joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc8ca3d
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 3
lea esp, [esp + 1]
lea esp, [esp + 0x10]
popal
jmp 0xc8ca8c
mov byte [esp + 6], dh
jmp 0xc8ca22
lea edx, [edx*4]
lea edx, reloc.KERNEL32.dll_GetProcAddress
mov ebx, dword [edx]
pop edx
pushal
jmp 0xc8ca6a

Function at 0xc8cacf
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov dword [esi], eax
pop esi
mov eax, dword [edx - 4]
sub esp, 0xc
jmp 0xc8c78b
push esi
mov esi, ecx
lea esi, [esi - 8]
jmp 0xc8c7b0
lea esp, [esp + 0x20]
add dword [ebp - 4], 4
push edx
push word [esp + 1]
lea esp, [esp + 2]
jmp 0xc8c801
lea esp, [esp + 1]
add esp, 0
lea esp, [esp + 3]
jmp 0xc8c8db

Function at 0xc8cc1e
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
add esp, 3
add esp, 0
lea esp, [esp + 1]
jmp 0xc8cc6d
mov edi, dword [edi*4 + reloc.KERNEL32.dll_GetProcAddress]
sub esp, 0xe
mov byte [esp + 4], ah
mov word [esp + 4], di
lea esp, [esp + 2]
jmp 0xc8cc45

Function at 0xc8cd29
Capabilities:
Encrypt data using aes

Disassembly:
mov edx, dword [edx*4 + reloc.KERNEL32.dll_GetProcAddress]
call 0xc8ccce
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_GetProcAddress]
bswap edi
jmp 0xc8cd21
mov edi, edx
call 0xc8cd29
lds eax, [ebx - 0x720afc3c]
and al, 1
jmp 0xc8cd74
shr edi, 0x18
push esp
push word [esp + 1]
lea esp, [esp + 2]
jmp 0xc8cd4f

Function at 0xc8ceca
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pushal
and edi, ecx
sub esp, 0xa
cmc
jmp 0xc8cd5b

Function at 0xc8cf40
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov di, word [esp]
inc di
inc di
mov edi, 0xffc5daf4
jmp 0xc8cf1c
mov edx, dword [esi + 0xc]
sub esp, 0x1a
lea esp, [esp + 0x19]
lea esp, [esp + 1]
mov dword [esi + 8], edi
jmp 0xc8ced6
lea esi, reloc.KERNEL32.dll_GetProcAddress
mov ebx, dword [esi]
pop esi
jmp 0xc8cf28
push esi
mov esi, ebx
lea esi, [esi*4]
jmp 0xc8cf06
mov edi, edx
push edx
jmp 0xc8cf65
jmp 0xc8cef3
mov edi, dword [edi*4 + reloc.KERNEL32.dll_GetProcAddress]
clc
and edi, ecx
clc
jmp 0xc8d178
shr edi, 0x18
sub esp, 0x1c
jmp 0xc8cf42
mov edi, dword [edi*4 + reloc.KERNEL32.dll_GetProcAddress]
sub esp, 0x1c
call fcn.00c8d004
jmp 0xc8de67
pushal
lea esp, [esp + 0x20]
jmp 0xc8deba
ja 0xc8d1ea
jbe 0xc8de7a
xor eax, 0xba4f28ba
push cs
adc eax, 0x996a0f9f
sbb byte [edx + 0x6d], dh
jl 0xc8deb6
cmp al, 0x39
pushal
mov word [esp + 0x14], dx
mov word [esp + 0x14], sp
lea esp, [esp + 0x20]
jmp 0xc8de4f
movzx eax, al
sub esp, 0x16
add esp, 0xd
add esp, 1
mov byte [esp + 3], dh
jmp 0xc8ded1
cmp al, 0x5a
lea esp, [esp + 8]
add eax, 4
jmp 0xc8d206
Function at 0xc8d004
Capabilities:
Encrypt data using aes

