joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100454d0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status
Set socket configuration

Disassembly:
sub esp, 0x218
push esi
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10045505
push str.socket_failed_n
push 0
push 0xa
call fcn.1003c490
add esp, 0xc
or eax, esi
pop esi
add esp, 0x218
ret
lea eax, [esp + 8]
push eax
push 0x8004667e
push esi
mov dword [esp + 0x14], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov edx, dword [esp + 0x220]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
push 0x10
push edx
push esi
dec ecx
mov dword [esp + 0x10], ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1004555f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jl 0x10045555
cmp eax, 0x2734
jle 0x1004555f
push str.error_connecting_to_HTTP_server
jmp 0x10045678
mov eax, dword [0x1013ff18]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x11c]
push edx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1c]
push eax
push 0
lea ecx, [esi + 1]
push ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 1
mov dword [esp + 0x130], esi
mov dword [esp + 0x12c], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x10045673
test eax, eax
je 0x1004566c
lea edx, [esp + 0x14]
push edx
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x100455e8
lea eax, [esp + 0x118]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x100455e8
push str.select_failed_n
jmp 0x10045678
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 8]
push edx
push 0x1007
push 0xffff
push esi
mov dword [esp + 0x1c], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jge 0x1004562b
push str.getsockopt_failed_n
push 0
push 0xa
call fcn.1003c490
add esp, 0xc
or eax, 0xffffffff
pop esi
add esp, 0x218
ret
mov eax, dword [esp + 4]
test eax, eax
je 0x10045662
push str.Error_connecting_to_remote_host
push 0
push 0xa
call fcn.1003c490
add esp, 0xc
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.MSVCR80.dll__errno]
mov ecx, dword [esp + 4]
mov dword [eax], ecx
or eax, 0xffffffff
pop esi
add esp, 0x218
ret
mov eax, esi
pop esi
add esp, 0x218
ret
push str.Connect_attempt_timed_out
jmp 0x10045678
push str.Connect_failed
push 0
push 0xa
call fcn.1003c490
add esp, 0xc
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
add esp, 0x218
ret
Function at 0x100456a0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x14
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
push ebp
mov dword [esp + 0x10], eax
push ecx
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebp, eax
test ebp, ebp
jne 0x100456db
push str.Failed_to_resolve_host
push eax
push 0xa
call fcn.1003c490
add esp, 0xc
or eax, 0xffffffff
pop ebp
add esp, 0x14
ret
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
push ebx
push esi
push edi
je 0x10045776
xor ebx, ebx
lea esp, [esp]
mov edx, 2
cmp word [ebp + 8], dx
jne 0x10045776
mov cx, word [ebp + 0xa]
cmp cx, 4
ja 0x10045765
mov esi, dword [ebx + eax]
movsx ecx, cx
mov eax, ecx
shr ecx, 2
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
mov word [esp + 0x14], dx
mov edx, dword [esp + 0x28]
push edx
mov dword [esp + 0x1c], ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x16], ax
lea eax, [esp + 0x14]
push eax
call fcn.100454d0
add esp, 4
