joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001bbe7
Capabilities:
Create raw socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x1009f1f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
lea eax, [ebp - 0x194]
push eax
xor edi, edi
push 0x101
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
call dword [sym.imp.WS2_32.dll_WSAStartup]
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push edi
push edi
push edi
xor ebx, ebx
mov word [esi + 8], ax
inc ebx
push ebx
push 3
push 2
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x1001bc64
push ebx
push dword [esi + 4]
push eax
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
push 0x2c
mov dword [esi + 0x10], ebx
call fcn.1004e32a
mov dword [esi + 0xc], eax
pop ecx
test eax, eax
jne 0x1001bc64
mov dword [esi + 0x10], edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001fb78
leave
ret

Function at 0x1001bd6e
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x1009f1f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0x64
mov dword [ebp - 0x7c], eax
xor edi, edi
lea eax, [ebp - 0x68]
push edi
push eax
call fcn.1003a980
add esp, 0xc
test esi, esi
je 0x1001be07
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x1001be07
mov ecx, dword [esi + 0xc]
mov ecx, dword [ecx]
jmp 0x1001bde9
movsx eax, word [esi + 0xa]
push eax
push ecx
lea eax, [ebp - 0x74]
push eax
call fcn.1003a2a0
add esp, 0xc
push dword [ebp - 0x74]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea eax, [ebp - 0x68]
push 0x10084988
push eax
call fcn.1001bbcc
mov eax, dword [esi + 0xc]
add esp, 0xc
inc edi
mov ecx, dword [eax + edi*4]
test ecx, ecx
jne 0x1001bdb5
push dword [ebp + 0x10]
lea eax, [ebp - 0x68]
push dword [ebp - 0x7c]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
push eax
mov ecx, ebx
call fcn.1001be1a
jmp 0x1001be09
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001fb78
leave
ret 0xc
Function at 0x1001be1a
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x1009f1f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x10], 0
je 0x1001bfd1
push 2
pop eax
mov word [ebp - 0x114], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x144], 0x10
call fcn.1001bce1
mov cx, word [0x100a1d98]
inc cx
mov dword [ebp - 0x14c], eax
push 0x2c
mov word [0x100a1d98], cx
push 0
push dword [edi + 0xc]
movzx eax, cx
mov dword [ebp - 0x148], eax
call fcn.1003a980
mov esi, dword [edi + 0xc]
add esp, 0xc
mov ecx, edi
mov word [esi], 8
mov ax, word [edi + 8]
mov word [esi + 4], ax
mov eax, dword [ebp - 0x148]
mov word [esi + 6], ax
mov eax, dword [ebp - 0x14c]
push 0x2c
mov dword [esi + 8], eax
push dword [edi + 0xc]
call fcn.1001bc93
mov word [esi + 2], ax
lea eax, [ebp - 0x114]
push dword [ebp - 0x144]
push eax
push 0
push 0x2c
push dword [edi + 0xc]
push dword [edi]
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
je 0x1001bfd1
test ebx, ebx
jne 0x1001bef3
xor eax, eax
inc eax
jmp 0x1001bfd3
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.1003a980
add esp, 0xc
lea esi, [edi + 4]
push 0
push 0x64
push 0
push esi
push 1
call dword [sym.imp.WS2_32.dll_WSAWaitForMultipleEvents]
cmp eax, 0x102
je 0x1001bfbb
lea eax, [ebp - 0x140]
push eax
push dword [esi]
push dword [edi]
call dword [sym.imp.WS2_32.dll_WSAEnumNetworkEvents]
test byte [ebp - 0x140], 1
je 0x1001bfbb
mov ecx, edi
call fcn.1001bce1
mov esi, eax
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push 0x100
lea eax, [ebp - 0x104]
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov edx, eax
cmp edx, 0xffffffff
je 0x1001bfb8
mov cl, byte [ebp - 0x104]
and cl, 0xf
movzx ecx, cl
shl cx, 2
movzx eax, cx
movzx ecx, ax
mov dword [ebp - 0x150], eax
mov ax, word [ebp + ecx - 0x100]
cmp ax, word [edi + 8]
jne 0x1001bfb8
cmp byte [ebp + ecx - 0x104], 0
jne 0x1001bfb8
mov eax, dword [ebp - 0x148]
cmp word [ebp + ecx - 0xfe], ax
je 0x1001bfe4
lea esi, [edi + 4]
mov ecx, edi
call fcn.1001bce1
sub eax, dword [ebp - 0x14c]
cmp eax, dword [ebp + 0x10]
jb 0x1001bf0c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001fb78
leave
ret 0xc
sub esi, dword [ebp + ecx - 0xfc]
mov ecx, dword [ebp - 0x150]
movzx ecx, cx
sub edx, ecx
mov word [ebx], ax
movzx ecx, byte [ebp - 0xfc]
sub edx, 0xc
mov dword [ebx + 4], esi
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], ecx
jmp 0x1001beeb
Function at 0x100648bd
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100644c5