Disassembly:
mov ebx, 0xc6f50310
movzx ebx, byte [esi + 0xe]
sub esp, 4
add esp, 3
mov byte [esp], dh
jmp 0xc8cfe7
and ebx, ecx
lea esp, [esp + 0x64]
xor edi, dword [ebx*4 + reloc.KERNEL32.dll_GetProcAddress]
bswap ebx
jmp 0xc8cf91
lea esp, [esp + 1]
and edx, ecx
pushal
push ebp
jmp 0xc8cfcd
mov ebp, edx
lea ebp, [ebp*4]
lea ebp, reloc.KERNEL32.dll_GetProcAddress
mov edx, dword [ebp]
jmp 0xc8d07a
add esp, 0
lea esp, [esp + 1]
mov ebx, dword [ebx*4 + reloc.KERNEL32.dll_GetProcAddress]
sub esp, 0xa
lea esp, [esp + 1]
jmp 0xc8cfbf
sub esp, 0x1e
push dword [esp + 0x12]
lea esp, [esp + 2]
jmp 0xc8cfae

Function at 0xc8d0d5
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 0xc]
jne 0xc5eb00
je 0xc5ea92
pushfd
pop es
xchg edi, eax
add dword [edx - reloc.KERNEL32.dll_GetProcAddress], edi
mov word [esp], sp

