joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436dd0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
mov esi, dword [eax]
push edi
xor edi, edi
push esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
push esi
mov dword [0x549b54], eax
call dword [sym.imp.MSVBVM60.DLL_VarPtr]
mov ecx, dword [0x549b54]
mov edx, dword [0x549f54]
mov ebp, dword [esp + 0x20]
mov dword [0x549b50], eax
lea ebx, [ecx - 1]
mov ecx, dword [0x549b5c]
cmp ebx, edi
mov dword [esp + 0x14], ebx
jl 0x436e7c
mov eax, dword [edx + 0x14]
mov esi, ebp
sub esi, eax
mov edi, dword [ecx + 0x14]
mov eax, esi
xor ebp, ebp
shl eax, 4
add eax, esi
shl edi, 1
lea esi, [eax + eax*2]
shl esi, 1
inc ebx
mov dword [esp + 0x24], ebx
mov ebx, dword [ecx + 0xc]
mov eax, ebp
sub eax, edi
add ebp, 2
mov ax, word [eax + ebx]
mov ebx, dword [edx + 0xc]
sub ax, 0x20
movsx eax, ax
add eax, ebx
xor ebx, ebx
mov bl, byte [eax + esi + 6]
mov eax, dword [esp + 0x10]
add eax, ebx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x24]
dec eax
mov dword [esp + 0x24], eax
jne 0x436e3f
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x28]
sub esi, eax
xor edi, edi
test ebx, ebx
mov dword [esp + 0x28], esi
jl 0x436f55
jmp 0x436e9c
mov ecx, dword [0x549b5c]
mov esi, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
mov eax, edi
sub eax, esi
mov ax, word [ecx + eax*2]
mov ecx, ebp
sub ax, 0x20
lea ebp, [esp + 0x18]
movsx esi, ax
mov eax, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
sub ecx, eax
push ebp
mov eax, ecx
push 0x3f800000
shl eax, 4
add eax, ecx
lea ecx, [eax + eax*2]
movsx eax, word [edx + ecx*2]
movsx ebp, word [edx + ecx*2 + 2]
lea ecx, [edx + ecx*2]
push ebp
push eax
imul eax, esi
movsx ecx, word [ecx + 4]
mov edx, dword [0x549b40]
push ecx
mov ecx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x44]
mov ebx, dword [edx]
push eax
push ecx
push 5
push edx
call dword [ebx + 0x7c]
test eax, eax
fnclex
jge 0x436f19
mov edx, dword [0x549b40]
push 0x7c
push 0x420aa0
push edx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
mov edx, dword [0x549f54]
mov ebp, dword [esp + 0x20]
mov ecx, ebp
sub ecx, dword [edx + 0x14]
mov eax, ecx
shl eax, 4
add eax, ecx
mov ecx, dword [edx + 0xc]
lea eax, [eax + eax*2]
lea eax, [ecx + eax*2]
xor ecx, ecx
mov cl, byte [eax + esi + 6]
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
add esi, ecx
inc edi
mov dword [esp + 0x28], esi
cmp edi, eax
jle 0x436e96
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
Function at 0x43a100
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
mov edx, dword [0x549f54]
mov ecx, dword [esp + 0x18]
push ebx
push ebp
mov ebp, dword [edx + 0x14]
mov edx, dword [edx + 0xc]
sub ecx, ebp
push esi
mov eax, ecx
push edi
shl eax, 4
add eax, ecx
xor ebx, ebx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ebx
lea ebp, [eax + eax*2]
shl ebp, 1
lea eax, [edx + ebp]
mov edx, 1
mov ax, word [eax + 2]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
mov edi, dword [ecx + 0xc]
mov eax, dword [ecx + 0x14]
sub edi, eax
xor eax, eax
mov dword [esp + 0x28], ebx
mov al, byte [edi + edx]
mov ecx, edx
mov esi, eax
test esi, esi
je 0x43a19d
mov ebx, dword [esp + 0x2c]
xor eax, eax
