joyce8/EMBER2024-capa huggingface dataset:
Function at 0x68ecec
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x43a400]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x1b6
mov edi, ecx
push 0x501
push edi
call fcn.00699d14
mov esi, eax
add esp, 0xc
test esi, esi
js 0x68ed66
push ebx
call fcn.00692deb
push eax
push 0x442a30
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.006836fc
mov ebx, eax
add esp, 0x10
cmp ebx, 0xf
ja 0x68edac
push ebx
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.006970e0
add esp, 0xc
cmp eax, ebx
pop ebx
push esi
jne 0x68ed84
call fcn.006982fa
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
call fcn.0068f1f9
mov esp, ebp
pop ebp
ret
call fcn.0068fa21
push edi
push 0x442a14
push dword [eax]
push 1
call fcn.006708ac
add esp, 0x10
push 1
call fcn.0068f820
call fcn.006982fa
push edi
call fcn.006a1edb
call fcn.0068fa21
push 0x442a50
push dword [eax]
push 1
call fcn.006708ac
add esp, 0x14
push 1
call fcn.0068f820
push esi
call fcn.006982fa
push edi
call fcn.006a1edb
push 0x442a38
push 1
call fcn.0066febc
add esp, 0x10
push 1
call fcn.0068f820
int3

Function at 0x68eddc
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp + 8]
xor eax, eax
xor esi, esi
test ecx, ecx
jle 0x68eeb0
push edi
lea edi, [ecx - 1]
mov dword [ebp - 8], edi
lea edi, [ecx - 2]
mov ch, byte [esi + edx]
cmp esi, dword [ebp - 8]
jge 0x68ee13
mov cl, byte [esi + edx + 1]
mov byte [ebp - 2], cl
jmp 0x68ee17
mov byte [ebp - 2], 0
cmp esi, edi
jge 0x68ee24
mov cl, byte [esi + edx + 2]
mov byte [ebp - 1], cl
jmp 0x68ee28
mov byte [ebp - 1], 0
movzx edi, byte [ebp - 2]
movzx edx, ch
mov ecx, edx
and edx, 3
shr ecx, 2
shl edx, 4
mov cl, byte [ecx + 0x438390]
mov byte [eax + ebx], cl
mov ecx, edi
shr ecx, 4
or ecx, edx
mov dl, byte [ebp - 1]
mov cl, byte [ecx + 0x438390]
mov byte [eax + ebx + 1], cl
cmp esi, dword [ebp - 8]
jge 0x68ee76
and edi, 0xf
movzx ecx, dl
shr ecx, 6
shl edi, 2
or ecx, edi
mov cl, byte [ecx + 0x438390]
mov byte [eax + ebx + 2], cl
jmp 0x68ee7b
mov byte [eax + ebx + 2], 0x3d
mov ecx, dword [ebp + 8]
add eax, 3
lea edi, [ecx - 2]
cmp esi, edi
jge 0x68ee9c
movzx ecx, dl
and ecx, 0x3f
mov cl, byte [ecx + 0x438390]
mov byte [eax + ebx], cl
mov ecx, dword [ebp + 8]
jmp 0x68eea0
mov byte [eax + ebx], 0x3d
mov edx, dword [ebp - 0xc]
add esi, 3
inc eax
cmp esi, ecx
jl 0x68ee02
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401350
Capabilities:
Terminate process

Disassembly:
mov eax, 0x1018
call fcn.00440cc0
push ebp
push esi
mov esi, dword [esp + 0x102c]
cmp esi, 0x3e8
lea ebp, [esp + 0x20]
mov byte [esp + 0xb], 1
mov dword [esp + 0xc], 0
ja 0x4013a0
mov eax, dword [0x45606c]
push 0x88
push eax
push 0x4561a0
call fcn.0040cd30
add esp, 0xc
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x1018
ret
cmp byte [esi], 0
je 0x4015ce
push 4
push 0x4561ac
push esi
call fcn.00405eb0
add esp, 0xc
test eax, eax
jne 0x40149b
mov ecx, 0x4561b4
neg ecx
sbb ecx, ecx
and ecx, 5
cmp ecx, 0xfff
mov dword [esp + 0xc], 1
jle 0x4013f6
mov edx, dword [0x45606c]
push 0x90
push edx
push 0x4561bc
call fcn.0040cd30
add esp, 0xc
push ebx
push edi
push 0xfff
lea eax, [esp + 0x2c]
push 0x456200
push eax
call fcn.00405810
lea ecx, [esp + 0x34]
add esp, 0xc
test ecx, ecx
je 0x401429
or ecx, 0xffffffff
xor eax, eax
lea edi, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edx, ecx
jmp 0x40142b
xor edx, edx
lea ebx, [esi + 3]
test ebx, ebx
je 0x401440
or ecx, 0xffffffff
xor eax, eax
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
jmp 0x401442
xor ecx, ecx
mov eax, 0xfff
sub eax, edx
cmp ecx, eax
jle 0x401466
mov ecx, dword [0x45606c]
push 0x91
push ecx
push 0x456208
call fcn.0040cd30
add esp, 0xc
push 0xfff
lea edx, [esp + 0x2c]
push ebx
push edx
call fcn.004058a0
push 0x456250
add esi, 4
push esi
call fcn.004053e0
add esp, 0x14
test al, al
pop edi
pop ebx
je 0x4015b6
mov byte [esp + 0xb], 0
jmp 0x4015b6
push 4
push 0x456260
push esi
call fcn.00405eb0
add esp, 0xc
test eax, eax
jne 0x4014bf
mov dword [esp + 0xc], 3
lea ebp, [esi + 4]
jmp 0x4015b6
push 0x456268
push esi
call fcn.004053e0
add esp, 8
test al, al
je 0x4014e3
mov dword [esp + 0xc], 3
mov ebp, 0x45626c
jmp 0x4015b6
push 4
push 0x456270
push esi
call fcn.00405eb0
add esp, 0xc
test eax, eax
jne 0x401507
mov dword [esp + 0xc], 4
lea ebp, [esi + 4]
jmp 0x4015b6
push 0x456278
push esi
call fcn.004053e0
add esp, 8
test al, al
je 0x401526
mov dword [esp + 0xc], 6
jmp 0x4015b6
push 0x45627c
push esi
call fcn.004053e0
add esp, 8
test al, al
je 0x401542
mov dword [esp + 0xc], 8
jmp 0x4015b6
push 4
push 0x456288
push esi
call fcn.00405eb0
add esp, 0xc
test eax, eax
jne 0x401563
mov dword [esp + 0xc], 2
lea ebp, [esi + 4]
jmp 0x4015b6
push 4
push 0x456290
push esi
call fcn.00405eb0
add esp, 0xc
test eax, eax
jne 0x401584
mov dword [esp + 0xc], 5
lea ebp, [esi + 4]
jmp 0x4015b6
push 8
push 0x456298
push esi
call fcn.00405eb0
add esp, 0xc
test eax, eax
je 0x40183e
push 0x4562a4
push esi
call fcn.004053e0
add esp, 8
test al, al
je 0x4015b6
mov dword [esp + 0xc], 7
mov eax, dword [esp + 0xc]
jmp dword [eax*4 + 0x401864]
pop esi
xor eax, eax
pop ebp
add esp, 0x1018
ret
mov eax, dword [0x45606c]
push 0xef
push eax
push 0x4562d8
call fcn.0040cd30
add esp, 0xc
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x1018
ret

Function at 0x401890
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4018ad
push 0x466868
push eax
call fcn.004018b0
add esp, 8
push 1
call fcn.00440bac
ret
Function at 0x402030
Capabilities:
Get hostname

Disassembly:
push ebx
mov ebx, dword [esp + 8]
cmp ebx, 0x3e8
push esi
jbe 0x402042
mov esi, ebx
jmp 0x402058
mov al, byte [0x456af1]
test al, al
mov esi, 0x4696ac
je 0x402058
push 0x64
push esi
call sub.WS2_32.dll_gethostname
push edi
push 0x456c70
call fcn.004019c0
add esp, 4
test eax, eax
je 0x4020a3
push 0x456c78
call fcn.004019c0
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x200
jle 0x4020a3
mov eax, dword [0x4567b4]
push 0xf8
push eax
push 0x456c80
call fcn.0040cd30
add esp, 0xc
push 0x200
push 0x456cd0
call fcn.004019c0
add esp, 4
push eax
push 0x469e88
call fcn.00405810
mov ecx, 0x469e88
add esp, 0xc
test ecx, ecx
je 0x4020da
mov edi, ecx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jmp 0x4020dc
xor ecx, ecx
mov edx, 0x456cd8
neg edx
sbb edx, edx
mov eax, 0x200
neg edx
sub eax, ecx
cmp edx, eax
jle 0x40210b
mov ecx, dword [0x4567b4]
push 0xf9
push ecx
push 0x456cdc
call fcn.0040cd30
add esp, 0xc
push 0x200
push 0x456d18
push 0x469e88
call fcn.004058a0
mov edx, 0x469e88
add esp, 0xc
test edx, edx
je 0x40213b
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edx, ecx
jmp 0x40213d
xor edx, edx
test esi, esi
je 0x40214f
or ecx, 0xffffffff
xor eax, eax
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
jmp 0x402151
xor ecx, ecx
mov eax, 0x200
sub eax, edx
cmp ecx, eax
pop edi
jle 0x402176
mov ecx, dword [0x4567b4]
push 0xfa
push ecx
push 0x456d1c
call fcn.0040cd30
add esp, 0xc
push 0x200
push esi
push 0x469e88
call fcn.004058a0
add esp, 0xc
pop esi
cmp ebx, 0x3e8
pop ebx
ja 0x4021cc
mov al, byte [0x456af1]
test al, al
je 0x4021c5
push 0
push 0x469e88
call fcn.00410650
add esp, 8
test eax, eax
je 0x4021c5
push 0
push 0
push 0x1fd
push 0x469e88
call fcn.00407250
add esp, 0x10
mov byte [0x456af1], 0
mov eax, 0x469e88
ret
Function at 0x408e60
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
mov esi, dword [esp + 0x128]
xor ebx, ebx
cmp esi, ebx
push edi
mov dword [esp + 0x10], ebx
jge 0x408ea3
mov eax, dword [0x45b410]
push 0x218
push eax
push 0x45b428
call fcn.0040cd30
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, 0x1389
pop ebx
add esp, 0x114
ret
cmp dword [esp + 0x128], ebx
jge 0x408ed5
mov ecx, dword [0x45b410]
push 0x219
push ecx
push 0x45b438
call fcn.0040cd30
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, 0x1389
pop ebx
add esp, 0x114
ret
mov edi, dword [esp + 0x130]
cmp edi, 0x3e8
ja 0x408f0d
mov edx, dword [0x45b410]
push 0x21a
push edx
push 0x45b444
call fcn.0040cd30
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, 0x1389
pop ebx
add esp, 0x114
ret
cmp dword [esp + 0x138], 0x3e8
ja 0x408f42
mov eax, dword [0x45b410]
push 0x21b
push eax
push 0x45b454
call fcn.0040cd30
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, 0x1389
pop ebx
add esp, 0x114
ret
push edi
call fcn.00409060
add esp, 4
test al, al
jne 0x408f82
push edi
call fcn.00409090
mov edi, eax
add esp, 4
cmp edi, ebx
jne 0x408f82
mov ecx, dword [0x45b410]
push 0x220
push ecx
call fcn.0040ce10
add esp, 8
pop edi
pop esi
pop ebp
mov eax, 0x1389
pop ebx
add esp, 0x114
ret
cmp esi, ebx
jle 0x408ffd
mov eax, dword [esp + 0x134]
mov edx, eax
shl edx, 8
xor ecx, ecx
mov cl, ah
lea ebp, [edx + ecx]
push 0
push 1
push 2
call sub.WS2_32.dll_socket
push edi
mov esi, eax
mov word [esp + 0x18], 2
mov word [esp + 0x1a], bp
call sub.WS2_32.dll_inet_addr
mov dword [esp + 0x18], eax
push 0x10
lea eax, [esp + 0x18]
xor edx, edx
push eax
mov dword [esp + 0x24], edx
push esi
mov dword [esp + 0x2c], edx
call sub.WS2_32.dll_connect
test eax, eax
je 0x408ff4
call sub.WS2_32.dll_WSAGetLastError
push esi
mov dword [esp + 0x14], eax
call sub.WS2_32.dll_closesocket
mov eax, dword [esp + 0x12c]
inc ebx
cmp ebx, eax
jl 0x408f99
jmp 0x408ffd
cmp ebx, dword [esp + 0x12c]
jl 0x409048
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x28]
push 0x45b474
push edx
call fcn.00440b2d
lea ecx, [esp + 0x30]
add esp, 0xc
test ecx, ecx
lea eax, [esp + 0x24]
jne 0x409025
mov eax, 0x45b494
push eax
push 0x45b4a4
push 0x1391
call fcn.0040cb80
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, 0x1391
pop ebx
add esp, 0x114
ret
mov edx, dword [esp + 0x138]
pop edi
mov dword [edx], esi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x114
ret

Function at 0x409090
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push eax
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x40909f
ret
cmp word [eax + 0xa], 4
je 0x4090c2
mov ecx, dword [0x45b410]
push 0x2bb
push ecx
push 0x45b4ec
call fcn.0040cd30
add esp, 0xc
xor eax, eax
ret
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
xor ecx, ecx
mov cl, byte [eax + 3]
xor edx, edx
mov dl, byte [eax + 2]
push ecx
xor ecx, ecx
mov cl, byte [eax + 1]
push edx
xor edx, edx
mov dl, byte [eax]
push ecx
push edx
push 0x45b504
push 0x47d238
call fcn.00440b2d
add esp, 0x18
mov eax, 0x47d238
ret
Function at 0x4091d0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor esi, esi
test edi, edi
jle 0x40920d
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
push 0
mov eax, edi
sub eax, esi
push eax
lea ecx, [esi + ebx]
push ecx
push ebp
call sub.WS2_32.dll_send
test eax, eax
jge 0x409207
mov eax, dword [0x493560]
cmp eax, 4
jne 0x409214
jmp 0x409209
add esi, eax
cmp esi, edi
jl 0x4091e6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
cmp eax, 0x20
jne 0x409223
pop edi
pop esi
pop ebp
mov eax, 0x1392
pop ebx
ret
mov edx, dword [0x45b410]
push 0x35c
push edx
push 0x45b510
call fcn.0040cdb0
mov edi, dword [0x493560]
add esp, 0xc
xor eax, eax
cmp edi, 0xb
setne al
pop edi
pop esi
pop ebp
pop ebx
dec eax
and eax, 3
add eax, 0x1390
ret
Function at 0x409320
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x60c
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0x400
xor edx, edx
mov eax, 0x45b760
test eax, eax
je 0x409366
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jae 0x409366
mov cl, byte [edx + 0x45b760]
add cl, byte [edx + 0x45b72c]
sub cl, 0x41
mov byte [esp + edx + 0x11c], cl
inc edx
jmp 0x409334
mov byte [esp + edx + 0x11c], 0
xor edx, edx
mov eax, 0x45b790
test eax, eax
je 0x40939f
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jae 0x40939f
mov cl, byte [edx + 0x45b79c]
add cl, byte [edx + 0x45b790]
sub cl, 0x41
mov byte [esp + edx + 0x1c], cl
inc edx
jmp 0x409370
mov byte [esp + edx + 0x1c], 0
lea edx, [esp + 0x14]
push edx
push 1
push 0
lea eax, [esp + 0x128]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4093e6
push 0x56e
push 0x45b7c8
call fcn.0040ce10
add esp, 8
pop edi
pop esi
pop ebp
mov eax, 0x1389
pop ebx
add esp, 0x60c
ret
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x220]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
push 0
lea ecx, [esp + 0x2c]
push ecx
push edx
call ebx
test eax, eax
je 0x409432
push 0x579
push 0x45b7e0
call fcn.0040ce10
add esp, 8
pop edi
pop esi
pop ebp
mov eax, 0x1389
pop ebx
add esp, 0x60c
ret
mov eax, dword [esp + 0x10]
dec eax
cmp eax, 0x13
jae 0x409463
cmp eax, 0x1b
jbe 0x409463
push 0x57e
push 0x45b7f8
call fcn.0040ce10
add esp, 8
pop edi
pop esi
pop ebp
mov eax, 0x1389
pop ebx
add esp, 0x60c
ret
mov esi, dword [esp + 0x628]
mov ebp, dword [esp + 0x624]
mov ecx, dword [esp + 0x620]
push esi
push ebp
push ecx
lea edx, [esp + 0x228]
push 0x45b810
push edx
call fcn.00440f49
add esp, 0x14
cmp eax, 1
je 0x40949e
cmp eax, 2
jne 0x409540
xor edx, edx
mov eax, 0x45b7ac
test eax, eax
je 0x4094d1
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jae 0x4094d1
mov cl, byte [edx + 0x45b7ac]
mov eax, edx
inc cl
shr eax, 1
mov byte [esp + eax + 0x9c], cl
add edx, 2
jmp 0x4094a0
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x220]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
push 0
lea ecx, [esp + 0xac]
push ecx
push edx
call ebx
test eax, eax
je 0x40951a
push 0x590
push 0x45b81c
call fcn.0040ce10
add esp, 8
pop edi
pop esi
pop ebp
mov eax, 0x1389
pop ebx
add esp, 0x60c
ret
push 4
lea eax, [esp + 0x220]
push eax
push ebp
call fcn.00406db0
add esp, 0xc
mov dword [esi], 0xe333335e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x60c
ret
cmp eax, 3
je 0x409533
pop edi
pop esi
pop ebp
mov eax, 0x1389
pop ebx
add esp, 0x60c
ret
Function at 0x410790
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4107a3
xor eax, eax
ret
test al, 0x10
mov eax, 0
setne al
inc eax
ret

Function at 0x410850
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push edx
call fcn.00444099
add esp, 0xc
ret

Function at 0x410ab0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [esp + 0x118]
cmp ebx, 0x3e8
push ebp
push esi
push edi
ja 0x410af1
mov eax, dword [0x45de94]
push 0xca1
push eax
push 0x45e368
call fcn.0040cd30
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, 0xb0451
pop ebx
add esp, 0x10c
ret
mov ebp, dword [esp + 0x12c]
cmp ebp, 0x3e8
ja 0x410b29
mov ecx, dword [0x45de94]
push 0xca2
push ecx
push 0x45e378
call fcn.0040cd30
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, 0xb0451
pop ebx
add esp, 0x10c
ret
mov esi, dword [esp + 0x120]
lea edx, [esp + 0x10]
push edx
push 0
push 0
lea eax, [esp + 0x24]
push eax
push esi
mov dword [esp + 0x24], 0x3c
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], 1
call sub.WS2_32.dll_select
test eax, eax
je 0x410bda
mov edi, dword [esp + 0x128]
push 0
push edi
push ebx
push esi
call sub.WS2_32.dll_recv
cmp eax, 0xffffffff
jne 0x410bdc
call sub.WS2_32.dll_WSAGetLastError
add eax, 0xffffd8ec
cmp eax, 0x38
ja case.0x410b91.10007
xor ecx, ecx
mov cl, byte [eax + 0x410bfc]
jmp dword [ecx*4 + 0x410bec]
pop edi
pop esi
pop ebp
mov eax, 0xb0454
pop ebx
add esp, 0x10c
ret
pop edi
pop esi
pop ebp
mov eax, 0xb0455
pop ebx
add esp, 0x10c
ret
mov eax, edi
pop edi
pop esi
mov dword [ebp], eax
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret
pop edi
pop esi
pop ebp
mov eax, 0xb0453
pop ebx
add esp, 0x10c
ret
xor eax, eax
pop edi
pop esi
mov dword [ebp], eax
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret
Function at 0x412640
Capabilities:
Get hostname

Disassembly:
push ebp
push edi
push 0x32
xor eax, eax
mov ecx, 0x3a
mov edi, 0x4912c0
push 0x4912c0
rep stosd dword es:[edi], eax
call sub.WS2_32.dll_gethostname
mov ebp, dword [esp + 0xc]
test ebp, ebp
je 0x41268d
or ecx, 0xffffffff
xor eax, eax
mov edi, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x31
jle 0x41268d
mov eax, dword [0x45e8b0]
push 0x137
push eax
push 0x45ea00
call fcn.0040cd30
add esp, 0xc
push 0x31
push ebp
push 0x4912f2
call fcn.00405810
mov edx, dword [esp + 0x1c]
add esp, 0xc
test edx, edx
je 0x4126b2
mov cl, byte [edx]
xor eax, eax
test cl, cl
sete al
test eax, eax
je 0x4126c3
lea ecx, [esp + 0x10]
push ecx
call fcn.0040fab0
mov edx, dword [esp + 0x14]
add esp, 4
test edx, edx
je 0x4126f5
or ecx, 0xffffffff
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x31
jle 0x4126f5
mov edx, dword [0x45e8b0]
push 0x13b
push edx
push 0x45ea48
call fcn.0040cd30
mov edx, dword [esp + 0x1c]
add esp, 0xc
push esi
push 0x31
push edx
push 0x491324
call fcn.00405810
push 0x45ea90
call fcn.00440ecc
mov esi, eax
add esp, 0x10
cmp esi, 0x3e8
jbe 0x41276d
test esi, esi
je 0x412747
or ecx, 0xffffffff
xor eax, eax
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x31
jle 0x412747
mov eax, dword [0x45e8b0]
push 0x13e
push eax
push 0x45ea98
call fcn.0040cd30
add esp, 0xc
push 0x31
push esi
push 0x491356
call fcn.00405810
push 0x3a
push 0x491356
call fcn.00405f10
add esp, 0x14
cmp eax, 0x3e8
jbe 0x41276d
mov byte [eax], 0
mov ecx, 0x491356
test ecx, ecx
pop esi
je 0x412788
mov dl, byte [0x491356]
xor eax, eax
test dl, dl
sete al
test eax, eax
je 0x4127ce
mov edx, 0x4912c0
test edx, edx
je 0x4127ba
or ecx, 0xffffffff
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x31
jle 0x4127ba
mov eax, dword [0x45e8b0]
push 0x149
push eax
push 0x45ead8
call fcn.0040cd30
add esp, 0xc
push 0x31
push 0x4912c0
push 0x491356
call fcn.00405810
add esp, 0xc
call fcn.00410c70
mov dword [0x491388], eax
mov eax, dword [esp + 0x14]
mov ecx, eax
dec ecx
je 0x41284c
dec ecx
je 0x412840
test eax, eax
mov dword [0x4913b8], 0
jge 0x4127f4
neg eax
push 0x49138c
mov dword [0x491390], eax
mov dword [0x491394], 0
call fcn.00409260
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
push 0x45eb28
push ebp
mov dword [0x4913a0], ecx
mov dword [0x4913a4], edx
call fcn.00405e50
add esp, 0xc
test eax, eax
pop edi
pop ebp
jne 0x41283a
mov byte [0x45e918], al
mov eax, 0x4912c0
ret
mov dword [0x4913b8], 1
jmp 0x4127f4
mov dword [0x4913b8], 2
jmp 0x4127f4
Function at 0x414f70
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [esp + 0x110]
push esi
mov esi, dword [esp + 0x118]
lea ecx, [eax + 1]
mov dword [esp + 0x10], eax
lea eax, [esp + 4]
push eax
push 0
push 0
lea edx, [esp + 0x18]
push edx
push ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 1
call sub.WS2_32.dll_select
test eax, eax
jge 0x414ff8
cmp dword [0x493560], 4
jne 0x414fde
push esi
push 0x45f2d8
push 0x466868
call fcn.00440e9a
add esp, 0xc
xor eax, eax
pop esi
add esp, 0x10c
ret
mov eax, dword [0x45e8b0]
push 0x78d
push eax
push 0x45f308
call fcn.0040cdb0
add esp, 0xc
xor eax, eax
pop esi
add esp, 0x10c
ret

Function at 0x4210c0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
ret
Function at 0x4437f5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x443815
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00449e37
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x443836
test byte [esp + 8], 2
je 0x443836
mov dword [0x493560], 0xd
mov dword [0x493564], 5
jmp 0x443811
xor eax, eax
ret

Function at 0x44c555
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x467ce0
cmp edx, dword [eax]
je 0x44c577
add eax, 8
inc ecx
cmp eax, 0x467d70
jl 0x44c568
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x467ce0]
jne 0x44c6a5
mov eax, dword [0x49362c]
cmp eax, 1
je 0x44c67f
test eax, eax
jne 0x44c5a8
cmp dword [0x466f28], 1
je 0x44c67f
cmp edx, 0xfc
je 0x44c6a5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x44c5df
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004472b0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004462d0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x44c622
lea eax, [ebp - 0x1a4]
push eax
call fcn.004462d0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x454508
push edi
call fcn.004424e0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004472b0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004472c0
lea eax, [ebp - 0xa0]
push 0x454504
push eax
call fcn.004472c0
push dword [esi + 0x467ce4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004472c0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0044c760
add esp, 0x2c
pop edi
jmp 0x44c6a5
lea eax, [ebp + 8]
lea esi, [esi + 0x467ce4]
push 0
push eax
push dword [esi]
call fcn.004462d0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..3ean
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x61ae418a
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..7LWLf
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x654a72e5
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4310c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219