Function at 0x10068095
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10067941

Function at 0x100680a0
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10067b7c

Function at 0x10076713
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10076551

Function at 0x1007c4f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x100a341c], 0
push esi
mov esi, dword [ebp + 8]
jne 0x1007c5fb
push 0x100a3420
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x1007c5e9
test esi, esi
jne 0x1007c5de
push ebx
push edi
push str.advapi32.dll
mov dword [ebp + 8], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
je 0x1007c5be
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptAcquireContextA
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x1007c5be
push str.CryptGenRandom
push esi
call edi
mov dword [ebp - 8], eax
test eax, eax
je 0x1007c5be
push str.CryptReleaseContext
push esi
call edi
mov edi, eax
test edi, edi
je 0x1007c5be
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp + 8]
push eax
call ebx
test eax, eax
je 0x1007c5be
lea eax, [ebp - 4]
push eax
push 4
push dword [ebp + 8]
call dword [ebp - 8]
push 0
push dword [ebp + 8]
mov esi, eax
call edi
test esi, esi
je 0x1007c5be
mov eax, dword [ebp - 4]
movzx esi, al
shl esi, 8
movzx eax, ah
or esi, eax
movzx eax, byte [ebp - 2]
shl esi, 8
or esi, eax
movzx eax, byte [ebp - 1]
shl esi, 8
or esi, eax
jmp 0x1007c5d2
push 0
call fcn.100514e8
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
test esi, esi
mov eax, 1
pop edi
cmove esi, eax
pop ebx
mov dword [0x100a341c], esi
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_SwitchToThread]
nop
call esi
cmp dword [0x100a341c], 0
je 0x1007c5f0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1007c600
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
add ecx, 0xdeadbeef
push ebx
mov ebx, dword [ebp + 8]
add ecx, edx
push esi
mov esi, ecx
mov dword [ebp + 0x10], esi
push edi
mov edi, ecx
cmp edx, 0xc
jbe switch.0x1007c70c
add edx, 0xfffffff3
mov eax, 0xaaaaaaab
mul edx
mov eax, edx
shr eax, 3
inc eax
mov dword [ebp - 4], eax
nop dword [eax + eax]
movzx esi, byte [ebx + 7]
movzx eax, byte [ebx + 6]
movzx edx, byte [ebx + 0xb]
shl esi, 8
add esi, eax
shl edx, 8
movzx eax, byte [ebx + 5]
shl esi, 8
add esi, eax
movzx eax, byte [ebx + 4]
add edi, eax
shl esi, 8
movzx eax, byte [ebx + 0xa]
add edi, esi
movzx esi, byte [ebx + 8]
add edx, eax
movzx eax, byte [ebx + 9]
add esi, ecx
shl edx, 8
add edx, eax
shl edx, 8
add esi, edx
mov edx, dword [ebp + 8]
mov ebx, esi
rol ebx, 4
movzx ecx, byte [edx + 3]
movzx eax, byte [edx + 2]
shl ecx, 8
add ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [edx]
shl ecx, 8
add ecx, eax
sub ecx, esi
add esi, edi
add ecx, dword [ebp + 0x10]
xor ebx, ecx
sub edi, ebx
mov eax, ebx
add ebx, esi
rol eax, 6
xor eax, edi
sub esi, eax
mov edx, eax
rol edx, 8
add eax, ebx
xor edx, esi
sub ebx, edx
mov esi, edx
rol esi, 0x10
add edx, eax
xor esi, ebx
mov ebx, dword [ebp + 8]
mov edi, esi
sub eax, esi
ror edi, 0xd
add esi, edx
xor edi, eax
mov dword [ebp + 0x10], esi
sub edx, edi
mov ecx, edi
rol ecx, 4
add ebx, 0xc
xor ecx, edx
mov dword [ebp + 8], ebx
mov edx, dword [ebp + 0xc]
add edi, esi
sub edx, 0xc
sub dword [ebp - 4], 1