mov al, byte [ebx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x18]
xor ebx, ebx
add eax, ebp
mov bl, byte [eax + esi + 6]
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
add esi, ebx
cmp ecx, eax
mov dword [esp + 0x28], esi
je 0x43a199
inc ecx
xor eax, eax
mov al, byte [edi + ecx]
mov esi, eax
test esi, esi
jne 0x43a16f
mov ebx, dword [esp + 0x10]
movsx eax, word [esp + 0x30]
cmp dword [esp + 0x28], eax
jle 0x43a1c0
test ebx, ebx
jle 0x43a1c0
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x14]
add esi, eax
xor ebx, ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
cmp edx, ecx
jg 0x43a1e2
xor eax, eax
mov al, byte [edi + edx]
mov esi, eax
mov eax, dword [esp + 0x18]
add esi, eax
xor eax, eax
mov al, byte [esi + ebp + 6]
add ebx, eax
inc edx
cmp edx, ecx
jle 0x43a1c4
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x2c]
lea edx, [ecx + 1]
xor ecx, ecx
mov cl, byte [eax + 4]
cmp edx, ecx
jle 0x43a151
mov ax, word [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
Function at 0x440b30
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x4054c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x90
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x401620
mov edx, dword [ebp + 0x10]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
xor edi, edi
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], edi
call esi
mov edx, dword [ebp + 0x14]
lea ecx, [ebp - 0x24]
call esi
mov eax, dword [ebp + 0xc]
movzx cx, byte [eax]
cmp word [0x54b20c], cx
je 0x44353e
call fcn.0044ce80
mov bx, word [0x54b244]
cmp bx, di
je 0x440c32
mov ecx, dword [0x54b200]
xor bx, bx
mov word [0x54b244], bx
mov edx, 1
mov eax, 8
cmp edx, eax
jg 0x440c0e
mov esi, dword [ecx + 0x14]
mov eax, edx
sub eax, esi
mov esi, dword [ecx + 0xc]
lea eax, [eax + eax*2]
shl eax, 4
mov word [eax + esi + 0x1c], di
mov esi, dword [ecx + 0x14]
mov eax, edx
sub eax, esi
mov esi, dword [ecx + 0xc]
lea eax, [eax + eax*2]
shl eax, 4
cmp dword [eax + esi + 0xc], edi
jle 0x440bff
or bx, 0xffff
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
mov eax, 1
add edx, eax
jmp 0x440bc7
cmp bx, di
mov word [0x54b244], bx
je 0x440c32
fld dword [0x54b248]
fsub dword [0x54b24c]
fstp dword [0x54b248]
jne 0x44353e
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x549b2c]
mov dword [0x54b248], 0x3f800000
mov dword [0x54b24c], 0x3dcccccd
mov bl, byte [ecx]
mov edx, dword [eax]
push ebx
push eax
mov word [0x54b250], di
call dword [edx + 0x3c]
cmp eax, edi
fnclex
jge 0x440c79
mov ecx, dword [0x549b2c]
push 0x3c
push 0x421ec4
push ecx
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaHresultCheckObj]
xor dx, dx
push edi
mov dl, bl
mov word [0x54b20c], dx
call fcn.0043ec30
mov edx, dword [ebp - 0x20]
mov ecx, 0x54b210
call esi
mov edx, dword [ebp - 0x24]
mov ecx, 0x54b214
call esi
mov edi, dword [ebp + 8]
mov ecx, dword [0x54b200]
mov esi, 1
Function at 0x47a130
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword [0x549b74]
push esi
push edi
xor eax, eax
lea edx, [ecx + ecx*4]
shl edx, 0xa
add edx, ecx
mov ecx, dword [0x549f68]
mov ecx, dword [ecx + edx*8 + 0x9ff8]
mov edx, dword [esp + 0xc]
mov esi, edx
mov edi, dword [ecx + 0x14]
mov ecx, dword [ecx + 0xc]
