joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c760
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0xc]
sub edx, 1
mov dword [ebp + 0xc], edx
test ecx, ecx
je 0x40c7bb
mov eax, dword [ebp - 4]
xor ecx, ecx
mov cl, byte [eax]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
and eax, 0xff
mov ecx, dword [ebp - 0xc]
xor ecx, eax
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
shr edx, 8
mov eax, dword [ebp - 0xc]
xor edx, dword [eax*4 + 0x4222b8]
mov dword [ebp - 8], edx
jmp 0x40c773
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x40ff10
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x4116eb
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push 0x40
push 0x36
lea eax, [ebp - 0x40]
push eax
call fcn.0041bb50
add esp, 0xc
mov dword [ebp - 0x44], 0
jmp 0x411713
mov ecx, dword [ebp - 0x44]
add ecx, 1
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x44]
cmp edx, dword [ebp + 0x14]
jge 0x411739
cmp dword [ebp - 0x44], 0x40
jge 0x411739
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov dl, byte [ebp + ecx - 0x40]
xor dl, byte [eax]
mov eax, dword [ebp - 0x44]
mov byte [ebp + eax - 0x40], dl
jmp 0x41170a
mov ecx, dword [ebp + 8]
push ecx
call fcn.0041139b
add esp, 4
push 0x40
lea edx, [ebp - 0x40]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004113ca
add esp, 0xc
push 0x40
push 0x5c
lea ecx, [ebp - 0x40]
push ecx
call fcn.0041bb50
add esp, 0xc
mov dword [ebp - 0x44], 0
jmp 0x411779
mov edx, dword [ebp - 0x44]
add edx, 1
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp + 0x14]
jge 0x41179f
cmp dword [ebp - 0x44], 0x40
jge 0x41179f
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x44]
mov al, byte [ebp + edx - 0x40]
xor al, byte [ecx]
mov ecx, dword [ebp - 0x44]
mov byte [ebp + ecx - 0x40], al
jmp 0x411770
mov edx, dword [ebp + 0xc]
push edx
call fcn.0041139b
add esp, 4
push 0x40
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004113ca
add esp, 0xc
push 0x40
push 0
lea edx, [ebp - 0x40]
push edx
call fcn.0041bb50
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x4136e0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0xc3d2e1f0
pop ebp
ret
Function at 0x413dc1
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push 0x40
push 0x36
lea eax, [ebp - 0x40]
push eax
call fcn.0041bb50
add esp, 0xc
mov dword [ebp - 0x44], 0
jmp 0x413de9
mov ecx, dword [ebp - 0x44]
add ecx, 1
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x44]
cmp edx, dword [ebp + 0x14]
jge 0x413e0f
cmp dword [ebp - 0x44], 0x40
jge 0x413e0f
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov dl, byte [ebp + ecx - 0x40]
xor dl, byte [eax]
mov eax, dword [ebp - 0x44]
mov byte [ebp + eax - 0x40], dl
jmp 0x413de0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00413a2e
add esp, 4
push 0x40
lea edx, [ebp - 0x40]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00413a5d
add esp, 0xc
push 0x40
push 0x5c
lea ecx, [ebp - 0x40]
push ecx
call fcn.0041bb50
add esp, 0xc
mov dword [ebp - 0x44], 0
jmp 0x413e4f
mov edx, dword [ebp - 0x44]
add edx, 1
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp + 0x14]
jge 0x413e75
cmp dword [ebp - 0x44], 0x40
jge 0x413e75
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x44]
mov al, byte [ebp + edx - 0x40]
xor al, byte [ecx]
mov ecx, dword [ebp - 0x44]
mov byte [ebp + ecx - 0x40], al
jmp 0x413e46
mov edx, dword [ebp + 0xc]
push edx
call fcn.00413a2e
add esp, 4
push 0x40
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00413a5d
add esp, 0xc
push 0x40
push 0
lea edx, [ebp - 0x40]
push edx
call fcn.0041bb50
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x416f18
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x416f39
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret

Function at 0x41701a
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x4354b4], 1
cmp dword [0x435538], 0
je 0x41705c
mov eax, dword [0x435538]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41705c
push 0
mov ecx, dword [0x435538]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x435538]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
pop ebp
ret
Function at 0x417bbc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0041940a
add esp, 0x10
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x40c], ecx
cmp dword [ebp - 0x40c], 1
je 0x417c00
cmp dword [ebp - 0x40c], 2
je 0x417c53
jmp 0x417ca7
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [0x435e84]
push eax
push 0x435a80
push 0x118
call fcn.004017a0
add esp, 4
push eax
lea ecx, [ebp - 0x408]
push ecx
call fcn.0041ad90
add esp, 0x14
push 0x40034
push 0x117
call fcn.004017a0
add esp, 4
push eax
lea edx, [ebp - 0x408]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 8], eax
jmp 0x417ca9
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [0x435e84]
push ecx
push 0x435a80
push 0x11a
call fcn.004017a0
add esp, 4
push eax
lea edx, [ebp - 0x408]
push edx
call fcn.0041ad90
add esp, 0x14
push 0x40034
push 0x117
call fcn.004017a0
add esp, 4
push eax
lea eax, [ebp - 0x408]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 8], eax
jmp 0x417ca9
jmp 0x417cce
cmp dword [ebp - 8], 7
jne 0x417cb6
push 0
call fcn.0041aea5
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0041977e
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x4182f9
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x200c
call fcn.004017c7
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
push 0x200c
push 0
mov eax, dword [ebp - 8]
push eax
call fcn.0041bb50
add esp, 0xc
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 8]
add edx, 0xc
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov ecx, dword [ebp + 8]
push ecx
call sub.WSOCK32.dll_inet_addr
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4183d9
mov edx, dword [ebp - 8]
cmp dword [edx + 4], 0
jne 0x418379
mov eax, dword [ebp + 8]
push eax
call sub.WSOCK32.dll_gethostbyname
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x418379
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], 2
mov edx, dword [ebp - 8]
cmp dword [edx + 4], 0
jne 0x41839d
call sub.WSOCK32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.00417d88
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x4183d7
mov edx, dword [ebp - 8]
mov dword [edx], 0
push 4
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
push edx
lea eax, [ebp - 4]
push eax
call fcn.0041b480
add esp, 0xc
push 0x2000
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 8]
add eax, 0xc
push eax
call fcn.0041aa50
add esp, 0xc
jmp 0x4183eb
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], 2
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
push ecx
call sub.WSOCK32.dll_ntohl
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x418666
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jne 0x418677
jmp 0x4187fa
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0
je 0x4187fa
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x18], 0
je 0x4187fa
mov edx, dword [ebp + 8]
cmp dword [edx + 0x1c], 0
je 0x4186ac
mov dword [ebp - 0xc], 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 8], ecx
jmp 0x4186c8
mov dword [ebp - 0xc], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
mov eax, dword [eax + 4]
sub eax, dword [edx + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
mov edx, dword [eax + 8]
lea eax, [ecx + edx + 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call sub.WSOCK32.dll_send
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x418775
call sub.WSOCK32.dll_WSAGetLastError
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x2733
jne 0x418719
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0
jmp 0x4187fa
cmp dword [ebp - 4], 0x2745
je 0x41872b
cmp dword [ebp - 4], 0x2746
jne 0x418759
mov ecx, dword [ebp + 8]
push ecx
call fcn.00418de7
add esp, 4
test eax, eax
jne 0x418752
mov edx, dword [ebp - 4]
push edx
call fcn.00417d88
add esp, 4
push eax
call fcn.0041a994
add esp, 4
jmp 0x418757
jmp 0x4187fa
jmp 0x418773
mov eax, dword [ebp - 4]
push eax
call fcn.00417d88
add esp, 4
push eax
call fcn.0041a994
add esp, 4
jmp 0x4187fa
jmp 0x4187e9
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 8]
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1c], 0
je 0x4187a2
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov edx, dword [edx + 8]
cmp edx, dword [ecx + 4]
jl 0x4187e9
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.0040184a
add esp, 4
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0
jne 0x4187e9
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x10]
push edx
call fcn.00401a8a
add esp, 4
jmp 0x418677
mov esp, ebp
pop ebp
ret
Function at 0x41977e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov eax, dword [ebp + 8]
push eax
call fcn.0041ac20
add esp, 4
mov esi, eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0041ac20
add esp, 4
add esi, eax
imul esi, esi, 3
add esi, 0xf
push esi
call fcn.004017c7
add esp, 4
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00419708
add esp, 0x10
lea eax, [ebp - 4]
push eax
push str.SoftwareNetSarangXsshServerHostKeys
push bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x4197e5
jmp 0x419815
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.0041ac20
add esp, 4
add eax, 1
push eax
mov edx, dword [ebp + 0x14]
push edx
push 1
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41987c
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0x212
lea eax, [ebp - 4]
push eax
push 0x4289e8
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4198e1
lea ecx, [ebp - 8]
push ecx
push 0x4355c8
lea edx, [ebp - 0xc]
push edx
push 0
push str.RandSeedFile
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4198ce
cmp dword [ebp - 0xc], 1
je 0x4198d5
mov byte [0x4355c8], 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4198e8
mov byte [0x4355c8], 0
movsx edx, byte [0x4355c8]
test edx, edx
jne 0x419977
push 0x212
push 0x4355c8
push str.HOMEDRIVE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x18], eax
mov eax, 0x212
sub eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x4355c8
push ecx
push str.HOMEPATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x419958
push 0x212
push 0x4355c8
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4355c8
call fcn.0041ac20
add esp, 4
mov dword [ebp - 0x18], eax
jmp 0x419961
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], edx
push str.Xssh.RND
mov eax, dword [ebp - 0x18]
add eax, 0x4355c8
push eax
call fcn.0041aca0
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x419a56
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov dword [ebp - 8], 0
push 0x105
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x419ac6
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x419ab3
mov eax, dword [ebp - 4]
push eax
call fcn.00419a56
add esp, 4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x110]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x419a66
mov esp, ebp
pop ebp
ret

Function at 0x41a3d9
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push 0x104
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x104]
push ecx
call fcn.0041ac20
add esp, 4
sub eax, 1
mov dword [ebp - 0x108], eax
jmp 0x41a426
mov edx, dword [ebp - 0x108]
sub edx, 1
mov dword [ebp - 0x108], edx
mov eax, dword [ebp - 0x108]
movsx ecx, byte [ebp + eax - 0x104]
cmp ecx, 0x5c
jne 0x41a43b
jmp 0x41a44b
mov edx, dword [ebp - 0x108]
mov byte [ebp + edx - 0x104], 0
jmp 0x41a417
push str.Xmanager.ini
lea eax, [ebp - 0x104]
push eax
call fcn.0041acb0
add esp, 8
lea ecx, [ebp - 0x104]
push ecx
push 0
push str.DisplayNumber
push str.Options
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esp, ebp
pop ebp
ret

Function at 0x41a5d4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push str.Xmanager:NET
push str.Xmanager
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x41a665
push 0x145
call fcn.004017a0
add esp, 4
push eax
call fcn.0041705e
add esp, 4
cmp dword [0x435e94], 0
je 0x41a62c
call fcn.0041a3d9
push eax
push str.Xmanager.exe__passive_:__d_
lea eax, [ebp - 0x104]
push eax
call fcn.0041ad90
add esp, 0xc
jmp 0x41a640
push str.Xmanager.exe__passive
lea ecx, [ebp - 0x104]
push ecx
call fcn.0041ad90
add esp, 8
push 5
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
ja 0x41a665
push 0xea
call fcn.00416e5e
add esp, 4
xor eax, eax
jmp 0x41a66a
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x41a66e
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov word [ebp - 4], 0x101
lea eax, [ebp - 0x194]
push eax
mov cx, word [ebp - 4]
push ecx
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x41a6a3
push 0xe4
call fcn.00416e5e
add esp, 4
xor eax, eax
jmp 0x41a6ec
mov edx, dword [ebp - 0x194]
and edx, 0xff
cmp edx, 1
jne 0x41a6d1
mov eax, dword [ebp - 0x194]
and eax, 0xffff
sar eax, 8
and eax, 0xff
and eax, 0xff
cmp eax, 1
je 0x41a6e7
push 0xe5
call fcn.00416e5e
add esp, 4
call sub.WSOCK32.dll_WSACleanup
xor eax, eax
jmp 0x41a6ec
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x41da17
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x429070
cmp edx, dword [eax]
je 0x41da39
add eax, 8
inc ecx
cmp eax, 0x429100
jl 0x41da2a
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x429070]
jne 0x41db67
mov eax, dword [0x435900]
cmp eax, 1
je 0x41db41
test eax, eax
jne 0x41da6a
cmp dword [0x42904c], 1
je 0x41db41
cmp edx, 0xfc
je 0x41db67
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41daa1
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0041aca0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0041ac20
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x41dae4
lea eax, [ebp - 0x1a4]
push eax
call fcn.0041ac20
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x426c54
push edi
call fcn.0041aa50
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0041aca0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0041acb0
lea eax, [ebp - 0xa0]
push 0x426c34
push eax
call fcn.0041acb0
push dword [esi + 0x429074]
lea eax, [ebp - 0xa0]
push eax
call fcn.0041acb0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0041f544
add esp, 0x2c
pop edi
jmp 0x41db67
lea eax, [ebp + 8]
lea esi, [esi + 0x429074]
push 0
push eax
push dword [esi]
call fcn.0041ac20
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x403371
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x40339c
mov ecx, dword [0x4702b8]
push esi
add eax, ecx
push esi
push eax
mov dword [0x4326f4], eax
push dword [0x40a01c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
call fcn.00403479
cmp eax, esi
jl 0x403473
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.004061db
test eax, eax
je 0x403463
push dword [ebp + 8]
add dword [0x4326f4], 4
call fcn.00403479
mov ebx, eax
cmp ebx, esi
jl 0x403471
cmp dword [ebp + 0x10], esi
jne 0x40343f
cmp dword [ebp + 8], esi
jle 0x403471
mov esi, 0x4266f0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x403401
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.004061db
test eax, eax
je 0x403463
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.0040620a
test eax, eax
je 0x40343b
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x4326f4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4033f0
jmp 0x403471
push 0xfffffffffffffffe
jmp 0x403465
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x40344a
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x403468
push 0xfffffffffffffffd
pop eax
jmp 0x403473
mov ebx, dword [ebp - 4]
add dword [0x4326f4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10

Function at 0x40462b
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x404666
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x40464d
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x40465e
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x404668
inc edi
add eax, 0x28
cmp edi, esi
jb 0x404643
xor eax, eax
pop edi
pop esi
ret

Function at 0x406668
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.004045b0
add esp, 0xc
invalid
invalid
invalid

Function at 0x4069c5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4069e9
xor eax, eax
test eax, eax
je 0x4069fc
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4069fc
xor ecx, ecx
jmp 0x4069ff
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4
Function at 0x61c36250
Capabilities:
Inspect section memory permissions

Disassembly:
add byte [ebx + 0x448d2478], cl
or bh, bh
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x61c362b2
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x61c36299
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x61c362a2
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x61c362ac
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x61c3628e
inc dword [ebp + 0xc]

Function at 0x61c362b5
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x61c36236
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x61c36254
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
invalid
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x61c36218
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x61c362ff
dec eax
je 0x61c362f6
sub eax, 3
je 0x61c362ed
mov dword [ebp - 4], 0x40
jmp 0x61c3631c
mov dword [ebp - 4], 4
jmp 0x61c36302
mov dword [ebp - 4], 0x20
jmp 0x61c36302
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x61c3634e
mov ch, 0x54
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x61c362ce
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.61c35b5f
dec esi
jge 0x61c3630a
clc
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x61c3635a
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x61c3786a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
mov byte [ebp - 0x7a4], 0x21
mov byte [ebp - 0x7a3], 0x20
mov byte [ebp - 0x7a2], 0x3c
mov byte [ebp - 0x7a1], 0x76
mov byte [ebp - 0x7a0], 0x7e
mov byte [ebp - 0x79f], 0x7e
mov byte [ebp - 0x79e], 0x12
push 0xb
lea eax, [ebp - 0x7ac]
push eax
call fcn.61c35b6f
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.61c35ad0
add esp, 0xc
jmp 0x61c37ad7
mov eax, dword [ebp - 0x6fc]
inc eax
mov dword [ebp - 0x6fc], eax
and dword [ebp - 0x37c], 0
call fcn.61c35b5f
adc al, 0x8f
invalid