joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408c80
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x42f549
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43cc00]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor edi, edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0x4349fc
mov ecx, ebp
mov esi, eax
call fcn.00402520
mov ecx, 3
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], ecx
mov edi, edi
mov eax, esi
shr eax, cl
test al, 1
je 0x408cf6
add ecx, 1
cmp ecx, 0x1a
jl 0x408ce0
mov dword [esp + 0x18], ecx
jmp 0x408d2c
mov dword [esp + 0x18], ecx
add ecx, 0x41
lea eax, [esp + 0x14]
mov word [esp + 0x14], cx
mov word [esp + 0x16], di
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x408d10
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebp
call fcn.004019b0
mov eax, dword [ebp]
mov ebx, dword [eax - 0xc]
mov esi, 0x435d34
mov dword [esp + 0x14], esi
sub esi, eax
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
lea edi, [ebx + 1]
sub eax, edi
sar esi, 1
or eax, ecx
jge 0x408d5b
push edi
mov ecx, ebp
call fcn.00401720
cmp esi, ebx
mov eax, dword [ebp]
ja 0x408d69
lea edx, [eax + esi*2]
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x14]
push 2
push ecx
lea edx, [eax + ebx*2]
push 2
push edx
call fcn.00417f28
add esp, 0x10
test edi, edi
jl 0x408dc3
mov eax, dword [ebp]
cmp edi, dword [eax - 8]
jg 0x408dc3
cmp dword [esp + 0x18], 0x1a
mov dword [eax - 0xc], edi
mov eax, dword [ebp]
mov word [eax + edi*2], 0
jne 0x408dab
push 0
push 0x4349fc
mov ecx, ebp
call fcn.004019b0
mov eax, ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
push 0x80070057
call fcn.004016a0
int3
Function at 0x408dd0
Capabilities:
Get uefi variable

Disassembly:
push 0xffffffffffffffff
push 0x42f691
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x43cc00]
xor eax, esp
mov dword [esp + 0x210], eax
mov eax, dword [0x43cc00]
xor eax, esp
push eax
lea eax, [esp + 0x218]
mov dword fs:[0], eax
push 0x206
lea eax, [esp + 0x12]
push 0
push eax
mov word [esp + 0x18], 0
call fcn.0041a7a0
add esp, 0xc
push 0x104
lea ecx, [esp + 0x10]
push ecx
push 0x435d38
push 0x4349fc
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
test eax, eax
jne 0x408ed7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 1
jne 0x408e88
push ecx
mov ecx, esp
mov dword [esp + 0xc], esp
push str.Boot_system_from_Legacy_BIOS
call fcn.00402520
push ecx
mov dword [esp + 0x228], 0
mov ecx, esp
mov dword [esp + 0xc], esp
push str.ERROR_INVALID_FUNCTION
call fcn.00402520
mov edx, dword [esi + 0x11a50]
push edx
jmp 0x408f0b
cmp eax, 0x3e6
jne 0x408ed7
push ecx
mov ecx, esp
mov dword [esp + 8], esp
push str.Boot_system_from_UEFI_BIOS
call fcn.00402520
push ecx
mov dword [esp + 0x228], 1
mov ecx, esp
mov dword [esp + 0x10], esp
push str.ERROR_NOACCESS
call fcn.00402520
mov eax, dword [esi + 0x11a50]
push eax
mov dword [esp + 0x22c], 0xffffffff
call fcn.004029e0
mov al, 1
jmp 0x408f1d
push ecx
mov ecx, esp
mov dword [esp + 8], esp
push str.Boot_system_from_Legacy_BIOS
call fcn.00402520
push ecx
mov dword [esp + 0x228], 2
mov ecx, esp
mov dword [esp + 0x10], esp
push str.DEFAULT
call fcn.00402520
mov ecx, dword [esi + 0x11a50]
push ecx
mov dword [esp + 0x22c], 0xffffffff
call fcn.004029e0
xor al, al
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00417ffe