cmp eax, 0xffffffff
jne 0x10045779
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebx + eax + 4]
add ebx, 4
test ecx, ecx
jne 0x100456f0
pop edi
pop esi
pop ebx
or eax, 0xffffffff
pop ebp
add esp, 0x14
ret
push str.address_size_mismatch_n
push 0
push 0xa
call fcn.1003c490
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x14
ret

Function at 0x100458e0
Capabilities:
Initialize winsock library
Query environment variable

Disassembly:
mov eax, dword [0x10146160]
sub esp, 0x190
test eax, eax
jne 0x10045966
lea eax, [esp]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x10045966
mov eax, dword [0x10146164]
test eax, eax
jne 0x1004595c
push esi
mov esi, dword [sym.imp.MSVCR80.dll_getenv]
push str.no_proxy
mov dword [0x1014615c], 0x50
call esi
add esp, 4
test eax, eax
je 0x10045936
cmp byte [eax], 0x2a
jne 0x10045936
mov cl, byte [eax + 1]
test cl, cl
je 0x1004595b
push str.http_proxy
call esi
add esp, 4
test eax, eax
jne 0x10045952
push str.HTTP_PROXY
call esi
add esp, 4
test eax, eax
je 0x1004595b
push eax
call fcn.10044ac0
add esp, 4
pop esi
mov dword [0x10146160], 1
add esp, 0x190
ret
Function at 0x100461c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
test esi, esi
je 0x1004629e
mov ecx, dword [esi + 0x440]
test ecx, ecx
jl 0x1004629e
cmp ecx, 0x400
jg 0x1004629e
mov eax, dword [esi + 0x444]
test eax, eax
jl 0x1004629e
cmp eax, 0x400
jg 0x1004629e
cmp ecx, eax
jg 0x1004629e
test ecx, ecx
jle 0x1004623a
sub eax, ecx
push eax
lea eax, [ecx + esi + 0x3c]
push eax
lea ecx, [esi + 0x3c]
push ecx
call dword [sym.imp.MSVCR80.dll_memmove]
mov edx, dword [esi + 0x440]
mov eax, dword [esi + 0x444]
add esp, 0xc
sub eax, edx
mov dword [esi + 0x444], eax
mov dword [esi + 0x440], 0
mov ecx, dword [esi + 0x444]
mov eax, 0x400
sub eax, ecx
jne 0x1004624c
xor eax, eax
ret
mov edx, dword [esi + 0x2c]
push 0
push eax
mov eax, dword [esi + 0x440]
lea ecx, [eax + esi + 0x3c]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jge 0x1004628a
push str.recv_failed
push 0
push 9
call fcn.1003c490
mov eax, dword [esi + 0x2c]
add esp, 0xc
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
mov dword [esi + 0x2c], eax
ret
mov ecx, dword [esi + 0x444]
add ecx, eax
mov dword [esi + 0x444], ecx
mov byte [ecx + esi + 0x3c], 0
ret
or eax, 0xffffffff
ret

Function at 0x100463f0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0xc8
push esi
mov esi, eax
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x1004641a
push str.USER_anonymous_r_n
lea eax, [esp + 8]
push 0xc8
push eax
call dword [sym.imp.MSVCR80.dll__snprintf]
add esp, 0xc
jmp 0x10046433
push eax
push str.USER__s_r_n
lea ecx, [esp + 0xc]
push 0xc8
push ecx
call dword [sym.imp.MSVCR80.dll__snprintf]
add esp, 0x10
lea eax, [esp + 4]
mov byte [esp + 0xcb], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10046442
sub eax, edx
push 0
push eax
mov eax, dword [esi + 0x2c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
test esi, esi
jge 0x1004647e
push str.send_failed
push 0
push 9
call fcn.1003c490
add esp, 0xc
mov eax, esi
pop esi
add esp, 0xc8
ret
xor eax, eax
pop esi
add esp, 0xc8
ret

Function at 0x10046490
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0xc8
push esi
mov esi, eax
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x100464ba
push str.PASS_anonymous__r_n
lea eax, [esp + 8]
push 0xc8
push eax
call dword [sym.imp.MSVCR80.dll__snprintf]
add esp, 0xc
jmp 0x100464d3
push eax
push str.PASS__s_r_n
lea ecx, [esp + 0xc]
push 0xc8
push ecx
call dword [sym.imp.MSVCR80.dll__snprintf]
add esp, 0x10
lea eax, [esp + 4]
mov byte [esp + 0xcb], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100464e2
sub eax, edx
push 0
push eax
mov eax, dword [esi + 0x2c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
test esi, esi
jge 0x1004651e
push str.send_failed
push 0
push 9
call fcn.1003c490
add esp, 0xc
mov eax, esi
pop esi
add esp, 0xc8
ret
xor eax, eax
pop esi
add esp, 0xc8
ret
Function at 0x10046530
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0xc8
push esi
mov esi, dword [esp + 0xd0]
test esi, esi
je 0x100465a7
push str.QUIT_r_n
lea eax, [esp + 8]
push 0xc8
push eax
call dword [sym.imp.MSVCR80.dll__snprintf]
lea eax, [esp + 0x10]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10046561
push 0
sub eax, edx
mov edx, dword [esi + 0x2c]
push eax
lea ecx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
test esi, esi
jge 0x1004659d
push str.send_failed
push 0
push 9
call fcn.1003c490
add esp, 0xc
mov eax, esi
pop esi
add esp, 0xc8
ret
xor eax, eax
pop esi
add esp, 0xc8
ret
or eax, 0xffffffff
pop esi
add esp, 0xc8
ret
Function at 0x10046e30
Capabilities:
Get socket status

Disassembly:
sub esp, 0x210
push esi
mov esi, dword [esp + 0x218]
test esi, esi
je 0x10046ef5
mov eax, dword [esi + 0x30]
push ebx
push edi
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
push eax
call edi
mov eax, dword [esi + 0x2c]
mov ecx, 1
mov dword [esp + 0x118], ecx
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
lea ecx, [esp + 0x124]
or ebx, 0xffffffff
mov dword [esp + 0x128], eax
mov dword [esp + 0x24], eax
push ecx
inc eax
push eax
mov dword [esi + 0x30], ebx
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x24], 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jge 0x10046ebd
mov edx, dword [esi + 0x2c]
push edx
call edi
pop edi
mov dword [esi + 0x2c], ebx
mov eax, ebx
pop ebx
pop esi
add esp, 0x210
ret
jne 0x10046ed4
mov eax, dword [esi + 0x2c]
push eax
call edi
mov dword [esi + 0x2c], ebx
pop edi
pop ebx
xor eax, eax
pop esi
add esp, 0x210
ret
mov eax, esi
call fcn.100462b0
cmp eax, 2
je 0x10046ec8
mov ecx, dword [esi + 0x2c]
push ecx
call edi
pop edi
mov dword [esi + 0x2c], ebx
mov eax, ebx
pop ebx
pop esi
add esp, 0x210
ret
or eax, 0xffffffff
pop esi
add esp, 0x210
ret
Function at 0x10046f00
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x12c
push esi
mov esi, dword [esp + 0x134]
test esi, esi
je 0x10046f35
mov eax, dword [esp + 0x138]
test eax, eax
jne 0x10046f24
mov eax, dword [esi + 0xc]
test eax, eax
je 0x10046f35
push esi
call fcn.10046ac0
add esp, 4
cmp eax, 0xffffffff
mov dword [esi + 0x30], eax
jne 0x10046f40
or eax, 0xffffffff
pop esi
add esp, 0x12c
ret
push ebp
mov ebp, dword [sym.imp.MSVCR80.dll__snprintf]
push str.TYPE_I_r_n
lea eax, [esp + 0xc]
push 0x12c
push eax
call ebp
lea eax, [esp + 0x14]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10046f62
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_send]
push edi
push 0
sub eax, edx
mov edx, dword [esi + 0x2c]
push eax
lea ecx, [esp + 0x18]
push ecx
push edx
call ebx
mov edi, eax
test edi, edi
jge 0x10046fb6
push str.send_failed
push 0
push 9
call fcn.1003c490
mov eax, dword [esi + 0x30]
add esp, 0xc
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, edi
pop edi
pop ebx
pop ebp
mov dword [esi + 0x30], 0xffffffff
pop esi
add esp, 0x12c
ret
mov eax, esi
call fcn.100462b0
mov edi, eax
cmp edi, 2
je 0x10046fcd
mov ecx, dword [esi + 0x30]
push ecx
jmp 0x1004706f
mov eax, dword [esp + 0x144]
test eax, eax
jne 0x10046fed
mov edx, dword [esi + 0xc]
push edx
push str.RETR__s_r_n
push 0x12c
lea eax, [esp + 0x1c]
push eax
jmp 0x10046ffd
push eax
push str.RETR__s_r_n
push 0x12c
lea ecx, [esp + 0x1c]
push ecx
call ebp
lea eax, [esp + 0x20]
add esp, 0x10
mov byte [esp + 0x13b], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10047011
sub eax, edx
push 0
push eax
mov eax, dword [esi + 0x2c]
lea edx, [esp + 0x18]
push edx
push eax
call ebx
mov edi, eax
test edi, edi
jge 0x1004705d
push str.send_failed
push 0
push 9
call fcn.1003c490
mov ecx, dword [esi + 0x30]
add esp, 0xc
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, edi
pop edi
pop ebx
pop ebp
mov dword [esi + 0x30], 0xffffffff
pop esi
add esp, 0x12c
ret
mov eax, esi
call fcn.100462b0
mov edi, eax
cmp edi, 1
je 0x1004708b
mov edx, dword [esi + 0x30]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, edi
pop edi
pop ebx
pop ebp
mov dword [esi + 0x30], 0xffffffff
neg eax
pop esi
add esp, 0x12c
ret
mov eax, dword [esi + 0x30]
pop edi
pop ebx
pop ebp
pop esi
add esp, 0x12c
ret
Function at 0x10047150
Capabilities:
Initialize winsock library
Query environment variable

Disassembly:
mov eax, dword [0x10146168]
sub esp, 0x190
test eax, eax
jne 0x1004720f
lea eax, [esp]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1004720f
push esi
mov esi, dword [sym.imp.MSVCR80.dll_getenv]
push str.no_proxy
mov dword [0x10146170], 0x15
call esi
add esp, 4
test eax, eax
je 0x100471a5
cmp byte [eax], 0x2a
jne 0x100471a5
mov cl, byte [eax + 1]
test cl, cl
je 0x1004720e
push str.ftp_proxy
call esi
add esp, 4
test eax, eax
jne 0x100471c1
push str.FTP_PROXY
call esi
add esp, 4
test eax, eax
je 0x100471ca
push eax
call fcn.10046000
add esp, 4
push str.ftp_proxy_user
call esi
add esp, 4
test eax, eax
je 0x100471e7
push eax
call dword [0x1013f8b8]
add esp, 4
mov dword [0x10146174], eax
push str.ftp_proxy_password
call esi
add esp, 4
test eax, eax
je 0x10047204
push eax
call dword [0x1013f8b8]
add esp, 4
mov dword [0x10146178], eax
mov dword [0x10146168], 1
pop esi
add esp, 0x190
ret

Function at 0x10054250
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x1005425b
or eax, 0xffffffff
ret
mov eax, dword [esi + 4]
test eax, eax
jne 0x100542ab
call dword [sym.imp.MSVCR80.dll__errno]
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x44]
push eax
push 0x4000
push 1
push ecx
call dword [sym.imp.MSVCR80.dll_fread]
add esp, 0x10
test eax, eax
mov dword [esi + 4], eax
jne 0x100542a6
mov edx, dword [esi + 0x40]
mov dword [esi + 0x3c], 1
mov cl, byte [edx + 0xc]
or eax, 0xffffffff
test cl, 0x20
je 0x100542b8
mov dword [esi + 0x38], eax
ret
mov eax, dword [esi + 0x44]
mov dword [esi], eax
dec dword [esi + 4]
mov eax, dword [esi]
mov cl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, cl
ret
Function at 0x100542c0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, eax
push edi
mov edi, dword [esi + 4]
cmp edi, 2
jae 0x10054332
test edi, edi
je 0x100542d9
mov eax, dword [esi]
mov ecx, dword [esi + 0x44]
mov dl, byte [eax]
mov byte [ecx], dl
call dword [sym.imp.MSVCR80.dll__errno]
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov ecx, edi
push eax
mov eax, dword [esi + 0x44]
mov edx, 0x4000
sar edx, cl
add eax, edi
push edx
push 1
push eax
call dword [sym.imp.MSVCR80.dll_fread]
add esp, 0x10
test eax, eax
jne 0x10054318
mov ecx, dword [esi + 0x40]
test byte [ecx + 0xc], 0x20
je 0x10054318
mov dword [esi + 0x38], 0xffffffff
mov edx, dword [esi + 4]
add edx, eax
mov eax, edx
cmp eax, 2
mov dword [esi + 4], edx
mov edx, dword [esi + 0x44]
mov dword [esi], edx
jae 0x10054332
pop edi
mov dword [esi + 0x58], eax
pop esi
ret
mov eax, dword [esi]
cmp byte [eax], 0x1f
jne 0x1005440c
cmp byte [eax + 1], 0x8b
jne 0x1005440c
mov ecx, dword [esi + 4]
add ecx, 0xfffffffe
add eax, 2
push ebx
mov dword [esi + 4], ecx
mov dword [esi], eax
call fcn.10054250
mov edi, eax
call fcn.10054250
cmp edi, 8
mov ebx, eax
jne 0x10054401
test bl, 0xe0
jne 0x10054401
mov edi, 6
jmp 0x10054380
call fcn.10054250
dec edi
jne 0x10054380
test bl, 4
je 0x100543b1
call fcn.10054250
mov edi, eax
call fcn.10054250
shl eax, 8
add edi, eax
mov edi, edi
mov eax, edi
dec edi
test eax, eax
je 0x100543b1
call fcn.10054250
cmp eax, 0xffffffff
jne 0x100543a0
test bl, 8
je 0x100543c4
call fcn.10054250
test eax, eax
je 0x100543c4
cmp eax, 0xffffffff
jne 0x100543b6
test bl, 0x10
je 0x100543de
lea esp, [esp]
call fcn.10054250
test eax, eax
je 0x100543de
cmp eax, 0xffffffff
jne 0x100543d0
test bl, 2
je 0x100543f0
mov edi, 2
call fcn.10054250
dec edi
jne 0x100543e8
mov ecx, dword [esi + 0x3c]
neg ecx
sbb ecx, ecx
pop ebx
and ecx, 0xfffffffd
pop edi
mov dword [esi + 0x38], ecx
pop esi
ret
pop ebx
pop edi
mov dword [esi + 0x38], 0xfffffffd
pop esi
ret
pop edi
mov dword [esi + 0x58], 1
pop esi
ret
Function at 0x100544d0
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x10054599
cmp byte [esi + 0x5c], 0x77
jne 0x10054599
mov dword [esi + 4], ebx
push edi
lea esp, [esp]
mov eax, dword [esi + 0x10]
mov edi, 0x4000
sub edi, eax
je 0x10054521
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x48]
push eax
push edi
push 1
push ecx
call dword [sym.imp.MSVCR80.dll_fwrite]
add esp, 0x10
cmp eax, edi
jne 0x1005458f
mov edx, dword [esi + 0x48]
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], 0x4000
test ebx, ebx
jne 0x1005457f
mov ecx, dword [esi + 0x68]
mov eax, dword [esi + 0x10]
add ecx, eax
mov dword [esi + 0x68], ecx
mov ecx, dword [esp + 0x10]
push ecx
push esi
call fcn.10054cf0
mov ebx, dword [esi + 0x68]
mov ecx, dword [esi + 0x10]
sub ebx, ecx
add esp, 8
test edi, edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x68], ebx
jne 0x10054558
cmp eax, 0xfffffffb
jne 0x10054558
mov dword [esi + 0x38], edi
test ecx, ecx
jne 0x10054566
cmp dword [esi + 0x38], 1
je 0x10054566
xor ebx, ebx
jmp 0x1005456b
mov ebx, 1
mov eax, dword [esi + 0x38]
test eax, eax
je 0x100544f0
cmp eax, 1
je 0x100544f0
mov esi, dword [esi + 0x38]
mov eax, esi
dec eax
neg eax
sbb eax, eax
pop edi
and eax, esi
pop esi
pop ebx
ret
or eax, 0xffffffff
pop edi
mov dword [esi + 0x38], eax
pop esi
pop ebx
ret
pop esi
mov eax, 0xfffffffe
pop ebx
ret
Function at 0x10055970
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov eax, dword [ebp + 0x2c]
push esi
push edi
mov dword [esp + 0x14], eax
jmp 0x10055985
mov eax, dword [esp + 0x14]
mov edx, dword [ebp + 0x74]
mov ebx, dword [ebp + 0x3c]
mov ecx, dword [ebp + 0x6c]
sub ebx, edx
mov edx, dword [ebp + 0x2c]
lea edx, [eax + edx - 0x106]
sub ebx, ecx
cmp ecx, edx
jb 0x10055a0f
mov edi, dword [ebp + 0x38]
mov ecx, eax
mov edx, ecx
shr ecx, 2
lea esi, [edi + eax]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x70]
mov edx, dword [ebp + 0x6c]
mov ecx, dword [ebp + 0x5c]
sub esi, eax
sub edx, eax
sub ecx, eax
mov dword [ebp + 0x70], esi
mov esi, dword [ebp + 0x4c]
mov dword [ebp + 0x5c], ecx
mov ecx, dword [ebp + 0x44]
mov dword [ebp + 0x6c], edx
lea edx, [ecx + esi*2]
movzx ecx, word [edx - 2]
sub edx, 2
cmp ecx, eax
jb 0x100559e6
sub ecx, eax
jmp 0x100559e8
xor ecx, ecx
dec esi
mov word [edx], cx
jne 0x100559d7
mov edx, dword [ebp + 0x40]
mov esi, eax
lea edx, [edx + eax*2]
movzx ecx, word [edx - 2]
sub edx, 2
cmp ecx, eax
jb 0x10055a05
sub ecx, eax
jmp 0x10055a07
xor ecx, ecx
dec esi
mov word [edx], cx
jne 0x100559f6
add ebx, eax
mov eax, dword [ebp]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x10055a78
mov ecx, dword [ebp + 0x74]
mov edx, dword [ebp + 0x6c]
mov edi, dword [ebp + 0x38]
add ecx, edx
add ecx, edi
push ecx
mov ecx, ebx
mov ebx, eax
call fcn.10055630
mov ecx, dword [ebp + 0x74]
add ecx, eax
mov edx, ecx
add esp, 4
cmp edx, 3
mov dword [ebp + 0x74], ecx
jb 0x10055a62
mov eax, dword [ebp + 0x6c]
mov ecx, dword [ebp + 0x38]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [ebp + 0x58]
mov dword [ebp + 0x48], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [ebp + 0x54]
mov dword [ebp + 0x48], eax
cmp edx, 0x106
jae 0x10055a78
mov edx, dword [ebp]
mov eax, dword [edx + 4]
test eax, eax
jne 0x10055981
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1005a96e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10140664]
jne 0x1005a978
repz ret
jmp fcn.1005aeee
Function at 0x4087f8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
jbe 0x40881f
push ebx
push edi
mov edi, dword [ebp + 8]
xor edx, edx
mov eax, esi
push 5
pop ebx
div ebx
mov al, byte [edx + ecx]
xor byte [esi + edi], al
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x408808
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x40dc8f
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x4958fe
call fcn.00493da1
mov esi, ecx
mov dword [ebp - 0x38], esi
or ebx, 0xffffffff
cmp dword [ebp + 8], ebx
jne 0x40dcaf
xor eax, eax
jmp 0x40de22
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x40dcdd
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x40dcdd
lea eax, [edi - 1]
mov dword [edx], eax
mov ecx, dword [esi + 0x20]
mov edx, dword [ecx]
lea eax, [edx + 1]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov byte [edx], al
jmp 0x40de22
cmp dword [esi + 0x4c], 0
jne 0x40dcea
mov eax, ebx
jmp 0x40de22
mov ecx, esi
call fcn.0040e535
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [esi + 0x38], ecx
jne 0x40dd11
push dword [esi + 0x4c]
movsx ecx, al
push ecx
call fcn.0047cd7b
cmp eax, ebx
pop ecx
cmovne ebx, dword [ebp + 8]
pop ecx
jmp 0x40dce3
mov dword [ebp - 0x1c], ecx
push ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 0x2c], cl
lea ecx, [ebp - 0x2c]
push 8
mov byte [ebp - 0x11], al
mov dword [ebp - 0x18], 0xf
call fcn.0040e487
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x3c], eax
mov edi, dword [ebp - 0x18]
mov esi, dword [esi + 0x38]
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x2c]
cmp edi, 0x10
lea edx, [ebp - 0x2c]
mov edi, dword [esi]
cmovae ecx, dword [ebp - 0x2c]
cmovae edx, dword [ebp - 0x2c]
add eax, ecx
push eax
push edx
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x11]
push eax
push dword [ebp - 0x3c]
call dword [edi + 0x1c]
test eax, eax
js 0x40de0d
cmp eax, 1
jg 0x40dde9
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
cmp edi, 0x10
mov edx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x38]
cmovae eax, ecx
sub edx, eax
mov dword [ebp - 0x40], edx
je 0x40ddbf
push dword [esi + 0x4c]
cmp edi, 0x10
lea eax, [ebp - 0x2c]
push edx
cmovae eax, ecx
push 1
push eax
call fcn.0047d900
mov edx, dword [ebp - 0x40]
add esp, 0x10
cmp edx, eax
jne 0x40de0d
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 0x11]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
jne 0x40de10
test edx, edx
jne 0x40dd3f
cmp dword [ebp - 0x1c], 0x20
jae 0x40de0d
push edx
push 8
lea ecx, [ebp - 0x2c]
call fcn.0040e4d5
jmp 0x40dd3c
cmp eax, 3
jne 0x40de0d
mov eax, dword [ebp - 0x38]
push dword [eax + 0x4c]
movsx eax, byte [ebp - 0x11]
push eax
call fcn.0047cd7b
pop ecx
pop ecx
cmp eax, ebx
mov ecx, ebx
cmovne ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
jmp 0x40de10
mov dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x2c]
push 0
push 1
call fcn.0040778c
mov eax, dword [ebp + 8]
call fcn.00493d4b
ret 4
Function at 0x40e5bd
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x4959a4
call fcn.00493da1
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x40e6c2
cmp byte [ebx + 0x3d], 0
je 0x40e6c2
push 0xffffffffffffffff
call fcn.0040dc8f
cmp eax, 0xffffffff
jne 0x40e5f2
xor al, al
jmp 0x40e6c4
xor eax, eax
lea ecx, [ebp - 0x2c]
push eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
push 8
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x2c], al
call fcn.0040e487
and dword [ebp - 4], 0
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
lea eax, [ebp - 0x30]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x1c]
lea esi, [ebp - 0x2c]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40e656
sub eax, 1
je 0x40e65a
dec eax
sub eax, 1
je 0x40e6ac
xor bl, bl
jmp 0x40e6ae
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
cmp ecx, 0x10
mov esi, dword [ebp - 0x30]
cmovae eax, edx
sub esi, eax
je 0x40e692
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
push esi
cmovae eax, edx
push 1
push eax
call fcn.0047d900
add esp, 0x10
cmp esi, eax
jne 0x40e652
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
cmp byte [ebx + 0x3d], 0
je 0x40e6ac
test esi, esi
jne 0x40e61c
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.0040e4d5
jmp 0x40e616
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
push 0
push 1
call fcn.0040778c
mov al, bl
jmp 0x40e6c4
mov al, 1
call fcn.00493d4b
ret