAudio_3__d
push 0x62
push str.LDPlayerAudio::start
call fcn.00419410
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00422442
mov esp, ebp
pop ebp
ret
call dword [sym.imp.MSVCP120.dll_void___cdecl_std::_Xbad_function_call_void_]
int3
Function at 0x406fb0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
push 0x10
lea edi, [esi + 0xc4]
push edi
push 0
push 0x9c
lea eax, [esi + 0x28]
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0x9c
jne 0x40705b
lea eax, [ebp - 0x108]
mov dword [ebp - 0x108], 0x10
push eax
push edi
push 0
push 0x100
lea eax, [ebp - 0x104]
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp eax, 4
jb 0x40704b
cmp dword [ebp - 0x104], 0xc8
jne 0x40703b
mov eax, dword [esi + 0xd4]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422442
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LDPlayerReader::readPix_erro_1__d
push 0x4c
jmp 0x407069
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LDPlayerReader::readPix_erro_2__d
push 0x50
jmp 0x407069
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LDPlayerReader::readPix_3__d
push 0x55
push str.LDPlayerReader::readPix
call fcn.00419410
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
xor eax, eax
pop edi
pop esi
call fcn.00422442
mov esp, ebp
pop ebp
ret