joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bc769
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov eax, ecx
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 0x20]
push esi
mov esi, dword [eax]
mov ebx, dword [esi + 0x20]
push edi
mov edi, dword [esi + 0x6c]
imul edi, dword [esi + 0x60]
add edi, ebx
cmp ebx, edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], edi
jae 0x4bc890
mov eax, 0xff1c
mov edx, dword [esi + 0x60]
mov esi, dword [esi + 0x68]
lea esi, [ebx + esi*2]
add edx, ebx
cmp ebx, esi
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x20], esi
jae 0x4bc871
movzx esi, word [edx + 2]
movzx ecx, word [edx]
movzx edx, word [ebx]
movzx edi, word [ebx + 2]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov ebx, esi
mov ecx, 0xe3
and dx, cx
and bx, cx
add ebx, edx
mov edx, dword [ebp - 4]
and dx, cx
add ebx, edx
mov edx, edi
and dx, cx
mov ecx, esi
and cx, ax
and esi, eax
lea edx, [ebx + edx + 0x42]
mov ebx, dword [ebp - 0xc]
and bx, ax
shr edx, 2
add ecx, ebx
mov ebx, dword [ebp - 4]
and bx, ax
add ecx, ebx
mov ebx, edi
and bx, ax
and edi, eax
lea ecx, [ecx + ebx + 0x208]
mov ebx, dword [ebp - 0x10]
shr ecx, 2
xor dl, cl
mov ecx, dword [ebp - 0xc]
and ecx, eax
add esi, ecx
mov ecx, dword [ebp - 4]
and ecx, eax
add esi, ecx
and edx, 0xffff00e3
lea ecx, [esi + edi + 0x208]
shr ecx, 2
xor edx, ecx
mov ecx, dword [ebp - 8]
add dword [ebp - 8], 2
mov word [ecx], dx
mov edx, dword [ebp - 0x14]
add ebx, 4
add edx, 4
cmp ebx, dword [ebp - 0x20]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], edx
jb 0x4bc7c2
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, dword [edx + 4]
add ecx, dword [esi + 0x60]
mov esi, dword [edx]
mov edx, dword [esi + 0x60]
lea ebx, [ebx + edx*2]
cmp ebx, edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ebx
jb 0x4bc7a3
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x4bc9a0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov eax, ecx
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 0x20]
push esi
mov esi, dword [eax]
mov ebx, dword [esi + 0x20]
push edi
mov edi, dword [esi + 0x6c]
imul edi, dword [esi + 0x60]
add edi, ebx
cmp ebx, edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], edi
jae 0x4bcac7
mov eax, 0xff00
mov edx, dword [esi + 0x60]
mov esi, dword [esi + 0x68]
lea esi, [ebx + esi*2]
add edx, ebx
cmp ebx, esi
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x20], esi
jae 0x4bcaa8
movzx esi, word [edx + 2]
movzx ecx, word [edx]
movzx edx, word [ebx]
movzx edi, word [ebx + 2]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov ebx, esi
mov ecx, 0xff
and dx, cx
and bx, cx
add ebx, edx
mov edx, dword [ebp - 4]
and dx, cx
add ebx, edx
mov edx, edi
and dx, cx
mov ecx, esi
and cx, ax
and esi, eax
lea edx, [ebx + edx + 2]
mov ebx, dword [ebp - 0xc]
and bx, ax
shr edx, 2
add ecx, ebx
mov ebx, dword [ebp - 4]
and bx, ax
add ecx, ebx
mov ebx, edi
and bx, ax
and edi, eax
lea ecx, [ecx + ebx + 0x200]
mov ebx, dword [ebp - 0x10]
shr ecx, 2
xor dl, cl
mov ecx, dword [ebp - 0xc]
and ecx, eax
add esi, ecx
mov ecx, dword [ebp - 4]
and ecx, eax
add esi, ecx
and edx, 0xffff00ff
lea ecx, [esi + edi + 0x200]
shr ecx, 2
xor edx, ecx
mov ecx, dword [ebp - 8]
add dword [ebp - 8], 2
mov word [ecx], dx
mov edx, dword [ebp - 0x14]
add ebx, 4
add edx, 4
cmp ebx, dword [ebp - 0x20]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], edx
jb 0x4bc9f9
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, dword [edx + 4]
add ecx, dword [esi + 0x60]
mov esi, dword [edx]
