joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10034862
Capabilities:
Get disk information
Suspend thread

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 0
je 0x10034875
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
pop ebp
ret
cmp byte [ecx], 0
je 0x10034889
push 0x11cb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
pop ebp
ret

Function at 0x10034b08
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
je 0x10034b1e
cmp byte [ecx], 0
je 0x10034b34
xor cl, cl
pop ebp
jmp fcn.1003491e
xor eax, eax
push eax
push eax
push eax
push eax
push 0x13c7
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop ebp
ret

Function at 0x10035ccf
Capabilities:
Create process on windows
Get disk information

Disassembly:
mov eax, 0x100599da
call fcn.10058864
sub esp, 0x38
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x18], dl
je 0x10035d5e
test dl, dl
je 0x10035d3e
mov esi, dword [ecx]
mov edi, dword [ecx + 4]
cmp esi, edi
je 0x10035e59
xor ebx, ebx
push esi
lea ecx, [ebp - 0x40]
call fcn.10013fd9
push ecx
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], ebx
call fcn.100179bf
pop ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
call fcn.100397c8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
push ebx
push 1
call fcn.100147bd
add esi, 0x18
cmp esi, edi
jne 0x10035cfe
jmp 0x10035e59
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10035e59
push 0x11cb
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
jmp 0x10035e59
xor ebx, ebx
cmp byte [ebp + 8], bl
je 0x10035e45
mov byte [ebp + 0x13], bl
lea edx, [ebp + 0x13]
xor cl, cl
call fcn.100355e1
mov dword [ebp - 0x24], 0x4e2c
cmp dword [ebp - 0x24], 0x512e
jle 0x10035e0a
push ebx
push 0x1305
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, ebx
mov dword [ebp - 0x20], ebx
mov edi, ebx
mov eax, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
lea ebx, [edi + esi]
mov esi, dword [ebp - 0x28]
xor ebx, eax
mov eax, ebx
mov ecx, 0x10072098
or eax, esi
cdq
push edx
push eax
call fcn.10013ec4
inc esi
cmp esi, 0x276b
jl 0x10035dae
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x1c], eax
push 0
pop ebx
cmp eax, 0x18a0
jl 0x10035da3
inc edi
cmp edi, 0x49f
jl 0x10035d9e
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x1eb8
jl 0x10035d9c
push 0x358
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
mov dword [ebp - 4], 1
cmp dword [ebp - 0x24], 0x4cae
jge 0x10035e29
mov edx, str.zle_khaow_mviroaj_mvoalmrq_dgw_sbpdv_gugtgpib_pao_rplpiqo_wachzzqr_olrsglp_xzli
mov ecx, 0x10072098
call fcn.1001684d
jmp 0x10035e59
push ebx
push ebx
push ebx
push ebx
push 0x13c7
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10037508
Capabilities:
Create pipe

Disassembly:
mov eax, 0x10059add
call fcn.10058864
sub esp, 0x48
push ebx
push esi
mov byte [ebp - 0x18], cl
xor ebx, ebx
mov dword [ebp - 0x24], 0x4ba4
cmp dword [ebp - 0x24], 0x4cb9
push edi
mov dword [ebp - 0x10], esp
jle 0x10037589
mov esi, ebx
mov edi, esi
mov dword [ebp - 0x20], 0xa83
mov dword [ebp - 0x28], ebx
mov eax, edi
mov ecx, 0x10072098
and eax, ebx
cdq
push edx
push eax
call fcn.10013ec4
inc ebx
cmp ebx, 0x3ff0
jl 0x1003753e
dec edi
dec dword [ebp - 0x20]
push 0
pop ebx
jne 0x1003753b
inc esi
cmp esi, 0x8b4
jl 0x10037532
push ebx
push 0x13d
push 0x1026
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x24], 0x48b8
jge 0x100375a4
mov edx, str.wagyeylbq_ytprpz_eaztcpmop_stgyl_mjj_osolct_zynhan_ppshna_ucjwgv_jyuci_mwfytfg_rantsbg
mov ecx, 0x10072098
call fcn.1001684d
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x18], 0
je 0x100376e0
sub esp, 0x18
mov ecx, esp
push dword [ebp + 8]
call fcn.10013fd9
lea ecx, [ebp - 0x38]
call fcn.10036099
add esp, 0x18
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x38], eax
