joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100518f0
Capabilities:
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 1
push 0x3e8
push 2
push 6
call dword [sym.imp.WSOCK32.dll_socket]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x1005194b
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x273f
je 0x10051944
call fcn.10051eb0
push eax
push str.WARNING:_IPX_Socket:_socket:__s_n
call fcn.10038500
add esp, 8
xor eax, eax
jmp 0x10051a1d
lea eax, [ebp - 0x1c]
push eax
push 0x8004667e
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.WSOCK32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x1005197d
call fcn.10051eb0
push eax
push str.WARNING:_IPX_Socket:_ioctl_FIONBIO:__s_n
call fcn.10038500
add esp, 8
xor eax, eax
jmp 0x10051a1d
push 4
lea edx, [ebp - 0x1c]
push edx
push 0x20
push 0xffff
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.WSOCK32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x100519b0
call fcn.10051eb0
push eax
push str.WARNING:_IPX_Socket:_setsockopt_SO_BROADCAST:__s_n
call fcn.10038500
add esp, 8
xor eax, eax
jmp 0x10051a1d
mov ecx, 6
mov word [ebp - 0x14], cx
xor edx, edx
mov dword [ebp - 0x12], edx
xor eax, eax
mov dword [ebp - 0xe], eax
mov word [ebp - 0xa], ax
cmp dword [ebp + 8], 0xffffffff
jne 0x100519d5
xor ecx, ecx
mov word [ebp - 8], cx
jmp 0x100519e4
movzx edx, word [ebp + 8]
push edx
call dword [sym.imp.WSOCK32.dll_htons]
mov word [ebp - 8], ax
push 0xe
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.WSOCK32.dll_bind]
cmp eax, 0xffffffff
jne 0x10051a1a
call fcn.10051eb0
push eax
push str.WARNING:_IPX_Socket:_bind:__s_n
call fcn.10038500
add esp, 8
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.WSOCK32.dll_closesocket]
xor eax, eax
jmp 0x10051a1d
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b585
mov esp, ebp
pop ebp
ret
Function at 0x10051c90
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100fc024], 0
je 0x10051cc3
mov eax, dword [0x100fc024]
movss xmm0, dword [eax + 0x14]
ucomiss xmm0, dword [0x10079ffc]
lahf
test ah, 0x44
jp 0x10051cc8
jmp 0x10051df4
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x10c], 0
mov ecx, 4
shl ecx, 0
cmp dword [ecx + 0x100b86f0], 0
je 0x10051d38
cmp dword [ebp - 0x108], 0x40
jae 0x10051d20
mov edx, 4
shl edx, 0
mov eax, dword [ebp - 0x108]
mov ecx, dword [edx + 0x100b86f0]
mov dword [ebp + eax*4 - 0x104], ecx
mov edx, dword [ebp - 0x108]
add edx, 1
mov dword [ebp - 0x108], edx
xor eax, eax
jne 0x10051ced
mov ecx, 4
shl ecx, 0
mov edx, dword [ecx + 0x100b86f0]
mov dword [ebp - 0x10c], edx
mov eax, 4
shl eax, 0
cmp dword [eax + 0x100b86e8], 0
je 0x10051daa
cmp dword [ebp - 0x108], 0x40
jae 0x10051d7c
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 0x108]
mov eax, dword [ecx + 0x100b86e8]
mov dword [ebp + edx*4 - 0x104], eax
mov ecx, dword [ebp - 0x108]
add ecx, 1
mov dword [ebp - 0x108], ecx
xor edx, edx
jne 0x10051d49
mov eax, 4
shl eax, 0
mov ecx, dword [eax + 0x100b86e8]
cmp ecx, dword [ebp - 0x10c]
jle 0x10051daa
mov edx, 4
shl edx, 0
mov eax, dword [edx + 0x100b86e8]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp + 8]
cdq
mov ecx, 0x3e8
idiv ecx
mov dword [ebp - 0x114], eax
mov eax, dword [ebp + 8]
cdq
mov ecx, 0x3e8
idiv ecx
imul edx, edx, 0x3e8
mov dword [ebp - 0x110], edx
lea eax, [ebp - 0x114]
push eax
push 0
push 0
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp - 0x10c]
add edx, 1
push edx
call dword [sym.imp.WSOCK32.dll_select]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b585
mov esp, ebp
pop ebp
ret

Function at 0x10051e10
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, 0x101
mov word [ebp - 4], ax
push 0x100b6710
push 0x101
call dword [sym.imp.WSOCK32.dll_WSAStartup]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10051e47
push str.Winsock_initialization_failed.