mov edx, dword [esi + 0x60]
lea ebx, [ebx + edx*2]
cmp ebx, edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ebx
jb 0x4bc9da
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x4bcace
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, ecx
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 0x20]
push ebx
push edi
mov dword [ebp - 0x28], eax
mov eax, dword [eax]
mov edi, dword [eax + 0x6c]
imul edi, dword [eax + 0x60]
mov ebx, dword [eax + 0x20]
add edi, ebx
cmp ebx, edi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], edi
jae 0x4bcbe6
push esi
mov esi, 0xf0
mov edx, dword [eax + 0x60]
mov eax, dword [eax + 0x68]
add eax, ebx
add edx, ebx
cmp ebx, eax
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], eax
jae 0x4bcbc6
movzx ecx, byte [edx]
movzx eax, byte [edx + 1]
movzx edi, byte [ebx + 1]
mov dword [ebp - 4], ecx
movzx ecx, byte [ebx]
mov ebx, ecx
and ebx, 0xf
mov edx, eax
and edx, 0xf
add edx, ebx
mov ebx, dword [ebp - 4]
and ebx, 0xf
add edx, ebx
mov dword [ebp - 0x1c], ecx
and cx, si
mov ebx, edi
and ebx, 0xf
lea edx, [edx + ebx + 2]
mov ebx, eax
and bx, si
shr edx, 2
and ax, si
add ebx, ecx
mov ecx, dword [ebp - 4]
and cx, si
add ebx, ecx
mov ecx, edi
and cx, si
and di, si
lea ecx, [ebx + ecx + 0x20]
shr ecx, 2
xor dl, cl
mov ecx, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0xc]
and cx, si
and dl, 0xf
add eax, ecx
mov ecx, dword [ebp - 4]
and cx, si
add eax, ecx
lea eax, [eax + edi + 0x20]
shr eax, 2
xor dl, al
mov eax, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [eax], dl
mov edx, dword [ebp - 0x10]
inc ebx
inc ebx
inc edx
inc edx
cmp ebx, dword [ebp - 0x20]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], edx
jb 0x4bcb26
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 4]
add ecx, dword [edx + 0x60]
mov eax, dword [eax]
mov edx, dword [eax + 0x60]
lea ebx, [ebx + edx*2]
cmp ebx, edi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ebx
jb 0x4bcb08
pop esi
pop edi
xor eax, eax
pop ebx
leave
ret
Function at 0x4e54ea
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
xor eax, eax
mov edi, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov esi, dword [ecx + 4]
test esi, esi
je 0x4e550b
mov eax, dword [ecx]
mov eax, dword [eax + 8]
add eax, esi
jmp 0x4e550d
xor eax, eax
mov dword [edx], eax
movzx eax, word [ecx + 8]
mov dword [edx + 4], eax
movzx eax, word [ecx + 0xa]
mov dword [edx + 8], eax
movzx eax, word [ecx + 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax]
mov dword [edx + 0x10], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 2]
mov dword [edx + 0x14], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 4]
mov dword [edx + 0x18], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 6]
mov dword [edx + 0x1c], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 8]
mov dword [edx + 0x20], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 0xa]
mov dword [edx + 0x24], eax
mov eax, dword [edx + 0x20]
imul eax, dword [edx + 0x18]
imul eax, dword [edx + 0x1c]
shl eax, 2
mov dword [edx + 0x28], eax
mov esi, dword [ecx + 0x14]
test esi, esi
je 0x4e5580
mov eax, dword [ecx]
mov eax, dword [eax + 8]
add eax, esi
jmp 0x4e5582
xor eax, eax
pop edi
mov dword [edx + 0x2c], eax
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x506db5
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
imul esi, esi, 0x64
mov edi, dword [ebp + 8]
imul edi, edi, 0x64
add edi, dword [ecx + 0x2c]
mov dword [ebp - 4], ecx
add esi, dword [edi + 4]
mov eax, dword [esi + 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov ebx, eax
