joyce8/EMBER2024-capa huggingface dataset:
Function at 0x611b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.004ce320
mov eax, dword [0x74b1ac]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
push edi
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x50]
movzx edx, byte [ecx + 3]
mov dword [esp + 0x18], eax
movzx ebx, byte [ecx]
mov esi, dword [eax]
movzx eax, byte [ecx + 1]
shl eax, 8
or ebx, eax
mov dword [esp + 0x1c], ecx
movzx eax, byte [ecx + 2]
shl eax, 0x10
or ebx, eax
mov ebp, dword [esp + 0x44]
movzx eax, byte [ecx + 5]
shl eax, 8
movzx edi, byte [ecx + 4]
movzx ecx, byte [ecx + 7]
or edi, eax
mov eax, dword [esp + 0x1c]
shl ecx, 8
shl edx, 0x18
or ebx, edx
mov dword [esp + 0x14], 0
movzx eax, byte [eax + 6]
or ecx, eax
mov dword [esp + 0x20], ebx
shl ecx, 0x10
mov eax, ebx
shr eax, 8
or edi, ecx
mov dword [esp + 0x2c], edi
mov ecx, edi
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x2e], al
mov eax, ecx
shr eax, 8
mov byte [esp + 0x31], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x32], al
mov eax, ecx
shr eax, 0x18
mov dword [esp + 0x24], ecx
mov byte [esp + 0x2c], bl
mov byte [esp + 0x30], cl
mov byte [esp + 0x33], al
bswap edx
mov byte [esp + 0x2f], dl
test ebp, ebp
je 0x611cf4
mov edi, dword [esp + 0x3c]
sub dword [esp + 0x10], edi
dec ebp
test esi, esi
jne 0x611ca1
push dword [esp + 0x28]
lea eax, [esp + 0x24]
push eax
call fcn.00611820
mov ebx, dword [esp + 0x28]
add esp, 8
mov ecx, dword [esp + 0x24]
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x2e], al
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2f], al
mov eax, ecx
shr eax, 8
mov byte [esp + 0x31], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x32], al
mov eax, ecx
shr eax, 0x18
inc dword [esp + 0x14]
mov byte [esp + 0x2c], bl
mov byte [esp + 0x30], cl
mov byte [esp + 0x33], al
mov al, byte [esp + esi + 0x2c]
inc esi
mov edx, dword [esp + 0x10]
and esi, 7
xor al, byte [edi]
mov byte [edx + edi], al
inc edi
mov edx, dword [esp + 0x14]
test ebp, ebp
jne 0x611c41
test edx, edx
je 0x611cf4
mov edx, dword [esp + 0x1c]
mov eax, ebx
shr eax, 8
mov byte [edx + 1], al
mov eax, ebx
shr eax, 0x10
mov byte [edx + 2], al
mov eax, ecx
shr eax, 8
mov byte [edx + 5], al
mov eax, ecx
mov byte [edx], bl
shr ebx, 0x18
shr eax, 0x10
mov byte [edx + 4], cl
shr ecx, 0x18
mov byte [edx + 3], bl
mov byte [edx + 6], al
mov byte [edx + 7], cl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x34]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004cd30a
add esp, 0x28
ret
Function at 0x612d90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x2c
call fcn.004ce320
mov eax, dword [0x74b1ac]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x44]
push ebx
push ebp
mov dword [esp + 0x10], eax
push esi
mov esi, dword [eax]
push edi
mov edi, dword [esp + 0x50]
mov dword [esp + 0x1c], edi
mov ebp, dword [esp + 0x48]
mov dword [esp + 0x14], 0
movzx ebx, byte [edi]
movzx ecx, byte [edi + 1]
movzx eax, byte [edi + 2]
movzx edx, byte [edi + 4]
shl eax, 8
shl ecx, 0x10
shl ebx, 0x18
or ecx, ebx
shl edx, 0x18
or ecx, eax
movzx eax, byte [edi + 3]
movzx edi, byte [edi + 5]
or ecx, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x30], ecx
shl edi, 0x10
or edi, edx
movzx ecx, byte [eax + 6]
movzx eax, byte [eax + 7]
shl ecx, 8
or ecx, eax
or edi, ecx
mov ecx, dword [esp + 0x30]
mov eax, ecx
mov dword [esp + 0x28], edi
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, ecx
shr eax, 8
bswap edx
mov byte [esp + 0x32], al
mov byte [esp + 0x34], dl
mov edx, edi
mov eax, edx
mov dword [esp + 0x20], ecx
shr eax, 0x10
mov byte [esp + 0x35], al
mov eax, edx