sub esi, edi
pop edi
mov ecx, dword [ecx + esi*8 + 4]
pop esi
test ecx, ecx
jne 0x47a17d
push ecx
push ecx
push 8
push 7
push 1
push edx
mov edx, dword [esp + 0x20]
push edx
call fcn.0047a0c0
ret 8
cmp ecx, 4
je 0x47a3b1
cmp ecx, 6
je 0x47a3b1
cmp ecx, 9
je 0x47a399
cmp ecx, 0xa
je 0x47a399
cmp ecx, 0xd
je 0x47a381
cmp ecx, 0xe
je 0x47a381
cmp ecx, 0x12
je 0x47a381
cmp ecx, 0x13
je 0x47a381
cmp ecx, 0x17
je 0x47a369
cmp ecx, 0x18
je 0x47a369
cmp ecx, 0x1c
je 0x47a351
cmp ecx, 0x1d
je 0x47a351
cmp ecx, 0x1f
jne 0x47a206
mov eax, dword [esp + 8]
push 0
push 0
push 0
push 0x28
push 2
push edx
push eax
call fcn.0047a0c0
ret 8
cmp ecx, 0x21
je 0x47a339
cmp ecx, 0x22
je 0x47a339
cmp ecx, 0x24
je 0x47a321
cmp ecx, 0x25
je 0x47a321
cmp ecx, 0x28
je 0x47a309
cmp ecx, 0x29
je 0x47a309
cmp ecx, 0x2c
je 0x47a309
cmp ecx, 0x2d
je 0x47a309
cmp ecx, 0x31
je 0x47a2f1
cmp ecx, 0x32
je 0x47a2f1
cmp ecx, 0x34
je 0x47a2d9
cmp ecx, 0x35
je 0x47a2d9
cmp ecx, 0x3a
jl 0x47a28c
cmp ecx, 0x3c
jg 0x47a28c
mov ecx, dword [esp + 8]
push 0x34
push 0x33
push 0x32
push 0x31
push 2
push edx
push ecx
call fcn.0047a0c0
ret 8
cmp ecx, 0x3f
je 0x47a2c1
cmp ecx, 0x40
je 0x47a2c1
cmp ecx, 0x44
je 0x47a2c1
cmp ecx, 0x45
je 0x47a2c1
cmp ecx, 0x47
jne 0x47a3c6
push 0
push 0
push 0x12
push 0x11
push 2
push edx
mov edx, dword [esp + 0x20]
push edx
call fcn.0047a0c0
ret 8
mov eax, dword [esp + 8]
push 0x39
push 0x38
push 0x37
push 0x36
push 2
push edx
push eax
call fcn.0047a0c0
ret 8
mov ecx, dword [esp + 8]
push 0
push 0
push 0
push 0x2d
push 2
push edx
push ecx
call fcn.0047a0c0
ret 8
push 0
push 0
push 0x3f
push 0x3e
push 2
push edx
mov edx, dword [esp + 0x20]
push edx
call fcn.0047a0c0
ret 8
mov eax, dword [esp + 8]
push 0
push 0
push 0x3d
push 0x3c
push 2
push edx
push eax
call fcn.0047a0c0
ret 8
mov ecx, dword [esp + 8]
push 0x42
push 0x41
push 0x40
push 0x3b
push 2
push edx
push ecx
call fcn.0047a0c0
ret 8
push 0
push 0x1a
push 0x19
push 0x18
push 2
push edx
mov edx, dword [esp + 0x20]
push edx
call fcn.0047a0c0
ret 8
mov eax, dword [esp + 8]
push 0
push 0x21
push 0x20
push 0x1f
push 2
push edx
push eax
call fcn.0047a0c0
ret 8
mov ecx, dword [esp + 8]
push 0
push 0
push 0x15
push 0x14
push 2
push edx
push ecx
call fcn.0047a0c0
ret 8
push 0xf
push 0xe
push 0xd
push 0xc
push 2
push edx
mov edx, dword [esp + 0x20]
push edx
call fcn.0047a0c0
ret 8
mov eax, dword [esp + 8]
push 0
push 0
push 0
push 0xc
push 2
push edx
push eax
call fcn.0047a0c0
ret 8
mov ecx, dword [esp + 8]
push 5
push 4
push 3
push 2
push 2
push edx
push ecx
call fcn.0047a0c0
ret 8
Function at 0x4af5c0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x4054c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x403308
fild dword [ebp + 8]
mov ecx, 6
xor eax, eax
lea edi, [ebp - 0x30]
mov edx, dword [0x549f68]
fstp qword [ebp - 0x40]
fld qword [ebp - 0x40]
fdiv qword [0x403300]
rep stosd dword es:[edi], eax
mov eax, dword [0x549b74]
lea ecx, [eax + eax*4]
shl ecx, 0xa
add ecx, eax
lea esi, [edx + ecx*8]
call dword [sym.imp.MSVBVM60.DLL___vbaFPFix]
fadd qword [0x4023f8]
call dword [sym.imp.MSVBVM60.DLL___vbaFpI4]
mov ecx, dword [ebp + 8]
xor ebx, ebx
lea edx, [ecx + ecx*2]
movzx di, byte [esi + edx*8 + 0xdf7]
add word [esi + eax*2 + 0xa88], di
lea edx, [esi + edx*8]
lea eax, [edx + 0xdf4]
movzx dx, byte [edx + 0xdf4]
mov byte [esi + ecx + 0x424], bl
lea ecx, [ebp - 0x30]
push ecx
add edx, 0x64
push eax
push 0x41e524
movsx edi, dx
call dword [sym.imp.MSVBVM60.DLL___vbaRecAssign]
call fcn.004af790
push edi
call fcn.004b46f0
mov edx, dword [0x54a648]
mov eax, dword [0x54a680]
mov ecx, dword [0x54a664]
mov dword [edx + edi*4 + 0x30], ebx
mov dword [eax + edi*4 + 0x30], ebx
mov dword [ecx + edi*4 + 0x30], ebx
call fcn.004b4bb0
push 0xffffffffffffffff
call fcn.00491c30
wait
push 0x4af6bd
lea edx, [ebp - 0x30]
push edx
push 0x41e524
call dword [sym.imp.MSVBVM60.DLL___vbaRecDestruct]
ret
Function at 0x523bb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x4054c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x404960
push 0x11
lea eax, [ebp - 0x28]
xor esi, esi
push 0x42a9c0
push eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], esi
call dword [sym.imp.MSVBVM60.DLL___vbaAryConstruct2]
mov edi, dword [ebp + 8]
mov ecx, dword [edi]
push ecx
push 1
call dword [sym.imp.MSVBVM60.DLL___vbaUbound]
mov ebx, eax
mov dword [ebp - 0x34], ebx
fild dword [ebp - 0x34]
fstp qword [ebp - 0x48]
fld qword [ebp - 0x48]
fdiv qword [0x401510]
fstp qword [ebp - 0x50]
fild dword [ebp - 0x34]
fstp qword [ebp - 0x58]
fld qword [ebp - 0x58]
fdiv qword [0x401510]
call dword [sym.imp.MSVBVM60.DLL___vbaFpI4]
and eax, 0x80000001
jns 0x523c38
dec eax
or eax, 0xfffffffe
inc eax
mov dword [ebp - 0x5c], eax
fild dword [ebp - 0x5c]
fstp qword [ebp - 0x64]
fld qword [ebp - 0x50]
fsub qword [ebp - 0x64]
call dword [sym.imp.MSVBVM60.DLL___vbaFpI4]
lea edx, [ebp - 0x38]
mov dword [ebp - 0x38], eax
push edx
call dword [sym.imp.MSVBVM60.DLL_VarPtr]
push 4
mov dword [ebp - 0x3c], eax
push eax
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0041fac4
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x14]
sub eax, edx
mov ecx, eax
mov dl, byte [eax + esi]
mov eax, dword [ebp - 0x1c]
sub ecx, esi
xor dl, byte [eax + 2]
add ecx, ebx
mov al, byte [ecx]
xor al, dl
mov byte [ecx], al
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x14]
sub eax, edx
mov ecx, eax
sub ecx, esi
mov dl, byte [ecx + ebx - 1]
mov ecx, dword [ebp - 0x1c]
xor dl, byte [ecx + 3]
mov cl, byte [eax + esi + 1]
xor cl, dl
mov byte [eax + esi + 1], cl
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x14]
sub eax, edx
mov edx, eax
sub edx, esi
mov cl, byte [edx + ebx]
mov dl, byte [eax + esi]
xor cl, dl
mov edx, dword [ebp - 0x1c]
xor cl, byte [edx]
mov byte [eax + esi], cl
mov ecx, dword [edi]
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x14]
sub eax, edx
mov ecx, eax
mov dl, byte [eax + esi + 1]
mov eax, dword [ebp - 0x1c]
sub ecx, esi
add esi, 2
xor dl, byte [eax + 1]
mov al, byte [ecx + ebx - 1]
lea ecx, [ecx + ebx - 1]
xor al, dl
mov byte [ecx], al
mov eax, dword [ebp - 0x38]
cmp esi, eax
jne 0x523c6f
wait
push 0x523d19
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x28]
push edx
push 0
mov dword [ebp - 0x3c], ecx
call dword [sym.imp.MSVBVM60.DLL___vbaAryDestruct]
ret
Function at 0x53ce50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x4054c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x4050b0
mov ebx, dword [sym.imp.MSVBVM60.DLL___vbaAryLock]
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov eax, dword [0x54bc60]
lea ecx, [ebp - 0x18]
push eax
push ecx
call ebx
mov ecx, dword [ebp - 0x18]
push 1
movsx eax, word [0x54bc64]
mov edx, dword [ecx + 0x14]
mov edi, dword [ecx + 0xc]
sub eax, edx
lea esi, [eax + eax*2]
shl esi, 5
add esi, edi
inc word [esi + 0x34]
mov ax, word [esi + 0x34]
movsx edx, ax
push edx
lea edi, [esi + 0x30]
push 1
push 0x41f708
push edi
push 0x10
push 0
call dword [sym.imp.MSVBVM60.DLL___vbaRedimPreserve]
mov eax, dword [edi]
add esp, 0x1c
lea ecx, [ebp - 0x14]
push eax
push ecx
call ebx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push edx
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
movsx edx, word [esi + 0x34]
mov esi, dword [eax + 0x14]
mov ebx, dword [eax + 0xc]
sub edx, esi
push ecx
shl edx, 4
add edx, ebx
push edx
call fcn.0053cc10
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
lea eax, [ebp - 0x14]
push eax
call esi
lea ecx, [ebp - 0x18]
push ecx
call esi
push 0x53cf31
jmp 0x53cf26
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryUnlock]
ret
Function at 0x10003530
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x214
mov eax, dword [0x100110c0]
test eax, eax
je 0x100035e8
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x10003570
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x214]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x1000355c
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x1000361d
mov dword [esp + 4], str.AtlCreateRegistrar
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x100110c0], eax
sub esp, 8
test eax, eax
jne 0x1000354d
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x1000355e
Function at 0x408150
Capabilities:
Encode data using xor

Disassembly:
lodsd eax, dword [esi]
mov esp, dword [eax - 0x75]
inc ebp
or al, 0x8b
dec ebp
or byte [ebx + 0x56], dl
inc esi
loop 0x40817b
adc al, 0x47
ror byte [ebx - 0x74f48b50], 0x45
mov esi, dword [eax + 0x458b0b74]
adc bh, al
add ah, ch
mov al, 0x3b
add bl, ch
lahf
mov edx, dword [ebp + 0x10]
xor eax, eax
test ebx, edx
setl al
test eax, eax
push ds
add dh, byte [edx + eax - 9]
fldenv [edi + esi*2 - 0x4c830b34]
or dh, byte [ecx - 0x3f]
mov byte [0x4ec28a35], al
in eax, dx
insb byte es:[edi], dx
sub cl, al
xor bh, 0x30
mov byte [esi], cl
mov ecx, edx
test edx, edx
jne 0x408122
movsb byte es:[edi], byte [esi]
ja 0x4080f1
hlt
add byte [ebp + 0x18], al
sub edi, esi
mov cl, 0x7a
mov eax, esi
pop esi
pop ebx
pop ebp
fst dword [eax - 0x1374aa70]
mov ebp, dword [ebx + 0x36648b0c]
push ebp
outsd dx, dword [esi]
pop ebp
or byte [edi + 0x40], dl
jge 0x408179
test eax, eax
ja 0x408172
jb 0x40815b
inc ecx
sti
push dword [edi + 4]
test dword [ebp - 0x3f92ded1], eax
jg 0x4081a8
jl 0x40817e
cmp ebx, 0x7ff8ffff
ja 0x408101
invalid
jg 0x4081f4
adc dword [eax + edi*8 + 0x7f257cff], 8
cmp ebx, 0xebc90000
jne 0x4081a8
xchg esp, eax
clc
invalid
test ecx, ecx
jne 0x4081ac
fild dword [ebp + 0x7c]
mov eax, dword [ebx + 0x14]
push eax
push esi
push edx
insd dword es:[edi], dx
push ebx
call fcn.004080f0
add esp, 0x14
je 0x408201
test bl, 0x85
leave
test ecx, ecx
je 0x4081b7
xor cl, byte [ebp + 0x14]
mov dword [ecx], 0x9e0000
jmp 0x4081da
test eax, eax
jg 0x4081d9
jl 0x4081ee
test ebx, ebx
jae 0x4081c8
les eax, [ecx]
add byte [eax], al
in al, 0xeb
test eax, 0x558bc933
adc al, 0x85
xor cl, byte [ecx + 0x6e07740a]
xor ecx, ecx
mov edx, dword [ebp + 0x14]
test dword [edx], esi
mov dword [edx], ecx
je 0x4081da
outsb dx, byte [esi]
invalid
fcom dword [esi + 0x6a]
add byte [edx + 0xa], ch
push esi
push 0
push 0xa
push eax
push ebx
call 0x3840b890
mov ebx, dword [edi + 0x33]
adc ecx, eax
mov dl, 0x1a
imul byte [edx + ebp]
ljmp 0xbf8b
ret
lea ebx, [eax]
mov ebx, dword [esp + ebx]
xchg edi, eax
invalid

Function at 0x408b40
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
inc ebp
cmp eax, 0x758b140c
adc byte [edx], ch
lea edx, [ebp - 8]
push 0
xchg esi, eax
push es
push edx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea ebp, [ebp - 4]
mov dword [ebp - 0xc], ecx
push eax
mov eax, dword [edx + 4]
lea ecx, [ebp + 0x3d]
push 1
push ecx
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x11], 0x7c000000
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
adc dword [edi + edx*2], ebp
mov edi, dword [sym.imp.WSOCK32.dll_WSAGetLastError]
call edi
test eax, eax
jne 0x408b9e
mov dword [esi], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x3f
call edi
mov dword [esi], 0xdf00fd
in eax, dx
add eax, 0x260a69db
cmpsb byte [esi], byte es:[edi]
mov ebx, dword [0x330cc25d]
mov eax, dword [ebp - 4]
mov dword [esi], eax
pop esi
neg eax
in al, 0x24
and eax, 0xffe9ee82
add eax, 0xad01117e
in eax, 0x23
ret 0xc
Function at 0x409ce0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
daa
inc ecx
dec eax
cmc
dec ecx
xchg ebx, eax
salc
cwde
cwde
salc
cdq
wait
inc ecx
aaa
das
inc eax
aaa
std
dec ecx
wait
clc
daa
cdq
inc ecx
cwde
daa
daa
salc
stc
aas
lahf
aaa
lahf
lahf
wait
xchg ebx, eax
cmc
dec edx
stc
aas
stc
dec ebx
cld
dec ebx
cld
xchg ecx, eax
aas
cdq
lahf
nop
xchg ecx, eax
dec ecx
inc ebx
xchg edx, eax
salc
dec eax
stc
stc
cdq
std
salc
xchg ebx, eax
inc ebx
nop
clc
cwde
lahf
dec eax
clc
inc ecx
xchg edx, eax
xchg edx, eax
clc
daa
std
xchg ecx, eax
inc eax
cwde
inc edx
cdq
dec eax
cld
cmc
inc edx
cmc
xchg ecx, eax
dec ecx
cmc
inc ecx
lahf
cld
inc ebx
aaa
inc ebx
aas
cld
std
inc eax
nop
dec ebx
inc ecx
dec ecx
salc
inc ecx
xchg ecx, eax
aaa
cwde
nop
dec eax
xchg ecx, eax
xchg ebx, eax
xchg ecx, eax
aaa
daa
jmp 0x409c53
cld
jmp 0x409c64
call 0x409fd9
nop
jmp 0x409c7a
nop
jmp 0x409c8a
nop
jmp 0x409c97
pushal
nop
jmp 0x409ca9
xor edx, edx
jmp 0x409cb7
mov ebp, esp
mov edx, dword fs:[edx + 0x30]
nop
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
nop
jmp 0x409cd0
nop
jmp 0x409cdf
movzx ecx, word [edx + 0x26]
xor edi, edi
nop
mov esi, dword [edx + 0x28]
nop
xor eax, eax
jmp 0x409cfc
lodsb al, byte [esi]
cmp al, 0x61
jmp 0x409d0b
jl 0x409d38
nop
jmp 0x409d1d
nop
jmp 0x409d2b
sub al, 0x20
jmp 0x409d38
nop
jmp 0x409d4a
ror edi, 0xd
nop
jmp 0x409d58
add edi, eax
jmp 0x409d6b
dec ecx
jne 0x409ce9
nop
push edx
nop
push edi
jmp 0x409d83
mov edx, dword [edx + 0x10]
jmp 0x409d97
mov eax, dword [edx + 0x3c]
jmp 0x409da7
add eax, edx
nop
mov eax, dword [eax + 0x78]
nop
jmp 0x409dbd
test eax, eax
nop