mov eax, dword [ebx + 0xc]
add eax, dword [edi]
xor ecx, ecx
mov dword [ebp - 8], eax
mov eax, dword [ebx + 4]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 4]
test byte [eax + 0x118], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp + 8], ecx
jne 0x506e2b
push ecx
push ecx
call fcn.0047af9c
mov ecx, dword [ebp - 4]
push 0x30000
push 0
mov dword [ecx + 0x114], eax
call fcn.0047af9c
mov eax, dword [ebp - 4]
add esp, 0x10
or dword [eax + 0x118], 1
xor edx, edx
cmp dword [esi + 0x3c], edx
je 0x506f06
mov ecx, dword [edi]
mov eax, dword [ebx + 0x10]
add eax, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x14]
add eax, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x18]
add eax, ecx
cmp word [esi + 0x4e], dx
mov dword [ebp - 0x14], eax
mov dword [ebp + 8], edx
jbe 0x506ef8
movzx ecx, word [ebp + 8]
shl ecx, 5
add ecx, dword [esi + 0x34]
cmp dword [ecx], edx
je 0x506ee5
mov eax, dword [ecx + 4]
mov dword [ecx], eax
mov eax, dword [ecx + 0x10]
movzx edx, word [eax + 4]
sub edx, 0
je 0x506ec0
dec edx
je 0x506e99
dec edx
jne 0x506ee5
push 0xffffffffffffffff
lea edx, [ebp - 0xc]
push edx
movzx edx, word [eax + 8]
push eax
movzx eax, word [eax + 6]
shl eax, 5
add eax, dword [ebp - 0x10]
jmp 0x506eae
push 0xffffffffffffffff
lea edx, [ebp - 0xc]
push edx
movzx edx, word [eax + 8]
push eax
movzx eax, word [eax + 6]
shl eax, 5
add eax, dword [ebp - 0x14]
push dword [esi + 0x3c]
push edx
push eax
push dword [ecx + 0xc]
mov ecx, dword [ebp - 4]
call fcn.0050624f
jmp 0x506ee5
push 0xffffffffffffffff
lea edx, [ebp - 0xc]
push edx
movzx edx, word [eax + 8]
push eax
push dword [esi + 0x3c]
movzx eax, word [eax + 6]
push edx
mov edx, dword [ebp - 0x18]
lea eax, [edx + eax*8]
push eax
push dword [ecx + 0xc]
mov ecx, dword [ebp - 4]
call fcn.005065e8
inc dword [ebp + 8]
mov ax, word [ebp + 8]
xor edx, edx
cmp ax, word [esi + 0x4e]
jb 0x506e5d
mov edi, dword [edi]
add edi, dword [ebx + 0x10]
mov eax, dword [ebx + 8]
mov dword [ebp - 0xc], edi
mov dword [ebp + 8], eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push edx
push dword [ebp + 8]
push edx
push dword [ebp - 8]
push dword [ebp - 8]
push dword [ebp - 8]
push edx
push dword [ebp - 0xc]
push edx
push dword [esi + 0x44]
push dword [esi + 0x40]
call fcn.004cad0a
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x514140
Capabilities:
Check for software breakpoints

Disassembly:
cmp dword [esi + 0x14], 0xcc
je 0x514163
mov eax, dword [esi + 0x1a8]
push esi
call dword [eax]
mov dword [esi + 0x8c], 0
mov dword [esi + 0x14], 0xcc
mov ecx, dword [esi + 0x1a8]
mov eax, dword [ecx + 8]
test eax, eax
je 0x514189
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x30
call dword [eax]
mov edx, dword [esi + 0x1a8]
mov eax, dword [edx + 8]
test eax, eax
jne 0x514170
mov edx, dword [esi + 0x44]
xor eax, eax
test edx, edx
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov eax, 1
ret

Function at 0x514240
Capabilities:
Check for software breakpoints

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x514277
push esi
call fcn.00546000
mov eax, dword [esi + 0x40]
test eax, eax
je 0x514270
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
pop ebp
ret 4
mov dword [esi + 0x14], 0xcb
mov ecx, dword [esi + 0x14]
cmp ecx, 0xcb
jne 0x5142f6
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x5142e0
nop
mov eax, dword [esi + 8]
test eax, eax
je 0x51429a
push esi
call dword [eax]
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
test eax, eax
je 0x5142d9
cmp eax, 2
je 0x5142e0
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x514290
cmp eax, 3
je 0x5142bd
cmp eax, 1
jne 0x514290
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
cmp eax, dword [ecx + 8]
jl 0x514290
mov eax, dword [ecx + 8]
mov edx, dword [esi + 0x144]
add eax, edx
mov dword [ecx + 8], eax
jmp 0x514290
xor eax, eax
pop esi
pop ebp
ret 4
mov eax, dword [esi + 0x94]
mov dword [esi + 0x9c], eax
call fcn.00514140
pop esi
pop ebp
ret 4
cmp ecx, 0xcc
je 0x51430d
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
push esi
mov dword [eax + 0x18], ecx
call dword [eax]
call fcn.00514140
pop esi
pop ebp
ret 4
Function at 0x547486
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x547495
xor eax, eax
jmp 0x547578
mov eax, dword [esp + 0xc]
cmp eax, 8
push ebx
push esi
mov esi, dword [esp + 0xc]
not esi
mov ecx, 0xff
jb 0x547558
push edi
mov edi, eax
shr edi, 3
xor ebx, ebx
mov bl, byte [edx]
sub eax, 8
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x595480]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x595480]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x595480]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x595480]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x595480]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x595480]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x595480]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x595480]
inc edx
dec edi
jne 0x5474b5
pop edi
test eax, eax
je 0x547572
xor ebx, ebx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x595480]
inc edx
dec eax
jne 0x54755c
mov eax, esi
pop esi
not eax
pop ebx
ret 0xc
Function at 0x547719
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebx + 0x24]
push esi
mov dword [ebp - 8], edx
push edi
mov ecx, dword [ebx + 0x64]
mov eax, dword [ebx + 0x34]
mov esi, dword [ebx + 0x6c]
sub eax, ecx
sub eax, esi
mov dword [ebp - 4], eax
jne 0x547745
test ecx, ecx
jne 0x54774f
test esi, esi
jne 0x54774f
mov eax, edx
jmp 0x5477c0
cmp eax, 0xffffffff
jne 0x54774f
push 0xfffffffffffffffe
pop eax
jmp 0x5477c0
mov esi, dword [ebx + 0x24]
lea esi, [edx + esi - 0x106]
cmp ecx, esi
jb 0x5477c0
mov edi, dword [ebx + 0x30]
mov ecx, edx
mov eax, ecx
shr ecx, 2
lea esi, [edi + edx]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x3c]
sub dword [ebx + 0x68], edx
sub dword [ebx + 0x64], edx
sub dword [ebx + 0x54], edx
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx esi, word [eax]
mov edi, esi
sub edi, edx
cmp esi, edx
sbb esi, esi
not esi
and esi, edi
dec ecx
mov word [eax], si
jne 0x547785
mov eax, dword [ebx + 0x38]
mov esi, edx
lea eax, [eax + edx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edi, ecx
sub edi, edx
cmp ecx, edx
sbb ecx, ecx
not ecx
and ecx, edi
dec esi
mov word [eax], cx
jne 0x5477a4
mov eax, dword [ebp - 4]
add eax, edx
mov esi, dword [ebx]
cmp dword [esi + 4], 0
mov dword [ebp - 0xc], esi
je 0x54786d
mov edi, dword [ebx + 0x6c]
add edi, dword [ebx + 0x64]
mov ecx, dword [esi + 4]
add edi, dword [ebx + 0x30]
cmp ecx, eax
mov dword [ebp - 4], ecx
jbe 0x5477e5
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5477ef
xor ecx, ecx
jmp 0x54782e
sub ecx, dword [ebp - 4]
mov eax, dword [esi + 0x1c]
mov dword [esi + 4], ecx
cmp dword [eax + 0x18], 0
jne 0x547811
push dword [ebp - 4]
push dword [esi]
push dword [esi + 0x30]
call fcn.0056dd83
mov edx, dword [ebp - 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebp - 4]
mov esi, dword [esi]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