shr eax, 8
mov dword [esp + 0x24], edi
mov byte [esp + 0x33], cl
mov byte [esp + 0x36], al
mov byte [esp + 0x37], dl
bswap ebx
mov byte [esp + 0x30], bl
test ebp, ebp
je 0x612f2c
mov edi, dword [esp + 0x40]
sub dword [esp + 0x10], edi
dec ebp
test esi, esi
jne 0x612ed5
push dword [esp + 0x2c]
lea eax, [esp + 0x24]
push eax
call fcn.006127c0
mov ecx, dword [esp + 0x28]
add esp, 8
mov edx, dword [esp + 0x24]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, ecx
shr eax, 8
mov byte [esp + 0x32], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x34], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x35], al
mov eax, edx
shr eax, 8
inc dword [esp + 0x14]
mov byte [esp + 0x33], cl
mov byte [esp + 0x36], al
mov byte [esp + 0x37], dl
mov al, byte [esp + esi + 0x30]
inc esi
mov ebx, dword [esp + 0x10]
and esi, 7
xor al, byte [edi]
mov byte [ebx + edi], al
inc edi
mov ebx, dword [esp + 0x14]
test ebp, ebp
jne 0x612e75
test ebx, ebx
je 0x612f2c
mov ebx, dword [esp + 0x1c]
mov eax, ecx
shr eax, 0x18
mov byte [ebx], al
mov eax, ecx
shr eax, 0x10
mov byte [ebx + 1], al
mov eax, ecx
shr eax, 8
mov byte [ebx + 2], al
mov eax, edx
shr eax, 0x18
mov byte [ebx + 4], al
mov eax, edx
shr eax, 0x10
mov byte [ebx + 5], al
mov eax, edx
shr eax, 8
mov byte [ebx + 3], cl
mov byte [ebx + 6], al
mov byte [ebx + 7], dl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x38]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004cd30a
add esp, 0x2c
ret
Function at 0x615190
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x2c
call fcn.004ce320
mov eax, dword [0x74b1ac]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x44]
push ebx
push ebp
mov dword [esp + 0x10], eax
push esi
mov esi, dword [eax]
push edi
mov edi, dword [esp + 0x50]
mov dword [esp + 0x1c], edi
mov ebp, dword [esp + 0x48]
mov dword [esp + 0x14], 0
movzx ebx, byte [edi]
movzx ecx, byte [edi + 1]
movzx eax, byte [edi + 2]
movzx edx, byte [edi + 4]
shl eax, 8
shl ecx, 0x10
shl ebx, 0x18
or ecx, ebx
shl edx, 0x18
or ecx, eax
movzx eax, byte [edi + 3]
movzx edi, byte [edi + 5]
or ecx, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x30], ecx
shl edi, 0x10
or edi, edx
movzx ecx, byte [eax + 6]
movzx eax, byte [eax + 7]
shl ecx, 8
or ecx, eax
or edi, ecx
mov ecx, dword [esp + 0x30]
mov eax, ecx
mov dword [esp + 0x28], edi
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, ecx
shr eax, 8
bswap edx
mov byte [esp + 0x32], al
mov byte [esp + 0x34], dl
mov edx, edi
mov eax, edx
mov dword [esp + 0x20], ecx
shr eax, 0x10
mov byte [esp + 0x35], al
mov eax, edx
shr eax, 8
mov dword [esp + 0x24], edi
mov byte [esp + 0x33], cl
mov byte [esp + 0x36], al
mov byte [esp + 0x37], dl
bswap ebx
mov byte [esp + 0x30], bl
test ebp, ebp
je 0x61532c
mov edi, dword [esp + 0x40]
sub dword [esp + 0x10], edi
dec ebp
test esi, esi
jne 0x6152d5
push dword [esp + 0x2c]
lea eax, [esp + 0x24]
push eax
call fcn.00614b80
mov ecx, dword [esp + 0x28]
add esp, 8
mov edx, dword [esp + 0x24]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, ecx
shr eax, 8
mov byte [esp + 0x32], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x34], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x35], al
mov eax, edx
shr eax, 8
inc dword [esp + 0x14]
mov byte [esp + 0x33], cl
mov byte [esp + 0x36], al
mov byte [esp + 0x37], dl
mov al, byte [esp + esi + 0x30]
inc esi
mov ebx, dword [esp + 0x10]
and esi, 7
xor al, byte [edi]
mov byte [ebx + edi], al
inc edi
mov ebx, dword [esp + 0x14]
test ebp, ebp
jne 0x615275
test ebx, ebx
je 0x61532c
mov ebx, dword [esp + 0x1c]
mov eax, ecx
shr eax, 0x18
mov byte [ebx], al
mov eax, ecx
shr eax, 0x10
mov byte [ebx + 1], al
mov eax, ecx
shr eax, 8
mov byte [ebx + 2], al
mov eax, edx
shr eax, 0x18
mov byte [ebx + 4], al
mov eax, edx
shr eax, 0x10
mov byte [ebx + 5], al
mov eax, edx
shr eax, 8
mov byte [ebx + 3], cl
mov byte [ebx + 6], al
mov byte [ebx + 7], dl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x38]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004cd30a
add esp, 0x2c
ret
Function at 0x619540
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x619554
mov dword [esp + 0x18], fcn.00617d10
jmp fcn.006092a0
mov dword [esp + 0x18], fcn.00616fb0
jmp fcn.00608fa0
Function at 0x657d60
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x98
call fcn.004ce320
mov eax, dword [0x74b1ac]
xor eax, esp
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xa0]
push ebx
push edi
mov edi, dword [esp + 0xac]
xor ebx, ebx
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
sub ecx, edi
mov dword [esp + 0x10], ecx
cmp edx, edi
jb 0x657f20
cmp edi, 0x40
ja 0x657f20
lea eax, [esp + 0x1c]
neg eax
lea ecx, [esp + 0x1c]
and eax, 0x3f
add ecx, eax
lea eax, [edi + 0x100]
mov dword [esp + 0xc], ecx
cmp edx, eax
jbe 0x657dd9
mov ebx, edx
sub ebx, edi
sub ebx, 0x100
push ebp
push esi
push edi
xor esi, esi
mov dword [esp + 0x20], 0
push esi
push ecx
call fcn.004e5e40
mov eax, dword [esp + 0xbc]
add esp, 0xc
xor ebp, ebp
cmp ebx, dword [eax + 0xc]
jae 0x657e9c
mov ecx, ebx
sub ecx, dword [eax + 8]
mov dword [esp + 0x10], ecx
nop dword [eax + eax]
mov edi, dword [esp + 0xb0]
mov eax, ebx
xor eax, dword [esp + 0x18]
lea edx, [eax - 1]
not eax
shr eax, 0x1f
shr edx, 0x1f
and edx, eax
mov eax, dword [esp + 0xb0]
neg edx
xor ecx, dword [eax + 8]
mov eax, ebx
xor eax, dword [edi + 8]
or ecx, eax
mov eax, edx
or eax, dword [esp + 0x1c]
xor ecx, ebx
shr ecx, 0x1f
and edx, ebp
neg ecx
or esi, edx
mov edx, dword [esp + 0x14]
and ecx, eax
mov eax, dword [edi + 0x14]
mov edi, dword [esp + 0xb4]
mov dword [esp + 0x1c], ecx
mov al, byte [eax + ebx]
inc ebx
and al, cl
or byte [edx + ebp], al
inc ebp
mov ecx, ebp
mov eax, ebp
sub ecx, edi
xor eax, edi
xor ecx, edi
or ecx, eax
mov eax, dword [esp + 0xb0]
xor ecx, ebp
shr ecx, 0x1f
neg ecx
and ebp, ecx
mov ecx, dword [esp + 0x10]
inc ecx
mov dword [esp + 0x10], ecx
cmp ebx, dword [eax + 0xc]
jb 0x657e10
jmp 0x657ea0
mov edx, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
je 0x657f02
mov eax, esi
and eax, 0xffffffdf
mov bl, byte [eax + edx]
mov eax, esi
or eax, 0x20
mov dl, byte [eax + edx]
mov eax, esi
and eax, 0x20
inc esi
dec eax
shr eax, 0x1f
neg al
movzx eax, al
mov dword [esp + 0x10], eax
not eax
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
and cl, dl
mov edx, dword [esp + 0x14]
and al, bl
or al, cl
mov ecx, dword [esp + 0x20]
mov byte [ecx + ebp], al
mov ecx, esi
sub ecx, edi
mov eax, esi
xor ecx, edi
xor eax, edi
or ecx, eax
inc ebp
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp ebp, edi
jb 0x657ea6
pop esi
pop ebp
pop edi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.004cd30a
add esp, 0x98
ret
mov ecx, dword [esp + 0x9c]
xor eax, eax
pop edi
pop ebx
xor ecx, esp
call fcn.004cd30a
add esp, 0x98
ret
Function at 0x658e80
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.004ce320
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x20]
push edi
mov eax, dword [ebx + 4]
inc esi
mov edi, dword [esp + 0x1c]
mov eax, dword [eax + 0x64]
mov ecx, dword [edi + 8]
test byte [eax + 0x30], 1
je 0x658f06
mov edx, dword [esp + 0x20]
lea eax, [esi + edx]
cmp eax, ecx
ja 0x658f0a
add dword [edi + 0x14], edx
sub ecx, edx
add dword [edi + 0x18], edx
sub dword [edi + 0xc], edx
mov dword [edi + 8], ecx