Function at 0xc91d13
Capabilities:
Hash data with md5

Disassembly:
mov word [esp], di
lea esp, [esp + 3]
jmp 0xc91cf5

Function at 0xd33f21
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [esp + 1]
lea edx, [edx + edx]
stc
lea ebp, [ecx + edi]
pop dword [esp]
mov si, 0x89e1
jmp 0xd33eee
jmp 0xd33f08
Function at 0xd343b8
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 2], dl
xchg si, cx
cmc
ror ecx, 9
pop word [esp]
setbe ch
jmp 0xd343ba
jmp 0xd3438f
lea esp, [esp]
lea ebx, [ecx + ebx]
cpuid
xchg word [esp], cx
setae bh
pop cx
jmp 0xd34410
mov edi, 0x8f321162
mov bl, bh
xchg ecx, ebx
add esp, 0
add esp, 0
jmp 0xd34420
inc bl
neg ebp
not ch
mov byte [esp], dh
shr bh, 3
not ah
jmp 0xd343f9
sub esp, 0x1a
mov ebx, 0xc6fd32c8
push word [esp + 0x15]
mov al, ah
bswap eax
jmp 0xd344e7
lea ebp, [eax*4]
stc
lea esi, [ebp*4]
mov ebp, dword [esp]
lea esp, [esp]
jmp 0xd344c8
bswap edi
mov eax, ebp
not ah
btc eax, edi
lea eax, [ebp*4]
xchg edi, ebp
jmp 0xd3444b
xchg byte [esp], bl
xchg bx, cx
mov edx, 0xf57626b2
mov dh, byte [esp]
shl di, cl
pop di
jmp 0xd34467
pop bx
pop dword [esp + 8]
mov ebx, ebp
sete ah
mov eax, dword [esp + 0xb]
mov bp, bx
jmp 0xd344f9
sub esp, 0x1c
not edx
push dword [esp + 5]
mov byte [esp + 0x13], ah
lea ecx, [ebp*4]
pop bp
jmp 0xd344a3
rdtsc
mov ah, byte [esp + 0x17]
add esp, 0x1a
mov esi, dword [esp]
bswap ecx
xchg dh, al
jmp 0xd3448e
lea esp, [esp + 0xe]
mov si, 0x8899
mov dword [esp + 6], esi
mov esi, eax
pop bp
pop dword [esp]
jmp 0xd34671
clc
mov si, word [esp + 0xb]
setl bh
lea esi, [edx*4]
xchg word [esp + 0xc], di
mov edx, esi
jmp 0xd3462f
rdtsc
mov bx, word [esp + 0xb]
lea esp, [esp + 0x12]
mov bh, byte [esp + 0x15]
btr eax, esp
xchg byte [esp + 4], bl
jmp 0xd34534
mov bl, 0x38
mov esi, 0xc6f47d00
sub esp, 0x1e
mov ax, dx
mov cl, ch
lea edx, [ebx + ebx]
jmp 0xd34554
xchg byte [esp + 2], cl
xchg ah, bl
xchg esi, eax
shl si, cl
push edx
xor edi, esi
jmp 0xd34580
lea edx, [ebx*4]
push dword [esp + 6]
pop word [esp + 0xb]
neg ecx
jmp 0xd345e5
xchg dword [esp + 4], esi
xor ebp, esi
mov dh, byte [esp + 7]
setae ah
mov edi, dword [esp + 1]
lea eax, [eax + 0xf9]
jmp 0xd345b3
xchg word [esp + 1], cx
mov dl, dh
sub esp, 0x1c
inc di
pop dword [esp + 0x1a]
xchg ch, dl
jmp 0xd34646
