joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46fe90
Capabilities:
Contain obfuscated stackstrings
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x46fe1f
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x46fe3d
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x46fe9b
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x46fe82
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x46fe8b
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x46fe95
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x46fe77
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x46fe01
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x46fee8
dec eax
je 0x46fedf
sub eax, 3
je 0x46fed6
mov dword [ebp - 4], 0x40
jmp 0x46ff05
mov dword [ebp - 4], 4
jmp 0x46feeb
mov dword [ebp - 4], 0x20
jmp 0x46feeb
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x46ff37
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x46feb7
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0046f748
je 0x46ff94
fldenv [edi - 1]
jne 0x46ff42
push 1
push esi
call edi
mov eax, esi
jmp 0x46ff43
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret
test dword [esp + edi*8 - 0x39a80001], esi
test dword [ebp + 0x4afffffc], esi
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
invalid
invalid
lodsb al, byte [esi]
cld
Function at 0x470e78
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea eax, [ecx + eax + 4]
mov dword [ebp - 0x6f8], eax
and dword [ebp - 0x700], 0
jmp 0x470e98
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
mov eax, dword [ebp - 0x700]
cmp eax, dword [ebp - 0x38c]
jae 0x470eea
mov eax, dword [ebp - 0x748]
add eax, dword [ebp - 0x700]
movsx eax, byte [eax]
movsx ecx, byte [ebp - 8]
xor eax, ecx
mov ecx, dword [ebp - 0x748]
add ecx, dword [ebp - 0x700]
mov byte [ecx], al
mov eax, dword [ebp - 0x748]
add eax, dword [ebp - 0x700]
movsx eax, byte [eax]
not eax
mov ecx, dword [ebp - 0x748]
add ecx, dword [ebp - 0x700]
mov byte [ecx], al
jmp 0x470e8b
and dword [ebp - 0x700], 0
jmp 0x470f00
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
mov eax, dword [ebp - 0x700]
cmp eax, dword [ebp - 0x688]
jae 0x470f52
mov eax, dword [ebp - 0x6f8]
add eax, dword [ebp - 0x700]
movsx eax, byte [eax]
movsx ecx, byte [ebp - 8]
xor eax, ecx
mov ecx, dword [ebp - 0x6f8]
add ecx, dword [ebp - 0x700]
mov byte [ecx], al
mov eax, dword [ebp - 0x6f8]
add eax, dword [ebp - 0x700]
movsx eax, byte [eax]
not eax
invalid
invalid
Function at 0x501000
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
cmp dword [ebx], 0
jne 0x50102e
mov ecx, 4
mov dl, 1
mov eax, dword [0x4ff6e8]
call fcn.00503dc8
call fcn.0040376c
mov eax, dword [ebx]
mov byte [eax + 0x14], 1
mov eax, dword [ebx]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [esi + 0x2c]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x50105d
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3e5
je 0x50105d
xor eax, eax
jmp 0x50105f
mov al, 1
test al, al
jne 0x50107f
call sub.kernel32.dll_GetLastError_1
push eax
mov ecx, 3
mov dl, 1
mov eax, dword [0x4ff6e8]
call fcn.00503d04
call fcn.0040376c
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x52d7c8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404128
mov eax, dword [ebp - 8]
call fcn.00404128
mov eax, dword [ebp - 0xc]
call fcn.00404128
xor eax, eax
push ebp
push 0x52d897
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x52d8b0
call fcn.00403f7c
lea eax, [ebp - 8]
mov edx, 0x52d8b0
call fcn.00403f7c
lea eax, [ebp - 0xc]
mov edx, 0x52d8b0
call fcn.00403f7c
mov bl, 1
push 1
lea eax, [ebp - 0xc]
call fcn.00404144
push eax
lea eax, [ebp - 8]
call fcn.00404144
push eax
lea eax, [ebp - 4]
call fcn.00404144
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jae 0x52d87c
xor ebx, ebx
push 0
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, 0x52d8bc
call fcn.00403fc0
mov eax, dword [ebp - 0x10]
mov cx, word [0x52d8d0]
mov dl, 1
call fcn.00459254
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52d89e
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403d1c
ret
Function at 0x1000a736
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x20]
lea ecx, [esp + 0x30]
mov dword [0x100486d0], 0x1e02
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.1000ba74
lea ecx, [0x1000a879]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x80], edx
mov dword [0x100486d0], 0x3f2
mov dword [esp + 0x5c], 0x13e000
mov edx, dword [0x100486bc]
mov dword [esp + 0x48], edx
mov edx, dword [0x100486c0]
mov dword [esp + 0x50], edx
mov edx, dword [0x100486c4]
mov dword [esp + 0x3c], edx
mov edx, dword [0x100486c8]
mov dword [esp + 0x78], edx
mov edx, dword [0x100486cc]
mov dword [esp + 0x58], edx
mov dword [0x100486d4], 0xffffe050
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
jne 0x1000a7eb
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x1000a809
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [0x100486d0], 0x18db
mov dword [esp + 0x14], eax
jmp 0x1000a7c8
lea eax, [esp + 0x30]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x40], ecx
mov dword [0x100486d4], 0x983
mov dword [0x100486d0], 0x297
mov edx, dword [esp + 0xc]
mov esi, dword [ecx + edx + 0x50]
mov dword [esp + 0x74], esi
mov esi, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.1000b903
mov dword [0x100486d4], 0x8f1
mov ecx, esp
lea edx, [esp + 0x30]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov ecx, dword [0x100486d4]
add ecx, 0xffffde88
mov dword [0x100486d0], ecx
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x1000af69
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x100486dc], 0
mov byte [0x100486e0], 0
mov edi, dword [0x100486d4]
add edi, 0xfffff865
mov dword [0x100486d4], edi
mov dword [0x100486d8], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1000b0a0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, 0x100
add ecx, 0xfffffb22
mov dword [ebp - 0x28], eax
xor esi, esi
mov dword [ebp - 0x2c], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x100486d4], ecx
mov ecx, dword [0x100486dc]
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x28]
movzx esi, byte [edi + ebx]
add esi, ecx
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + edx]
add esi, edx
mov eax, esi
cdq
mov esi, dword [ebp - 0x2c]
idiv esi
mov dword [0x100486dc], edx
mov cl, byte [edi + ebx]
mov byte [0x100486e0], cl
mov dword [0x100486d4], 0xc06
mov cl, byte [edi + edx]
mov byte [edi + ebx], cl
mov cl, byte [0x100486e0]
mov edx, dword [0x100486dc]
mov byte [edi + edx], cl
mov edx, dword [0x100486d0]
add edx, 0x2167
mov dword [0x100486d0], edx
mov edx, dword [0x100486d8]
add edx, 1
mov dword [0x100486d8], edx
mov ecx, dword [0x100486d4]
cmp edx, 0x100
mov esi, ecx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x20], edx
jl 0x1000afbb
jmp 0x1000b0d2
xor eax, eax
mov ecx, dword [0x100486d4]
mov edx, ecx
add edx, 0x155b
mov dword [0x100486d0], edx
mov dword [0x100486d8], 0
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
jmp 0x1000afbb
mov eax, dword [ebp - 0x1c]
mov dword [0x100486d4], 0xca1
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x100486d8]
add eax, 1
mov dword [0x100486d8], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1000b0a0
jmp 0x1000b075
mov eax, dword [ebp - 0x30]
add eax, 0x459
mov dword [0x100486d4], eax
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000b0f4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x100486d4], 0x1e81
mov dword [0x100486d8], 0
mov dword [0x100486dc], 0
mov dword [0x100486e4], 0
mov dword [0x100486d0], 0x26dd
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x1000b26c
jmp 0x1000b17a
mov eax, dword [0x100486d8]
mov ecx, dword [0x100486dc]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x100486d8], edx
mov dword [0x100486d0], 0x4eb
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x34]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x100486dc], edx
mov dword [0x100486d4], 0xa9a
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x100486e0], cl
mov dword [0x100486d0], 0xffffe7ca
mov edi, dword [ebp - 0x20]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov edx, dword [0x100486d4]
add edx, 0xffffe4a8
mov dword [0x100486d0], edx
mov cl, byte [0x100486e0]
mov edx, dword [0x100486dc]
mov byte [edi + edx], cl
mov dword [0x100486d4], 0x1f7a
mov edx, dword [0x100486d8]
movzx edx, byte [edi + edx]
mov ebx, dword [0x100486dc]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x100486e4], ebx
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x30]
mov cl, byte [edx + ecx]
xor cl, byte [edi + ebx]
mov ebx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x30]
mov byte [ebx + edx], cl
mov dword [0x100486d0], 0x1826
add edx, 1
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
mov dword [ebp - 0x2c], edx
jne 0x1000b163
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000b3c2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x40
mov eax, dword [ebp + 8]
mov dword [0x100486d0], 0x12db
mov dword [ebp - 0x10], eax
call fcn.1000b274
mov ecx, eax
mov dword [0x100486d4], 0x983
mov edx, dword [eax + 0x3c]
mov dword [0x100486d0], 0x297
mov edx, dword [eax + edx + 0x78]
mov dword [0x100486d4], 0x1bf3
mov esi, ecx
add esi, dword [eax + edx + 0x20]
mov dword [0x100486d0], 0xfffffbb5
mov eax, dword [eax + edx + 0x18]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], eax
xor eax, eax
mov ecx, dword [ebp - 0x20]
cmp ecx, 0
mov dword [ebp - 0x24], eax
je 0x1000b480
jmp 0x1000b48b
mov eax, dword [ebp - 0x28]
mov ecx, eax
mov edx, dword [ebp - 0x2c]
add ecx, edx
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x31], bh
mov byte [ebp - 0x32], cl
je 0x1000b4d5
jmp 0x1000b4a9
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov esi, dword [ebp - 0x14]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edx
jmp 0x1000b439
mov eax, dword [ebp - 0x24]
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x1c]
add eax, 0x24
mov dword [ebp - 0x48], eax
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x48]
add ecx, dword [ecx + edx]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], eax
jmp 0x1000b464
mov eax, dword [ebp - 0x30]
add eax, 1
mov cl, byte [ebp - 0x31]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x32]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x28], eax
jne 0x1000b439
mov al, byte [ebp - 0x32]
test al, 1
jne 0x1000b510
jmp 0x1000b4de
mov eax, dword [ebp - 0x44]
add eax, 2
mov dword [ebp - 0x4c], eax
xor eax, eax
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov edx, dword [ebp - 0x20]
cmp ecx, edx
mov esi, dword [ebp - 0x4c]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x24], eax
jb 0x1000b464
jmp 0x1000b480
mov eax, dword [ebp - 0x44]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
add edx, dword [edx + esi + 0x1c]
mov dword [0x100486d0], 0xd83
mov edi, dword [ebp - 0x18]
add edi, dword [edx + ecx*4]
mov dword [ebp - 0x24], edi
jmp 0x1000b480
Function at 0x1000b903
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x100486d4], 0x1a92
mov dword [0x100486d0], 0x2534
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
jmp 0x1000b977
lea eax, [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov dword [0x100486d0], 0x18b3
call fcn.1000b665
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.1000b76c
mov ecx, dword [0x100486d4]
add ecx, 0x65b
mov dword [0x100486d4], ecx
cmp eax, 0
mov dword [ebp - 0x38], eax
je 0x1000ba47
jmp 0x1000b99f
mov eax, dword [ebp - 0x30]
mov cl, byte [eax + 0x1000c84a]
mov dl, byte [eax + 0x1000c81b]
sub dl, cl
mov byte [ebp + eax - 0x24], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x30], eax
je 0x1000b931
jmp 0x1000b977
mov eax, dword [ebp - 0x38]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x100486d0], 0x1b3e
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.1000ac42
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x100486d0], 0x105c
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 8], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x38], ecx
mov dword [0x100486d4], 0x1a71
add ecx, 0x1e5a
mov esi, dword [ebp - 0x3c]
cmp esi, 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x1000ba3e
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x50
pop esi
pop ebp
ret
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret
Function at 0x414e60
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x100
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
push edi
mov edi, eax
jne 0x414fcb
mov edi, 0x5ea438
mov edx, edi
mov ecx, dword [0x5ec420]
test ecx, ecx
jne 0x414e8c
mov ecx, 0x5ea438
mov eax, dword [0x5ec3d8]
test eax, eax
jne 0x414e9a
mov eax, 0x5ea438
push edi
push edx
push ecx
push eax
lea eax, [esp + 0x98]
push str._s_s_s_tv_s_
push eax
call fcn.0058815f
push str.CountryB
lea ecx, [esp + 0xa4]
push ecx
lea edx, [esp + 0x28]
push 0x5be860
push edx
call fcn.0058815f
lea edi, [esi + 0xc]
add esp, 0x28
mov edx, edi
lea ecx, [esp + 8]
call fcn.00414900
test eax, eax
je 0x414ef4
mov eax, dword [esi + 8]
push 1
push 0
push eax
push edi
mov ecx, 0x5ea5e8
call fcn.00417f60
push str.CountryE
lea ecx, [esp + 0x8c]
push ecx
lea edx, [esp + 0x10]
push 0x5be860
push edx
call fcn.0058815f
lea edi, [esi + 0x20]
add esp, 0x10
mov edx, edi
lea ecx, [esp + 8]
call fcn.00414900
test eax, eax
je 0x414f38
mov eax, dword [esi + 8]
push 0
push 0
push eax
push edi
mov ecx, 0x5ea5e8
call fcn.00417f60
push str.CircuitB
lea ecx, [esp + 0x8c]
push ecx
lea edx, [esp + 0x10]
push 0x5be860
push edx
call fcn.0058815f
lea edi, [esi + 0x34]
add esp, 0x10
mov edx, edi
lea ecx, [esp + 8]
call fcn.00414900
test eax, eax
je 0x414f7c
mov eax, dword [esi + 8]
push 1
push 1
push eax
push edi
mov ecx, 0x5ea5e8
call fcn.00417f60
push str.CircuitE
lea ecx, [esp + 0x8c]
push ecx
lea edx, [esp + 0x10]
push 0x5be860
push edx
call fcn.0058815f
lea edi, [esi + 0x48]
add esp, 0x10
mov edx, edi
lea ecx, [esp + 8]
call fcn.00414900
test eax, eax
je 0x414fc0
mov eax, dword [esi + 8]
push 0
push 1
push eax
push edi
mov ecx, 0x5ea5e8
call fcn.00417f60
pop edi
xor eax, eax
pop esi
add esp, 0x100
ret
mov edx, eax
jmp 0x414e7d
Function at 0x4230c0
Capabilities:
Check os version

Disassembly:
sub esp, 0x19c
xor eax, eax
mov cl, byte [eax + str.Unknown]
mov byte [esp + eax + 0x9c], cl
inc eax
test cl, cl
jne 0x4230c8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
xor eax, eax
mov ecx, 0x27
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x9c
call esi
test eax, eax
jne 0x423119
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x94
call esi
test eax, eax
je 0x42323a
mov eax, dword [esp + 0x18]
sub eax, 0
je 0x4231fa
dec eax
je 0x423194
dec eax
jne 0x423212
mov edx, dword [esp + 0xc]
cmp edx, 4
ja 0x423152
xor eax, eax
nop
lea esp, [esp]
mov cl, byte [eax + str.Windows_NT]
mov byte [esp + eax + 0xa4], cl
inc eax
test cl, cl
jne 0x423140
cmp edx, 5
jb 0x423212
cmp dword [esp + 0x10], 1
jb 0x42317b
xor eax, eax
mov cl, byte [eax + str.Windows_XP]
mov byte [esp + eax + 0xa4], cl
inc eax
test cl, cl
jne 0x423164
jmp 0x423212
xor eax, eax
lea ecx, [ecx]
mov cl, byte [eax + str.Windows_2000]
mov byte [esp + eax + 0xa4], cl
inc eax
test cl, cl
jne 0x423180
jmp 0x423212
mov eax, dword [esp + 0xc]
cmp eax, 4
mov ecx, dword [esp + 0x10]
jb 0x4231c7
cmp ecx, 0x5a
jb 0x4231bc
xor eax, eax
mov cl, byte [eax + str.Windows_ME]
mov byte [esp + eax + 0xa4], cl
inc eax
test cl, cl
jne 0x4231a8
jmp 0x423212
cmp eax, 4
ja 0x4231e4
jne 0x4231c7
test ecx, ecx
ja 0x4231e4
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + str.Windows_95]
mov byte [esp + eax + 0xa4], cl
inc eax
test cl, cl
jne 0x4231d0
jmp 0x423212
xor eax, eax
mov cl, byte [eax + str.Windows_98]
mov byte [esp + eax + 0xa4], cl
inc eax
test cl, cl
jne 0x4231e6
jmp 0x423212
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + str.Microsoft_Win32s]
mov byte [esp + eax + 0xa4], cl
inc eax
test cl, cl
jne 0x423200
mov edx, dword [esp + 0x1a8]
test edx, edx
je 0x42323a
lea ecx, [esp + 0xa4]
lea eax, [esp + 0xa4]
sub edx, ecx
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x423230
pop edi
pop esi
add esp, 0x19c
ret 4
Function at 0x449a80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x194
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
movzx eax, word [edi + 0x1a]
mov esi, ecx
push eax
mov ecx, 0x8acea0
call fcn.004ce8d0
mov dword [esi + 0x54], eax
mov cl, byte [edi + 0x18]
mov byte [esi + 0x58], cl
xor edx, edx
mov edi, edi
cmp edx, 2
lea eax, [edx + edx*2 + 0xc]
lea ecx, [esi + eax*4]
mov eax, dword [edi + edx*8]
jne 0x449ac3
xor ebx, ebx
jmp 0x449ac6
lea ebx, [edx + 1]
test edx, edx
mov ebx, dword [edi + ebx*8]
mov dword [esp + 0x10], ebx
mov ebx, 2
je 0x449ad9
lea ebx, [edx - 1]
mov ebx, dword [edi + ebx*8]
fld dword [eax + 0xc]
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x10]
fsub dword [ebx + 0xc]
fstp dword [ecx]
fld dword [ebx]
fsub dword [eax]
fst dword [ecx + 4]
fmul dword [eax + 0xc]
fld dword [eax]
mov eax, dword [esp + 0xc]
fmul dword [ecx]
faddp st(1)
fst dword [ecx + 8]
fld dword [eax + 0xc]
fmul dword [ecx + 4]
fld dword [ecx]
fmul dword [eax]
faddp st(1)
fcomp st(1)
fnstsw ax
fstp st(0)
test ah, 5
jp 0x449b30
fld dword [ecx]
fchs
fstp dword [ecx]
fld dword [ecx + 4]
fchs
fstp dword [ecx + 4]
fld dword [ecx + 8]
fchs
fstp dword [ecx + 8]
fld dword [ecx + 4]
inc edx
cmp edx, 3
fld dword [ecx]
fld st(0)
fmul st(1)
fld st(2)
fmul st(3)
faddp st(1)
fstp dword [esp + edx*4 + 0x10]
fstp st(0)
fstp st(0)
invalid
Function at 0x45cd70
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi], 0
je 0x45cd7c
mov al, 1
pop esi
ret
xor eax, eax
mov dword [0x8d4680], eax
mov dword [0x8d4684], eax
mov dword [0x8d4688], eax
mov dword [0x8d468c], eax
mov cl, byte [eax + 0x59f0c4]
xor cl, 0x3e
mov byte [eax + 0x8d4680], cl
inc eax
cmp eax, 6
jl 0x45cd92
mov edx, dword [str.f1comp]
mov eax, dword [esi + 4]
push 0
push 0x45d130
push 0x45d0d0
push 0x45cf50
push 0x45cde0
push 0x8d4680
push edx
push eax
xor edx, edx
xor ecx, ecx
call fcn.00561bf0
neg eax
sbb al, al
inc al
mov byte [esi], al
pop esi
ret

Function at 0x45d260
Capabilities:
Encode data using xor

Disassembly:
movzx eax, word [0x7d0fe8]
push esi
mov esi, ecx
mov dword [esi + 4], eax
movzx ecx, word [0x7d0fe8]
xor edx, edx
mov dword [esi + 8], ecx
mov byte [esi], 0
mov dword [0x8d4680], edx
mov dword [0x8d4684], edx
mov dword [0x8d4688], edx
mov dword [0x8d468c], edx
xor eax, eax
mov cl, byte [eax + 0x59f0c4]
xor cl, 0x3e
mov byte [eax + 0x8d4680], cl
inc eax
cmp eax, 6
jl 0x45d296
mov ecx, dword [str.f1comp]
push 0
push 1
push 0x45d2d0
push 8
push 0x8d4680
mov edx, ecx
call fcn.00562b50
mov dword [esi + 0xc], eax
pop esi
ret

Function at 0x45d4e0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
cmp byte [ecx], 0
je 0x45d4f8
mov al, byte [ecx + 1]
xor ecx, ecx
test al, al
je 0x45d4f3
jmp 0x561e00
jmp 0x561e20
ret
push esi
mov esi, ecx
test esi, esi
jne 0x561e0d
mov esi, dword [0x5e4dfc]
mov ecx, esi
call fcn.00561ed0
mov ecx, esi
pop esi
jmp 0x561e30
test ecx, ecx
jne 0x561e2a
mov ecx, dword [0x5e4dfc]
jmp 0x561e30
sub esp, 0x120
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 8], 0x10
mov dword [esp + 0xc], ebx
mov eax, dword [esi + 0xe4]
mov dword [esp + 0x10], ebx
cmp eax, ebx
je 0x561ebc
mov eax, dword [esi]
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], eax
lea ecx, [esp + 0xc]
lea edx, [esp + 0x24]
push ecx
push ebx
push ebx
push edx
push 0x40
call sub.WSOCK32.dll_select
cmp eax, 0xffffffff
je 0x561ebc
cmp eax, ebx
je 0x561ebc
mov edx, dword [esi]
lea eax, [esp + 8]
lea ecx, [esp + 0x14]
push eax
push ecx
push ebx
push 0xff
push 0x8cef80
push edx
call sub.WSOCK32.dll_recvfrom
cmp eax, 0xffffffff
je 0x561e64
lea ecx, [esp + 0x14]
mov edx, 0x8cef80
push ecx
push eax
mov ecx, esi
mov byte [eax + 0x8cef80], bl
call fcn.005622c0
jmp 0x561e64
pop esi
pop ebx
add esp, 0x120
ret

Function at 0x461f70
Capabilities:
Check for time delay via gettickcount
Get socket status
Receive data
Receive data on socket
Resolve function by parsing pe exports
Send data
Send data on socket
Set socket configuration

Disassembly:
mov eax, dword [ecx]
mov ecx, dword [eax + 0x1b79c]
test ecx, ecx
je 0x461f81
jmp fcn.00563410
ret