joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d16d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx eax, word [0x4339c2]
xor edx, edx
sub eax, 0x25583
mov word [0x4339c2], ax
and dword [0x43c978], 0xbfffff7d
mov eax, dword [0x43e380]
imul eax, eax, 0xa4527c00
push esi
mov esi, ecx
or dword [0x439660], eax
mov eax, dword [0x43d724]
sar eax, 3
imul ecx, eax, 0x15d70519
mov eax, dword [0x43cf84]
or ecx, 0x6029ea91
imul eax, ecx
mov dword [0x43cf84], eax
movzx eax, word [0x434c54]
mov ecx, 0x396e
sub eax, 0x63d232c6
mov word [0x434c54], ax
add dword [0x437e9c], 0x553e08ff
mov al, byte [esi + edx + 0x58]
shr al, 4
movzx eax, al
mov word [0x435222], cx
and dword [0x43c538], 0xe37a73ec
mov al, byte [eax + esi + 0xa8]
mov byte [esi + edx*2 + 0xb9], al
movsx eax, word [0x435c0e]
cmp eax, 0xd9920bb8
jle 0x41d224
or dword [0x43a6b0], 0xb7f0e2f3
jmp 0x41d247
movsx eax, word [0x435426]
or eax, 0x5bf0b2d4
sar eax, 2
cmp eax, 0xd2ec1d4a
je 0x41d241
mov eax, dword [0x43957c]
jmp 0x41d247
mov ax, word [0x434e96]
xor dword [0x43d160], 0x925e3f40
imul eax, dword [0x437f04], 0x65dcd9fb
mov cl, byte [esi + edx + 0x58]
mov dword [0x437f04], eax
or dword [0x437474], 0xc4bdf6c2
movzx eax, cl
and eax, 0x8000000f
jns 0x41d27d
dec eax
or eax, 0xfffffff0
inc eax
movzx eax, al
mov al, byte [eax + esi + 0xa8]
mov byte [esi + edx*2 + 0xba], al
imul eax, dword [0x4369cc], 0x3ffd82c2
dec dword [0x4369cc]
cmp eax, 0x2301088
jne 0x41d2be
mov eax, dword [0x43cb40]
shl eax, 9
cmp eax, 0x65179062
jge 0x41d2be
mov dword [0x439b2c], 0x10140b6
mov eax, dword [0x43bcd0]
mov ecx, 0xb5b0e949
sub ecx, eax
inc edx
or ecx, 0x2c146c0d
and dword [0x437ac0], ecx
cmp edx, 0x10
jne 0x41d1c0
add dword [0x43c49c], 0x23739d90
pop esi
ret
Function at 0x42c371
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
inc dword [0x43e488]
mov eax, dword [0x43e488]
dec dword [0x439598]
mov ecx, dword [0x439598]
imul edx, eax, 0x8e376b21
lea eax, [ecx + 0x45aa5226]
or edx, 0x5602abb6
cmp edx, eax
je 0x42c3ab
and dword [0x43cfb8], 0x3ddc3e4a
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jne 0x42c3c0
mov dword [0x438ab8], 0xbe4e8bd2
xor eax, eax
pop ebp
ret
and dword [0x439880], 0x8a652db8
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
dec ecx
je 0x42c3de
mov al, byte [esi]
cmp al, byte [edx]
jne 0x42c3de
inc esi
inc edx
jmp 0x42c3d1
movzx eax, word [0x4365be]
movzx esi, byte [esi]
add eax, 0x75d23be6
mov word [0x4365be], ax
movzx eax, byte [edx]
sub esi, eax
mov eax, dword [0x438460]
sub eax, 0x54217f90
inc dword [0x438460]
cmp eax, 0xfc747ffd
jl 0x42c41b
mov dword [0x43bba4], 0xae26ddbf
jmp 0x42c43d
mov edx, dword [0x437fa4]
movzx ecx, word [0x435d4e]
or edx, 0xe24a0aec
xor ecx, edx
mov word [0x435d4e], cx
dec dword [0x437fa4]
mov eax, esi
pop esi
pop ebp
ret
Function at 0x401029
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x10], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x401a4f
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push esi
xor esi, esi
push esi
push esi
push 3
push esi
push 7
push esi
push str..PhysicalDrive0
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x401b45
push ebx
push edi
xor eax, eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
stosd dword es:[edi], eax
lea esi, [ebp - 0x41c]
mov dword [ebp - 4], 0x400
mov ebx, dword [ebp - 4]
xor edi, edi
lea eax, [ebp - 4]
push edi
push eax
push ebx
push esi
lea eax, [ebp - 0x1c]
push 0xc
push eax
push 0x2d1400
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, edi
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edi
je 0x401af3
mov eax, dword [esi + 4]
mov dword [ebp - 0xc], esi
cmp eax, ebx
jbe 0x401ad4
mov dword [ebp - 4], eax
mov dword [ebp - 8], edi
jmp 0x401af3
mov eax, dword [esi + 0x18]
cmp eax, edi
je 0x401af3
lea edi, [eax + esi]
push edi
call fcn.00402c30
push eax
push edi
push dword [ebp + 8]
call fcn.004018cc
add esp, 0x10
xor edi, edi
lea eax, [ebp - 0x41c]
cmp esi, eax
je 0x401b04
push esi
call fcn.00402c16
pop ecx
cmp dword [ebp - 8], edi
jne 0x401b3a
cmp dword [ebp - 0xc], edi
jne 0x401b27
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x401b3a
cmp dword [ebp - 4], ebx
ja 0x401b27
or bx, 0xfff
inc ebx
mov dword [ebp - 4], ebx
push dword [ebp - 4]
call fcn.00402c08
mov esi, eax
pop ecx
cmp esi, edi
jne 0x401a98
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov eax, dword [ebp - 8]
pop esi
leave
ret

Function at 0x401f27
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
push 0x10
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.00402bb0
lea eax, [ebp - 0x10]
push eax
call fcn.00401a1d
add esp, 0x10
xor eax, eax
movzx ecx, byte [ebp + eax - 0x10]
lea esi, [ecx + esi*2]
xor esi, dword [ebp - 0x10]
inc eax
cmp eax, 0x10
jb 0x401f4a
mov eax, esi
pop esi
leave
ret
Function at 0x401f64
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, word [ebp + 8]
push ebx
push esi
push edi
push 0xa
push eax
push dword [0x40c050]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x401f9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push dword [0x40c050]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
ja 0x401fa6
xor eax, eax
jmp 0x402096
push edi
push dword [0x40c050]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0x40
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push esi
push ebx
push edi
mov dword [ebp - 8], edi
call fcn.00402870
sub esi, 0x20
push 0x20
mov dword [ebp - 0xc], esi
lea eax, [edi + esi]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00402870
add esp, 0x18
xor eax, eax
xor ebx, ebx
movzx ecx, byte [ebp + eax - 0x2c]
add ebx, ecx
inc eax
cmp eax, 0x20
jb 0x401fee
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp ebx, eax
jne 0x402032
test ebx, ebx
je 0x402053
xor edx, edx
xor ecx, ecx
test esi, esi
jbe 0x402053
mov al, dl
and al, 0x23
xor al, byte [edx + edi]
or al, byte [ebp + ecx - 0x2c]
inc ecx
cmp ecx, 0x10
mov byte [edx + edi], al
jne 0x402027
xor ecx, ecx
inc edx
cmp edx, esi
jb 0x402011
test ecx, ecx
jne 0x402009
jmp 0x402053
xor edx, edx
xor ecx, ecx
test esi, esi
jbe 0x402053
mov al, byte [ebp + ecx - 0x2c]
xor al, byte [edx + edi]
xor al, dl
inc ecx
cmp ecx, 0x10
mov byte [edx + edi], al
jne 0x40204e
xor ecx, ecx
inc edx
cmp edx, esi
jb 0x40203a
mov edi, dword [edi]
mov dword [ebp + 8], edi
add edi, 0x100
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
sub eax, 4
push eax
mov eax, dword [ebp - 8]
add eax, 4
push eax
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00401c26
add esp, 0x10
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40212f
Capabilities:
Link function at runtime on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x40909c
jmp loc.0040d12f

Function at 0x4024d3
Capabilities:
Copy file
Create directory
Create service
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
push 0x40911c
jmp loc.0040d184

Function at 0x402626
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x409160
jmp loc.0040d4c5
Function at 0x549950
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xdc000]
push edi
jmp 0x54996a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x549971
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x549960
mov eax, 1
add ebx, ebx
jne 0x549983
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x549994
jne 0x5499b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5499b3
dec eax
add ebx, ebx
jne 0x5499a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x549978
add ebx, ebx
jne 0x5499af
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x549a05
xor ecx, ecx
sub eax, 3
jb 0x5499cb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x549a3a
sar eax, 1
mov ebp, eax
jmp 0x5499d6
add ebx, ebx
jne 0x5499d6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5499a4
inc ecx
add ebx, ebx
jne 0x5499e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5499a4
add ebx, ebx
jne 0x5499f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5499e6
jne 0x549a02
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5499e6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x549a24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x549a16
jmp 0x549966
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x549a24
add edi, ecx
jmp 0x549966
pop esi
mov edi, esi
mov ecx, 0x996a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x549a42
cmp byte [edi], 0x13
jne 0x549a42
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x549a47
lea edi, [esi + 0x145000]
mov eax, dword [edi]
or eax, eax
je 0x549abf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x164788]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1648f0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x549a74
mov ecx, edi
jns 0x549aa3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1648f4]
or eax, eax
je 0x549ab9
mov dword [ebx], eax
add ebx, 4
jmp 0x549a91
call dword [esi + 0x164904]
mov ebp, dword [esi + 0x1648f8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x549af3
sub esp, 0xffffff80
jmp 0x4b0a26
Function at 0x10001a50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x6c], 0
je 0x10001a6b
fld dword [0x1001c2e8]
fcom dword [esi + 0x70]
fnstsw ax
test ah, 1
jne 0x10001a6f
fstp st(0)
xor al, al
pop esi
ret
fld dword [esi + 0x74]
fabs
fcomp st(1)
fnstsw ax
test ah, 0x41
jnp 0x10001a69
fld dword [esi + 0x78]
fabs
fcompp
fnstsw ax
test ah, 0x41
jnp 0x10001a6b
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
call edx
sub eax, 1
jne 0x10001a6b
test byte [esi + 0x7c], 0x7f
jne 0x10001a6b
movzx eax, word [esi + 0x7e]
mov ecx, eax
and ecx, 0x7f
cmp cx, ax
jne 0x10001a6b
test dword [esi + 0x80], 0xfffffffe
jne 0x10001a6b
fld dword [esi + 8]
sub esp, 8
fstp qword [esp]
call fcn.1000db16
add esp, 8
test eax, 0x207
jne 0x10001a6b
fld dword [esi + 0xc]
sub esp, 8
fstp qword [esp]
call fcn.1000db16
add esp, 8
test eax, 0x207
jne 0x10001a6b
fld dword [esi + 0x10]
sub esp, 8
fstp qword [esp]
call fcn.1000db16
add esp, 8
test eax, 0x207
jne 0x10001a6b
fld dword [esi + 0x14]
sub esp, 8
fstp qword [esp]
call fcn.1000db16
add esp, 8
test eax, 0x207
jne 0x10001a6b
fld dword [esi + 0x18]
sub esp, 8
fstp qword [esp]
call fcn.1000db16
add esp, 8
test eax, 0x207
jne 0x10001a6b
fld dword [esi + 0x1c]
sub esp, 8
fstp qword [esp]
call fcn.1000db16
add esp, 8
test eax, 0x207
jne 0x10001a6b
fld dword [esi + 0x20]
sub esp, 8
fstp qword [esp]
call fcn.1000db16
add esp, 8
test eax, 0x207
jne 0x10001a6b
fld dword [esi + 0x24]
sub esp, 8
fstp qword [esp]
call fcn.1000db16
add esp, 8
test eax, 0x207
jne 0x10001a6b
fld dword [esi + 0x28]
sub esp, 8
fstp qword [esp]
call fcn.1000db16
add esp, 8
test eax, 0x207
jne 0x10001a6b
fld dword [esi + 0x2c]
sub esp, 8
fstp qword [esp]
call fcn.1000db16
add esp, 8
test eax, 0x207
jne 0x10001a6b
fld dword [esi + 0x30]
sub esp, 8
fstp qword [esp]
call fcn.1000db16
add esp, 8
test eax, 0x207
jne 0x10001a6b
fld dword [esi + 0x34]
sub esp, 8
fstp qword [esp]
call fcn.1000db16
add esp, 8
test eax, 0x207
jne 0x10001a6b
cmp word [esi + 0x3c], 0x20
jae 0x10001a6b
cmp dword [esi + 4], 0xa
jge 0x10001a6b
mov edx, 0xffff
cmp word [esi + 0x3e], dx
je 0x10001a6b
fld dword [0x1001c284]
fcomp dword [esi + 0x4c]
fnstsw ax
test ah, 0x44
jnp 0x10001c46
fldz
fcomp dword [esi + 0x4c]
fnstsw ax
test ah, 0x41
je 0x10001a6b
mov al, 1
pop esi
ret
Function at 0x4016fe
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x464a58]
sub esp, 0x1c
push ebx
push edi
push dword [eax + 0x10]
mov edi, ecx
push dword [eax + 0x18]
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x401851
cmp byte [edi + 1], al
je 0x40184d
cmp byte [edi + 0x31], al
je 0x40175c
sub esp, 0x18
lea eax, [edi + 0x34]
mov ecx, esp
mov edx, str.TLS_Handshake...______