lea esp, [esp + 0xb]
inc al
mov di, 0xcff1
setae bh
mov dx, 0xb2a7
mov byte [esp + 0xa], ah
jmp 0xd345cc
xchg word [esp + 5], cx
bsf ax, si
mov ebx, ecx
mov edx, 0x63238394
mov al, ah
shr ch, 5
jmp 0xd34609
mov dx, 0x4d69
mov byte [esp + 0x1b], dh
mov dl, 0x14
not edx
push dword [esp + 0x1e]
push esp
jmp 0xd35211
cpuid
mov ax, dx
add esp, 0
not dx
pop bx
push edx
jmp 0xd345a4
pop word [esp + 7]
lea esi, [ebx*4]
mov byte [esp + 0x15], ah
mov di, 0x92f5
xchg dh, al
bsr dx, cx
call fcn.00d346e9
mov ch, byte [esp]
mov dl, 0xd4
btr eax, esp
mov bx, 0x18e3
call fcn.00d34894
mov bl, 0x32
mov al, byte [0xb3d032c7]
stosb byte es:[edi], al
lds ebx, [ebp + 0x66]
pop dword [esp]
inc bx
mov byte [esp], bh
add esp, 1
neg si
jmp 0xd347c7
pop eax
pop word [esp + 0xb]
xchg bx, ax
rcr edx, 0x1d
mov ebp, dword [esp + 5]
mov si, di
jmp 0xd347a8
mov di, 0xca1
mov ebp, 0xa11d63a4
mov word [esp + 2], sp
xchg word [esp + 3], ax
bsf dx, si
pop edi
jmp 0xd34f90
Function at 0xd346e9
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bx, sp
mov ebp, dword [esp + 0x21]
stc
pop dword [esp + 0x14]
sub esp, 0x16
xchg ah, bl
jmp 0xd346bf
rdtsc
popal
pop word [esp + 7]
mov ebx, ebp
xchg word [esp + 5], dx
jmp 0xd346cf
lea ebx, [edx + edi]
pushal
lea esp, [esp + 0x46]
push esp
xchg si, bp
pushal
jmp 0xd34684
cld
mov ax, 0x8a4b
pop esi
mov ch, byte [esp + 9]
bswap ecx
bswap esi
jmp 0xd34697
lea esi, [eax*4]
setno bh
xor dx, 0x9a1c
sub esp, 0
jmp 0xd3473c
jmp 0xd346b0
lea esi, [edi*4]
bswap edi
bswap eax
lea ebx, [esi + edi]
stc
lea ebp, reloc.KERNEL32.dll_GetProcAddress
jmp 0xd34783
mov word [esp], sp
lea edi, [ebp - 0xd7]
xchg word [esp], bp
bswap esi
jmp 0xd346eb
pop dword [esp + 2]
neg bx
shr esi, 0x13
pop word [esp + 7]
push edx
lea esp, [esp + 0xb]
jmp 0xd34707
mov byte [esp + 6], bh
mov cl, 0x22
mov bl, bh
inc edi
btr edi, edx
add al, dh
jmp 0xd3471f
lea edi, [ebx*4]
bsf si, si
clc
push edx
xchg dx, ax
jmp 0xd349bb
cpuid
add esp, 1
add eax, ebp
xchg ecx, ebx
xchg byte [esp], dl
mov bl, 0x40
jmp 0xd3474c
xchg byte [esp], dl
pushal
popal
mov di, word [esp + 2]
xchg dx, bp
mov ebp, 0x38b8f79a
jmp 0xd34763
pop ebp
pop word [esp]
mov bx, word [esp + 4]
mov ch, byte [esp + 3]
mov bl, 0x28
push word [esp + 3]
xchg byte [esp + 2], al
rdtsc
jmp 0xd347e1