mov eax, dword [ebp - 0xc]
add dword [eax], ecx
add dword [eax + 8], ecx
add dword [ebx + 0x6c], ecx
mov edi, dword [ebx + 0x6c]
cmp edi, 3
jb 0x547859
mov eax, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [ebx + 0x50]
mov dword [ebx + 0x40], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp edi, 0x106
jae 0x54786d
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x547727
pop edi
pop esi
leave
ret
Function at 0x576734
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebp
push ebx
push esi
mov dword [esp], eax
test eax, eax
je 0x5767e1
mov esi, eax
mov edx, dword [esi]
xor eax, eax
mov byte [edx + 0x16], al
mov ecx, dword [esi]
mov byte [ecx + 0x17], al
mov ebx, dword [esi]
mov byte [ebx + 0x18], al
mov ebp, dword [esi]
mov byte [ebp + 0x19], al
mov ebp, dword [esi + 4]
test ebp, ebp
jle 0x57678b
mov eax, esi
mov edx, dword [eax]
xor ecx, ecx
xor ebx, ebx
movzx esi, byte [edx + ebx]
mov edi, ecx
shl edi, 8
shr ecx, 0x18
xor ecx, esi
mov eax, ecx
mov ecx, edi
xor ecx, dword [eax*4 + 0x599fa0]
inc ebx
cmp ebx, ebp
jl 0x57676b
jmp 0x576791
mov eax, esi
mov edx, dword [eax]
xor ecx, ecx
mov eax, dword [esp]
mov edi, dword [eax + 0xc]
test edi, edi
jle 0x5767bf
mov ebp, dword [eax + 8]
xor esi, esi
movzx eax, byte [ebp + esi]
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
xor ecx, eax
mov eax, ecx
mov ecx, ebx
xor ecx, dword [eax*4 + 0x599fa0]
inc esi
cmp esi, edi
jl 0x5767a0
mov esi, dword [esp]
mov byte [edx + 0x16], cl
mov ebp, dword [esi]
mov eax, ecx
shr eax, 8
mov byte [ebp + 0x17], al
mov ebx, dword [esi]
mov edx, ecx
shr edx, 0x10
mov byte [ebx + 0x18], dl
mov edi, dword [esi]
shr ecx, 0x18
mov byte [edi + 0x19], cl
pop ecx
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x40cf9b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x40cfaa
pop dword [ebp - 0x44]
mov eax, 0x463536a7
sub eax, 0x45f466fd
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x4023e
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x71e9ce17
sub ecx, 0x71e97c8e
xor edx, edx
add edx, eax
mov ebx, 0x435400
add ebx, dword [ebp - 0x44]
mov edi, 0x703de5cf
xor dword [ebp - 0x18], 0x61d0864
mov esi, dword [ebx]
add dword [ebp - 0x10], eax
add esi, edi
sub dword [ebp - 0x20], ebx
mov dword [edx], esi
add edx, 0xbb0ed4b1
sub edx, 0xbb0ed4ad
add ebx, 4
loop 0x40cffa
add eax, 0x86226a35
sub eax, 0x8621313e
xor ebx, ebx
add ebx, eax
add eax, 0xcc1ee7c5
add eax, 0x33e11840
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [0x40d0d7]
shl eax, 2
mov dword [0x40d0db], eax
push edi
push ecx
xor eax, eax
mov edi, 0x40f5c0
mov ecx, 0x42dc84
cmp ecx, edi
jbe 0x401024
sub ecx, edi
cld
rep stosb byte es:[edi], al
pop ecx
pop edi
push 0
call fcn.00402e6b
pop ecx
push 0x40d0a0
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x40d0df], eax
push 0
jmp fcn.0040c0c0
Function at 0x40236c
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp byte [esi], 0
je 0x4023af
push esi
call sub.WSOCK32.dll_inet_addr
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4023af
push str.255.255.255.255
push esi
call fcn.00402a14
add esp, 8
test eax, eax
je 0x4023af
push esi
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x4023ad
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
mov ebx, dword [edx]
jmp 0x4023af
xor ebx, ebx
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x402405
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
mov ax, 0x101
lea edx, [ebp - 0x190]
push edx
push eax
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x402460
cmp byte [ebp - 0x190], 1
jne 0x402460
movzx ecx, word [ebp - 0x190]
sar ecx, 8
and cl, 0xff
cmp cl, 1
jne 0x402460
push 0x1e0
push 0xffffffffffffffff
push 0x42d5c4
call fcn.00402934
add esp, 0xc
mov dword [0x40d36c], 1
xor eax, eax
jmp 0x402465
mov eax, 0xfffffffc
mov esp, ebp
pop ebp
ret

Function at 0x40248a
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 8]
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x4024a1
mov ax, 0xfffd
pop ecx
pop ebp
ret
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov eax, dword [ecx]
mov dword [ebp - 4], eax
push dword [ebp - 4]
call sub.WSOCK32.dll_inet_ntoa
push eax
push dword [ebp + 0xc]
call fcn.00402a60
add esp, 8
xor eax, eax
pop ecx
pop ebp
ret
Function at 0x4027de
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push 0
push 0x5b4
push edi
lea eax, [esi + esi*2]
push dword [eax*8 + 0x42d5c4]
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x402810
mov eax, 0xfffffff8
jmp 0x40286f
mov byte [ebp - 0xc], 6
mov ebx, eax
cmp eax, 0x5b4
jne 0x40286d
push 0
push 1
lea eax, [ebp - 0xc]
push eax
lea edx, [esi + esi*2]
push dword [edx*8 + 0x42d5c4]
call sub.WSOCK32.dll_send
inc eax
jne 0x40283e
mov eax, 0xfffffff9
jmp 0x40286f
push 0
push 0x5b4
lea edx, [ebx + edi]
push edx
lea ecx, [esi + esi*2]
push dword [ecx*8 + 0x42d5c4]
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x402864
mov eax, 0xfffffff8
jmp 0x40286f
add ebx, eax
cmp eax, 0x5b4
je 0x40281d
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4077c4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test byte [ebp + 0xd], 0xc0
jne 0x4077e3
mov eax, dword [0x40e628]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4077f0
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x40781d
je 0x40782f
sub ecx, 0x100
je 0x40783d
sub ecx, 0x100
je 0x407844
sub ecx, 0x100
je 0x407836
jmp 0x40784b
sub ecx, 0x600
je 0x407844
sub ecx, 0x100
je 0x40782f
jmp 0x40784b
mov edi, 1
jmp 0x407850
mov edi, 2
jmp 0x407850
mov edi, 4
jmp 0x407850
mov edi, 5
jmp 0x407850
mov edi, 3
test byte [ebp + 0xd], 1
je 0x407877
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x40eb30]
test al, 0x80
je 0x407870
mov ebx, 0x80
jmp 0x407889
mov ebx, 1
jmp 0x407889
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x407889
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x40789b
je 0x4078a4
dec eax
je 0x4078ad
jmp 0x4078b6
mov dword [ebp - 4], 0x80000000
jmp 0x4078c5
mov dword [ebp - 4], 0x40000000
jmp 0x4078c5
mov dword [ebp - 4], 0xc0000000
jmp 0x4078c5
push 1
call fcn.0040753c
pop ecx
mov ebx, eax
jmp 0x4079b1
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4078e1
sub eax, 0x10
je 0x4078e8
sub eax, 0x10
je 0x4078f1
sub eax, 0x10
je 0x4078fa
jmp 0x4078fa
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x407901
mov dword [ebp - 8], 1
jmp 0x407901
mov dword [ebp - 8], 2
jmp 0x407901
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x40796a
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x40795f
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x40795f
add ebx, 0xffffffb2
push ebx
call fcn.0040753c
pop ecx
mov ebx, eax
jmp 0x4079b1
mov edi, esi
push edi
call fcn.00407734
pop ecx
test eax, eax
je 0x40797e
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x40798a
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00407298
add esp, 8
mov ebx, eax
inc eax
jne 0x4079b1
push 4
call fcn.0040753c
pop ecx
push esi
call sub.KERNEL32.dll_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40b04c
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret