joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4207ec
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x93be07
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x420827
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x420840
lea eax, [ebp - 0x10]
mov edx, dword [0x95977c]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.00404d30
jmp 0x420853
lea eax, [ebp - 0x10]
mov edx, dword [0x95977c]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x42085f
adc edx, 0
mov edx, dword [edx*4 + 0x958568]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x4209d9
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4209cc
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4209cc
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dec
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4209cc
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4209cc
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x42096a
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x42096a
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x42096a
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x42096a
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x4209cc
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x4209cc
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x4209cc
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4209cc
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4209cc
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x4209f1
inc ebx
cmp ebx, 0x19
jne 0x420819
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x93be0e
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x438c9b
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x438a14
mov ecx, 0x3b57cdd
add eax, eax
call fcn.00438cca
add eax, eax
xor dword [ebx], edi
and ecx, ecx
inc ecx
inc ecx
add ebx, 1
or eax, ecx
cmp ebx, esi
jne fcn.00438c9b
push 0x98fca342
pop ecx
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x402000
Capabilities:
Terminate process

Disassembly:
push str.Enter_x_and_a_n
call dword [sym.imp.msvcrt.dll_printf]
push 0x40104f
push 0x40100f
call dword [sym.imp.msvcrt.dll_scanf]
push 0x401047
push 0x40100f
call dword [sym.imp.msvcrt.dll_scanf]
wait
fninit
fld qword [0x40104f]
mov dword [0x401077], 2
fild dword [0x401077]
fcompi st(1)
jbe 0x40206c
fld qword [0x40104f]
mov dword [0x401077], 2
fild dword [0x401077]
fsub qword [0x40104f]
fstp qword [0x401057]
jmp 0x40208e
fld qword [0x401047]
mov dword [0x401077], 3
fild dword [0x401077]
fadd qword [0x401047]
fstp qword [0x401057]
wait
fninit
fld qword [0x40104f]
fld qword [0x401047]
fcompi st(1)
jbe 0x4020c1
fld qword [0x401047]
mov dword [0x401077], 1
fild dword [0x401077]
fsubp st(1)
fstp qword [0x40105f]
jmp 0x4020e5
fld qword [0x401047]
fmul qword [0x40104f]
mov dword [0x401077], 1
fild dword [0x401077]
fsubp st(1)
fstp qword [0x40105f]
fld qword [0x401057]
fadd qword [0x40105f]
fstp qword [0x401067]
push dword [0x40105b]
push dword [0x401057]
push str.y1___5.3f_n
call dword [sym.imp.msvcrt.dll_printf]
push dword [0x401063]
push dword [0x40105f]
push str.y2___5.3f_n
call dword [sym.imp.msvcrt.dll_printf]
push dword [0x40106b]
push dword [0x401067]
push str.y____5.3f_n
call dword [sym.imp.msvcrt.dll_printf]
push 0x401045
call dword [sym.imp.msvcrt.dll_printf]
fld1
fadd qword [0x40104f]
fstp qword [0x40104f]
mov ecx, dword [0x40106f]
inc ecx
cmp ecx, dword [0x401073]
mov dword [0x40106f], ecx
jne 0x40202b
call dword [sym.imp.msvcrt.dll__getch]
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
Function at 0x401628
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40167f
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401670
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [esp + 0x10]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x40166c
cmp esi, ecx
jae 0x401670
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec edx
jne 0x40165c
cmp esi, ecx
jb 0x401674
xor eax, eax
jmp 0x40167e
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x4017ac
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [0x41a240]
push edi
push esi
mov ebx, ecx
call fcn.004056d7
mov edi, eax
mov eax, dword [0x41a23c]
pop ecx
xor ecx, ecx
mov dword [esp + 0xc], edi
cmp eax, esi
jae 0x401809
push ebp
sub ebx, edi
lea ebp, [eax + edi]
mov edi, dword [0x419270]
sub esi, eax
xor eax, eax
cmp ecx, dword [0x41a238]
cmove ecx, eax
lea eax, [ecx - 1]
cdq
idiv dword [0x41a238]
mov al, byte [edx + edi + 1]
inc al
xor al, byte [ebx + ebp]
inc ecx
mov byte [ebp], al
inc ebp
dec esi
jne 0x4017de
mov edi, dword [esp + 0x10]
pop ebp
mov eax, edi
pop edi
pop esi
mov dword [0x41a234], 0x416528
pop ebx
pop ecx
ret

Function at 0x40181a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x804
mov eax, dword [0x4180a0]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
push edi
push 0x416530
push 0x81
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x40184d
xor al, al
jmp 0x401896
push esi
push edi
mov dword [0x41a23c], edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [0x41a240], eax
push 0x400
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401849
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x401849
mov ecx, eax
call fcn.004017ac
mov dword [0x41a230], eax
mov al, 1
mov ecx, dword [esp + 0x808]
pop edi
pop esi
xor ecx, esp
call fcn.00402da8
add esp, 0x804
ret
Function at 0x402188
Capabilities:
Resume thread

Disassembly:
push 4
mov eax, 0x41022c
call fcn.00405cab
mov esi, ecx
and dword [ebp - 4], 0
mov dword [0x41a234], 0x416630
call fcn.0040181a
cmp dword [0x41a230], 0
je 0x401d3f
mov edx, esi
mov dword [0x41a234], 0x416638
call fcn.004018ad
test al, al
je 0x401d2e
push dword [0x41a248]
mov dword [0x41a234], 0x416640
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x401d20
mov dword [0x41a234], str.NORUN
mov eax, 0x12c
jmp 0x401d59
mov dword [0x41a234], 0x416658
xor eax, eax
jmp 0x401d59
mov dword [0x41a234], str.NOTSUMBITMEMORY
mov eax, 0xc8
jmp 0x401d59
push 0x64
mov dword [0x41a234], 0x41666c
pop eax
jmp 0x401d59
call fcn.00405c55
ret
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_FreeConsole]
mov eax, dword [0x419284]
inc eax
push eax
call fcn.00402d9f
cmp dword [0x419288], 0x10
mov ecx, 0x419274
cmovae ecx, dword [0x419274]
push ecx
mov ecx, dword [0x419284]
inc ecx
push ecx
push eax
mov dword [0x419270], eax
call fcn.00405955
mov eax, dword [0x419284]
add esp, 0x10
inc eax
mov dword [0x41a238], eax
call fcn.00402095
test al, al
je 0x4021e9
push ecx
push ecx
call fcn.00401d5f
pop ecx
pop ecx
cmp eax, 2
jge 0x4021f1
mov ecx, esi
pop esi
jmp 0x401cb5
pop esi
ret
Function at 0x409eb8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4180a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00407dd8
mov dword [ebp - 0x14], eax
cmp dword [0x41a144], edi
jne 0x409fa9
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x409f36
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40a089
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x40a089
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40a089
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x41a144], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x41a148], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x41a14c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41a154], eax
test eax, eax
je 0x409fa6
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41a150], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x409fce
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x409fc1
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x409fe3
push 4
pop eax
jmp 0x40a08b
cmp dword [ebp - 0x14], edi
je 0x409fe3
push dword [0x41a144]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x409fc8
mov eax, dword [0x41a150]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x40a041
cmp dword [0x41a154], esi
je 0x40a041
push eax
call ebx
push dword [0x41a154]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40a041
test eax, eax
je 0x40a041
call ecx
test eax, eax
je 0x40a036
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40a036
test byte [ebp - 8], 1
jne 0x40a041
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x40a071
mov eax, dword [0x41a148]
cmp eax, esi
je 0x40a06e
push eax
call ebx
test eax, eax
je 0x40a06e
call eax
mov edi, eax
test edi, edi
je 0x40a06e
mov eax, dword [0x41a14c]
cmp eax, esi
je 0x40a06e
push eax
call ebx
test eax, eax
je 0x40a06e
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x41a144]
call ebx
test eax, eax
je 0x40a089
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x40a08b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402da8
leave
ret
Function at 0x40cd20
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40cd5e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x40cd56
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x40cd60
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x40cd46
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40ce30
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x40ce61
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40ce61
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x40ce61
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x7e383577
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x69cd1656
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x406676
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x4066eb
push dword [ebp + 0xc]
mov word [ebp - 0x14], 2
call sub.WSOCK32.dll_htons
push 0
push 2
push 2
mov dword [ebp - 0x10], 0
mov word [ebp - 0x12], ax
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [0x4258ec], eax
jne 0x4066b9
jmp 0x406773
lea eax, [ebp - 0x14]
push 0x10
push eax
push dword [0x4258ec]
call sub.WSOCK32.dll_bind
test eax, eax
je 0x4066d3
jmp 0x406773
push 1
push 0x447
push dword [0x425948]
push dword [0x4258ec]
call sub.WSOCK32.dll_WSAAsyncSelect
cmp ebx, 0x47
jne 0x40677a
mov word [0x419c10], 2
mov ax, word [0x425954]
push eax
call sub.WSOCK32.dll_htons
push 0
push 1
push 2
mov word [0x419c12], ax
mov dword [0x419c14], 0
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [0x4258e8], eax
jne 0x406732
jmp 0x406773
push 0x10
push 0x419c10
push dword [0x4258e8]
call sub.WSOCK32.dll_bind
test eax, eax
je 0x40674a
jmp 0x406773
push 8
push 0x400
push dword [0x425948]
push dword [0x4258e8]
call sub.WSOCK32.dll_WSAAsyncSelect
push 5
push dword [0x4258e8]
call sub.WSOCK32.dll_listen
test eax, eax
je 0x40677a
mov eax, 0xffffffff
jmp 0x40677c
xor eax, eax
lea esp, [ebp - 4]
pop ebx
pop ebp
ret
Function at 0x407136
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 0x90
mov eax, dword [ebp + 8]
xor edi, edi
xor ebx, ebx
cmp byte [eax], 0
jne 0x407183
lea eax, [ebp - 0x90]
push pe_nt_image_headers32
push eax
call sub.WSOCK32.dll_gethostname
test eax, eax
jne 0x407263
lea eax, [ebp - 0x90]
push 0x429e90
push eax
call fcn.00409960
test eax, eax
pop ecx
pop ecx
jne 0x40719a
jmp 0x407263
lea eax, [ebp - 0x90]
push dword [ebp + 8]
push eax
call fcn.004098e0
mov eax, dword [ebp + 8]
pop ecx
mov byte [eax], 0
pop ecx
lea eax, [ebp - 0x90]
push eax
call sub.WSOCK32.dll_gethostbyname
test eax, eax
mov dword [ebp - 0x9c], eax
jne 0x4071b5
jmp 0x407263
mov dword [ebp - 0x98], 0
mov eax, dword [ebp - 0x9c]
inc edi
mov ecx, dword [eax + 0xc]
mov eax, ecx
add eax, dword [ebp - 0x98]
test eax, eax
jne 0x4071da
jmp 0x40726a
mov esi, dword [ecx + ebx*4]
test esi, esi
jne 0x4071e6
jmp 0x40726a
push dword [esi]
call sub.WSOCK32.dll_ntohl
mov edx, eax
mov ecx, eax
and edx, 0xff000000
and ecx, 0xff0000
shr edx, 0x18
shr ecx, 0x10
mov byte [ebp - 0x10], dl
mov edx, eax
and edx, 0xff00
mov byte [ebp - 0xf], cl
mov cl, al
shr edx, 8
and cl, 0xff
mov byte [ebp - 0xe], dl
mov byte [ebp - 0xd], cl
movzx eax, byte [ebp - 0xe]
movzx edx, byte [ebp - 0xd]
movzx ecx, byte [ebp - 0xf]
push edx
push eax
movzx eax, byte [ebp - 0x10]
push ecx
push eax
push dword [ebp + 8]
push str._s_d._d._d._d
push dword [ebp + 8]
call fcn.0040b2b0
add dword [ebp - 0x98], 4
add esp, 0x1c
inc ebx
test esi, esi
je 0x40725b
cmp edi, 6
jl 0x4071bf
mov eax, dword [ebp + 8]
cmp byte [eax], 0
jne 0x40726a
mov eax, 0xffffffff
jmp 0x40726c
xor eax, eax
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x408653
Capabilities:
Continue service
Pause service
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 0x20
mov ebx, dword [ebp + 0xc]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
cmp byte [eax], 0
jne 0x40867b
jmp 0x408680
cmp byte [ebx], 0
jne 0x40868a
mov eax, 0xffffffff
jmp 0x408786
push 4
push ebx
push 0x42a2b8
call fcn.004065df
add esp, 0xc
test eax, eax
jne 0x4086c1
push 0x20
push dword [ebp + 8]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x4086c1
lea eax, [ebp - 0x28]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, eax
push 5
push ebx
push str.pause
call fcn.004065df
add esp, 0xc
test eax, eax
jne 0x4086f8
push 0x40
push dword [ebp + 8]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x4086f8
lea eax, [ebp - 0x28]
push eax
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, eax
push 6
push ebx
push str.resume
call fcn.004065df
add esp, 0xc
test eax, eax
jne 0x40872f
push 0x40
push dword [ebp + 8]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x40872f
lea eax, [ebp - 0x28]
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, eax
push 5
push ebx
push str.start
call fcn.004065df
add esp, 0xc
test eax, eax
jne 0x408764
push 0x10
push dword [ebp + 8]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x408764
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov edi, eax
test esi, esi
je 0x40876f
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
jne 0x408784
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x408786
xor eax, eax
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x409079
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov eax, 0x102d0
mov ebp, esp
push ebx
push esi
push edi
call fcn.0040c490
lea eax, [ebp - 0x1020c]
xor esi, esi
push 0x200
push esi
push eax
mov ebx, dword [ebp + 0xc]
call fcn.00409b60
lea eax, [ebp - 0x102d8]
add esp, 0xc
push 0x64
push 0
push eax
call fcn.00409b60
lea eax, [ebp - 0x10274]
add esp, 0xc
push 0x64
push 0
push eax
call fcn.00409b60
mov edi, 2
add esp, 0xc
jmp 0x4090d8
mov byte [ebp + edi - 0x102da], al
inc edi
push ebx
call fcn.004098c0
cmp edi, eax
pop ecx
jae 0x4090ea
mov al, byte [ebx + edi]
cmp al, 0x5c
jne 0x4090d0
lea eax, [ebp - 0x102d8]
push eax
call fcn.004098c0
xor ebx, ebx
pop ecx
mov dword [ebp - 0x102dc], eax
cmp ebx, dword [ebp - 0x102dc]
jl 0x409117
mov byte [ebp - 0x1020d], 0x41
mov byte [ebp - 0x1020e], 0x43
jmp 0x409144
movsx ecx, byte [ebp + ebx - 0x102d8]
mov edi, 0x10
mov eax, ecx
cdq
idiv edi
mov edi, 0x10
add al, 0x41
mov byte [ebp - 0x1020e], al
mov eax, ecx
cdq
idiv edi
lea edx, [edx + 0x41]
mov byte [ebp - 0x1020d], dl
mov dl, byte [ebp - 0x1020e]
inc ebx
mov byte [ebp + esi - 0x10274], dl
mov al, byte [ebp - 0x1020d]
mov byte [ebp + esi - 0x10273], al
add esi, 2
cmp ebx, 0x10
jl 0x4090ff
mov byte [ebp - 0x10209], 0x48
mov byte [ebp - 0x1020c], 0x81
lea eax, [ebp - 0x1020c]
lea ecx, [ebp - 0x10274]
add eax, 5
push esi
push ecx
push eax
mov byte [ebp - 0x10208], 0x20
call fcn.00409b20
mov byte [ebp + esi - 0x10206], 0x20
add esp, 0xc
lea eax, [ebp - 0x10274]
push str.CACACACACACACACACACACACACACACAAA
push eax
call fcn.0040b2b0
lea eax, [ebp - 0x10274]
pop ecx
lea edx, [esi + 7]
pop ecx
push 0x20
push eax
lea eax, [ebp - 0x1020c]
add edx, eax
push edx
call fcn.00409b20
lea eax, [ebp - 0x1020c]
add esp, 0xc
lea ecx, [esi + 0x25]
push 0
push ecx
push eax
push dword [ebp + 8]
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
jne 0x4091ee
jmp 0x409221
lea eax, [ebp - 0x1000c]
push 0x10000
push 0
push eax
call fcn.00409b60
lea eax, [ebp - 0x1000c]
add esp, 0xc
push 0
push 0x2000
push eax
push dword [ebp + 8]
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x409228
mov eax, 0xffffffff
jmp 0x409247
movsx edx, byte [ebp - 0xffeb]
movsx eax, byte [ebp - 0xffec]
shl edx, 8
add edx, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
movsx eax, byte [ebp - 0x1000c]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x2bd3700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.02bd378f
jae 0x2bd370e
xor ecx, ecx
call fcn.02bd378f
jae 0x2bd373d
xor eax, eax
call fcn.02bd378f
jae 0x2bd374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.02bd378f
adc al, al
jae 0x2bd372f
jne 0x2bd3779
stosb byte es:[edi], al
jmp 0x2bd3711
call fcn.02bd379b
sub ecx, ebx
jne 0x2bd3756
call fcn.02bd3799
jmp 0x2bd3775
lodsb al, byte [esi]
shr eax, 1
je 0x2bd3783
adc ecx, ecx
jmp 0x2bd3772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.02bd3799
cmp eax, 0x7d00
jae 0x2bd3772
cmp ah, 5
jae 0x2bd3773
cmp eax, 0x7f
ja 0x2bd3774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2bd3711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8