push 0
call fcn.10038830
add esp, 8
push str.Winsock_Initialized_n
call fcn.10038500
add esp, 4
push 8
push 0x1009297c
push str.noudp
call fcn.1003af50
add esp, 0xc
mov dword [0x100b60fc], eax
push 8
push 0x10092988
push str.noipx
call fcn.1003af50
add esp, 0xc
mov dword [0x100b68a0], eax
push 0
push 0x10092994
push str.net_shownet
call fcn.1003af50
add esp, 0xc
mov dword [0x100bb2f0], eax
mov esp, ebp
pop ebp
ret

Function at 0x10052210
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call fcn.1005ec66
add esp, 4
pop ebp
ret
Function at 0x10053770
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.100123e0
call fcn.1003ac60
lea eax, [ebp + 0xc]
mov dword [ebp - 0x408], eax
mov ecx, dword [ebp - 0x408]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x404]
push eax
call fcn.1005e0ee
add esp, 0xc
mov dword [ebp - 0x408], 0
push 0
push str.Error
lea ecx, [ebp - 0x404]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [0x100b6a5c], 0
je 0x100537e6
mov edx, dword [0x100b6a5c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1004e890
push 1
call fcn.1005fc43
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b585
mov esp, ebp
pop ebp
ret

Function at 0x10053860
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100b68c8], 0
je 0x10053883
mov eax, 0x100b69d8
jmp 0x100539aa
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x48], 0x63
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x48], 0x3a
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x48], 0x5c
mov ecx, 1
imul edx, ecx, 3
mov dword [ebp - 0x54], edx
cmp dword [ebp - 0x54], 4
jae 0x100538c4
jmp 0x100538c9
call fcn.1005be64
mov eax, dword [ebp - 0x54]
mov byte [ebp + eax - 0x48], 0
mov dword [0x100b68c8], 1
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x48], 0x63
jmp 0x10053905
mov eax, 1
imul ecx, eax, 0
mov dl, byte [ebp + ecx - 0x48]
add dl, 1
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x48], dl
mov edx, 1
imul eax, edx, 0
movsx ecx, byte [ebp + eax - 0x48]
cmp ecx, 0x7a
jg 0x10053983
lea edx, [ebp - 0x48]
push edx
push str._sinstalldata
push 0x100b69d8
call fcn.1005bf5d
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
push str._sinstalldataquake2.exe
lea ecx, [ebp - 0x44]
push ecx
call fcn.1005bf5d
add esp, 0xc
push 0x10093524
lea edx, [ebp - 0x44]
push edx
call fcn.1005c29c
add esp, 8
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x1005397e
mov eax, dword [ebp - 0x4c]
push eax
call fcn.1005bae0
add esp, 4
lea ecx, [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
jne 0x1005397e
mov eax, 0x100b69d8
jmp 0x100539aa
jmp 0x100538ea
mov edx, 1
imul eax, edx, 0
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x80
jae 0x10053999
jmp 0x1005399e
call fcn.1005be64
mov ecx, dword [ebp - 0x50]
mov byte [ecx + 0x100b69d8], 0
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b585
mov esp, ebp
pop ebp
ret
Function at 0x10053ab0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x501c
call fcn.10064ac0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100fc024], 0
je 0x10053ae7
mov eax, dword [0x100fc024]
movss xmm0, dword [eax + 0x14]
ucomiss xmm0, dword [0x10079ffc]
lahf
test ah, 0x44
jp 0x10053aee
xor eax, eax
jmp 0x10053cc7
lea ecx, [ebp - 0x5018]
push ecx
mov edx, dword [0x100b69d4]
push edx
call dword [sym.imp.KERNEL32.dll_GetNumberOfConsoleInputEvents]
test eax, eax
jne 0x10053b13
push str.Error_getting__of_console_events
call fcn.10053770
add esp, 4
cmp dword [ebp - 0x5018], 0
jg 0x10053b21
jmp 0x10053cc5
lea eax, [ebp - 0x501c]
push eax
push 1
lea ecx, [ebp - 0x5004]
push ecx
mov edx, dword [0x100b69d4]
push edx
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
test eax, eax
jne 0x10053b4f
push str.Error_reading_console_input
call fcn.10053770
add esp, 4
cmp dword [ebp - 0x501c], 1
je 0x10053b65
push str.Couldnt_read_console_input
call fcn.10053770
add esp, 4
mov eax, 0x14
imul ecx, eax, 0
movzx edx, word [ebp + ecx - 0x5004]
cmp edx, 1
jne 0x10053cc0
mov eax, 0x14
imul ecx, eax, 0
cmp dword [ebp + ecx - 0x5000], 0
jne 0x10053cc0
mov edx, 0x14
imul eax, edx, 0
movsx ecx, byte [ebp + eax - 0x4ff6]
mov dword [ebp - 0x5008], ecx
mov edx, dword [ebp - 0x5008]
mov dword [ebp - 0x5014], edx
cmp dword [ebp - 0x5014], 8
je 0x10053c38
cmp dword [ebp - 0x5014], 0xd
je 0x10053bcd
jmp 0x10053c6e
push 0
lea eax, [ebp - 0x500c]
push eax
push 2
push 0x1009364c
mov ecx, dword [0x100b69d0]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [0x100b6a58], 0
je 0x10053c33
mov edx, dword [0x100b6a58]
mov dword [ebp - 0x5010], edx
cmp dword [ebp - 0x5010], 0x100
jae 0x10053c0d
jmp 0x10053c12
call fcn.1005be64
mov eax, dword [ebp - 0x5010]
mov byte [eax + 0x100b68d0], 0
mov dword [0x100b6a58], 0
mov eax, 0x100b68d0
jmp 0x10053cc7
jmp 0x10053cc0
cmp dword [0x100b6a58], 0
je 0x10053c6c
mov ecx, dword [0x100b6a58]
sub ecx, 1
mov dword [0x100b6a58], ecx
push 0
lea edx, [ebp - 0x500c]
push edx
push 3
push 0x10093650
mov eax, dword [0x100b69d0]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x10053cc0
cmp dword [ebp - 0x5008], 0x20
jl 0x10053cc0
cmp dword [0x100b6a58], 0xfe
jae 0x10053cc0
push 0
lea ecx, [ebp - 0x500c]
push ecx
push 1
lea edx, [ebp - 0x5008]
push edx
mov eax, dword [0x100b69d0]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [0x100b6a58]
mov dl, byte [ebp - 0x5008]
mov byte [ecx + 0x100b68d0], dl
mov eax, dword [0x100b6a58]
add eax, 1
mov dword [0x100b6a58], eax
jmp 0x10053aee
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b585
mov esp, ebp
pop ebp
ret
Function at 0x10053ce0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100fc024], 0
je 0x10053d13
mov eax, dword [0x100fc024]
movss xmm0, dword [eax + 0x14]
ucomiss xmm0, dword [0x10079ffc]
lahf
test ah, 0x44
jp 0x10053d18
jmp 0x10053e4a
cmp dword [0x100b6a58], 0
je 0x10053db8
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x104], 0xd
mov eax, dword [0x100b6a58]
push eax
push 0x20
mov ecx, 1
shl ecx, 0
lea edx, [ebp + ecx - 0x104]
push edx
call fcn.10060570
add esp, 0xc
mov eax, dword [0x100b6a58]
mov byte [ebp + eax - 0x103], 0xd
mov ecx, dword [0x100b6a58]
add ecx, 2
mov dword [ebp - 0x114], ecx
cmp dword [ebp - 0x114], 0x100
jae 0x10053d7f
jmp 0x10053d84
call fcn.1005be64
mov edx, dword [ebp - 0x114]
mov byte [ebp + edx - 0x104], 0
push 0
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [0x100b6a58]
add ecx, 2
push ecx