add esp, 0x220
ret
Function at 0x40d27c
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x1f4]
sub esp, 0x274
mov eax, dword [0x43cc00]
xor eax, ebp
mov dword [ebp + 0x1f0], eax
cmp dword [ebp + 0x200], 0x800
mov eax, dword [ebp + 0x1fc]
push esi
mov dword [ebp - 0x40], eax
mov esi, ecx
lea eax, [ebp + 0x1e8]
jne 0x40d31a
push 0x431b04
push 4
push eax
call fcn.00419276
push eax
call fcn.00401610
add esp, 0x10
push ebx
push edi
call fcn.004198af
mov edi, dword [eax]
call fcn.004198af
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp + 0x1e8]
push eax
push dword [ebp - 0x40]
lea eax, [ebp - 0x3c]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.00419855
add esp, 0x18
mov dword [ebp - 0x40], eax
call fcn.004198af
cmp dword [eax], ebx
je 0x40d331
call fcn.004198af
push dword [eax]
call fcn.0040be75
pop ecx
jmp 0x40d338
push 4
push eax
push 3
push dword [ebp + 0x200]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x40d2cb
jmp 0x40d3aa
call fcn.004198af
mov dword [eax], edi
cmp dword [ebp - 0x40], 0xffffffff
je 0x40d3a6
cmp dword [ebp - 0x40], esi
jae 0x40d3a6
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x7c]
push ebx
push eax
mov dword [ebp - 0x80], 0x40
call fcn.0041a7a0
add esp, 0xc
push 0x431864
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x40d398
push str.FindActCtxSectionStringW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x40d398
lea ecx, [ebp - 0x80]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x40d398
push ebx
push ebx
push esi
jmp 0x40d39e
push ebx
push ebx
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x40d3a8
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp + 0x1f0]
xor ecx, ebp
pop esi
call fcn.00417ffe
add ebp, 0x1f4
leave
ret
Function at 0x417ffe
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43cc00]
jne 0x418008
repz ret
jmp fcn.0041e005

Function at 0x41919d
Capabilities:
Encode data using xor

Disassembly:
mov edx, ebx
and ch, al
sub ch, bl
mov ah, 0x39
mov bl, bh
add dh, bh
test esi, ebp
jo 0x41915a
lea ecx, [0x92cd9e1a]
imul ecx, ebp
inc al
push ecx
push ecx
xchg al, ah
or edx, 0x414ffa7e
imul ebp, ecx, 0x11fb94ab
call 0x419174
cmp esi, ebx
jbe 0x41917b
test bh, 0x43
inc ebx
cmp edi, eax
mov al, 0x92
test ebx, eax
imul eax, ebp
xor edx, eax
mov esi, edx
add ecx, edi
lea eax, [0xf2ca34f8]
mov esi, 0
adc ecx, edx
mov eax, 0x56eda29c
in eax, dx
push esi
mov ah, 0xea
test al, 0xfd
test dl, 0x49
imul ecx, esi, 0x2b9e4dd5
xor bh, bl
inc ch
movsx ecx, ah
or al, 0xf1
test cl, 0xcc
add dl, al
mov edi, 0x24e
dec eax
sub eax, 0xcdff23c8
sbb eax, 0xac3a7f75
sub edi, 0xe4e
test edi, esi
add esi, edi
xchg bh, dl
add esi, 0xc01
test edi, 0x156c12c6
mov eax, 0x519406da
mov al, 0xec
movzx eax, di
mov cl, 0x48
mov edi, 0xd65024c5
sub ecx, 0x983146a5
test edx, 0xd58957d8
cmp esi, 0x410
jbe 0x419197
pop ecx
mov dh, 0x35
adc esi, 0x2a18e11b
push 0xf2a144
push ecx
and al, 0x5a
mov edx, esi
dec bl
add ebx, edx
test cl, bl
adc eax, 0x999f0c62
cmp edi, 0xc27c
inc edi
lea eax, [0x35211bdd]
jmp 0x419248
or al, 0xec
push edi
xchg al, al
test eax, ebp
mov esi, ebp
mov eax, 0xc1268d56
inc edx
mov al, 0x31
sbb ah, al
imul edx, eax, 0x6618e01
mov fs, word [ecx + 6]
mov dl, bh
sub bh, dl
mov esi, 0x231fc
and edi, ecx
xor esi, 0xa218
mov al, 0x44
inc esp
add esi, 0xb1b
lea eax, [0x64cf1caa]
add ecx, esi
jno 0x41928d
imul eax, esi
movzx eax, si
mov edi, 0x833f2b08
test esi, edx
mov eax, 0x7dca8ff
push edx
imul ebp, ebp
xchg dl, bl
movzx ebp, cx
imul eax, esi, 0xd717b781
or edi, edx
imul edi, ebp
test ebp, ebx
jae 0x4192b8
test edx, 0xdc0c9478
jmp 0x4192c5
xor edx, eax
dec bl
mov esi, edx
mov bh, dl
mov ah, dh
jne 0x4192dc
mov bh, 0x26
test dl, 0x60
lea edx, [0x9c086518]
sub edx, 0x33e9bb0c
Function at 0x42316f
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x43d768]
je 0x42318a
inc edi
cmp edi, 0x17
jb 0x42317b
cmp edi, 0x17
jae 0x42330a
push ebp
push 3
call fcn.0042973b
cmp eax, 1
pop ecx
je 0x4232d6
push 3
call fcn.0042973b
test eax, eax
pop ecx
jne 0x4231be
cmp dword [0x43cbfc], 1
je 0x4232d6
cmp ebx, 0xfc
je 0x423309
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x440480
push ebp
call fcn.00426f49
add esp, 0xc
test eax, eax
je 0x4231f4
push esi
push esi
push esi
push esi
push esi
call fcn.0041d809
add esp, 0x14
push 0x104
mov esi, 0x440499
push esi
push 0
mov byte [0x44059d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x423238
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00426f49
add esp, 0xc
test eax, eax
je 0x423238
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0041d809
add esp, 0x14
push esi
call fcn.00426fb0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x42327d
push esi
call fcn.00426fb0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x440794
push 0x4334b4
sub ecx, eax
push ecx
push eax
call fcn.00426e96
add esp, 0x14
test eax, eax
je 0x42327d
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0041d809
add esp, 0x14
jmp 0x42327f
xor esi, esi
push 0x4334b0
push ebx
push ebp
call fcn.00426dd3
add esp, 0xc
test eax, eax
je 0x42329f
push esi
push esi
push esi
push esi
push esi
call fcn.0041d809
add esp, 0x14
push dword [edi*8 + 0x43d76c]
push ebx
push ebp
call fcn.00426dd3
add esp, 0xc
test eax, eax
je 0x4232c1
push esi
push esi
push esi
push esi
push esi
call fcn.0041d809
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0042957e
add esp, 0xc
jmp 0x423309
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x423309
cmp ebp, 0xffffffff
je 0x423309
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x43d76c]
push dword [esi]
call fcn.00426fb0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x42957e
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0041d180
xor ebx, ebx
cmp dword [0x440ae8], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x429654
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x429734
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x429734
push eax
call fcn.0041d112
mov dword [esp], 0x434738
push edi
mov dword [0x440ae8], eax
call esi
push eax
call fcn.0041d112
mov dword [esp], 0x434724
push edi
mov dword [0x440aec], eax
call esi
push eax
call fcn.0041d112
mov dword [0x440af0], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0041a529
test eax, eax
pop ecx
pop ecx
je 0x429622
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041d809
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x429654
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0041d112
cmp eax, ebx
pop ecx
mov dword [0x440af8], eax
je 0x429654
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041d112
pop ecx
mov dword [0x440af4], eax
