joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48bc2f
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x4c9df6
call fcn.004b48a4
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
push 8
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.0040201b
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.00401f65
lea edi, [esi + 0xc]
push 8
mov ecx, edi
mov dword [ebp - 4], 1
mov dword [ebp - 0x14], edi
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
call fcn.0040201b
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.00401f65
lea edi, [esi + 0x18]
push 8
mov ecx, edi
mov byte [ebp - 4], 3
mov dword [ebp - 0x14], edi
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
call fcn.0040201b
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.00401f65
lea edi, [esi + 0x24]
push 8
mov ecx, edi
mov byte [ebp - 4], 5
mov dword [ebp - 0x14], edi
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
call fcn.0040201b
mov ecx, edi
mov byte [ebp - 4], 6
call fcn.00401f65
lea edi, [esi + 0x30]
push 8
mov ecx, edi
mov byte [ebp - 4], 7
mov dword [ebp - 0x14], edi
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
call fcn.0040201b
mov ecx, edi
mov byte [ebp - 4], 8
call fcn.00401f65
lea edi, [esi + 0x3c]
push 8
mov ecx, edi
mov byte [ebp - 4], 9
mov dword [ebp - 0x14], edi
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
call fcn.0040201b
mov ecx, edi
mov byte [ebp - 4], 0xa
call fcn.00401f65
lea edi, [esi + 0x48]
push 8
mov ecx, edi
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x14], edi
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
call fcn.0040201b
mov ecx, edi
mov byte [ebp - 4], 0xc
call fcn.00401f65
lea edi, [esi + 0x54]
push 8
mov ecx, edi
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x14], edi
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
call fcn.0040201b
mov ecx, edi
mov byte [ebp - 4], 0xe
call fcn.00401f65
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x60], ebx
mov byte [esi + 0x64], bl
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x48bd9e
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x4c9e4a
call fcn.004b48a4
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x54]
mov dword [ebp - 4], 6
call fcn.0040204f
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 5
call fcn.0040204f
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 4
call fcn.0040204f
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.0040204f
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.0040204f
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.0040204f
and byte [ebp - 4], 0
lea ecx, [esi + 0xc]
call fcn.0040204f
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0040204f
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x49ae78
Capabilities:
Get process heap force flags

Disassembly:
mov eax, 0x4cb2c6
call fcn.004b48a4
sub esp, 0x1c
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x28]
call fcn.0047e10c
and dword [ebp - 4], 0
push 0x34
call fcn.004b4894
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
test esi, esi
mov byte [ebp - 4], 1
je 0x49aebc
lea ecx, [esi + 8]
call fcn.0048b217
lea ecx, [esi + 0x18]
call fcn.004029db
jmp 0x49aebe
xor esi, esi
mov eax, dword [ebp + 0x14]
push dword [ebp + 8]
and byte [ebp - 4], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 0x18]
mov dword [esi + 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [esi], edi
mov dword [esi + 0x30], eax
call fcn.00402d70
push esi
push 0x49af07
lea ecx, [ebp - 0x28]
call fcn.0047e24c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0047e187
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 0x10

Function at 0x49e5ba
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4cb8e8
call fcn.004b48a4
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
push 8
mov dword [ebp - 0x10], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
call fcn.0040201b
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.00401f65
mov dword [ebp - 4], 1
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
lea ebx, [esi + 0x18]
push 8
mov ecx, ebx
mov byte [ebp - 4], 2
mov dword [ebp - 0x14], ebx
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
call fcn.0040201b
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.00401f65
lea ebx, [esi + 0x24]
push 8
mov ecx, ebx
mov byte [ebp - 4], 4
mov dword [ebp - 0x14], ebx
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
call fcn.0040201b
mov ecx, ebx
mov byte [ebp - 4], 5
call fcn.00401f65
lea ebx, [esi + 0x30]
push 8
mov ecx, ebx
mov byte [ebp - 4], 6
mov dword [ebp - 0x14], ebx
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
call fcn.0040201b
mov ecx, ebx
mov byte [ebp - 4], 7
call fcn.00401f65
lea ebx, [esi + 0x3c]
push 8
mov ecx, ebx
mov byte [ebp - 4], 8