mov dword [ebp + 0xc], edx
jne 0x1007c640
cmp edx, 0xc
ja 0x1007c778
jmp dword [edx*4 + 0x1007c7c8]
movzx eax, byte [ebx + 0xb]
shl eax, 0x18
add ecx, eax
movzx eax, byte [ebx + 0xa]
shl eax, 0x10
add ecx, eax
movzx eax, byte [ebx + 9]
shl eax, 8
add ecx, eax
movzx eax, byte [ebx + 8]
add ecx, eax
movzx eax, byte [ebx + 7]
shl eax, 0x18
add edi, eax
movzx eax, byte [ebx + 6]
shl eax, 0x10
add edi, eax
movzx eax, byte [ebx + 5]
shl eax, 8
add edi, eax
movzx eax, byte [ebx + 4]
add edi, eax
movzx eax, byte [ebx + 3]
shl eax, 0x18
add esi, eax
movzx eax, byte [ebx + 2]
shl eax, 0x10
add esi, eax
movzx eax, byte [ebx + 1]
shl eax, 8
add esi, eax
movzx eax, byte [ebx]
add esi, eax
mov dword [ebp + 0x10], esi
xor ecx, edi
mov eax, edi
rol eax, 0xe
sub ecx, eax
mov eax, ecx
mov esi, ecx
xor esi, dword [ebp + 0x10]
rol eax, 0xb
sub esi, eax
xor edi, esi
mov eax, esi
ror eax, 7
sub edi, eax
mov eax, edi
xor ecx, edi
rol eax, 0x10
sub ecx, eax
mov eax, ecx
mov edx, ecx
rol eax, 4
xor edx, esi
sub edx, eax
mov eax, edx
xor edi, edx
rol eax, 0xe
sub edi, eax
mov eax, edi
xor ecx, edi
ror eax, 8
sub ecx, eax
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x40c770
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.0042dc23
test eax, eax
jne 0x40c80a
push str.Fatal_Error:_MFC_initialization_failed
push 0x8e6be8
call fcn.0040ca90
add esp, 8
mov esi, eax
mov ecx, esi
push 0xa
call fcn.0040c830
mov eax, dword [esi]
xor edi, edi
mov ecx, dword [eax + 4]
lea eax, [ecx + esi]
mov cl, byte [ecx + esi + 4]
test cl, 6
jne 0x40c7de
mov eax, dword [eax + 0x28]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0xffffffff
jne 0x40c7de
mov edi, 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
test edi, edi
je 0x40c7ff
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 0x28]
or eax, edi
test edx, edx
jne 0x40c7f7
or al, 4
push 0
push eax
call fcn.00426e54
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0040cd50
mov dword [0x8c2d3c], esp
mov dword [0x8c2d40], ebp
call fcn.0040c620
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40d4b0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x40d4ce
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x40d4c3
pop esi
ret

Function at 0x40d8f0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x40d959
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.0040cf30
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x40e100
Capabilities:
Query environment variable

Disassembly:
push ebp
push esi
push edi
push 0x104
call fcn.0040cee0
mov ebp, dword [esp + 0x18]
add esp, 4
mov edi, eax
push 0x104
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, 0x104
jbe 0x40e157
push ebx
push edi
call fcn.0040cff0
push esi
mov ebx, esi
call fcn.0040cee0
add esp, 8
mov edi, eax
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, ebx
ja 0x40e12e
mov eax, edi
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x40e190
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x40e222
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x40e214
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x40e20c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x40e1d5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
Function at 0x40e490
Capabilities:
Delete directory

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x40e49d
xor eax, eax
pop esi
ret
push esi
call dword [0x8bd018]
add esp, 4
test eax, eax
jne 0x40e4ad
pop esi
ret
cmp eax, 1
jne 0x40e4bb
cmp byte [esi], 0x5c
jne 0x40e4bb
xor eax, eax
pop esi
ret
push esi
call fcn.0040e240
add esp, 4
test eax, eax
je 0x40e4cf
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop esi
ret

Function at 0x40e4f0
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 0x10]
sub esp, 0xc
test ecx, ecx
mov eax, 0xfffffff5
je 0x40e50c
cmp dword [esp + 0x14], 2
jne 0x40e50c
mov eax, 0xfffffff4
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
test ebp, ebp
je 0x40e5d7
mov eax, dword [esp + 0x14]
cmp eax, 1
jle 0x40e5d7
push ebx
push esi
push edi
lea edi, [esp + 0x30]
dec eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], eax
mov eax, dword [edi + 8]
mov dword [esp + 0x10], 0
cmp eax, reloc.WSOCK32.dll_connect
jne 0x40e551
mov ebx, dword [edi]
jmp 0x40e568
push edi
call fcn.00410770
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x40e5be
mov dword [esp + 0x10], 1
push ebx
call dword [0x8bd018]
mov esi, eax
add esp, 4
test esi, esi
jbe 0x40e5ad
mov edi, ebx
mov eax, 0x400
mov dword [esp + 0x20], 0
cmp esi, eax
jae 0x40e58d
mov eax, esi
lea ecx, [esp + 0x20]
push 0
push ecx
push eax
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x20]
sub esi, eax
add edi, eax
test esi, esi
ja 0x40e57a
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40e5be
push ebx
call fcn.00419e5e
add esp, 4
mov eax, dword [esp + 0x18]
add edi, 0xc
dec eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], eax
jne 0x40e53b
pop edi
pop esi
pop ebx
pop ebp
add esp, 0xc
ret

Function at 0x40fdc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x40fde1
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x40fe3b
inc edi
cmp edi, esi
jl 0x40fdd5
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x40fe70
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x40fe2a
cmp byte [eax], bl
je 0x40fe45
cmp byte [eax + 1], bl
je 0x40fe4e
cmp byte [eax + 2], bl
je 0x40fe58
cmp byte [eax + 3], bl
je 0x40fe64
add eax, 4
cmp eax, edi
jb 0x40fe01
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
Function at 0x4110b0
Capabilities:
Manipulate console buffer

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x38]
push ebp
mov ebp, dword [esp + 0x40]
push esi
push edi
xor edi, edi
cmp ebx, 1
jne 0x4110da
test ebp, ebp
jg 0x4110d4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
lea eax, [ebp + 1]
push eax
jmp 0x4110dc
push 2
call fcn.00419f47
mov esi, eax
add esp, 4
test esi, esi
jne 0x4110f2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x41110e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov eax, dword [esp + 0x30]
test eax, eax
je 0x41114f
cmp dword [eax], 0
jle 0x41114f
mov ecx, dword [eax + 4]
test ecx, ecx
jle 0x41114f
mov cx, word [eax]
mov dx, word [eax + 4]
mov word [esp + 0x44], cx
mov ecx, dword [esp + 0x2c]
mov word [esp + 0x46], dx
mov eax, dword [esp + 0x44]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
jne 0x41114f
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
cmp dword [esp + 0x34], 1
jne 0x41115e
mov edx, dword [esp + 0x14]
mov dword [esp + 0x44], edx
call fcn.00427fef
mov edx, 1
cmp ebx, edx
jne 0x41117e
cmp al, 0xd
je 0x4111af
lea ecx, [edi + 1]
mov byte [esi + edi], al
cmp ecx, ebp
je 0x4111bf
mov edi, ecx
jmp 0x411184
mov byte [esi], al
mov byte [esi + 1], 0
cmp dword [esp + 0x38], edx
jne 0x4111a8
cmp dword [esp + 0x3c], edx
jne 0x41119c
mov eax, dword [esp + 0x40]
push eax
call fcn.0041b0ea
jmp 0x4111a5
movsx ecx, al
push ecx
call fcn.0041b0df
add esp, 4
cmp ebx, 1
jne 0x4111c4
jmp 0x41115e
push 0xa
mov byte [esi + edi], 0
call fcn.0041b0df
add esp, 4
jmp 0x4111c4
mov byte [esi + edi + 1], 0
cmp dword [esp + 0x34], 1
jne 0x4111db
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x2c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x411270
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x4112d6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x4112d6
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x4112b7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x411660
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x411698
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x4123d0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WSOCK32.dll_select
cmp eax, 0xffffffff
jne 0x412419
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x412890
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42f5b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00412440
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004124c0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.004124c0
lea ecx, [esi + 0xc]
call fcn.004293a4
lea ecx, [esi + 0x10]
call fcn.004293a4
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00413a60
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00413a60
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00413a60
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00429419
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00429419
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x413c80
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
xor ecx, ecx
xor eax, eax
push ebp
mov ebp, dword [esp + 0x18]
mov byte [eax + ebp], al
inc eax
cmp eax, 0x100
jl 0x413c8c
mov eax, dword [esp + 0x14]
mov byte [ebp + 0x100], cl
cmp eax, ecx
mov byte [ebp + 0x101], cl
jle 0x413d1f
push ebx
push esi
push edi
mov byte [esp + 0x24], cl
xor esi, esi
mov ebx, ebp
mov dword [esp + 0x10], 0x100
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
and edi, 0xff
xor eax, eax
xor edx, edx
mov al, byte [edi + ecx]
mov dl, byte [ebx]
add esi, eax
add edx, esi
and edx, 0x800000ff
jns 0x413ce9
dec edx
or edx, 0xffffff00
inc edx
mov byte [esp + 0x14], dl
mov esi, dword [esp + 0x14]
and esi, 0xff
lea eax, [esi + ebp]
push eax
push ebx
call fcn.00413d30
lea eax, [edi + 1]
add esp, 8
cdq
idiv dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc ebx
dec eax
mov dword [esp + 0x10], eax
mov byte [esp + 0x24], dl
jne 0x413cbe
pop edi
pop esi
pop ebx
pop ebp
add esp, 8
ret

Function at 0x413d50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x14]
push ebx
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
mov al, byte [esi + 0x100]
mov cl, byte [esi + 0x101]
test edx, edx
mov byte [esp + 0x20], al
mov byte [esp + 8], cl
jle 0x413e4d
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x28]
and edi, 0xff
and ebp, 0xff
lea eax, [edi + 1]
and eax, 0x800000ff
jns 0x413da2
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x28], al
xor ecx, ecx
mov edi, dword [esp + 0x28]
and edi, 0xff
mov cl, byte [edi + esi]
lea eax, [edi + esi]
add ecx, ebp
mov dword [esp + 0x18], eax
and ecx, 0x800000ff
jns 0x413dce
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ebp, dword [esp + 0x10]
and ebp, 0xff
lea ecx, [esi + ebp]
push ecx
push eax
mov dword [esp + 0x1c], ecx
call fcn.00413d30
mov eax, dword [esp + 0x1c]
xor edx, edx
xor ecx, ecx
add esp, 8
mov dl, byte [eax]
mov eax, dword [esp + 0x18]
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x413e0f
dec edx
or edx, 0xffffff00
inc edx
mov eax, dword [esp + 0x20]
and edx, 0xff
mov cl, byte [edx + esi]
mov dl, byte [ebx + eax]
xor dl, cl
mov byte [ebx + eax], dl
mov eax, dword [esp + 0x24]
inc ebx
cmp ebx, eax
jl 0x413d91
mov dl, byte [esp + 0x28]
mov al, byte [esp + 0x10]
pop edi
mov byte [esi + 0x100], dl
mov byte [esi + 0x101], al
pop ebp
pop esi
pop ebx
add esp, 0xc
ret
mov byte [esi + 0x100], al
mov byte [esi + 0x101], cl
pop esi
pop ebx
add esp, 0xc
ret