mov eax, dword [0x440af4]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4296d9
cmp dword [0x440af8], ecx
je 0x4296d9
push eax
call fcn.0041d189
push dword [0x440af8]
mov esi, eax
call fcn.0041d189
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4296d9
cmp edi, ebx
je 0x4296d9
call esi
cmp eax, ebx
je 0x4296a6
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4296a6
test byte [ebp - 0x18], 1
jne 0x4296d9
lea eax, [ebp - 0x10]
push eax
call fcn.0041a560
test eax, eax
pop ecx
je 0x4296c1
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041d809
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4296d0
or dword [ebp + 0x10], 0x200000
jmp 0x429714
or dword [ebp + 0x10], 0x40000
jmp 0x429714
mov eax, dword [0x440aec]
cmp eax, dword [ebp - 8]
je 0x429714
push eax
call fcn.0041d189
cmp eax, ebx
pop ecx
je 0x429714
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x429714
mov eax, dword [0x440af0]
cmp eax, dword [ebp - 8]
je 0x429714
push eax
call fcn.0041d189
cmp eax, ebx
pop ecx
je 0x429714
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x440ae8]
call fcn.0041d189
cmp eax, ebx
pop ecx
je 0x429734
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x429736
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42e26e
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x43cc00]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0042e203
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0041a7a0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x42e2bd
cmp dword [ebp - 0x1c], 5
jb 0x42e2d5
jmp 0x42e2d1
cmp dword [ebp - 0x10], 1
jne 0x42e2d5
cmp dword [ebp - 0x1c], 4
ja 0x42e2d1
jne 0x42e2d5
cmp dword [ebp - 0x18], 0
jbe 0x42e2d5
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4347f8
call fcn.0042e0d7
test eax, eax
jge 0x42e2f6
mov byte [0x440b80], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00417ffe
add ebp, 0x78
leave
ret
Function at 0x404f60
Capabilities:
Encode data using xor

Disassembly:
xchg ebx, eax
add byte [ebx - 0x74aa6f70], dl
push ebp
mov ebp, esp
push ebp
mov ebp, esp
xor dword [ebp + 8], eax
xor eax, dword [eax]
add byte [edi], dl
add byte [ebx - 0x3f7a34bb], al
jae 0x404f7e
mov eax, 0x4002e50d
add byte [ecx - 0x3e06edb3], cl
mov edi, dword [ebx + 0x75c9e681]
or al, byte [esi - 0x40]
je 0x404f8f
mov edx, dword [eax + 0x20]
mov dword [ebp + 0x10], edx
mov eax, 0x56105d8b
push edi
test ebx, ebx
jne 0x404f5b
jmp 0x404ff3
mov edx, dword [eax - 0x13]
sub eax, 4
dec ecx
test edx, edx
jne 0x404ffa
sal byte [ebp + 4], cl
test ecx, edi
ja 0x404feb
mov dword [ebx], ecx
jmp 0x405020
jae 0x405069
mov eax, esi
mov esi, dword [esi]
invalid
mov edx, dword [esi]
mov dword [eax], edx
mov edi, dword [ebx + 8]
mov eax, dword [esi - 0x77]
add edi, eax
mov esi, dword [ebx - 0x763074fc]
jnp 0x405085
cmp ecx, eax
jbe 0x4050d7
inc dword [ebx - 0x1c]
mov eax, dword [ebx + 0xc]
test dword [0xe8f00674], edi
inc ebx
or al, 0x85
cmp eax, 0xe8f00674
scasd eax, dword es:[edi]
push edx
pop dword [eax]
lea edx, [edi]
sbb bh, al
push es
call 0x89405153
dec esi
adc byte [ebx], dh
adc byte [ebx + 0x36e8104d], cl
mov dword [ebp + 0x40478d04], esp
mov dword [ecx], edx
pop ds
mov dword [esi + 0x10], eax
mov dword [edi - 0x4ea274e8], eax
inc edi
ja 0x4050ea
mov dword [edi + 0x2c], esi
xor esi, esi
mov dword [edi + 0x20], ecx
stc
fimul word [ecx + 0x41890477]
adc byte [ecx - 0x7810eb89], cl
cmp byte [ecx + 0x7789d177], cl
sbb al, 0xea
ja 0x4050fd
mov dword [edi + 0x28], esi
mov dword [edi], ebx
je 0x405142
mov byte [ebx + 0x18], dl
push edx
call 0x3f9710
cmp ecx, dword [ecx + 0x74104589]
or dword [eax - 0x18], edx
pop ecx
add eax, 0x458b0000
adc dh, dh
dec ebx
imul eax, dword [0x57a0c2c6], 8
cmp ebp, dword [eax]
mov dword [edx], ecx
je 0x40510b
mov dword [ecx + 0x9741045], ecx
push eax
call 0x40564f
mov eax, dword [ebp + 0x10]
test byte [ebx + 0x6b], 5
mov dl, 0xa0
push edi
or byte [ebx], bh
sub byte [ecx - 0x76fc8bf6], cl
push ecx
or al, 0x89
cmp edi, dword [ebx]
invalid
mov dword [ecx + 0xc], edx
mov dword [ebx], edi
cmp eax, esi
mov dword [edi + 0xc], ebx
add edx, dword ds:[eax - 0x18]
add byte es:[eax], al
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
xor ebx, dword [edx + 0x10c25d5b]
add cl, dh
imul edx, dword [eax], 0xffffff85
sal byte [edi + eax + 0x6a], 0xc
call eax
aam 0xc4
or al, 0xd3
pop esi
mov eax, 0xc
pop ebx
pop ebp
ret 0x10
mov dword [edi + 0x69], esi
mov dword [edi + 0xc], esi
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
xor eax, eax
pop ebx
pop esp
ret 0x9810
Function at 0x405340
Capabilities:
Check for vm using instruction vpcext

Disassembly:
loope 0x4052fd
int1
jmp [edi + 0x49]
xchg esi, eax
or al, 0x8b
jp 0x405308
cmp ecx, edi
jae 0x40532f
mov edx, dword [edx]
cmp ecx, dword [edx + 0xc]
jb 0x405320
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [eax]
jmp 0xe1ca17a2
loope 0x405326
mov ebx, ebp
xor cl, byte [ecx + 0x1895f48]
dec eax
pop edi
mov dword [ecx], eax
mov dword [eax], edx
mov dword [edx + 4], eax
mov eax, dword [ebp + 0x10]
pop edi
stosd dword es:[edi], eax
pop ebx
sbb ah, ch
pop ebp
ret 0xc
nop
nop
push ebp
lodsd eax, dword [esi]
xchg byte [ebx + 0x558b1001], al
or byte [ebx + 0x56], dl
push edi
mov ebx, dword [edx + 8]
mov eax, dword [edx]
push edi
jp 0x405360
sub eax, dword [ebx + 0x10]
mov dword [ecx - 0xc], esi
lea ecx, [eax + eax]
nop
stc
and byte [ebx - 0x24], dh
jae 0x40533e
mov ecx, 0xdc
cmp byte [edx + 0x10], 0
mov eax, dword [ebx]
lodsd eax, dword [esi]
jnp 0x4052fb
jo 0x405386
sub esp, dword [0x77ce3b10]
jno 0x405305
mov esi, 0x89308b04
xor dword [ebx - 0x4d8f1bf8], ecx
mov dword [ecx + 4], esi
jno 0x40538c
mov ecx, dword [ebx + 4]
mov dword [eax + 0x65], ecx
inc byte [ecx]
dec eax
inc byte gs:[ecx]
mov dword [eax], ebx
mov dword [ebx + 4], eax
mov dword [eax + 0xc], 0x3ff80000
mov dword [edi + 0x2c], eax
mov esi, dword [esp + edx]
inc edi
sub al, 0x8b
xor al, 0x14
mov ecx, dword [ebx + 0x52]
mov edx, dword [esi + 0x2b]
rol dword [esi + ecx*8 + 0x100005], 0
and eax, 0xfffff000
dec eax
sar eax, 0xc
mov dword [ebx + 0x46], eax
xchg byte [ecx + 0xc], al
jae 0x4053db
mov ecx, dword [ecx]
cmp eax, dword [ecx + 0xc]
jb 0x4053c1
xchg ecx, eax
add al, 0x89
xor byte [ebx + 0x4738b6c], cl
mov dword [eax + 4], esi
jbe 0x405418
add al, 0xd
inc ebx
add al, 0x89
sbb byte [eax], dh
mov eax, dword [0x8b045989]
mov dword [eax], ebx
xor byte [ecx - 0x74fba677], ah
inc edi
sub al, 0xe9
sbb al, byte [eax]
lahf
add byte [ecx - 0x7e72e789], ch
pop ss
int 0
add byte [0xfffff000], ah
cmp eax, ecx
mov dword [ebp - 4], eax
jb 0x4055c0
cmp eax, 0x2000
jae 0x40539d
mov dword [ebp - 0x77], 0x20c7
or dword [ebx - 0x3e9b7564], ecx
out dx, eax
or al, 0x4f
pop edi
pop esi
or eax, 0xffffffff
pop ebx
xchg ebp, eax
pop ecx
pop ebp
ret

Function at 0x406840
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
mov edi, 0x210ec
add byte [edx - 0x75], cl
pop ebp
or byte [esi + 0x4ce8b57], al
cmp eax, 0xffffffff
pcmpgtw mm2, qword [ebp + edx*2 + 0x4b8b0016]
xchg edi, eax
sti
mov byte [edi], cl
test byte [ecx - 0x74ffffff], cl
jne 0x4068d8
mov ecx, dword [esi + 0x14]
dec esi
push esi
sub byte [ecx + 0x52], dl
call dword es:[sym.imp.WSOCK32.dll_connect]
cmp eax, 0xffffffff
mov edi, 0x8a013785
add byte [ebx + 0x40c1f968], cl
int1
call esi
test eax, eax
je 0x40698a
call esi
add eax, 0x471bfc80
cmp eax, 0xad0b2319
xchg ebx, eax
test dword [ecx + 1], edx
add byte [edi - 0x74df3b75], bh
sub byte [eax + ecx*8], ah
invalid
dec dword [ecx - 0x7c010b73]
invalid
mov dl, 0x5e
xor edx, esi
pop ebx
mov esp, ebp
inc edx
or byte [eax], al
push dword [ecx]
pop edi
pop esi
sbb eax, dword [eax + 0x5b9f0afc]
mov esp, ebp
pop ebp
ret 0xbd08
Function at 0x4088d5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004063ea
and dword [ebp - 4], 0
cmp dword [0x4a5300], 0
mov ebx, eax
jne 0x408986
push 0x401b58
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408a37
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401b4c
push edi
call esi
test eax, eax
je 0x408a37
push eax
call fcn.00406378
mov dword [esp], 0x401b3c
push edi
mov dword [0x4a5300], eax
call esi
push eax
call fcn.00406378
mov dword [esp], 0x401b28
push edi
mov dword [0x4a5304], eax
call esi
push eax
call fcn.00406378
mov dword [esp], 0x401b0c
push edi
mov dword [0x4a5308], eax
call esi
push eax
call fcn.00406378
pop ecx
mov dword [0x4a5310], eax
test eax, eax
je 0x408986
push 0x401af4
push edi
call esi
push eax
call fcn.00406378
pop ecx
mov dword [0x4a530c], eax
mov eax, dword [0x4a530c]
cmp eax, ebx
je 0x4089de
cmp dword [0x4a5310], ebx
je 0x4089de
push eax
call fcn.004063f3
push dword [0x4a5310]
mov esi, eax
call fcn.004063f3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4089de
test edi, edi
je 0x4089de
call esi
test eax, eax
je 0x4089d5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4089d5
test byte [ebp - 0xc], 1
jne 0x4089de
or dword [ebp + 0x10], 0x200000
jmp 0x408a17
mov eax, dword [0x4a5304]
cmp eax, ebx
je 0x408a17
push eax
call fcn.004063f3
pop ecx
test eax, eax
je 0x408a17
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408a17
mov eax, dword [0x4a5308]
cmp eax, ebx
je 0x408a17
push eax
call fcn.004063f3
pop ecx
test eax, eax
je 0x408a17
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4a5300]
call fcn.004063f3
pop ecx
test eax, eax
je 0x408a37
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408a39
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x450012
Capabilities:
Encode data using xor

Disassembly:
push dword fs:[0]
mov dword fs:[0], esp
xor ebx, ebx
push ebx
push ebx
push 0x80000000
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [0x44ff28]
sub edi, edi
sub ecx, ecx
mov cl, 0xe5
inc edi
loop 0x45003a
call 0x450042
pop esi
sub esi, 0xffffffc2
push esi
sub ebx, ebx
or ebx, 0x2394
mov al, byte [esi]
xor ax, di
xchg byte [esi], al
inc esi
sub ebx, 1
cmp ebx, 0
ja 0x450052
pop esi
mov esp, dword fs:[0]
pop dword fs:[0]
pop edi
pop ebp
jmp esi