mov dword [ebp - 0x14], ebx
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
call fcn.0040201b
mov ecx, ebx
mov byte [ebp - 4], 9
call fcn.00401f65
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x49e6a2
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x4cb928
call fcn.004b48a4
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x3c]
mov dword [ebp - 4], 4
call fcn.0040204f
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.0040204f
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.0040204f
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.0040204f
and byte [ebp - 4], 0
lea ecx, [esi + 0xc]
call fcn.004a24a1
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0040204f
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4a6438
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor eax, eax
xor esi, esi
mov ecx, dword [edx + 8]
sub ecx, dword [edx + 4]
je 0x4a645b
mov edx, dword [edx + 4]
push edi
movsx edi, byte [edx + esi]
add eax, eax
xor eax, edi
inc esi
cmp esi, ecx
jb 0x4a644d
pop edi
pop esi
ret 4
Function at 0x29832d6e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x29832d7d
pop dword [ebp - 0x48]
mov eax, 0x29832d7d
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x1237e6a8
sub dword [ebp - 0x58], 0xc3e5a15d
mov dword [ebp - 0x54], 0x5c4e8c4c
sub dword [ebp - 0x54], 0x2a1b4007
mov dword [ebp - 0x50], 0xd8e813b0
sub dword [ebp - 0x50], 0x8c9bcf82
mov dword [ebp - 0x4c], 0x357be762
sub dword [ebp - 0x4c], 0x357be762
lea eax, [ebp - 0x58]
push eax
mov eax, 0xe831d4af
sub eax, 0xbeac53ef
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x222b997a
add dword [ebp - 0x58], 0x5246cfdc
mov dword [ebp - 0x54], 0xce78601d
add dword [ebp - 0x54], 0x72f40158
mov dword [ebp - 0x50], 0x95cfacb5
add dword [ebp - 0x50], 0xcd9fbfb7
mov dword [ebp - 0x4c], 0x7c65dff
sub dword [ebp - 0x4c], 0x7c65dff
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x73f02909
add eax, 0xb59557af
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x4a1a2
push 0
call eax
mov ecx, 0x50bb
mov edx, eax
mov ebx, 0x817bbf78
sub ebx, 0x57f24b78
add ebx, dword [ebp - 0x48]
mov esi, 0xf928b15c
sub esi, 0xcc185c0
mov dword [ebp - 0x24], 0xe967f47
mov edi, dword [ebx]
add dword [ebp - 0x1c], eax
sub edi, esi
xor dword [ebp - 0xc], esi
mov dword [edx], edi
mov dword [ebp - 0x38], 0xf74260d9
add edx, 0x96f537b8
sub edx, 0x96f537b4
add ebx, 0x47012187
add ebx, 0xb8fede7d
loop 0x29832e94
add eax, 0x96b15a8b
sub eax, 0x96b024cc
xor ebx, ebx
add ebx, eax
add eax, 0xb979a737
sub eax, 0xb979a732
mov ecx, 0x29800000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0xadf8c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6dd000]
push edi
jmp 0xadf8da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xadf8e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xadf8d0
mov eax, 1
add ebx, ebx
jne 0xadf8f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xadf904
jne 0xadf923
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xadf923
dec eax
add ebx, ebx
jne 0xadf910
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xadf8e8
add ebx, ebx
jne 0xadf91f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xadf975
xor ecx, ecx
sub eax, 3
jb 0xadf93b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xadf9aa
sar eax, 1
mov ebp, eax
jmp 0xadf946
add ebx, ebx
jne 0xadf946
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xadf914
inc ecx
add ebx, ebx
jne 0xadf954
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xadf914
add ebx, ebx
jne 0xadf961
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xadf956
jne 0xadf972
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xadf956
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xadf994
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xadf986
jmp 0xadf8d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xadf994
add edi, ecx
jmp 0xadf8d6
pop esi
mov edi, esi
mov ecx, 0x58
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xadf9b2
cmp byte [edi], 2
jne 0xadf9b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xadf9b7
lea edi, [esi + 0x6dd000]
mov eax, dword [edi]
or eax, eax
je 0xadfa26
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xbc7c7c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xbc7ce8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xadf9e4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xbc7cf0]
or eax, eax
je 0xadfa20
mov dword [ebx], eax
add ebx, 4
jmp 0xadfa01
call dword [esi + 0xbc7cec]
mov ebp, dword [esi + 0xbc7cf4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xadfa5a
sub esp, 0xffffff80
jmp 0x401253
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e004]
jne 0x40100a
repz ret
jmp fcn.00401647

Function at 0x4071e9
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42e004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404019
and dword [ebp - 0x14], 0
cmp dword [0x432e64], 0
mov dword [ebp - 0x18], eax
jne 0x40729c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x407344
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x407344
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x432e64], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x432e68], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x432e6c], eax
call edi
push eax
call esi
mov dword [0x432e74], eax
test eax, eax
je 0x40729c
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x432e70], eax
mov eax, dword [0x432e70]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4072f5
cmp dword [0x432e74], ecx
je 0x4072f5
push eax
call esi
push dword [0x432e74]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4072f5
test ebx, ebx
je 0x4072f5
call edi
test eax, eax
je 0x4072ec
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4072ec
test byte [ebp - 8], 1
jne 0x4072f5
or dword [ebp + 0x10], 0x200000
jmp 0x407328
mov eax, dword [0x432e68]
cmp eax, dword [ebp - 0x18]
je 0x407328
push eax
call esi
test eax, eax
je 0x407328
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x407328
mov eax, dword [0x432e6c]
cmp eax, dword [ebp - 0x18]
je 0x407328
push eax
call esi
test eax, eax
je 0x407328
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x432e64]
call esi
test eax, eax
je 0x407344
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x407346
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x429450
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x808
mov eax, dword [0x42e004]
xor eax, esp
mov dword [esp + 0x804], eax
cmp dword [0x22d5ea4], 0xfc7
jne 0x42947f
push 0
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x433384]
imul eax, eax, 0x343fd
cmp dword [0x22d5ea4], 0x139e
mov dword [0x433384], eax
jne 0x4294ae
mov ecx, dword [esp]
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_GetAce]
mov eax, dword [0x433384]
add eax, 0x269ec3
push esi
mov dword [0x433384], eax
movzx esi, word [0x433386]
and esi, 0x7fff
cmp dword [0x22d5ea4], 0x8e7
jne 0x4294e3
push 0
lea edx, [esp + 0xc]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, dword [esp + 0x808]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00401000
add esp, 0x808
ret

Function at 0x4295b0
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x42e004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x42f1f0]
push ebx
mov ebx, dword [0x22d5910]
push edi
mov edi, dword [0x22d5ea4]
call fcn.00429500
cmp dword [0x22d5ea4], 0x2f
jne 0x429615
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.00429530
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.00401000
add esp, 0x24
ret
Function at 0x4298e0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1818
call fcn.00409170
mov eax, dword [0x42e004]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x429909
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xbbe2aa2
jge 0x4299af
cmp dword [0x22d5ea4], 0xa5f
jne 0x429953
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 0
lea ecx, [ebp - 0x818]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
lea edx, [ebp - 0x1018]
push edx
push 0x42cc7c
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp dword [ebp - 4], 0x84526b
jne 0x429978
mov eax, dword [0x4320e0]
mov dword [0x22d5ea4], eax
mov ecx, dword [0x22d5ea4]
add ecx, 0xa231
mov dword [0x22d5ea4], ecx
cmp dword [0x22d5ea4], 0x141
jne 0x4299aa
push str.durudaxo_payuyafelamelokeyir_tacadasevow_kipazoci_kanorowawacasolicalotija
lea edx, [ebp - 0x1818]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [0x433388], 0xec58acac
mov dword [0x43338c], 0xffffffff
jmp 0x429900
call fcn.00429630
jmp dword [0x22d5910]
Function at 0x403d10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x64
push ebx
mov ebx, dword [esp + 0x6c]
push ebp
push esi
push edi
xor edi, edi
cmp eax, edi
mov esi, ecx
jne 0x403d43
mov ecx, dword [ebx + 0xc]
cmp ecx, 5
jge 0x403d6e
mov ebp, dword [ebx + 8]
inc ebp
mov eax, ebp
cmp eax, 6
mov dword [ebx + 8], ebp
jne 0x403d5a
inc ecx
mov dword [ebx + 0xc], ecx
jmp 0x403d57
cmp dword [ebx + 0x10], 1
je 0x403d6e
mov edx, dword [ebx + 8]
inc edx
mov eax, edx
cmp eax, 6
mov dword [ebx + 8], edx
jne 0x403d5a
mov dword [ebx + 8], edi
mov eax, dword [ebx + 8]
cdq
mov ecx, 6
idiv ecx
cmp edx, 3
jge 0x403f19
lea edx, [esp + 0x14]
push edx
mov ecx, ebx
mov dword [esp + 0x70], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x74], 0x3f800000
mov dword [esp + 0x60], 0x3f800000
mov dword [esp + 0x4c], 0x3f800000
mov dword [esp + 0x38], 0x3f800000
call fcn.00403040
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x80]
push ecx
push ebx
mov ecx, esi
call fcn.00403aa0
mov ecx, dword [ebx + 0x14]
mov dword [esp + 0x78], ecx
fild dword [esp + 0x78]
fld st(0)
fmul dword [ebx + 0x18]
fadd dword [esp + 0x7c]
fstp dword [esp + 0x64]
fmul dword [ebx + 0x20]
fadd dword [esp + 0x10]
fstp dword [esp + 0x6c]
fld dword [ebx + 0x1c]
fcomp dword [0x478000]
fnstsw ax
test ah, 0x44
jnp 0x403e46
inc ecx
mov dword [ebx + 0x14], ecx
cmp dword [esp + 0x80], edi
jne 0x403f19
xor eax, eax
mov dword [esp + 0x78], edi
mov dword [esp + 0x7c], eax
lea edi, [esi + 0x80]
mov ebp, dword [esp + eax*4 + 0x14]
test ebp, ebp
jle 0x403f08
nop
fild dword [ebx + 0x14]
mov edx, dword [esi]
fmul dword [ebx + 0x1c]
fild dword [esp + 0x78]
fmul dword [0x478010]
faddp st(1)
fstp dword [esp + 0x68]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 0x34]
push edx
push 0x100
push eax
call dword [ecx + 0x94]
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
push 0
push 0x1b
push eax
call dword [ecx + 0xc8]
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax]
push 0
push 0x1d
push eax
call dword [ecx + 0xc8]
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov edx, dword [edi - 4]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xa8]
mov edx, dword [edi]
mov edx, dword [edx]
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
push edx
push 0
push eax
call dword [ecx + 0xf4]
mov eax, dword [edi - 0xc]
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0xc]
mov ecx, dword [esp + 0x78]
inc ecx
dec ebp
mov dword [esp + 0x78], ecx
jne 0x403e70
mov eax, dword [esp + 0x7c]
inc eax
add edi, 0x10
cmp eax, 8
mov dword [esp + 0x7c], eax
jl 0x403e63
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret 0xc
Function at 0x406cc0
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, dword [esi + 0xc]
push 0
push 0x3f
push 1
push 0
call fcn.004742bf
mov eax, dword [esi + 0xd0]
test eax, eax
jne 0x406d1f
push str.kkk888999.com
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x406d02
mov ecx, dword [esi + 4]
mov dword [ecx + 0x15d8], 1
pop esi
ret
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
call sub.WSOCK32.dll_inet_ntoa
mov ecx, dword [esi + 0xc]
push 0x2710
push eax
call fcn.00473e99
pop esi
ret
mov edx, dword [esi + 0xd0]
push edi
mov di, word [esi + 0xd4]
push edx
call sub.WSOCK32.dll_inet_ntoa
movzx ecx, di
push ecx
mov ecx, dword [esi + 0xc]
push eax
call fcn.00473e99
pop edi
pop esi
ret
Function at 0x409100
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xcc
push esi
mov esi, ecx
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x98]
push edx
lea eax, [esp + 0x5c]
push eax
mov ecx, esi
call fcn.004087a0
mov eax, dword [esp + 8]
cmp eax, 1
jne 0x409136
push 0
push 7
jmp 0x40913f
cmp eax, 2
jne 0x40914c
push 0
push 8
mov ecx, dword [esi]
add ecx, 0x104
call fcn.00417350
mov eax, dword [esp + 0xd4]
test eax, eax
jne 0x4092e0
mov ecx, dword [esi]
mov eax, dword [ecx + 0xc]
mov edx, dword [eax]
push edi
push 0
push 0x1b
push eax
call dword [edx + 0xc8]
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
push 1
push 0x1d
push eax
call dword [ecx + 0xc8]
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 0x54]
push edx
push 0x100
push eax
call dword [ecx + 0x94]
mov eax, dword [esi + 0xb4]
xor edi, edi
test eax, eax
jbe 0x4091fd
push ebx
xor ebx, ebx
jmp 0x4091b0
mov edx, dword [esi + 0xb8]
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
add edx, ebx
push edx
push eax
call dword [ecx + 0xa8]
mov edx, dword [esi + 0xbc]
mov edx, dword [edx + edi*4]
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
push edx
push 0
push eax
call dword [ecx + 0xf4]
mov eax, dword [esi + 0xb0]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0xc]
mov eax, dword [esi + 0xb4]
inc edi
add ebx, 0x44
cmp edi, eax
jb 0x4091b0
pop ebx
mov eax, dword [esp + 8]
test eax, eax
pop edi
je 0x4092e0
mov edx, dword [esi]
mov dword [esp + 0x1c], 0x3f666666
mov dword [esp + 0x20], 0x3f666666
mov dword [esp + 0x24], 0x3f666666
mov dword [esp + 0x28], 0x3f800000
mov dword [esp + 0xc], 0x3f666666
mov dword [esp + 0x10], 0x3f666666
mov dword [esp + 0x14], 0x3f666666
mov dword [esp + 0x18], 0x3f800000
mov dword [esp + 0x38], 0x3f800000
mov dword [esp + 0x2c], 0x3e99999a
mov dword [esp + 0x30], 0x3e99999a
mov dword [esp + 0x34], 0x3e99999a
mov dword [esp + 0x48], 0x3f800000
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x4c], 0x41a00000
mov eax, dword [edx + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 0x90]
push edx
push 0x100
push eax
call dword [ecx + 0x94]
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
push eax
call dword [ecx + 0xa8]
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
push 0
push 0
push eax
call dword [ecx + 0xf4]
mov esi, dword [esi + 0xc0]
mov edx, dword [esi]
push 0
push esi
call dword [edx + 0xc]
pop esi
add esp, 0xcc
ret 4