je 0x10037657
push dword [ebp - 0x2c]
xor ecx, ecx
mov dword [ebp - 0x3c], 7
push eax
push dword [ebp - 0x38]
mov word [ebp - 0x50], cx
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x40], ebx
call fcn.100171db
mov ecx, dword [ebp + 0x14]
lea edx, [ebp - 0x50]
mov byte [ebp - 4], 3
call fcn.10037497
lea ecx, [ebp - 0x50]
push ebx
push 1
test eax, eax
jns 0x1003764e
mov eax, dword [ebp + 0xc]
mov byte [eax], 1
call fcn.100147bd
lea ecx, [ebp - 0x38]
call fcn.10027581
jmp 0x10037706
mov byte [ebp - 4], 2
call fcn.100147bd
mov eax, dword [ebp + 0xc]
mov byte [eax], bl
mov dword [ebp - 0x28], 0xa3
cmp dword [ebp - 0x28], 0xce
jle 0x1003761c
push 0x1ea3
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov edi, ebx
mov dword [ebp - 0x28], ebx
mov esi, ebx
mov eax, ebx
mov dword [ebp - 0x20], 0x3750
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], ebx
mov ecx, eax
mov ebx, edi
mov edi, dword [ebp - 0x2c]
shl ebx, cl
mov eax, ebx
mov ecx, 0x10072098
and eax, edi
cdq
push edx
push eax
call fcn.10013ec4
inc edi
cmp edi, 0x5ea1
jl 0x10037699
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x28]
add eax, esi
dec dword [ebp - 0x20]
push 0
mov dword [ebp - 0x24], eax
pop ebx
jne 0x1003768d
inc esi
cmp esi, 0x503b
jl 0x10037681
inc edi
mov dword [ebp - 0x28], edi
cmp edi, 0xb94
jl 0x1003767f
jmp 0x1003761c
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10037706
push 1
push 0x7811
push 0x29f
push 1
mov edx, 0x3a65
xor cl, cl
call fcn.10035675
add esp, 0x10
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10037b58
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10059b33
call fcn.10058864
sub esp, 0x60
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], esi
je 0x10037bc4
cmp byte [ebp + 0x14], 0
je 0x10037ba5
push ecx
mov edx, 0x28f1
lea ecx, [ebp - 0x38]
call fcn.100179ef
and dword [ebp - 4], 0
push ecx
mov ecx, dword [ebp + 0x1c]
push eax
call fcn.100298d2
lea ecx, [ebp - 0x38]
jmp 0x10037ce3
push 0x59ed
push 0xd0b
lea edx, [ebp + 0xf]
mov byte [ebp + 0xf], 0
xor cl, cl
call fcn.10038119
pop ecx
pop ecx
jmp 0x10037cec
mov dword [ebp - 0x18], 0x7ce2
cmp dword [ebp - 0x18], 0x8076
jle 0x10037c1b
xor esi, esi
xor edi, edi
mov ebx, 0x303
mov eax, edi
lea ecx, [ebp - 0x50]
cdq
push edx
push eax
call fcn.10001ade
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10037bf4
mov eax, dword [eax]
push eax
call fcn.1004041f
pop ecx
push 0
push 1
lea ecx, [ebp - 0x50]
call fcn.10014649
add edi, esi
dec ebx
jne 0x10037bdd
inc esi
cmp esi, 0x6036
jl 0x10037bd6
mov ebx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
cmp dword [ebp - 0x18], 0x7c44
jge 0x10037c2f
push str.ncxhezs_mvulhkfi_vrweifijq_ntfvfr_mcm_fzcc_jbh_vkxpn_kuhn_cvze_rzmd
call fcn.1004041f
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x20], 0
je 0x10037c59
mov eax, dword [ebp + 0x18]
mov esi, dword [esi]
mov edx, dword [ebx]
mov ecx, dword [eax]
mov eax, dword [edx + esi*4]
cmp eax, dword [ecx + esi*4]
jge 0x10037cec
mov eax, dword [ebp + 8]
or dword [eax], 0xffffffff
jmp 0x10037cec
mov dword [ebp - 0x18], 0xbc7
cmp dword [ebp - 0x18], 0xf32
jle 0x10037c9c
xor esi, esi
xor edi, edi
xor ebx, ebx
lea eax, [ebx + edi]
mov ecx, 0x10072098
xor eax, esi
cdq
push edx
push eax
call fcn.10013ec4
inc ebx
cmp ebx, 0x659c
jl 0x10037c6f
inc edi
cmp edi, 0x3b5f
jl 0x10037c6d
inc esi
cmp esi, 0x7a64
jl 0x10037c6b
mov dword [ebp - 4], 3
cmp dword [ebp - 0x18], 0xbae
jge 0x10037cbb
mov edx, str.txhxobhz_dzceahyvh_hzqti
mov ecx, 0x10072098
call fcn.1001684d
mov eax, dword [ebp + 0x24]
or dword [ebp - 4], 0xffffffff
cmp dword [eax], 0xffffffff
je 0x10037cec
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
push dword [eax]
lea eax, [ebp - 0x68]
push eax
call fcn.100394cd
mov ecx, dword [ebp + 0x10]
push eax
call fcn.10017af1
lea ecx, [ebp - 0x68]
push 0
push 1
call fcn.100147bd
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100380f3
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0xc], 0
je 0x1003810e
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10038116
push ecx
call fcn.10035b5a
pop ecx
jmp 0x10038116
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
pop ecx
pop ebp
ret
Function at 0x417800
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor eax, eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
mov ecx, 0x20000004
mov dword [ebp - 4], edi
cmp dword [ebp + 8], edi
je 0x41788b
lea eax, [ebp - 4]
push eax
push 0x1a
call fcn.00417753
mov esi, eax
cmp esi, edi
jge 0x417836
push str.Failed_to_allocate_administrator_SID.
jmp 0x41787c
push 2
push 8
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
jne 0x417886
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x41785c
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, edi
jl 0x417867
mov esi, 0x80004005
push esi
push 0x573
push str.cache.cpp
call fcn.0043294e
push str.Failed_to_initialize_ACL.
push esi
call fcn.0042fa86
pop ecx
pop ecx
jmp 0x4178b6
mov ecx, 0x20000005
push 0x7d0
push 3
push edi
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp - 4]
push ecx
push 1
push dword [ebp + 0xc]
call fcn.0042fa9a
push pe_nt_image_headers32
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp - 4], edi
je 0x4178c3
push dword [ebp - 4]
call fcn.004324f6
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x426851
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push dword [ebp + 0xc]
xor ebx, ebx
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 8], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.004174c4
mov dword [ebp - 4], eax
cmp eax, ebx
jge 0x42688c
push dword [ebp + 8]
push str.Failed_to_calculate_resume_path_from_working_path:__ls
push eax
call fcn.0042fa86
add esp, 0xc
jmp 0x426940
mov eax, dword [ebp + 0xc]
push ebx
push pe_nt_image_headers32
push 4
push ebx
push 4
push 0xc0000000
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x4268f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x4268c3
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x4268d1
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0xd0
push str.downloadengine.cpp
call fcn.0043294e
mov eax, dword [ebp + 0xc]
push dword [eax]
push str.Failed_to_create_resume_file:__ls
push dword [ebp - 4]
jmp 0x42687f
push ebx
lea eax, [ebp - 8]
push eax
push 8
pop eax
sub eax, edi
push eax
lea eax, [edi + esi]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x426949
add edi, dword [ebp - 8]
cmp dword [ebp - 8], ebx
je 0x42691b
cmp edi, 8
jb 0x4268f2
cmp edi, 8
je 0x426925
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
or dword [ebp + 8], 0xffffffff
mov dword [eax], ecx
cmp dword [ebp + 8], 0xffffffff
je 0x426940
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x42695d
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x42696b
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0xd7
push str.downloadengine.cpp
call fcn.0043294e
mov eax, dword [ebp + 0xc]
push dword [eax]
push str.Failed_to_read_resume_file:__ls
push dword [ebp - 4]
call fcn.0042fa86
add esp, 0xc
jmp 0x426931
Function at 0x435bbe
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
or dword [ebp - 4], 0xffffffff
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
xor ebx, ebx
call fcn.00435710
test eax, eax
je 0x435c4c
test byte [ebp - 4], 7
push esi
push edi
mov edi, 0xffff
mov esi, 0x80070000
je 0x435c19
push pe_nt_image_headers32
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x435c19
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x435c0b
and eax, edi
or eax, esi
mov ebx, eax
test ebx, ebx
jns 0x435c19
push ebx
push 0x519
jmp 0x435c40
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x435c4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x435c34
and eax, edi
or eax, esi
mov ebx, eax
test ebx, ebx
jns 0x435c4a
push ebx
push 0x51f
push str.fileutil.cpp
call fcn.0043294e
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4

Function at 0x435c53
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x14], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 4], eax
mov ebx, 0xffff
mov edi, 0x80070000
test eax, eax
jne 0x435cad
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x435c92
and eax, ebx
or eax, edi
mov esi, eax
test esi, esi
jns 0x435cad
push esi
push 0x118
push str.fileutil.cpp
call fcn.0043294e
jmp 0x435d56
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x435ccc
mov esi, 0x8007000e
push esi
push 0x11c
jmp 0x435c9e
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x435cfb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x435ced
and eax, ebx
or eax, edi
mov esi, eax
test esi, esi
jns 0x435cfb
push esi
push 0x120
jmp 0x435d2e
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x450f74
push dword [ebp - 0x10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x435d3a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x435d22
and eax, ebx
or eax, edi
mov esi, eax
test esi, esi
jns 0x435d3a
push esi
push 0x125
push str.fileutil.cpp
call fcn.0043294e
jmp 0x435d4d
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x407360
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40739e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407396
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4073a0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407386
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407480
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4074af
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4074af
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x42991ed5
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x34841306
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x404a60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0x42b010]
push edi
push 0x4349f0
call esi
push 0x4349f0
call esi
push 0x4349f0
call esi
push 0x4349f0
call esi
push 0x4349f0
call esi
mov edi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
push 0
call 0x2b10337
nop
push eax
call 0x77f1296e
nop
mov ebx, eax
push 0x4349f0
mov dword [ebp - 4], ebx
call esi
push 0x4349f0
call esi
push 0x4349f0
call esi
push 0x4349f0
call esi
push 0x4349f0
call esi
push 0x4349f0
mov byte [ebx + edi], 0
call esi
push 0x4349f0
call esi
push 0x4349f0
call esi
push 0x4349f0
call esi
push 0x4349f0
call esi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0x404b7a
mov eax, dword [ebp + 8]
sub eax, ebx
mov dword [ebp - 8], eax
push 0x4349f0
call esi
push 0x4349f0
call esi
push 0x4349f0
call esi
push 0x4349f0
call esi
push 0x4349f0
call esi
mov ecx, dword [ebp + 0xc]
push ecx
add ebx, edi
call 0x6ff643d3
nop
mov ecx, eax
xor edx, edx
mov eax, edi
div ecx
mov eax, dword [ebp + 0xc]
add esp, 4
push 0x4349f0
mov cl, byte [edx + eax]
mov edx, dword [ebp - 8]
xor cl, byte [edx + ebx]
mov byte [ebx], cl
call esi
push 0x4349f0
call esi
push 0x4349f0
call esi
push 0x4349f0
call esi
push 0x4349f0
call esi
mov ebx, dword [ebp - 4]
inc edi
cmp edi, dword [ebp + 0x10]
jb 0x404b06
push 0x4349f0
call esi
push 0x4349f0
call esi
push 0x4349f0
call esi
push 0x4349f0
call esi
push 0x4349f0
call esi
lea eax, [ebp - 0xc]
push eax
push 0x100
push 4
push ebx
mov dword [ebp - 0xc], 0
call 0x2b1033c
nop
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x14d0fa28
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x20000013
push dword [ebp + 8]
mov dword [ebp - 8], 4
mov dword [ebp - 0xc], ebx
call dword [0x14d12300]
test eax, eax
je 0x14d0fb16
cmp dword [ebp - 0xc], 0xc8
jne 0x14d0fb16
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 0xc]
call dword [0x14d12158]
mov esi, eax
cmp esi, 0xffffffff
je 0x14d0fb16
mov byte [ebp - 1], bl
push ebx
push dword [ebp + 0x10]
call dword [0x14d12150]
test eax, eax
je 0x14d0fabc
lea eax, [ebp - 8]
push eax
push 0x200
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
call dword [0x14d122ec]
test eax, eax
jne 0x14d0fac0
mov byte [ebp - 1], 1
cmp dword [ebp - 8], ebx
je 0x14d0faf0
push ebx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x210]
push eax
push esi
call dword [0x14d12190]
test eax, eax
je 0x14d0fae7
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 8]
je 0x14d0faeb
mov byte [ebp - 1], 1
cmp byte [ebp - 1], bl
je 0x14d0fa91
push esi
call dword [0x14d121a0]
push esi
call dword [0x14d12140]
cmp byte [ebp - 1], bl
je 0x14d0fb0c
push dword [ebp + 0xc]
call fcn.14d0eab6
pop ecx
xor eax, eax
cmp byte [ebp - 1], bl
sete al
jmp 0x14d0fb18
xor al, al
pop esi
pop ebx
leave
ret

Function at 0x408960
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4085d8
mov esi, ecx
call fcn.0040898a
xor dword [ebx], eax
sub esi, esi
push 0x218577e0
pop esi
inc ebx
cmp ebx, edi
jne fcn.00408960
mov ecx, 0xb3b919b9
push ecx
mov esi, dword [esp]
add esp, 4
ret
Function at 0x40172e
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x465a50]
sub esp, 0x1c
push ebx
push edi
push dword [eax + 0x10]
mov edi, ecx
push dword [eax + 0x18]
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x401881
cmp byte [edi + 1], al
je 0x40187d
cmp byte [edi + 0x31], al
je 0x40178c
sub esp, 0x18
lea eax, [edi + 0x34]
mov ecx, esp
mov edx, str.TLS_Handshake...______
push eax
call fcn.00402ab1
sub esp, 0x14
mov ecx, esp
push 0x459450
call fcn.00402198
call fcn.00413bec
add esp, 0x30
call fcn.004190d9
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x4017a7
sub esp, 0x18
mov ecx, esp
push str.TLS_Error_1
jmp 0x4018e1
mov edx, dword [edi + 4]
mov ecx, eax
call fcn.004192fd
cmp eax, 1
je 0x4017ed
sub esp, 0x18
mov ecx, esp
push str.TLS_Error_2
call fcn.00402198
sub esp, 0x18
mov ecx, esp
push 0x4593b4
call fcn.00402198
call fcn.00413bec
add esp, 0x30
mov ecx, dword [edi + 0x4c]
call fcn.0041911f
and dword [edi + 0x4c], 0
jmp 0x4018fd
mov ecx, dword [edi + 0x4c]
call fcn.00419ddd
cmp eax, 1
je 0x40182a
sub esp, 0x18
mov ecx, esp
push str.TLS_Authentication_Failed
call fcn.00402198
sub esp, 0x18
mov ecx, esp
push 0x4593b4
call fcn.00402198
call fcn.00413bec
mov ecx, dword [edi + 0x4c]
add esp, 0x30
call fcn.00419526
jmp 0x4017dc
mov ecx, dword [edi + 0x4c]
call fcn.00419274
mov dword [edi + 0x50], eax
test eax, eax
jne 0x40185f
sub esp, 0x18
mov ecx, esp
push str.TLS_Error_3
call fcn.00402198
sub esp, 0x18
mov ecx, esp
push 0x4593b4
call fcn.00402198
call fcn.00413bec
add esp, 0x30
xor ebx, ebx
push ebx
push 1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push 1
push ebx
push ebx
mov dword [edi + 0x70], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x6c], eax
mov al, 1
jmp 0x4018ff
cmp byte [edi + 0x31], 0
je 0x4018fd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
sub ecx, 0x2736
je 0x4018fd
sub ecx, 0x17
je 0x4018d7
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.00414e9e
sub esp, 0x18
mov edx, str.Connection_Failed:
mov ecx, esp
push eax
call fcn.00402a8d
sub esp, 0x14
mov ecx, esp
push 0x4593b4
call fcn.00402198
call fcn.00413bec
add esp, 0x30
lea ecx, [ebp - 0x1c]
call fcn.004020b1
jmp 0x4018fd
sub esp, 0x18
mov ecx, esp
push str.Connection_Refused
call fcn.00402198
sub esp, 0x18
mov ecx, esp
push 0x4593b4
call fcn.00402198
call fcn.00413bec
add esp, 0x30
xor al, al
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4