joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d3a4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44a1ac]
jne 0x41d3ae
repz ret
jmp fcn.0041d8d5

Function at 0x41d77c
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x440f90
call fcn.0041dab0
xor ebx, ebx
cmp dword [0x44be54], ebx
jne 0x41d55a
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_HeapSetInformation]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x44be50
push ebx
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x41d594
cmp eax, esi
jne 0x41d587
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x41d597
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x41d56e
xor esi, esi
inc esi
mov eax, dword [0x44be4c]
cmp eax, esi
jne 0x41d5aa
push 0x1f
call sub.MSVCR100.dll__amsg_exit
pop ecx
jmp 0x41d5e5
mov eax, dword [0x44be4c]
test eax, eax
jne 0x41d5df
mov dword [0x44be4c], esi
push 0x43853c
push 0x43852c
call sub.MSVCR100.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x41d5e5
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x41d6bc
mov dword [0x44b9a8], esi
mov eax, dword [0x44be4c]
cmp eax, esi
jne 0x41d609
push 0x438528
push 0x4384d4
call sub.MSVCR100.dll__initterm
pop ecx
pop ecx
mov dword [0x44be4c], 2
cmp dword [ebp - 0x1c], ebx
jne 0x41d616
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x44be58], ebx
je 0x41d637
push 0x44be58
call fcn.00408ace
pop ecx
test eax, eax
je 0x41d637
push ebx
push 2
push ebx
call dword [0x44be58]
mov eax, dword [0x44b990]
mov ecx, dword [sym.imp.MSVCR100.dll___initenv]
mov dword [ecx], eax
push dword [0x44b990]
push dword [0x44b994]
push dword [0x44b98c]
call fcn.0040f1ce
add esp, 0xc
mov dword [0x44b9a4], eax
cmp dword [0x44b998], ebx
jne 0x41d6a2
push eax
call dword [sym.imp.MSVCR100.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.MSVCR100.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x44b9a8], ebx
jne 0x41d6b0
call dword [sym.imp.MSVCR100.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x44b9a4]
call fcn.0041daf5
ret
call fcn.00408ace
jmp 0x41d539

Function at 0x41fce0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
xor ecx, ecx
cmp eax, edx
je 0x41fd0f
push esi
push edi
mov esi, ecx
mov edi, ecx
shl esi, 6
shr edi, 2
add esi, edi
movsx edi, byte [eax]
lea esi, [esi + edi - 0x61c88647]
inc eax
xor ecx, esi
cmp eax, edx
jne 0x41fcf0
pop edi
pop esi
mov eax, 0x4e25
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add edx, eax
shr edx, 0x1e
imul edx, edx, 0x7fffd8ee
mov eax, ecx
sub eax, edx
add eax, 0x2710
ret
Function at 0x40a23c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
xor ebp, ebp
xor edi, edi
lea eax, [ebx + 0x10]
call fcn.00403dcc
cmp ebp, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x40a2a5
mov eax, dword [ebx + 0x10]
mov edx, 0x40a3d8
call fcn.00404190
jne 0x40a274
lea eax, [ebx + 0x10]
call fcn.00403dcc
jmp 0x40a2ad
mov eax, dword [ebx + 0x10]
mov edx, 0x40a3e4
call fcn.00404190
jne 0x40a290
lea eax, [ebx + 0x10]
mov edx, 0x40a3d8
call fcn.00403e20
cmp dword [ebx + 0x10], 0
jne 0x40a2ad
lea eax, [ebx + 0x10]
mov edx, 0x40a3e4
call fcn.00403e20
jmp 0x40a2ad
lea eax, [ebx + 0x10]
call fcn.00403dcc
mov eax, ebx
call fcn.0040a08c
mov eax, dword [0x40b158]
inc dword [eax]
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov word [esp], 2
push 0x8b
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404244
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a307
or edi, 0xffffffff
jmp 0x40a394
mov eax, dword [0x40b170]
inc dword [eax]
mov word [esp], 2
push 0x1bd
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404244
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a34a
or edi, 0xffffffff
jmp 0x40a394
mov eax, dword [0x40b170]
inc dword [eax]
mov word [esp], 2
push 0x75d7
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404244
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a38d
or edi, 0xffffffff
jmp 0x40a394
mov eax, dword [0x40b170]
inc dword [eax]
test edi, edi
je 0x40a3b7
push esi
call sub.wsock32.dll_closesocket
lea eax, [ebx + 0x14]
mov ecx, dword [ebx + 0x10]
mov edx, 0x40a3f0
call fcn.00404090
mov eax, ebx
call fcn.00409f64
mov ebp, eax
push 0x200
call sub.kernel32.dll_Sleep
jmp 0x40a251

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1001b43a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1001b449
pop dword [ebp - 8]
mov eax, 0x1001b449
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x40f1b
push 0
mov eax, 0xa78f3f4
sub eax, 0xfa759318
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0xc83327ec
add ecx, 0x37cd2224
xor ebx, ebx
add ebx, eax
mov esi, 0x69b08ee3
sub esi, 0x59acd0e3
add esi, dword [ebp - 8]
mov edi, 0xc8b195d3
sub edi, 0x35a915c1
mov edx, dword [esi]
sub dword [ebp - 4], 0x64ac593f
xor edx, edi
xor dword [ebp - 4], 0x5957b62c
mov dword [ebx], edx
sub dword [ebp - 4], 0x1f5c193c
add ebx, 0x2b6e9bf2
sub ebx, 0x2b6e9bee
add esi, 4
loop 0x1001b4a5
add eax, 0x11b13
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1001b43a
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1001b43a
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret
Function at 0x433d50
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea edi, [ecx + 0x44]
mov eax, dword [ebx + 0x540]
shl edi, 4
add edi, ebx
mov esi, dword [edi + 4]
sub esi, dword [edi + 8]
test byte [eax + 0x40], 3
je 0x433e24
cmp dword [ebx + ecx*4 + 0x430], 0x433790
jne 0x433e24
cmp dword [edi], 0
je 0x433d99
test esi, esi
je 0x433e24
mov eax, dword [ebx + ecx*4 + 0x420]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
mov dword [ebp - 4], eax
call fcn.00445ce0
add esp, 0x14
cmp eax, 0xffffffff
je 0x433e24
test al, 1
je 0x433e24
mov ecx, dword [edi]
test ecx, ecx
jne 0x433dfd
mov eax, dword [ebx]
mov eax, dword [eax + 0x90c]
add eax, eax
mov dword [edi + 4], eax
mov esi, dword [fcn.004747c0]
mov ecx, esi
push eax
call dword [0x498390]
call esi
mov esi, dword [edi + 4]
mov ecx, eax
add esp, 4
mov dword [edi], ecx
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
test ecx, ecx
je 0x433e1d
mov eax, dword [edi + 8]
push 0
push esi
add eax, ecx
push eax
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x433e24
add dword [edi + 8], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4347b0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4b9b18]
mov dword [ebp - 8], 0x4020
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
test eax, eax
jne 0x434801
push 3
push 2
push eax
push 6
call fcn.00435e80
add esp, 0x10
test al, al
je 0x4347f5
mov dword [0x4b9b18], 2
mov esp, ebp
pop ebp
ret
mov dword [0x4b9b18], 1
jmp 0x434806
cmp eax, 2
je 0x434846
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x43482d
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jg 0x434846
push 4
lea eax, [ebp - 8]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esp, ebp
pop ebp
ret
Function at 0x434ab0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4b80c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x2f8], 3
jne 0x434cda
cmp byte [esi + 0x501], 0
push ebx
push edi
jne 0x434ccf
cmp byte [esi + 0x518], 0
jne 0x434ccf
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x208]
mov ebx, dword [esi]
push eax
lea eax, [ebp - 0x204]
mov dword [ebp - 0x208], 0x80
push eax
push edi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x434b53
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [ebp - 0x104]
push 0x100
push eax
push esi
call fcn.00420d30
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebx
call fcn.00433500
add esp, 0x1c
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046b428
mov esp, ebp
pop ebp
ret
push 0x80
lea eax, [ebp - 0x184]
mov dword [ebp - 0x20c], 0x80
push 0
push eax
call fcn.0046d330
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x184]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x434bc7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [ebp - 0x104]
push 0x100
push eax
push esi
call fcn.00420d30
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.00433500
add esp, 0x1c
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046b428
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x3a0]
push eax
lea edi, [esi + 0x372]
push edi
push dword [ebp - 0x208]
lea eax, [ebp - 0x204]
push eax
call fcn.00433e30
add esp, 0x10
test al, al
jne 0x434c30
call fcn.00475914
mov esi, dword [eax]
call fcn.00475914
mov edi, eax
lea eax, [ebp - 0x104]
push 0x100
push eax
push esi
call fcn.00420d30
push eax
push dword [edi]
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.00433500
add esp, 0x1c
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046b428
mov esp, ebp
pop ebp
ret
movups xmm0, xmmword [edi]
mov eax, dword [edi + 0x28]
movups xmmword [esi + 0x2c4], xmm0
movups xmm0, xmmword [edi + 0x10]
movups xmmword [esi + 0x2d4], xmm0
movq xmm0, qword [edi + 0x20]
movq qword [esi + 0x2e4], xmm0
mov dword [esi + 0x2ec], eax
mov ax, word [edi + 0x2c]
mov word [esi + 0x2f0], ax
lea eax, [esi + 0x3d4]
push eax
lea eax, [esi + 0x3a4]
push eax
push dword [ebp - 0x20c]
lea eax, [ebp - 0x184]
push eax
call fcn.00433e30
add esp, 0x10
test al, al
jne 0x434ccf
call fcn.00475914
mov esi, dword [eax]
call fcn.00475914
mov edi, eax
lea eax, [ebp - 0x104]
push 0x100
push eax
push esi
call fcn.00420d30
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.00433500
add esp, 0x1c
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046b428
mov esp, ebp
pop ebp
ret
push esi
call fcn.004346d0
add esp, 4
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0046b428
mov esp, ebp
pop ebp
ret
Function at 0x4357a0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4b80c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
push 4
cmp byte [esi + 0xb0f], al
setne al
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x4357fd
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.004335e0
add esp, 0xc
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046b428
mov esp, ebp
pop ebp
ret
push dword [esi + 0xaac]
mov dword [ebp - 0x10], 1
call fcn.00435a50
push dword [esi + 0xab0]
imul eax, eax, 0x3e8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
call fcn.00435a50
add esp, 8
imul eax, eax, 0x3e8
push 0
push 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x43586d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.004335e0
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0046b428
mov esp, ebp
pop ebp
ret

Function at 0x435880
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4b80c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push 4
mov dword [ebp - 0x108], 1
mov esi, dword [eax]
lea eax, [ebp - 0x108]
push eax
push 1
push 6
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x4358e4
push 0x100
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.00420d30
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.004335e0
add esp, 0x18
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0046b428
mov esp, ebp
pop ebp
ret
Function at 0x435ce0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x435cfb
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
push 0x49be9c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [ebp + 8]
mov ebx, eax
push 0x49beac
push edi
call fcn.0047c0e4
add esp, 8
test eax, eax
je 0x435d4c
test ebx, ebx
je 0x435d3c
push 8
push 0
push edi
mov ecx, ebx
call dword [0x498390]
call ebx
pop edi
mov ebx, eax
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop edi
mov ebx, eax
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x435d7b
push str.AddDllDirectory
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x435d7b
push 0x800
push 0
push edi
mov ecx, ebx
call dword [0x498390]
call ebx
pop edi
mov ebx, eax
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
mov dword [ebp - 4], edx
test edx, edx
je 0x435e66
mov ecx, edi
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x435d97
sub ecx, esi
mov esi, dword [fcn.004747c0]
sar ecx, 1
lea eax, [ecx + edx]
mov ecx, esi
lea eax, [eax*2 + 2]
push eax
call dword [0x498390]
call esi
mov esi, eax
add esp, 4
test esi, esi
je 0x435e47
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x435e47
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x435de1
sub ecx, edx
sar ecx, 1
mov dword [esi + ecx*2], 0x5c
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x435e00
sub ecx, edx
sar ecx, 1
add ecx, ecx
sub ecx, edi
add ecx, esi
movzx eax, word [edi]
lea edi, [edi + 2]
mov word [ecx + edi - 2], ax
test ax, ax
jne 0x435e15
test ebx, ebx
je 0x435e3c
push 8
push 0
push esi
mov ecx, ebx
call dword [0x498390]
call ebx
mov ebx, eax
jmp 0x435e49
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
jmp 0x435e49
xor ebx, ebx
push esi
mov esi, dword [fcn.00474120]
mov ecx, esi
call dword [0x498390]
call esi
add esp, 4
mov eax, ebx
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
xor ebx, ebx
pop edi
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x435ff0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x4b80c8]
xor eax, ebp
mov dword [ebp - 4], eax
test byte [ebp + 8], 2
je 0x436049
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x436036
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x436030
shr eax, 8
cmp al, 2
je 0x436049
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046b428
mov esp, ebp
pop ebp
ret
call fcn.0044d820
test eax, eax
jne 0x4360ab
push str.iphlpapi.dll
call fcn.00435ce0
add esp, 4
mov dword [0x4b9b20], eax
test eax, eax
je 0x436085
push str.if_nametoindex
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x4b9b1c]
test eax, eax
cmovne ecx, eax
mov dword [0x4b9b1c], ecx
push 3
push 2
push 0
push 6
call fcn.00435e80
add esp, 0x10
test al, al
setne byte [0x4bb550]
push 0x4bb558
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046b428
mov esp, ebp
pop ebp
ret

Function at 0x4384e0
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 0x14]
push esi
push 0
push dword [ebp + 0x10]
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], esi
call fcn.0046d330
add esp, 0xc
lea eax, [ebp - 8]
push 0xf0000000
push dword [ebp + 0x18]
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4385ae
lea eax, [ebp - 4]
push eax
push 0
push 0
push dword [ebp + 0x1c]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x438590
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x438590
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x438590
cmp esi, dword [ebp - 0xc]
jb 0x438590
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x10]
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [ebp - 4]
test eax, eax
je 0x43859e
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 8]
test eax, eax
je 0x4385ae
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x43ba50
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043b9b0

Function at 0x43dd40
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x548], 2
jne 0x43dd58
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0043dd00
mov al, 1
pop ebp
ret
Function at 0x43def0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x43df1b
cmp dword [esi + 0x80], 0
je 0x43df1b
push 2
push 3
push esi
call fcn.00437ef0
push dword [ebp + 0xc]
call fcn.0043d880
add esp, 0x10
jmp 0x43df2a
push dword [ebp + 0xc]
call fcn.0043d880
add esp, 4
test esi, esi
je 0x43df3e
cmp dword [esi + 0x80], 0
je 0x43df3e
push 3
push esi
call fcn.00437f40
add esp, 8
pop esi
pop ebp
ret
Function at 0x41a73a
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x41b788
call fcn.0041ad80
push 1
call fcn.0041a82b
pop ecx
test al, al
je 0x41a724
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0041a7f9
mov byte [ebp - 0x24], al
mov eax, dword [0x41c0f0]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x41a724
test eax, eax
jne 0x41a642
mov dword [0x41c0f0], ecx
push 0x401058
push 0x401048
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x41a625
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x41a714
push 0x401044
push section..text
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x41c0f0], 2
jmp 0x41a647
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0041a97f
pop ecx
call fcn.0041ab44
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x41a678
push esi
call fcn.0041a8eb
pop ecx
test al, al
je 0x41a678
mov esi, dword [esi]
push edi
push 2
push edi
mov ecx, esi
call dword [0x41d210]
call esi
call fcn.0041ab4a
mov esi, eax
cmp dword [esi], edi
je 0x41a696
push esi
call fcn.0041a8eb
pop ecx
test al, al
je 0x41a696
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_initial_wide_environment
mov edi, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___wargv
mov esi, dword [eax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argc
push edi
push esi
push dword [eax]
call main
add esp, 0xc
mov esi, eax
call fcn.0041ac70
test al, al
je 0x41a72b
test bl, bl
jne 0x41a6c9
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push 0
push 1
call fcn.0041a99c
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x41a714
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push 7
call fcn.0041ab50
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push dword [ebp - 0x20]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
int3
call fcn.004ae000
jmp 0x41a5b8
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x44305f
Capabilities:
Packed with generic packer

Disassembly:
pushal
push 0x2bd46
push section.packerBY
push 0x4434e3
call fcn.004434a8
cld
mov esi, 0x414000
mov ecx, 4
sub ecx, esi
cmp esi, 0x440290
ja 0x4430a7
lodsb al, byte [esi]
add al, 0x18
sub al, 2
jb 0x44309d
cmp al, 0x25
jne 0x443081
mov al, byte [esi]
and al, 0xf0
cmp al, 0x80
jne 0x443081
inc esi
lea edi, [esi + ecx]
sub dword [esi], edi
add esi, 4
jmp 0x443081
mov edx, 0x400000
lea esi, [edx + 0x4120c]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x44310a
add eax, edx
mov edi, dword [esi + 0x10]
mov ebx, dword [esi]
test ebx, ebx
jne 0x4430c6
mov ebx, edi
add ebx, edx
add edi, edx
push edx
push edi
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
pop edi
pop edx
test eax, eax
je 0x443108
mov ecx, eax
mov eax, dword [ebx]
test eax, eax
je 0x443103
btr eax, 0x1f
jb 0x4430eb
lea eax, [eax + edx + 2]
push ecx
push edx
push edi
push eax
push ecx
call dword [sym.imp.kernel32.dll_GetProcAddress]
pop edi
pop edx
pop ecx
test eax, eax
je 0x443108
stosd dword es:[edi], eax
add ebx, 4
jmp 0x4430db
add esi, 0x14
jmp 0x4430b2
popal
ret
popal
jmp 0x440130