jmp 0x409dcb
je 0x409fa7
nop
jmp 0x409ddd
nop
add eax, edx
jmp 0x409dea
push eax
nop
mov ebx, dword [eax + 0x20]
nop
mov ecx, dword [eax + 0x18]
add ebx, edx
nop
nop
test ecx, ecx
jmp 0x409e05
je 0x409f90
jmp 0x409e1a
nop
jmp 0x409e25
xor edi, edi
jmp 0x409e36
dec ecx
jmp 0x409e47
mov esi, dword [ebx + ecx*4]
add esi, edx
nop
xor eax, eax
jmp 0x409e60
ror edi, 0xd
lodsb al, byte [esi]
nop
jmp 0x409e70
add edi, eax
jmp 0x409e81
cmp al, ah
jmp 0x409e8f
jne 0x409e4d
jmp 0x409ea6
add edi, dword [ebp - 8]
nop
cmp edi, dword [ebp + 0x24]
nop
jne 0x409df6
nop
jmp 0x409ec7
nop
jmp 0x409ed5
pop eax
mov ebx, dword [eax + 0x24]
jmp 0x409eeb
add ebx, edx
jmp 0x409f00
mov cx, word [ebx + ecx*2]
nop
mov ebx, dword [eax + 0x1c]
jmp 0x409f17
add ebx, edx
nop
jmp 0x409f2a
mov eax, dword [ebx + ecx*4]
nop
jmp 0x409f3e
add eax, edx
nop
jmp 0x409f4e
mov dword [esp + 0x24], eax
pop ebx
pop ebx
nop
popal
jmp 0x409f69
pop ecx
nop
jmp 0x409f7a
pop edx
jmp 0x409f8c
push ecx
jmp eax
nop
jmp 0x409fa5
pop eax
nop
pop edi
pop edx
nop
jmp 0x409fbe
mov edx, dword [edx]
nop
jmp 0x409cd0
Function at 0x6c4cb4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebx
mov ebx, dword [esp + 0x74]
lea eax, [esp + 0x20]
push ebp
push esi
push edi
push 0x34
push dword [esp + 0x7c]
mov edi, ebx
mov ebp, ebx
sub edi, dword [esp + 0x70]
sub ebp, dword [esp + 0x84]
push eax
mov dword [esp + 0x30], edi
call fcn.006d057c
xor esi, esi
add esp, 0xc
cmp dword [esp + 0x70], esi
jbe 0x6c4dff
mov ecx, dword [esp + 0x6c]
mov edx, ebx
movzx eax, byte [ecx + esi*2]
mov dword [esp + 0x14], eax
movzx eax, byte [ecx + esi*2 + 1]
mov ecx, dword [esp + 0x68]
sub edx, eax
mov dword [esp + 0x28], eax
sub ecx, edx
mov dword [esp + 0x18], edx
mov eax, dword [esp + eax*4 + 0x2c]
mov dword [esp + 0x10], eax
xor eax, eax
inc eax
shl eax, cl
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x68]
sub eax, edx
mov dword [esp + 0x20], eax
cmp eax, ebp
jb 0x6c4d8b
xor eax, eax
add edx, edi
inc eax
cmp edx, eax
cmovl edx, eax
mov eax, dword [esp + 0x74]
mov ecx, dword [eax + edx*4]
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x74]
sub eax, ecx
push ebx
push eax
mov eax, dword [esp + 0x78]
lea eax, [eax + ecx*2]
mov ecx, dword [esp + 0x24]
push eax
imul eax, ecx, 0x34
push edx
add eax, dword [esp + 0x8c]
push eax
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x80]
push dword [esp + 0x3c]
lea eax, [ecx + eax*4]
push eax
call fcn.00820b44
mov edx, dword [esp + 0x40]
add esp, 0x24
jmp 0x6c4dec
mov eax, dword [esp + 0x14]
movzx eax, ax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push 2
push eax
lea eax, [esp + 0x84]
push eax
call fcn.006d057c
mov ecx, dword [esp + 0x24]
xor eax, eax
mov edx, dword [esp + 0x28]
inc eax
mov byte [esp + 0x8a], cl
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x7f], al
lea eax, [edx + ecx]
cmp ecx, eax
jae 0x6c4dec
mov ebx, dword [esp + 0x64]
mov ecx, edx
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x7c]
lea edi, [ebx + edi*4]
mov ebx, dword [esp + 0x80]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
add dword [esp + eax*4 + 0x2c], edx
inc esi
cmp esi, dword [esp + 0x70]
jb 0x6c4cf1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret