joyce8/EMBER2024-capa huggingface dataset:
Function at 0x915c10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3d1000]
push edi
jmp 0x915c2a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x915c31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x915c20
mov eax, 1
add ebx, ebx
jne 0x915c43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x915c54
jne 0x915c73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x915c73
dec eax
add ebx, ebx
jne 0x915c60
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x915c38
add ebx, ebx
jne 0x915c6f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x915cc5
xor ecx, ecx
sub eax, 3
jb 0x915c8b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x915cfa
sar eax, 1
mov ebp, eax
jmp 0x915c96
add ebx, ebx
jne 0x915c96
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x915c64
inc ecx
add ebx, ebx
jne 0x915ca4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x915c64
add ebx, ebx
jne 0x915cb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x915ca6
jne 0x915cc2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x915ca6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x915ce4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x915cd6
jmp 0x915c26
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x915ce4
add edi, ecx
jmp 0x915c26
pop esi
mov edi, esi
mov ecx, 0x115ab
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x915d02
cmp byte [edi], 0x2e
jne 0x915d02
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x915d07
lea edi, [esi + 0x511000]
mov eax, dword [edi]
or eax, eax
je 0x915d7f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x518838]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5189dc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x915d34
mov ecx, edi
jns 0x915d63
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5189e0]
or eax, eax
je 0x915d79
mov dword [ebx], eax
add ebx, 4
jmp 0x915d51
call dword [esi + 0x5189f0]
mov ebp, dword [esi + 0x5189e4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x24f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x915db3
sub esp, 0xffffff80
jmp 0x6e7555
Function at 0x401168
Capabilities:
Packed with generic packer

Disassembly:
push ebx
add esp, 0xffffffbc
mov ebx, 0xa
push esp
call sub.kernel32.dll_GetStartupInfoA
test byte [esp + 0x2c], 1
je fcn.00401183
jmp loc.004164a3

Function at 0x40126c
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, ecx
mov dword [esp], edx
mov ebp, eax
mov ebx, dword [ebp]
mov eax, dword [esp]
mov edx, dword [eax]
mov dword [esi], edx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov edi, dword [ebx]
mov eax, dword [esi]
mov edx, dword [ebx + 8]
add edx, dword [ebx + 0xc]
cmp eax, edx
jne 0x4012aa
mov eax, ebx
call fcn.00401254
mov eax, dword [ebx + 8]
mov dword [esi], eax
mov eax, dword [ebx + 0xc]
add dword [esi + 4], eax
jmp 0x4012bf
add eax, dword [esi + 4]
cmp eax, dword [ebx + 8]
jne 0x4012bf
mov eax, ebx
call fcn.00401254
jmp 0x416152
mov ebx, edi
cmp ebp, ebx
jne 0x401288
mov edx, esi
mov eax, ebp
call fcn.00401224
test al, al
jne 0x4012d6
xor eax, eax
mov dword [esi], eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4013d4
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, ecx
mov esi, edx
mov ebp, eax
mov dword [ebx + 4], 0x100000
push 4
push 0x2000
push 0x100000
push ebp
call sub.kernel32.dll_VirtualAlloc
mov edi, eax
mov dword [ebx], edi
test edi, edi
jne 0x40141e
jmp loc.004182d6
cmp dword [ebx], 0
je 0x401446
mov edx, ebx
mov eax, 0x40c5d4
call fcn.00401224
test al, al
jne 0x401446
push 0x8000
push 0
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_VirtualFree
xor eax, eax
mov dword [ebx], eax
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401a60
Capabilities:
Packed with generic packer

Disassembly:
mov edx, dword [0x40c610]
jmp 0x401a78
jmp loc.00413f95
cmp edx, 0x40c610
jne 0x401a68
mov dword [0x40c5b0], 3
xor edx, edx
mov eax, edx
ret

Function at 0x401ac0
Capabilities:
Packed with generic packer

Disassembly:
inc dword [0x40c59c]
mov edx, eax
sub edx, 4
mov edx, dword [edx]
jmp loc.00413205

Function at 0x401e24
Capabilities:
Packed with generic packer

Disassembly:
xor edx, edx
test eax, eax
jns 0x401e2d
add eax, 3
sar eax, 2
jmp loc.0041c3cc

Function at 0x402774
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
jmp loc.0041c047

Function at 0x4027d4
Capabilities:
Packed with generic packer

Disassembly:
add esp, 0xfffffff8
push esp
call sub.kernel32.dll_QueryPerformanceCounter
test eax, eax
je 0x4027ec
mov eax, dword [esp]
mov dword [0x40b008], eax
pop ecx
pop edx
ret
jmp loc.00415b1c

Function at 0x402ad0
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x14c
call fcn.00402d38
lea eax, [ebx + 0x14c]
mov dword [ebx + 0x14], eax
mov word [ebx + 4], 0xd7b0
xor eax, eax
mov al, byte [0x40b024]
mov word [ebx + 6], ax
mov dword [ebx + 8], 0x80
mov dword [ebx + 0x18], 0x402924
mov eax, esi
call fcn.00404044
push eax
mov eax, esi
call fcn.00404244
lea edx, [ebx + 0x48]
pop ecx
jmp loc.0041b181
Function at 0x402cec
Capabilities:
Get file size

Disassembly:
push ebx
push esi
mov ebx, eax
or esi, 0xffffffff
mov ax, word [ebx + 4]
cmp ax, 0xd7b0
jbe 0x402d26
cmp ax, 0xd7b3
ja 0x402d26
push 0
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetFileSize
mov esi, eax
cmp esi, 0xffffffff
jne 0x402d1b
jmp loc.00416191
mov eax, esi
xor edx, edx
div dword [ebx + 8]
mov esi, eax
jmp fcn.00402d30
mov eax, 0x67
jmp loc.004136f2

Function at 0x402d38
Capabilities:
Packed with generic packer

Disassembly:
push edi
mov edi, eax
mov ch, cl
jmp loc.00418abe

Function at 0x402d58
Capabilities:
Generate random numbers using the delphi lcg
Packed with generic packer

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x40b008], 0x8088405
inc edx
jmp loc.004145cd

Function at 0x403060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
and cl, 3
cmp cl, 2
jbe 0x40305c
mov cl, 2
jmp loc.00419220

Function at 0x403068
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push edx
sub esp, 0x14
mov edi, ecx
mov esi, eax
cdq
xor eax, edx
sub eax, edx
mov ecx, 0xa
xor ebx, ebx
xor edx, edx
div ecx
add edx, 0x30
mov byte [esp + ebx], dl
inc ebx
test eax, eax
jne 0x40307f
test esi, esi
jge fcn.00403097
jmp loc.00416098

Function at 0x403330
Capabilities:
Packed with generic packer
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40b014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4033c8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4033a8
xor eax, eax
push ebp
push 0x4033a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4033e4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4033a8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40b014]
jmp loc.0041a529

Function at 0x4033a8
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40b014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4033c8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4033a8
xor eax, eax
push ebp
push 0x4033a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4033e4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4033a8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40b014]
jmp loc.0041a529

Function at 0x403468
Capabilities:
Packed with generic packer

Disassembly:
test eax, eax
je fcn.00403473
mov dl, 1
jmp loc.004134b8
Function at 0x4034cc
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, eax
mov esi, dword [esi]
mov edx, dword [esi - 0x40]
mov esi, dword [esi - 0x24]
test edx, edx
je 0x4034e5
jmp loc.00415d42
test esi, esi
jne 0x4034d2
pop esi
pop ebx
ret

Function at 0x403558
Capabilities:
Packed with generic packer

Disassembly:
push edx
push ecx
push ebx
test dl, dl
jl 0x403562
call dword [eax - 0xc]
jmp loc.0041965a

Function at 0x4035b0
Capabilities:
Packed with generic packer

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
jmp loc.0041c34d

Function at 0x4035d0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [0x40b018], 1
jbe fcn.004035ea
push 0
push 0
push 0
push 0xeedfadf
jmp loc.00416d59

Function at 0x40363c
Capabilities:
Packed with generic packer

Disassembly:
test ecx, ecx
je 0x403659
jmp loc.00418ce0
ret

Function at 0x4036a0
Capabilities:
Packed with generic packer

Disassembly:
push eax
push edx
cmp byte [0x40b018], 1
jbe fcn.004036bb
push esp
push 2
push 0
push 0xeedfae3
jmp loc.00413897

Function at 0x403a00
Capabilities:
Packed with generic packer

Disassembly:
xor edx, edx
lea eax, [ebp - 0xc]
jmp loc.00418a85

Function at 0x403a48
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x40c620
mov eax, dword [edi + 8]
test eax, eax
je 0x403aa2
jmp loc.00414b00
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x403ba4
Capabilities:
Packed with generic packer

Disassembly:
xor eax, eax
xchg dword [section.DATA], eax
neg eax
sbb eax, eax
inc eax
mov edi, 0x40c620
mov ebx, dword [edi + 0x18]
mov ebp, dword [edi + 0x14]
jmp loc.0041a229

Function at 0x403bd4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40c034], 0
je 0x403c35
cmp word [0x40c208], 0xd7b2
jne fcn.00403bfd
cmp dword [0x40c210], 0
jbe fcn.00403bfd
jmp loc.00416ee3
cmp byte [0x40b020], 0
jne fcn.00403c51
push 0
push 0x40b078
push 0x40b080
push 0
jmp loc.0041744d

Function at 0x403d38
Capabilities:
Packed with generic packer

Disassembly:
mov dword [section.DATA], eax
jmp loc.0041c687

Function at 0x403d88
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
jmp loc.00418bfb

Function at 0x403e20
Capabilities:
Packed with generic packer

Disassembly:
test edx, edx
je 0x403e48
mov ecx, dword [edx - 8]
inc ecx
jg 0x403e44
push eax
push edx
mov eax, dword [edx - 4]
call fcn.00403e90
mov edx, eax
pop eax
push edx
mov ecx, dword [eax - 4]
call fcn.00402648
pop edx
pop eax
jmp 0x403e48
lock inc dword [edx - 8]
xchg dword [eax], edx
test edx, edx
je 0x403e62
mov ecx, dword [edx - 8]
dec ecx
jl 0x403e62
lock dec dword [edx - 8]
jne 0x403e62
lea eax, [edx - 8]
jmp 0x416873
ret

Function at 0x403e64
Capabilities:
Packed with generic packer

Disassembly:
test edx, edx
je 0x403e72
mov ecx, dword [edx - 8]
inc ecx
jle 0x403e72
lock inc dword [edx - 8]
xchg dword [eax], edx
test edx, edx
je 0x403e8c
mov ecx, dword [edx - 8]
dec ecx
jl 0x403e8c
lock dec dword [edx - 8]
jne 0x403e8c
lea eax, [edx - 8]
jmp 0x418390
ret
Function at 0x403ebc
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
mov eax, edi
call fcn.00403e90
mov ecx, edi
mov edi, eax
test esi, esi
je fcn.00403edd
mov edx, eax
mov eax, esi
jmp loc.00413692

Function at 0x403fb4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor ecx, ecx
test edx, edx
je 0x403fdb
push edx
cmp cl, byte [edx]
je 0x403fd6
cmp cl, byte [edx + 1]
je 0x403fd5
cmp cl, byte [edx + 2]
je 0x403fd4
cmp cl, byte [edx + 3]
je 0x403fd3
add edx, 4
jmp 0x403fbb
inc edx
inc edx
inc edx
mov ecx, edx
pop edx
sub ecx, edx
jmp 0x413c18

Function at 0x403fe4
Capabilities:
Packed with generic packer

Disassembly:
xor ecx, ecx
test edx, edx
je 0x404017
push edx
cmp cx, word [edx]
je 0x404010
cmp cx, word [edx + 2]
je 0x40400d
cmp cx, word [edx + 4]
je 0x40400a
cmp cx, word [edx + 6]
je 0x404007
add edx, 8
jmp 0x403feb
add edx, 2
add edx, 2
add edx, 2
mov ecx, edx
pop edx
sub ecx, edx
shr ecx, 1
jmp 0x4162fb

Function at 0x404190
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
cmp eax, edx
jmp loc.00414c88

Function at 0x404388
Capabilities:
Packed with generic packer

Disassembly:
test eax, eax
je 0x4043cc
test edx, edx
je 0x4043c1
push ebx
push esi
push edi
mov esi, eax
jmp loc.0041a1bc
xor eax, eax
ret
ret

Function at 0x404498
Capabilities:
Packed with generic packer

Disassembly:
xor ecx, ecx
push ebx
mov cl, byte [edx + 1]
push esi
push edi
mov ebx, eax
lea esi, [ecx + edx + 0xa]
mov edi, dword [ecx + edx + 6]
jmp loc.00419fac

Function at 0x40455c
Capabilities:
Packed with generic packer

Disassembly:
xor ecx, ecx
push ebx
mov cl, byte [edx + 1]
push esi
push edi
mov ebx, eax
lea esi, [ecx + edx + 0xa]
mov edi, dword [ecx + edx + 6]
jmp loc.00416dcc

Function at 0x404708
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [0x40b02c]
jmp loc.0041c2fa

Function at 0x4047fc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x404862
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040402c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
jmp loc.0041c24f

Function at 0x404a10
Capabilities:
Get thread local storage value

Disassembly:
mov cl, byte [0x40c64c]
mov eax, dword [0x40b0b0]
test cl, cl
jne 0x404a45
jmp loc.0041937b
jmp loc.004139b5
push eax
call sub.kernel32.dll_TlsGetValue
test eax, eax
je 0x404a2a
ret
Function at 0x404e48
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404234
xor eax, eax
push ebp
push 0x404e9d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
call fcn.00404044
push eax
lea eax, [ebp - 4]
call fcn.0040429c
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.wsock32.dll_send
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404ea4
lea eax, [ebp - 4]
call fcn.00403dcc
ret

Function at 0x4070b8
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebx
mov ebx, eax
lea eax, [ebx + 0x44]
push eax
mov dl, 1
mov al, 2
call fcn.00404c28
push eax
call sub.wsock32.dll_WSAStartup
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebx + 0x30], eax
jmp loc.0041c3f9

Function at 0x40717c
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404234
xor eax, eax
push ebp
push 0x407208
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 4]
call fcn.00404244
push eax
call sub.kernel32.dll_FindFirstFileA
cmp eax, 0xffffffff
je fcn.004071f2
push eax
call sub.kernel32.dll_FindClose
mov eax, dword [ebp - 0x134]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [ebp - 0x130]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
jmp loc.004134f8

Function at 0x407764
Capabilities:
Copy file
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x40783f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea edx, [ebp - 8]
mov eax, 0x407854
call fcn.00409064
mov eax, dword [ebp - 8]
call fcn.00404244
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
je 0x4077a6
mov eax, dword [0x40b16c]
add dword [eax], 0xa
jmp loc.00416f07

Function at 0x407e60
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
jmp loc.00416454

Function at 0x408650
Capabilities:
Packed with generic packer

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x14]
cmp eax, 0xffffffff
je fcn.00408668
push eax
call sub.kernel32.dll_FindClose
jmp loc.00413854

Function at 0x4086bc
Capabilities:
Packed with generic packer

Disassembly:
push ebx
mov ebx, eax
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 0x14]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
je 0x4086d9
mov eax, ebx
call fcn.004085ec
pop ebx
ret
jmp loc.004143da

Function at 0x4089f4
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov eax, esi
call fcn.00404044
mov ebx, eax
mov eax, edi
mov edx, ebx
jmp loc.00419b96

Function at 0x408a30
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
mov ebx, eax
mov eax, ebx
jmp loc.00418bb1
Function at 0x408bd8
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebx
push ecx
mov ebx, eax
mov dword [esp], 2
push 0
lea eax, [esp + 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
test eax, eax
je fcn.00408c0a
jmp loc.004152cf

Function at 0x408c58
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x19c], ecx
mov dword [ebp - 0x198], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404234
xor eax, eax
push ebp
push 0x408d9f
jmp loc.0041d13d

Function at 0x408e18
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
jmp loc.0041ceb2

Function at 0x408f14
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404234
xor eax, eax
push ebp
push 0x408fa3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
jmp loc.004186ed

Function at 0x408fbc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404234
xor eax, eax
push ebp
push 0x40904b
jmp loc.0041a14f

Function at 0x409064
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
jmp loc.00415486

Function at 0x40910c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404234
xor eax, eax
push ebp
push 0x40919b
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x101
call fcn.0040402c
push dword [ebp - 0x10c]
jmp loc.0041c8f0

Function at 0x4091f8
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov eax, esi
call fcn.00404044
mov ebx, eax
cmp ebx, 1
jl 0x40922f
jmp loc.00414e29
pop edi
pop esi
pop ebx
ret

Function at 0x409234
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], edx
mov esi, eax
mov eax, esi
call fcn.00404044
mov edi, eax
mov ebx, edi
cmp ebx, 1
jl 0x409272
jmp loc.00416a76
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4093c0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa88
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x578], ebx
mov dword [ebp - 0x568], ebx
mov dword [ebp - 0x56c], ebx
mov dword [ebp - 0x570], ebx
mov dword [ebp - 0x574], ebx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404234
jmp loc.00414f33
Function at 0x40970c
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
push ebx
xor edx, edx
mov dword [ebp - 0x194], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409781
jmp loc.0041599a

Function at 0x4097a4
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push ecx
mov ebx, eax
mov eax, dword [0x40b164]
mov dword [eax], 0xffffffff
call fcn.004027d4
test bx, bx
jbe 0x4097d9
push 0
jmp loc.00414a1d
pop edx
pop ebx
ret

Function at 0x409884
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe68
push ebx
push esi
push edi
xor edx, edx
jmp loc.0041bfd8

Function at 0x4099c0
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, ecx
mov ebx, edx
mov edx, esp
mov eax, ebx
call fcn.004030c8
mov edx, esp
mov eax, esi
jmp loc.00418f58

Function at 0x4099e8
Capabilities:
Check if file exists
Get file attributes
Packed with generic packer

Disassembly:
push ebx
mov ebx, edx
mov eax, ebx
call fcn.00404244
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x409a05
jmp loc.0041675a
xor eax, eax
jmp 0x409a0b
neg al
sbb eax, eax
pop ebx
ret

Function at 0x409c70
Capabilities:
Connect network resource
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x48], ecx
jmp loc.0041af26

Function at 0x40a23c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
xor ebp, ebp
xor edi, edi
lea eax, [ebx + 0x10]
jmp loc.0041c818

Function at 0x40a3f4
Capabilities:
Link many functions at runtime
Packed with generic packer

Disassembly:
push ebx
push 0x40a460
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
push 0x40a470
push ebx
call sub.kernel32.dll_GetProcAddress
mov dword [0x40c800], eax
push 0x40a480
push ebx
call sub.kernel32.dll_GetProcAddress
mov dword [0x40c804], eax
call fcn.00409a14
test eax, eax
je 0x40a44c
push 0x40a494
push ebx
call sub.kernel32.dll_GetProcAddress
mov dword [0x40c80c], eax
push 0x40a4a4
push ebx
jmp loc.0041c1cd
push 0x40a494
push ebx
call sub.kernel32.dll_GetProcAddress
mov dword [0x40c808], eax
pop ebx
ret

Function at 0x40a524
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push ecx
mov ebx, eax
mov eax, dword [0x40b19c]
mov dword [eax], 0xffffffff
jmp loc.00414449

Function at 0x413ada
Capabilities:
Copy file
Receive data
Receive data on socket

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
push 0x20
pop edi
xor ebx, ebx
push 0x8001
push eax
test eax, eax
add esp, 0x10
leave
popal
popfd
push 0x406934
jmp fcn.00405595

Function at 0x4152f2
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
dec eax
xor al, 0
pop edi
push ebx
dec edi
pop edi
dec edi
add al, 6
add al, 0x3f
dec ecx
and al, 0
add al, 0
popal
popfd
mov eax, dword [edx + 0xc]
and dword [eax + 4], 0xfffffffd
jmp loc.00403849