mov eax, dword [edi + 0x14]
push ebp
push dword [ebx + 0x3cc]
mov al, byte [ecx + eax - 1]
movzx ebp, al
mov byte [esp + 0x2c], al
mov dword [esp + 0x20], ebp
call fcn.00510e80
push eax
call fcn.0055cdb0
mov edx, dword [edi + 8]
add esp, 8
test eax, 0x200000
je 0x658f13
sub edx, ebp
mov eax, 1
pop ebp
dec edx
mov dword [edi + 8], edx
pop edi
pop esi
pop ebx
add esp, 8
ret
cmp esi, ecx
jbe 0x658ec2
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
lea ecx, [esi + ebp]
mov ebx, edx
sub ebx, ecx
mov eax, edx
xor ebx, ecx
xor eax, ecx
or ebx, eax
mov eax, 0x100
xor ebx, edx
shr ebx, 0x1f
dec ebx
cmp edx, eax
cmovb eax, edx
xor esi, esi
mov dword [esp + 0x14], eax
test eax, eax
je 0x658f90
mov eax, ebp
mov ebp, dword [edi + 0x14]
mov edi, dword [esp + 0x1c]
dec ebp
shr eax, 0x1f
add ebp, edx
mov dword [esp + 0x10], eax
nop
mov edx, dword [esp + 0x10]
lea ebp, [ebp - 1]
mov ecx, edi
mov eax, esi
sub ecx, esi
shr eax, 0x1f
shr ecx, 0x1f
inc esi
xor cl, al
xor al, dl
or cl, al
movzx eax, byte [esp + 0x28]
xor cl, dl
dec cl
movzx edx, cl
movzx ecx, byte [ebp + 1]
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
cmp esi, dword [esp + 0x14]
jb 0x658f50
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
not ebx
lea eax, [ebp + 1]
movzx ecx, bl
dec ecx
shr ecx, 0x1f
neg ecx
and eax, ecx
sub dword [edi + 8], eax
mov dword [esp + 0x28], ecx
not ecx
pop ebp
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
and ecx, 1
pop edi
pop esi
or eax, ecx
pop ebx
add esp, 8
ret
Function at 0x665a40
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00665a50

Function at 0x665cd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00665ce0
Function at 0x2c19acc
Capabilities:
Encode data using xor

Disassembly:
and bl, byte [edi]
push ss
push ebx
shr dword [edi - 0x516330bd], 0x1c
scasd eax, dword es:[edi]
inc ebx
iretd
jmp 0x2c19ad6
pushal
call 0x2c19adc
pop ebp
sub ebp, 0x10
sub ebp, 0x2819acc
jmp 0x2c19af2
mov eax, 0x2819acc
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c8
mov edx, 0xa199f22c
xor byte [eax], dl
inc eax
dec ecx
jne 0x2c19b09
jmp 0x2c19b1c
cmpsd dword [esi], dword es:[edi]
loope 0x2c19ac6
movsd dword es:[edi], dword [esi]
adc byte [esp + ebp], ch
sub al, 0xad
in eax, dx
aam 0x2c
sub al, 0x2c
das
loope 0x2c19ac1
sub ch, byte [esp + ebp]
sub al, 0x96
add al, 0x2c
sub al, 0x2c
fcmovne st(0), st(6)
das
in al, 0xa7
lodsd eax, dword [esi]
and byte [esp + ebp], ch
sub al, 0x2f
jmp 0xd2c9e3e7

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
nop
mov ecx, 0x4d1d4118
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x431024
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x5ff6730
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x40438c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
nop
lea eax, [ebp - 0x44]
push eax
call sub.kernel32.dll_GetStartupInfoA
mov eax, dword [ebp - 0x18]
and eax, 1
cmp eax, 0
je 0x4043ba
movzx eax, word [ebp - 0x14]
mov dword [ebp - 0x50], eax
jmp 0x4043c2
mov eax, 0xa
mov dword [ebp - 0x50], eax
mov eax, 0
mov dword [ebp - 0x48], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 8]
cmp eax, 0
je 0x4043f1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x4c]
push eax
call sub.msvcrt.dll_strstr
add esp, 8
mov dword [ebp - 0x48], eax
mov eax, 0
mov ecx, dword [ebp - 0x48]
cmp eax, ecx
jne 0x404417
mov eax, 0x4074e0
push eax
call sub.msvcrt.dll__strdup
add esp, 4
mov dword [ebp - 0x48], eax
jmp 0x404440
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
cmp eax, ecx
jbe 0x404440
mov eax, dword [ebp - 0x48]
add eax, 0xffffffff
movsx ecx, byte [eax]
cmp ecx, 0x22
jne 0x404440
mov eax, dword [ebp - 0x48]
add eax, 0xffffffff
mov dword [ebp - 0x48], eax
mov eax, 0x30000
push eax
mov eax, 0x10000
push eax
call sub.msvcrt.dll__controlfp
add esp, 8
mov eax, 0
push eax
call sub.kernel32.dll_GetModuleHandleA
mov ecx, dword [ebp - 0x50]
push ecx
mov ecx, dword [ebp - 0x48]
push ecx
mov ecx, 0
push ecx
push eax
call fcn.00404042
leave
ret
Function at 0x405590
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4055ae
or eax, eax
pop esi
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
mov dword [esp + 0xc], eax
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_htons]
lea edx, [esp + 4]
push 0x10
push edx
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4055ef
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x574b41
Capabilities:
Encode data using xor

Disassembly:
cmp ecx, 0x60
dec esi
std
pop esp
xchg ebp, eax
pop esp
jae 0x574b11
jnp 0x574b30
clc
rcl byte [ecx + 0x4c20bf66], 3
in eax, 0xeb
cdq
lodsd eax, dword [esi]
inc esp
int1
test eax, 0xcdadc113
pop dword [edx - 0x26]
invalid
outsd dx, dword [esi]
xor byte [eax + esi*2], 0xa6
xchg ebx, eax
retf 0xa2a2
push edx
jnp 0x574af0
cmc
scasd eax, dword es:[edi]
invalid
mov ebx, 0x882d091b
je 0x574aec
mov ebx, 0x65446cc2
inc edx
mov bl, 0xdb
cmc
fldenv [ebx]
aaa
pushal
jle 0x574baf
test al, 0xde
mov bl, 0xa7
mov bl, 0xa7
cmp ebx, dword [edx + 0x44]
xor byte [esi - 0x4eb44ea4], dh
jnp 0x574bb4
mov ebp, esp
xchg ebx, eax
pushfd
sub dword [eax + 0x552c583d], 0x933e33d
cmc
lcall 0xa9f9, 0x458378d2
push ebx
fild qword [esi + 0x73f43256]
and dword [0xd1c2f5a], edi
jb 0x574b5a
aas
add esi, edx
push edi
xchg dword [ecx], eax
std
out dx, al
loopne 0x574bd2
movsd dword es:[edi], dword [esi]
inc ebx
test eax, 0xe95fbfa0
inc ebx
dec edi
and bl, byte [edi + 0x90da724]
cmp eax, 0x13734b4c
ljmp 0x59ec
or esp, ebp
pop ecx
sar cl, cl
or byte [ebp - 0x5d], 0xf1
wait
add dword [edi], esi
xor byte [ebx - 0x2f], ah
mov ecx, 0xbba9ab09
and ah, byte [edx - 0x7d]
test eax, 0x836222bb
aaa
int3
mov ebp, 0xd38837a9
fild dword [eax - 0x5fd0d526]
lock xchg byte [edi - 2], ch
jmp 0x574bc1
Function at 0x10029d66
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10029724

Function at 0x1003b198
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003b06c
Function at 0x401000
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push 0x28
push 0
lea eax, [ebp - 0x48]
push eax
call fcn.00402180
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x24], 0x413270
mov dword [ebp - 0x44], 0x401190
mov dword [ebp - 0x48], 3
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [ebp - 0x34], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
push 0
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x2c], eax
lea edx, [ebp - 0x48]
push edx
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
push 0x15e
push 0x258
push 0x64
push 0x64
push 0xca0000
push str.System_Direcory
push str.MainWindow
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
push 0x1e
push 0x50
push 0xb4
push 0x1e
push 0x50000001
push str.START
push str.Button
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x41a918], eax
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401122
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x4010f8
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401e3d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401e7c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401e7c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401e7c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401e7c
cmp dword [ecx + 0x74], 0xe
jbe 0x401e7c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret