joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000236c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x100023af
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov eax, 0x59f
mov dword [0x1000641c], esi
push str.ws2_32
mov word [0x10006018], ax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push 0
push 0x10002318
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
add esp, 0xc
pop esi
xor eax, eax
inc eax
pop ebp
ret 0xc

Function at 0x10002490
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10006004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 6
push 1
push 2
pop ebx
push ebx
mov edi, ecx
call dword [sym.imp.WS2_32.dll_socket]
push 4
mov esi, eax
mov dword [ebp - 0x18], 0x5dc
lea eax, [ebp - 0x18]
push eax
push 0x1006
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
push str.raw.githubusercontent.com
call dword [sym.imp.WS2_32.dll_gethostbyname]
push 0x1bb
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push esi
mov word [ebp - 0x14], bx
call dword [sym.imp.WS2_32.dll_connect]
push ecx
push ecx
push dword [sym.imp.WS2_32.dll_recv]
push dword [sym.imp.WS2_32.dll_send]
push esi
call fcn.1000104e
add esp, 0x14
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
push str._r_n_r_n
push dword [0x10006478]
call dword [sym.imp.VCRUNTIME140.dll_strstr]
push 0xa
lea ecx, [ebp - 0x1c]
add eax, 4
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
mov ecx, dword [ebp - 4]
add esp, 0x14
mov dword [edi], eax
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.100028ba
leave
ret
Function at 0x10002883
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
mov edx, dword [ecx]
je 0x100028b4
push esi
push edi
mov edi, dword [ebp + 8]
not edx
xor esi, esi
movzx eax, byte [esi + edi]
xor eax, edx
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0x10004358]
inc esi
cmp esi, dword [ebp + 0xc]
jne 0x10002897
pop edi
not edx
pop esi
mov dword [ecx], edx
pop ebp
ret 8

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x5c22cba
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x38533be1
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x7501b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x25d000]
push edi
jmp 0x7501ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x7501d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7501c0
mov eax, 1
add ebx, ebx
jne 0x7501e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x7501f4
jne 0x750213
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x750213
dec eax
add ebx, ebx
jne 0x750200
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x7501d8
add ebx, ebx
jne 0x75020f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x750265
xor ecx, ecx
sub eax, 3
jb 0x75022b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x75029a
sar eax, 1
mov ebp, eax
jmp 0x750236
add ebx, ebx
jne 0x750236
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x750204
inc ecx
add ebx, ebx
jne 0x750244
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x750204
add ebx, ebx
jne 0x750251
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x750246
jne 0x750262
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x750246
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x750284
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x750276
jmp 0x7501c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x750284
add edi, ecx
jmp 0x7501c6
pop esi
mov edi, esi
mov ecx, 0x3029
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x7502a2
cmp byte [edi], 0x19
jne 0x7502a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x7502a7
lea edi, [esi + 0x34d000]
mov eax, dword [edi]
or eax, eax
je 0x75031f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x385234]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x385338]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x7502d4
mov ecx, edi
jns 0x750303
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x38533c]
or eax, eax
je 0x750319
mov dword [ebx], eax
add ebx, 4
jmp 0x7502f1
call dword [esi + 0x38534c]
mov ebp, dword [esi + 0x385340]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x750353
sub esp, 0xffffff80
jmp 0x78718e
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x48a67b8a
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
mov eax, section..rdata
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3e49061c
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x401000
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x401029
mov al, byte [esi + 1]
inc esi
test al, al
je 0x401021
cmp al, 0x22
jne 0x401015
cmp byte [esi], 0x22
jne 0x401033
inc esi
jmp 0x401033
cmp al, 0x20
jle 0x401033
inc esi
cmp byte [esi], 0x20
jg 0x40102d
mov al, byte [esi]
test al, al
je 0x40103d
cmp al, 0x20
jle 0x401026
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004018d4
push 0x404004
push section..data
call fcn.004018ba
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x40106d
movzx eax, word [ebp - 0x14]
jmp 0x401070
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.00401123
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00431219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x4aee17e8
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0xd2276bc
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x40693c
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x406964
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x406956
pop edi
pop esi
pop ebp
ret 4
add al, 0

Function at 0x40bec0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
xor ecx, ecx
mov dword [esp + 0x24], 1
mov dword [esp + 0x18], ecx
or ebx, 0xffffffff
mov dword [esp + 0x20], ecx
mov eax, dword [edi + 4]
mov dword [esp + 0x10], ecx
mov eax, dword [eax]
mov dword [esp + 0x14], eax
movsx eax, word [eax + 8]
sub eax, ecx
je 0x40bf27
sub eax, 1
je 0x450474
sub eax, 0x32
jne 0x4503eb
push edi
mov ecx, esi
call fcn.0040dfd0
lea ecx, [esp + 0x18]
call fcn.0040cfa0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push dword [ebp + 0xc]
mov ecx, esi
push edi
call fcn.0040dd50
test ebx, ebx
js 0x40bf15
jmp 0x45048e
push edx
adc byte [edx - 0x73], dl
inc esp
and al, 0x14
sbb al, 0x50
lea eax, [esp + 0x18]
push eax
push edi
push ecx
mov ecx, esi
call 0x40bf6c
jmp 0x4504b3
Function at 0x41fe68
Capabilities:
Enumerate pe sections

Disassembly:
add byte [eax], al
add byte [ebx - 0x74a9f7bb], cl
dec eax
cmp al, 3
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x41fea2
mov ecx, dword [ebp + 0xc]

Function at 0x424963
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp byte [ebx + 0x73], ah
insd dword es:[edi], dx
loopne 0x4249de
and eax, ebp
xor edx, ebp
invalid
or al, 0xff

Function at 0x438a8d
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov eax, dword [eax]
push ecx
push ecx
push ebx
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
call fcn.00438776
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0xdbc38fd8
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
and eax, 0x3f
sar edx, 6
push edi
imul edi, eax, 0x30
mov dword [ebp - 4], edx
mov eax, dword [edx*4 + 0x4d0fe8]
mov dword [ebp - 8], eax
cmp byte [eax + edi + 0x29], 0
jne 0x438adc
mov eax, ecx
jmp 0x4474d7
push esi
lea esi, [ebx - 1]
add esi, ecx
mov al, byte [esi]
test al, al
js 0x438aee
inc esi
jmp 0xe9438b89
xor edx, edx
movzx eax, al
inc edx
jmp 0x438b04
cmp edx, 4
ja 0x438b0d
cmp esi, ebx
jb 0x438b0d
dec esi
inc edx
movzx eax, byte [esi]
cmp byte [eax - 0x25b33de0], 0x4c
je 0x438af6
mov cl, byte [esi]
movzx eax, cl
movsx eax, byte [eax - 0x25b33de0]
test eax, eax
jne 0x438b2d
call fcn.0042f305
mov dword [eax], 0x4cdaa82a
jmp 0xe9438bb3
inc eax
cmp eax, edx
jne 0x438b36
add esi, edx
jmp 0x438b89
mov eax, dword [ebp - 8]
test byte [eax + edi + 0x28], 0x48
je 0x438b75
inc esi
mov byte [eax + edi + 0x2a], cl
cmp edx, 2
jb 0x438b5b
mov ecx, dword [ebp - 4]
mov al, byte [esi]
inc esi
mov ecx, dword [ecx*4 + 0x4d0fe8]
mov byte [ecx + edi + 0x2b], al
cmp edx, 3
jne 0x438b71
dec esp
inc ebp
cld
mov ecx, dword [eax*4 + 0x4d0fe8]
mov al, byte [esi]
inc esi
mov byte [ecx + edi + 0x2c], al
sub esi, edx
jmp 0x438b89
neg edx
mov eax, edx
push 1
cdq
push edx
push eax
push dword [ebp + 8]
call 0x4d1d9450
add esp, 0x10
push dword [ebp + 0x18]
sub esi, ebx
push dword [ebp + 0x14]
push esi
push ebx
push 0
push 0xdb80fde9
call dword [0x8349c184]
mov edx, eax
test edx, edx
jne 0x438bb8
call dword [0x8349c334]
push eax
call 0x8b4ff2cf
pop ecx
or eax, 0xffffffff
jmp 0x438bd6
mov eax, dword [ebp - 4]
cmp edx, esi
mov ecx, dword [eax*4 + 0x4d0fe8]
setne al
add al, al
xor al, byte [ecx + edi + 0x2d]
and al, 2
xor byte [ecx + edi + 0x2d], al
lea eax, [edx + edx]
pop esi
pop edi
pop ebx
mov esp, ebp
dec esp
ret
cld
or al, 0x8b
inc ebp
clc

Function at 0x46970e
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
jle 0x46971b
xor word [edi + eax*2], cx
inc eax
cmp eax, ecx
jl 0x469712
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x472088
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x4d2ff0], 0
push esi
push edi
mov esi, 0x4d2630
jne 0x4720ab
push 0
call fcn.0042e52a
pop ecx
mov ecx, eax
call 0xa8472048
mov dword [0x4d06e0], 0xe8100270
mov edx, 0xe3
mov dword [0x4d2ff4], esi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
xor ecx, eax
and al, 1
and ecx, 0x7f468dfe
movzx eax, al
xor ecx, dword [esi]
shr ecx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi - 0x17eff9cc]
mov dword [esi], ecx
add esi, 4
sub edx, 1
jne 0x4720c0
mov eax, dword [esi]
mov dword [ebp - 4], 0x4d19018c
mov edi, dword [esi + 4]
mov ecx, eax
xor ecx, edi
and ecx, 0x7f468dfe
xor ecx, eax
mov eax, edi
and al, 1
shr ecx, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edi
xor ecx, dword [esi - 0x38c]
sub dword [ebp - 4], 1
mov dword [esi], ecx
lea esi, [esi + 4]
jne 0x4720fa
mov eax, dword [0x4d2630]
mov ecx, edi
xor ecx, eax
and al, 1
and ecx, 0x7f468dfe
movzx eax, al
xor ecx, edi
shr ecx, 1
neg eax
pop edi
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi - 0x38c]
mov dword [esi], ecx
pop esi
leave
ret

Function at 0x472940
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
lea ecx, [ebp - 0xdc]
call 0x1472790
add byte [ebp + 8], dh
lea ecx, [ebp - 0xdc]
call fcn.004727d4
xor esi, esi
test ebx, ebx
je 0x472984
push ecx
push ecx
lea ecx, [ebp - 0xdc]
call 0x46d43914
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jb 0x47296f
pop edi
pop esi
pop ebx
leave
ret

Function at 0x47c0ad
Capabilities:
Encode data using xor

Disassembly:
leave
dec ecx
add byte [ebp - 0x74f08b37], al
jno 0x47c0ef
mov esi, dword [ecx + 0x38]
push ecx
call 0x67301a40
mov ecx, esi
test esi, esi
jne 0x47c0b4
test byte [ebp + 8], 1
je 0x47c0d6
push 0x3c244489
push edi
call 0x487fe2a
add eax, edi
mov eax, edi
pop edi
pop esi
pop ebp
cmp dword [edi + edi*8], eax
Function at 0x404596
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4070b8]
jne 0x4045a7
test ecx, 0xffff0000
jne 0x4045a7
ret
jmp fcn.004045ac

Function at 0x40492b
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x405578
call fcn.00404974
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x407ecc
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x40471f
cmp eax, esi
jne 0x404712
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x404722
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4046f9
xor esi, esi
inc esi
mov eax, dword [0x407ec8]
cmp eax, esi
jne 0x404735
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x404770
mov eax, dword [0x407ec8]
test eax, eax
jne 0x40476a
mov dword [0x407ec8], esi
push 0x401204
push 0x4011f4
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x404770
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x404847
mov dword [0x407658], esi
mov eax, dword [0x407ec8]
cmp eax, esi
jne 0x404794
push 0x4011f0
push 0x4011dc
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x407ec8], 2
cmp dword [ebp - 0x1c], ebx
jne 0x4047a1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x407ed8], ebx
je 0x4047c2
push 0x407ed8
call fcn.00404bd0
pop ecx
test eax, eax
je 0x4047c2
push ebx
push 2
push ebx
call dword [0x407ed8]
mov eax, dword [0x407640]
mov ecx, dword [sym.imp.MSVCR80.dll___winitenv]
mov dword [ecx], eax
push dword [0x407640]
push dword [0x407644]
push dword [0x40763c]
call fcn.00402d98
add esp, 0xc
mov dword [0x407654], eax
cmp dword [0x407648], ebx
jne 0x40482d
push eax
call dword [sym.imp.MSVCR80.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.MSVCR80.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x407658], ebx
jne 0x40483b
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x407654]
call fcn.004049b9
ret
call fcn.00404528
jmp 0x4046d7

Function at 0x405238
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push edi
mov edi, dword [ebp + 8]
cmp edi, 0xffffffff
jne 0x40524e
xor eax, eax
jmp 0x4052a3
push ebx
push esi
xor esi, esi
lea eax, [ebp - 8]
push eax
push esi
push esi
lea eax, [ebp - 0x10c]
xor ebx, ebx
push eax
inc ebx
push esi
mov dword [ebp - 0x108], edi
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.WS2_32.dll_select]
cmp eax, esi
je 0x40529b
cmp eax, 0xffffffff
je 0x40529f
push 2
push ebx
lea eax, [ebp + 0xb]
push eax
push edi
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, esi
je 0x40529f
cmp eax, 0xffffffff
je 0x40529f
mov eax, ebx
jmp 0x4052a1
xor eax, eax
pop esi
pop ebx
pop edi
leave
ret 4

Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
pop ds
rol dword [ebx], 1
xor al, 0x76
push ebp
test byte [ecx], dh
xchg edi, eax
pop esp
adc eax, 0xaf34d523
invalid
Function at 0x401130
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x10008
call fcn.00421fc0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x10004], eax
cmp dword [0x42f580], 0
push esi
push edi
je 0x4011df
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [esp + 0x14]
push 0x8000
push eax
call fcn.00401000
push dword [eax + 4]
push dword [eax]
call fcn.0040ed44
mov esi, eax
add esp, 0x1c
or eax, 0xffffffff
test esi, esi
cmovs esi, eax
test esi, esi
jle 0x4011df
push dword [0x42f580]
lea eax, [esp + 0xc]
push eax
call fcn.00414c03
add esp, 8
lea edi, [esi + esi]
movzx eax, word [esp + edi + 8]
push eax
call fcn.004151d0
add esp, 4
test eax, eax
je 0x4011cc
dec esi
cmp edi, 0x10000
jae 0x4011f3
xor eax, eax
mov word [esp + edi + 8], ax
test esi, esi
jne 0x4011a3
cmp word [esp + 8], 0
je 0x4011df
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [esp + 0x1000c]
pop edi
pop esi
xor ecx, esp
call fcn.0040649c
mov esp, ebp
pop ebp
ret
call fcn.004065cc
int3