lea edx, [ebp - 0x104]
push edx
mov eax, dword [0x100b69d0]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10c], ecx
mov edx, dword [ebp - 0x10c]
add edx, 1
mov dword [ebp - 0x11c], edx
mov eax, dword [ebp - 0x10c]
mov cl, byte [eax]
mov byte [ebp - 0x105], cl
add dword [ebp - 0x10c], 1
cmp byte [ebp - 0x105], 0
jne 0x10053dd0
mov edx, dword [ebp - 0x10c]
sub edx, dword [ebp - 0x11c]
mov dword [ebp - 0x118], edx
push 0
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [0x100b69d0]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [0x100b6a58], 0
je 0x10053e4a
push 0
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [0x100b6a58]
push edx
push 0x100b68d0
mov eax, dword [0x100b69d0]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b585
mov esp, ebp
pop ebp
ret
Function at 0x10053ed0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x14], 0
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10053f74
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10053f6e
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10053f6e
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalSize]
add eax, 1
push eax
call fcn.1005d5f6
add esp, 4
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov al, byte [edx]
mov byte [ebp - 1], al
mov ecx, dword [ebp - 8]
mov dl, byte [ebp - 1]
mov byte [ecx], dl
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp byte [ebp - 1], 0
jne 0x10053f3c
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x10057c30
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
movzx ecx, word [edx + 0x14]
lea edx, [eax + ecx + 0x18]
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], 0
jmp 0x10057c6f
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
add ecx, 0x28
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
movzx ecx, word [eax + 6]
cmp dword [ebp - 0x10], ecx
jge 0x10057d8b
mov edx, dword [ebp - 4]
cmp dword [edx + 0x10], 0
jne 0x10057cfc
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x38]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jle 0x10057cf7
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + 0x34]
push eax
push 4
push 0x1000
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x1c]
call edx
add esp, 0x14
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10057cd0
xor eax, eax
jmp 0x10057d90
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.10060570
add esp, 0xc
jmp 0x10057c5d
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0x10]
push ecx
mov eax, dword [ebp + 0xc]
push eax
call fcn.10057c10
add esp, 8
test eax, eax
jne 0x10057d1d
xor eax, eax
jmp 0x10057d90
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x34]
push edx
push 4
push 0x1000
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x1c]
call edx
add esp, 0x14
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10057d54
xor eax, eax
jmp 0x10057d90
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.100632a0
add esp, 0xc
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 8], edx
jmp 0x10057c5d
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10059250
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x100950a8], 0
jne 0x10059265
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 4], 0
push str.DllRegisterServer
mov eax, dword [0x100950a8]
push eax
call fcn.10058a00
add esp, 8
mov dword [ebp - 4], eax
call dword [ebp - 4]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x42e005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0xf5d3bf7
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x33476acc
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x402230
Capabilities:
Check http status code

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov cl, ah
cmp cl, 0xb0
mov byte [esp + 4], cl
jb 0x40248c
cmp cl, 0xc8
ja 0x40248c
mov ecx, dword [esp + 4]
and ecx, 0xff
lea edx, [ecx + ecx*2]
shl edx, 4
sub edx, ecx
mov ecx, eax
and ecx, 0xff
cmp ax, 0xb0a1
lea ecx, [ecx + edx*2 - 0x4141]
jb 0x40228b
cmp ax, 0xb1ee
jae 0x402291
mov eax, 1
add eax, ecx
mov ax, word [eax*2 + 0x453e10]
ret
cmp ax, 0xb1ee
jb 0x4022a7
cmp ax, 0xb3aa
jae 0x4022ad
mov eax, 2
add eax, ecx
mov ax, word [eax*2 + 0x453e10]
ret
cmp ax, 0xb3aa
jb 0x4022c3
cmp ax, 0xb4d9
jae 0x4022c9
mov eax, 3
add eax, ecx
mov ax, word [eax*2 + 0x453e10]
ret
cmp ax, 0xb4d9
jb 0x4022df
cmp ax, 0xb5fb
jae 0x4022e5
mov eax, 4
add eax, ecx
mov ax, word [eax*2 + 0x453e10]
ret
cmp ax, 0xb5fb
jb 0x4022fb
cmp ax, 0xb6f3
jae 0x402301
mov eax, 5
add eax, ecx
mov ax, word [eax*2 + 0x453e10]
ret
cmp ax, 0xb6f3
jb 0x402317
cmp ax, 0xb8b6
jae 0x40231d
mov eax, 6
add eax, ecx
mov ax, word [eax*2 + 0x453e10]
ret
cmp ax, 0xb8b6
jb 0x402333
cmp ax, 0xb9d9
jae 0x402339
mov eax, 7
add eax, ecx
mov ax, word [eax*2 + 0x453e10]
ret
cmp ax, 0xb9d9
jb 0x40234f
cmp ax, 0xbafc
jae 0x402355
mov eax, 8
add eax, ecx
mov ax, word [eax*2 + 0x453e10]
ret
cmp ax, 0xbafc
jb 0x40236b
cmp ax, 0xbbe7
jae 0x402371
mov eax, 9
add eax, ecx
mov ax, word [eax*2 + 0x453e10]
ret
cmp ax, 0xbbe7
jb 0x402387
cmp ax, 0xbdce
jae 0x40238d
mov eax, 0xa
add eax, ecx
mov ax, word [eax*2 + 0x453e10]
ret
cmp ax, 0xbdce
jb 0x4023a3
cmp ax, 0xbec6
jae 0x4023a9
mov eax, 0xb
add eax, ecx
mov ax, word [eax*2 + 0x453e10]
ret
cmp ax, 0xbec6
jb 0x4023bf
cmp ax, 0xc0da
jae 0x4023c5
mov eax, 0xc
add eax, ecx
mov ax, word [eax*2 + 0x453e10]
ret
cmp ax, 0xc0da
jb 0x4023db
cmp ax, 0xc2a5
jae 0x4023e1
mov eax, 0xd
add eax, ecx
mov ax, word [eax*2 + 0x453e10]
ret
cmp ax, 0xc2a5
jb 0x4023f7
cmp ax, 0xc2f7
jae 0x4023fd
mov eax, 0xe
add eax, ecx
mov ax, word [eax*2 + 0x453e10]
ret
cmp ax, 0xc2f7
jb 0x402413
cmp ax, 0xc4ab
jae 0x402419
mov eax, 0xf
add eax, ecx
mov ax, word [eax*2 + 0x453e10]
ret
cmp ax, 0xc4ab
jb 0x40242f
cmp ax, 0xc5b8
jae 0x402435
mov eax, 0x10
add eax, ecx
mov ax, word [eax*2 + 0x453e10]
ret
cmp ax, 0xc5b8
jb 0x40244b
cmp ax, 0xc6c4
jae 0x402451
mov eax, 0x11
add eax, ecx
mov ax, word [eax*2 + 0x453e10]
ret
cmp ax, 0xc6c4
jb 0x402467
cmp ax, 0xc7cf
jae 0x40246d
mov eax, 0x12
add eax, ecx
mov ax, word [eax*2 + 0x453e10]
ret
cmp ax, 0xc7cf
jb 0x40247d
mov eax, 0x13
add eax, ecx
mov ax, word [eax*2 + 0x453e10]
ret
mov eax, dword [esp + 4]
add eax, ecx
mov ax, word [eax*2 + 0x453e10]
ret
mov edx, 0x92e
mov ecx, 0x453ce4
cmp word [ecx], ax
je 0x4024a7
add ecx, 2
inc edx
cmp ecx, 0x453d0a
jl 0x402496
cmp edx, 0x941
jne 0x4024b5
mov eax, 0xffff
ret
mov ax, word [edx*2 + 0x452bb4]
ret
Function at 0x417c90
Capabilities:
Enumerate gui resources

Disassembly:
mov al, byte [0x45b8e0]
mov ecx, dword [esp + 4]
push ebx
mov byte [0x45d2a0], al
mov byte [0x45d180], al
mov eax, dword [esp + 0xc]
push esi
push edi
push eax
push ecx
mov esi, 1
mov byte [0x45bd38], 0
call fcn.00441340
mov eax, dword [0x45b960]
add esp, 8
test eax, eax
jne 0x417cd9
push 0x4d2
push 0x417c20
call dword [sym.imp.USER32.dll_EnumWindows]
mov ebx, dword [sym.imp.USER32.dll_MessageBoxA]
movsx edx, si
push edx
call fcn.00441470
mov edi, eax
add esp, 4
test edi, edi
jge 0x417d22
push edi
push str.TEMPLATE:_bad_status_from_ads_link_____d_n
push 0x45d3c0
call fcn.00443a60
mov eax, dword [0x45b960]
add esp, 0xc
push 0x10
push str.Message
push 0x45d3c0
push eax
call ebx
push 1
call fcn.00443e60
add esp, 4
or esi, 0xffffffff
sub edi, 0xe
je 0x417cdf
sub edi, 0x56
je 0x417d41
dec edi
jne 0x417cdf
push 0x456660
call fcn.0043caa0
add esp, 4
jmp 0x417cdf
call fcn.00419f10
test eax, eax
je 0x417d6d
call fcn.00417bb0
mov esi, eax
push 0x456648
neg esi
sbb esi, esi
and esi, 0xfffffffe
add esi, 3
call fcn.0043caa0
add esp, 4
jmp 0x417cdf
push str._nLock_Device
mov esi, 3
call fcn.0043de80
add esp, 4
push 0xffffffffffffffff
call fcn.00443e60
add esp, 4
jmp 0x417cdf

Function at 0x427feb
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x428026
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x42800d
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x42801e
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x428028
inc edi
add eax, 0x28
cmp edi, esi
jb 0x428003
xor eax, eax
pop edi
pop esi
ret
Function at 0x42ab40
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0x45d140]
mov ecx, dword [0x45d144]
mov edx, dword [0x45d148]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [0x45d14c]
mov dword [esp + 0xc], ecx
mov ecx, dword [0x45d150]
mov dword [esp + 0x10], edx
mov edx, dword [0x45d154]
test edi, edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
je 0x42ac38
mov esi, dword [edi + 8]
test esi, esi
je 0x42ac38
push 0x45d140
call fcn.0042a720
add esp, 4
push 0xa
push esi
call fcn.0040f0b0
mov ecx, dword [0x45d140]
mov edx, dword [0x45d144]
mov dword [eax + 6], ecx
mov dword [eax + 0xa], edx
mov ecx, dword [0x45d148]
mov edx, dword [0x45d14c]
mov dword [eax + 0xe], ecx
add esp, 8
mov dword [eax + 0x12], edx
mov ecx, dword [0x45d150]
mov edx, dword [0x45d154]
mov dword [eax + 0x16], ecx
push esi
mov dword [eax + 0x1a], edx
call fcn.0043afa0
add esp, 4
push 0x45d140
call fcn.0042a790
add esp, 4
push 1
push esi
call fcn.0040f0b0
mov eax, dword [eax + 6]
add esp, 8
mov cl, byte [eax + 1]
test cl, cl
je 0x42ac22
mov al, byte [eax]
push ecx
push eax
call fcn.0041f070
add esp, 8
jmp 0x42ac2d
mov cl, byte [eax]
push ecx
call fcn.0041ee80
add esp, 4
mov edi, dword [edi + 4]
test edi, edi
jne 0x42ab90
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [0x45d140], edx
mov edx, dword [esp + 0x14]
mov dword [0x45d144], eax
mov eax, dword [esp + 0x18]
mov dword [0x45d148], ecx
mov ecx, dword [esp + 0x1c]
pop edi
mov dword [0x45d14c], edx
mov dword [0x45d150], eax
mov dword [0x45d154], ecx
pop esi
mov esp, ebp
pop ebp
ret