push eax
call fcn.00402a81
sub esp, 0x14
mov ecx, esp
push 0x458410
call fcn.00402168
call fcn.00412866
add esp, 0x30
call fcn.00417aa8
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x401777
sub esp, 0x18
mov ecx, esp
push str.TLS_Error_1
jmp 0x4018b1
mov edx, dword [edi + 4]
mov ecx, eax
call fcn.00417ccc
cmp eax, 1
je 0x4017bd
sub esp, 0x18
mov ecx, esp
push str.TLS_Error_2
call fcn.00402168
sub esp, 0x18
mov ecx, esp
push 0x458374
call fcn.00402168
call fcn.00412866
add esp, 0x30
mov ecx, dword [edi + 0x4c]
call fcn.00417aee
and dword [edi + 0x4c], 0
jmp 0x4018cd
mov ecx, dword [edi + 0x4c]
call fcn.004187ac
cmp eax, 1
je 0x4017fa
sub esp, 0x18
mov ecx, esp
push str.TLS_Authentication_Failed
call fcn.00402168
sub esp, 0x18
mov ecx, esp
push 0x458374
call fcn.00402168
call fcn.00412866
mov ecx, dword [edi + 0x4c]
add esp, 0x30
call fcn.00417ef5
jmp 0x4017ac
mov ecx, dword [edi + 0x4c]
call fcn.00417c43
mov dword [edi + 0x50], eax
test eax, eax
jne 0x40182f
sub esp, 0x18
mov ecx, esp
push str.TLS_Error_3
call fcn.00402168
sub esp, 0x18
mov ecx, esp
push 0x458374
call fcn.00402168
call fcn.00412866
add esp, 0x30
xor ebx, ebx
push ebx
push 1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push 1
push ebx
push ebx
mov dword [edi + 0x70], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x6c], eax
mov al, 1
jmp 0x4018cf
cmp byte [edi + 0x31], 0
je 0x4018cd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
sub ecx, 0x2736
je 0x4018cd
sub ecx, 0x17
je 0x4018a7
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.004138a0
sub esp, 0x18
mov edx, str.Connection_Failed:
mov ecx, esp
push eax
call fcn.00402a5d
sub esp, 0x14
mov ecx, esp
push 0x458374
call fcn.00402168
call fcn.00412866
add esp, 0x30
lea ecx, [ebp - 0x1c]
call fcn.00402081
jmp 0x4018cd
sub esp, 0x18
mov ecx, esp
push str.Connection_Refused
call fcn.00402168
sub esp, 0x18
mov ecx, esp
push 0x458374
call fcn.00402168
call fcn.00412866
add esp, 0x30
xor al, al
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4018d7
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp + 0xc]
call fcn.00402010
xor ebx, ebx
lea ecx, [ebp - 0x1c]
push ebx
push 0xc
lea esi, [eax + 4]
call fcn.0040213e
push ebx
lea ecx, [ebp - 0x1c]
call fcn.0040201d
mov ecx, dword [edi + 0x2c]
push 4
mov dword [eax], ecx
lea ecx, [ebp - 0x1c]
call fcn.0040201d
push 8
lea ecx, [ebp - 0x1c]
mov dword [eax], esi
call fcn.0040201d
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040205e
cmp byte [edi + 1], bl
jne 0x401954
push ebx
lea ecx, [ebp - 0x1c]
call fcn.00402010
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402018
push eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
jmp 0x40198f
or ebx, 0xffffffff
push ebx
push dword [edi + 0x70]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00402010
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402018
mov ecx, dword [edi + 0x50]
mov edx, eax
call fcn.00417e7d
pop ecx
mov esi, eax
pop ecx
push dword [edi + 0x70]
test esi, esi
cmove esi, ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea ecx, [ebp - 0x1c]
call fcn.00402081
lea ecx, [ebp + 0xc]
call fcn.00402081
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x4019aa
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp byte [edi + 1], 0
je 0x4019e3
push 0xffffffffffffffff
push dword [edi + 0x6c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp + 8]
push ecx
push dword [ebp + 0xc]
mov ecx, dword [edi + 0x4c]
call fcn.00417eb9
pop ecx
pop ecx
push dword [edi + 0x6c]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, esi
jmp 0x4019f4
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_recv]
pop edi
pop esi
pop ecx
pop ebp
ret 0xc

Function at 0x4019fb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [ecx + 8], eax
xor eax, eax
push eax
push eax
push ecx
push 0x401a1a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret 4
Function at 0x401d5f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x5c], 0
jne 0x401df8
cmp byte [ebp + 0xc], 0
mov edi, dword [ebp + 8]
jne 0x401d82
mov byte [esi + 0x7c], 1
jmp 0x401dce
cmp byte [0x464a81], 0
je 0x401dce
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, edi
lea ecx, [ebp - 0x28]
call fcn.00412d96
sub esp, 0x18
mov edx, str.Connection_KeepAlive___Enabled__Timeout:
mov ecx, esp
push eax
call fcn.00402a5d
sub esp, 0x14
mov ecx, esp
push 0x458410
call fcn.00402168
call fcn.00412866
add esp, 0x30
lea ecx, [ebp - 0x28]
call fcn.00402081
mov dword [esi + 0x74], edi
xor edi, edi
push edi
push edi
push edi
push edi
mov byte [esi + 0x5c], 1
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push edi
push edi
push esi
push 0x401f5e
push edi
push edi
mov dword [esi + 0x60], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov al, 1
jmp 0x401dfa
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x403f98
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
push edi
mov edi, ecx
mov eax, esi
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmmword [0x45e900]
movups xmmword [edi + eax*4], xmm0
add eax, 4
cmp eax, 0x100
jl 0x403fa4
mov ebx, esi
xor edx, edx
mov eax, ebx
div dword [ebp + 0xc]
mov eax, dword [ebp + 8]
movzx eax, byte [edx + eax]
add eax, dword [edi + ebx*4]
add esi, eax
and esi, 0x800000ff
jns 0x403fe8
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [edi + ebx*4]
mov eax, dword [edi + esi*4]
mov dword [edi + ebx*4], eax
inc ebx
movzx eax, cl
mov dword [edi + esi*4], eax
cmp ebx, 0x100
jl 0x403fc5
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x404007
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
xor edx, edx
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x400]
mov ecx, 0x100
mov ebx, edx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0xc]
mov edi, edx
add esi, 1
je 0x40409f
inc edx
and edx, 0x800000ff
jns 0x404041
dec edx
or edx, 0xffffff00
inc edx
mov eax, dword [ebp + edx*4 - 0x400]
add ebx, eax
and ebx, 0x800000ff
jns 0x40405a
dec ebx
or ebx, 0xffffff00
inc ebx
mov cl, al
mov eax, dword [ebp + ebx*4 - 0x400]
mov dword [ebp + edx*4 - 0x400], eax
movzx eax, cl
mov dword [ebp + ebx*4 - 0x400], eax
mov ecx, dword [ebp + edx*4 - 0x400]
add ecx, eax
and ecx, 0x800000ff
jns 0x40408d
dec ecx
or ecx, 0xffffff00
inc ecx
mov al, byte [ebp + ecx*4 - 0x400]
mov ecx, dword [ebp + 8]
xor byte [edi + ecx], al
inc edi
cmp edi, esi
jb 0x404030
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40449e
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
lea eax, [ebp - 0x298]
lea ecx, [ebp + 8]
push ebx
push esi
push eax
call fcn.00404386
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4044e4
sub esp, 0x18
lea edx, [ebp + 8]
mov ecx, esp
call fcn.00412f0c
push 0x54
mov ecx, 0x466d48
call fcn.004018d7
jmp 0x4045a5
lea ecx, [ebp - 0x18]
call fcn.004021b9
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x30]
call fcn.004034f9
mov edx, 0x458590
mov ecx, eax
call fcn.00406232
lea ecx, [ebp - 0x30]
mov bl, al
call fcn.004034ef
test bl, bl
je 0x404571
push 0x250
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040218f
push eax
lea ecx, [ebp - 0x18]
call fcn.0040208b
lea ecx, [ebp - 0x30]
jmp 0x40456c
push 0x250
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x48]
call fcn.0040218f
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x30]
call fcn.004062b4
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.0040208b
lea ecx, [ebp - 0x30]
call fcn.00402081
lea ecx, [ebp - 0x48]
call fcn.00402081
lea eax, [ebp - 0x298]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x404537
sub esp, 0x18
lea eax, [ebp - 0x18]
mov ecx, esp
push eax
call fcn.004021d0
push 0x50
mov ecx, 0x466d48
call fcn.004018d7
lea ecx, [ebp - 0x18]
call fcn.00402081
lea ecx, [ebp + 8]
call fcn.004034ef
pop esi
pop ebx
mov esp, ebp
pop ebp
ret