Function at 0xd34816
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], eax
bsr di, bp
jmp 0xd34823
xchg bp, di
mov dword [esp], eax
add esp, 1
and edx, ecx
clc
bswap edi
jmp 0xd3484c
bswap edx
rdtsc
pop di
setno ch
mov al, ah
pushal
jmp 0xd348c5
mov si, word [esp + 1]
bswap edx
btc ebx, edi
lea ebp, [edx*4]
lea edx, [esi + 0x4d]
neg edx
jmp 0xd348a1
Function at 0xd34ae9
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg cx
rdtsc
cpuid
mov bp, word [esp + 0x1f]
lea ebp, [ecx*4]
bswap ebx
jmp 0xd34af6
lea edi, [ebx + ebp]
add esp, 0
sub esp, 0x1e
sub esp, 8
pop di
rdtsc
jmp 0xd34aac
btc ebp, ebx
xchg dh, al
mov eax, ecx
push dword [esp + 5]
jmp 0xd34acb
push esp
mov word [esp + 0x2a], di
xchg dword [esp + 0x28], ebp
pop cx
push edx
pop word [esp + 0x21]
jmp 0xd34b4b
push word [esp + 0x18]
mov ebp, esi
mov dword [esp + 0xa], ecx
mov edx, ebp
sub esp, 0
jmp 0xd34cb9
xchg dword [esp], eax
mov edi, dword [esp + 0xe]
mov dword [esp + 0xd], esi
not ah
setge bh
jmp 0xd34b1a
popal
lea eax, [edx*4]
mov dx, 0x86eb
push dword [esp + 2]
btc ecx, ebx
pop word [esp + 3]
jmp 0xd34b33
add esp, 0x14
pushal
pop word [esp + 0x10]
call fcn.00d34ba3
btc eax, ebx
mov esi, eax
clc
inc ebx
clc
inc bl
jmp 0xd34c90
sub esp, 0x12
sub esp, 0
pop ebx
mov esi, dword [esp + 0x2a]
btr ebx, esp
mov edx, dword [esp + 0x25]
jmp 0xd34d17
mov edi, 0x8357e55c
mov word [esp + 2], di
inc dl
shr esi, 0x13
cld
mov edi, eax
jmp 0xd34c2e
xchg word [esp + 0xf], di
rdtsc
lea esi, [ebp*4]
mov bx, word [esp + 0x17]
cpuid
mov al, 0x2e
jmp 0xd34c14
cpuid
push dword [esp + 0x1a]
popal
btr eax, edx
xchg ah, bl
lea ecx, [ebx*4]
jmp 0xd34d50
bsf dx, ax
lea esp, [esp + 9]
bsr dx, bp
not ax
jmp 0xd34d2a
mov ax, 0x1fb3
mov eax, dword [esp + 0x20]
not ah
mov cl, 0xba
bsr bx, bp
jmp 0xd34cd5
shr edi, 7
mov ecx, esi
shr ecx, 0x17
pop ebx
mov word [esp + 1], di
setge dh
jmp 0xd34d00
bswap esi
rdtsc
bswap eax
rdtsc
lea eax, [eax + 0xc9]
mov eax, esi
jmp 0xd34db5
xchg word [esp + 0xe], bp
lea esi, [ebx + ebp]
push word [esp + 0x14]
bsf ax, ax
cld
lea esp, [esp + 0xd]
jmp 0xd34cea
mov eax, ecx
mov byte [esp], bh
mov bx, word [esp]
rdtsc
bsr cx, bp
add esp, 0
jmp 0xd34d9e
add esp, 2
mov esi, 0xccbb550
mov al, 0x2e
lea esp, [esp]
mov edx, esi
mov al, 0xb6
jmp 0xd34d68
lea esp, [esp]
sub esp, 4
mov cl, ch
btc ebp, ebx
mov dword [esp], esi
stc
jmp 0xd34dc9
setge dh
lea edi, [ebx + ebp]
neg ebx
xchg word [esp], si
rdtsc
mov si, word [esp]
jmp 0xd34d8b
setno ah
xchg dword [esp], ebp
inc al
mov edi, 0x558366a2
mov bp, 0x603f
push edx
jmp 0xd34f1a
mov cl, ch
mov cx, word [esp + 1]
sub bl, ah
push esp
mov edx, dword [esp]
Function at 0xd34ba3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, word [esp + 2]
mov word [esp + 0xb], dx
mov di, word [esp + 0xa]
jmp 0xd34bcf
xchg byte [esp + 0x14], al
lea ebx, [ebx*4]
neg edi
jmp 0xd34b76
bswap eax
mov si, word [esp + 3]
lea esp, [esp + 0xa]
jmp 0xd34b8c
ror ah, 1
mov al, ah
neg di
mov dword [esp + 0xe], esi
sub di, 0x87d0
lea edx, [esp + edx]
jmp 0xd34bea
lea eax, [edx*4]
cpuid
mov bl, 0xe8
xchg dword [esp + 0x18], ebx
lea ebx, reloc.KERNEL32.dll_GetProcAddress
mov eax, dword [esp + 2]
jmp 0xd34bb0
pop di
mov byte [esp + 0x11], dh
push dword [esp + 0x17]
mov byte [esp + 0xb], ah
mov cl, ch
mov ax, bx
jmp 0xd34c7d
mov word [esp + 0x1a], di
bsf cx, si
and ebp, ecx
push dword [esp + 0x22]
setae ah
cpuid
jmp 0xd34c22
bswap eax
mov edx, dword [esp + 0xa]
not bh
shl di, cl
mov cx, word [esp + 0x20]
jmp 0xd34c47
bsr ax, cx
push dword [esp + 0x1d]
xchg dword [esp + 0x20], edx
bswap eax
inc dl
cmc
jmp 0xd34c64

Function at 0xd35371
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.00d34048
push eax
jmp 0xd34043
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0xd35249
lea esp, [esp + 0xac]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0xd35262
lea esp, [esp + 0x13]
lea esp, [esp + 3]
mov dword [esp + 0xac], edi
jmp 0xd3528a
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.0040b1c2
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.0040b1c2
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.0040b1c2
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.0040b1c2
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.0040b1c2
mov dword [0x41203c], eax
call fcn.0040b1c2
test eax, eax
jge 0x402550
push 8
call fcn.0040b1c2
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.0040b1c2
pop ecx
push 1
call fcn.0040b1c2
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.0040b1c2
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.0040b1c2
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.0040b1c2
jmp 0x402495

Function at 0x40b1c2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40b1d1
pop dword [ebp - 0x1c]
mov eax, 0xed066d1d
sub eax, 0xecc5bb4c
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x3b15f
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x4f13
mov ebx, eax
mov edx, 0x2000345e
sub edx, 0x1fbef89a
add edx, dword [ebp - 0x1c]
mov edi, 0xde884d99
xor dword [ebp - 0x14], 0xf0ce3cbd
mov esi, dword [edx]
sub dword [ebp - 0x10], 0x61210af7
sub esi, edi
sub dword [ebp - 0xc], ecx
mov dword [ebx], esi
mov dword [ebp - 0xc], 0xa567b528
add ebx, 0x222149ca
sub ebx, 0x222149c6
add edx, 0xf721c117
add edx, 0x8de3eed
loop 0x40b21f
add eax, 0x90363614
add eax, 0x6fcaf90b
mov ebx, eax
add eax, 0x1a299403
add eax, 0xe5d66c02
mov ecx, 0xf234f4ce
sub ecx, 0xf1f4f4ce
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x6fc610
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x7024cc]
cmp dword [eax + 0x28], 0
jne 0x6fc628
xor eax, eax
jmp 0x6fc757
mov ecx, dword [0x70243c]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, 0xe
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [0x702430], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [0x70242c], eax
push 0
call dword [0x700138]
mov dword [ebp - 0x10], eax
push 1
call dword [0x700138]
mov dword [ebp - 0x18], eax
mov ecx, dword [0x702430]
mov dword [ebp - 0x40], ecx
mov edx, dword [0x70242c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x40]
shr eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 8]
shr ecx, 1
mov dword [ebp - 0x1c], ecx
push 0
mov edx, dword [0x7024b8]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x14]
push eax
push closesocket
push 0x700680
push 0x7006d0
push 0x88
call dword [0x700134]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [0x702428], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [0x70010c]
push eax
call fcn.006fc550
push 5
mov eax, dword [ebp - 0xc]
push eax
call dword [0x700148]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [0x70012c]
push 0x6fc5e0
mov edx, dword [0x7024cc]
mov eax, dword [edx + 0x34]
imul eax, eax, 0x3e8
push eax
push 0
push 0
call dword [0x70013c]
mov dword [0x702434], eax
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
call dword [0x700130]
test eax, eax
je 0x6fc757
cmp dword [ebp - 0x38], 0x12
jne 0x6fc74b
mov dword [0x702444], 0
call fcn.006fc760
xor eax, eax
jmp 0x6fc757
lea edx, [ebp - 0x3c]
push edx
call dword [0x700140]
jmp 0x6fc71c
mov esp, ebp
pop ebp
ret 4

Function at 0x6fdb30
Capabilities:
Read .ini file
Read and send data from client to server
Send data
Send data on socket
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebp
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
pop ebp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x6fe6cc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x700168
sub eax, eax
test esi, esi
je 0x6fe7a4
sub eax, 1
test ecx, ecx
je 0x6fe7a2
test esi, 3
je 0x6fe70a
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x6fe6ef
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x6fe789
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x6fe714
mov ecx, edx
test ecx, ecx
je 0x6fe7a2
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x6fe78f
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x6fe7ac
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.006fe82f
jae 0x6fe7ba
xor ecx, ecx
call fcn.006fe82f
jae 0x6fe7e9
xor eax, eax
call fcn.006fe82f
jae 0x6fe7f9
mov bl, 2
inc ecx
mov al, 0x10
call fcn.006fe82f
adc al, al
jae 0x6fe7db
jne 0x6fe825
stosb byte es:[edi], al
jmp 0x6fe7bd
call fcn.006fe83b
sub ecx, ebx
jne 0x6fe802
call fcn.006fe839
jmp 0x6fe821
lodsb al, byte [esi]
shr eax, 1
je 0x6fe84b
adc ecx, ecx
jmp 0x6fe81e
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.006fe839
cmp eax, 0x7d00
jae 0x6fe81e
cmp ah, 5
jae 0x6fe81f
cmp eax, 0x7f
ja 0x6fe820
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6fe7bd
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x6ff17c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x702000]
jne 0x6ff186
repz ret
jmp fcn.006ff42d
Function at 0x40330c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404ca0
test esi, esi
jne 0x403342
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404d90
jmp 0x403360
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004031b0
mov edi, eax
test esi, esi
je 0x403360
cmp dword [ebx], 0
je 0x403360
dec esi
jmp 0x403349
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403a4c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x46a020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403ae4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403ac4
xor eax, eax
push ebp
push 0x403abd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403b00
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403ac4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x46a020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x46a020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404a4c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x46c04c], 0
je 0x404aad
cmp word [0x46c220], 0xd7b2
jne 0x404a75
cmp dword [0x46c228], 0
jbe 0x404a75
mov eax, 0x46c21c
call dword [0x46c238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404ad4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x46a02c], 0
jne 0x404ac9
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404c24
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x46a030], 0
je 0x404c4a
mov edx, esi
mov eax, ebx
call dword [0x46a030]
jmp 0x404c59
mov eax, 8
call fcn.00402ec0
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x46c04d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404bec
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc