joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a5bc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
cmp dword [0x43d610], 0
push ebx
push esi
push edi
mov ebx, 0x400
jne 0x41a607
push 0x64
lea eax, [ebp - 0x12c]
push eax
push 0xf
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ax, word [ebp - 0x12c]
mov word [0x45dca0], ax
xor eax, eax
mov word [0x45dca2], ax
mov dword [0x43d610], 0x45dca0
push 0x32
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040fc65
mov edi, dword [ebp + 0x10]
xor eax, eax
mov esi, dword [ebp + 0x14]
push esi
push edi
push 0x43d600
mov word [edi], ax
lea eax, [ebp - 0x64]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
xor eax, eax
mov word [edi + esi*2 - 2], ax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x41a81f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.0041e1c0
cmp byte [0x449470], 0
je 0x41a8cd
push 0x800
lea eax, [ebp - 0x200c]
push eax
push dword [ebp + 8]
call fcn.0041bcf0
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41a8cd
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x1000
push eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x200c]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41a8c4
mov eax, dword [ebp - 4]
mov ecx, 0x7ff
shr eax, 1
mov dword [ebp - 4], eax
cmp eax, ecx
jb 0x41a8a8
mov eax, ecx
push dword [ebp + 0xc]
xor ecx, ecx
mov word [ebp + eax*2 - 0x100c], cx
lea eax, [ebp - 0x100c]
push eax
push dword [ebp + 8]
call fcn.0040fd96
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret 8
Function at 0x41a986
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x2004
call fcn.0041e1c0
mov ecx, dword [esp + 0x2014]
push ebx
xor ebx, ebx
push esi
test ecx, ecx
je 0x41a9a1
mov byte [ecx], bl
mov edx, dword [esp + 0x2020]
test edx, edx
je 0x41a9ae
mov byte [edx], bl
mov esi, dword [esp + 0x2010]
test esi, esi
je 0x41aa71
movzx eax, word [esi]
test ax, ax
je 0x41aa71
push ebp
mov ebp, dword [esp + 0x2018]
push edi
mov edi, dword [esp + 0x2020]
mov dword [esp + 0x10], ebx
movzx eax, ax
add esi, 2
cmp eax, 0x3d
jne 0x41a9fb
test edi, edi
je 0x41aa05
test ebx, ebx
jne 0x41aa05
test ecx, ecx
je 0x41a9f7
mov byte [ecx], 1
mov ebx, ebp
jmp 0x41aa1c
cmp eax, 0xd
je 0x41aa2f
cmp eax, 0xa
je 0x41aa32
mov word [ebp], ax
add ebp, 2
mov eax, dword [esp + 0x202c]
add eax, 0xfffffffe
cmp dword [esp + 0x10], eax
jge 0x41aa2a
movzx eax, word [esi]
inc dword [esp + 0x10]
test ax, ax
jne 0x41a9dd
jmp 0x41aa32
mov byte [edx], 1
jmp 0x41aa32
add esi, 2
xor eax, eax
mov word [ebp], ax
test edi, edi
je 0x41aa6b
mov word [edi], ax
test ebx, ebx
je 0x41aa6b
push 0x1000
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [esp + 0x202c]
lea eax, [esp + 0x18]
push eax
push edi
call fcn.0040fd96
xor eax, eax
mov word [ebx], ax
pop edi
mov eax, esi
pop ebp
jmp 0x41aa73
xor eax, eax
pop esi
pop ebx
add esp, 0x2004
ret 0x18

Function at 0x41aa7e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push eax
push dword [ebp + 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov ebx, eax
neg ebx
sbb bl, bl
add bl, 1
je 0x41aad9
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [ebp - 4]
dec eax
neg eax
sbb al, al
lea ebx, [eax + 1]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0x432260]
call esi
pop esi
jmp 0x41aae1
mov eax, dword [ebp + 8]
xor ecx, ecx
mov word [eax], cx
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41cf10
Capabilities:
Hide graphical window

Disassembly:
and dword [0x44744c], 0
push 1
push dword [esp + 8]
mov byte [0x447440], 1
mov byte [0x447441], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 2
push dword [esp + 0xc]
call fcn.004012c8
cmp dword [0x447454], 0
jne 0x41cf50
cmp byte [0x447446], 0
je 0x41cf59
cmp dword [0x44743c], 0
jne 0x41cf6c
push 0
push 1
push 0x111
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
ret 4

Function at 0x41d06f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0041e1c0
cmp byte [0x449470], 0
je 0x41d0fe
cmp word [0x449472], 0
je 0x41d0fe
push esi
push 0x800
lea eax, [ebp - 0x1008]
push eax
push 0x449472
call fcn.0041bcf0
lea eax, [ebp - 8]
xor esi, esi
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41d0fd
push dword [ebp + 8]
call fcn.004233f3
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1008]
push 1
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x41d104
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.0041e1c0
push esi
push dword [ebp + 8]
push str.sfxcmd
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x1000
lea eax, [ebp - 0x2000]
push eax
push dword [ebp + 8]
call fcn.0040fb18
mov esi, eax
test esi, esi
je 0x41d15c
movzx ecx, word [esi]
push ecx
jmp 0x41d147
add esi, 2
movzx eax, word [esi]
push eax
call fcn.0040fc31
test al, al
jne 0x41d140
push esi
push str.sfxpar
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc
Function at 0x401000
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
push ebx
push esi
xor esi, esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], eax
cmp esi, dword [ebp + 0x10]
jge 0x401191
mov eax, dword [ebp - 0x10]
push 3
pop edx
cmp eax, edx
mov dword [ebp - 0xc], edx
jge 0x401032
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov eax, 0x3d3d3d3d
lea edi, [ebp - 4]
stosw word es:[edi], ax
test ecx, ecx
stosb byte es:[edi], al
jle 0x401059
mov eax, dword [ebp + 8]
lea edi, [ebp - 4]
add esi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, edx
rep movsb byte es:[edi], byte [esi]
mov cl, byte [ebp - 4]
mov al, cl
shr al, 2
test ebx, ebx
mov byte [ebp - 1], al
je 0x40108e
mov edi, dword [ebp + 0x14]
test edi, edi
jle 0x401096
mov eax, ebx
mov esi, dword [ebp + 0xc]
sub eax, dword [ebp - 8]
cdq
idiv edi
test edx, edx
jne 0x401099
mov byte [ebx + esi], 0xd
inc ebx
mov byte [ebx + esi], 0xa
inc ebx
add dword [ebp - 8], 2
jmp 0x401099
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
jmp 0x401099
mov esi, dword [ebp + 0xc]
movzx eax, byte [ebp - 1]
mov edx, dword [0x40e030]
and cl, 3
shl cl, 4
mov al, byte [eax + edx]
mov byte [ebx + esi], al
mov al, byte [ebp - 3]
mov dl, al
inc ebx
shr dl, 4
add cl, dl
test ebx, ebx
je 0x4010df
test edi, edi
jle 0x4010df
mov eax, ebx
sub eax, dword [ebp - 8]
cdq
idiv edi
test edx, edx
jne 0x4010dc
mov byte [ebx + esi], 0xd
inc ebx
mov byte [ebx + esi], 0xa
inc ebx
add dword [ebp - 8], 2
mov al, byte [ebp - 3]
mov edx, dword [0x40e030]
and al, 0xf
movzx ecx, cl
shl al, 2
mov cl, byte [ecx + edx]
mov byte [ebx + esi], cl
mov cl, byte [ebp - 2]
mov dl, cl
inc ebx
shr dl, 6
add al, dl
test ebx, ebx
mov byte [ebp - 1], al
je 0x401123
test edi, edi
jle 0x401123
mov eax, ebx
sub eax, dword [ebp - 8]
cdq
idiv edi
test edx, edx
jne 0x401123
mov byte [ebx + esi], 0xd
inc ebx
mov byte [ebx + esi], 0xa
inc ebx
add dword [ebp - 8], 2
movzx eax, byte [ebp - 1]
mov edx, dword [0x40e030]
mov al, byte [eax + edx]
mov byte [ebx + esi], al
inc ebx
cmp dword [ebp - 0xc], 2
jg 0x40113f
mov byte [ebx + esi - 1], 0x3d
and cl, 0x3f
test ebx, ebx
je 0x401164
test edi, edi
jle 0x401164
mov eax, ebx
sub eax, dword [ebp - 8]
cdq
idiv edi
test edx, edx
jne 0x401164
mov byte [ebx + esi], 0xd
inc ebx
mov byte [ebx + esi], 0xa
inc ebx
add dword [ebp - 8], 2
movzx eax, cl
mov ecx, dword [0x40e030]
mov al, byte [eax + ecx]
mov byte [ebx + esi], al
inc ebx
cmp dword [ebp - 0xc], 1
jg 0x40117f
mov byte [ebx + esi - 1], 0x3d
mov esi, dword [ebp - 0x14]
add esi, 3
sub dword [ebp - 0x10], 3
mov dword [ebp - 0x14], esi
jmp 0x401019
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x401198
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
and dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
push 4
push 0x40f244
call fcn.00403434
pop ecx
pop ecx
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x401282
push ebx
push esi
push edi
mov ebx, 0x40f967
push eax
push ebx
call fcn.00403464
pop ecx
mov dword [ebp - 0xc], eax
pop ecx
lea eax, [ebp - 0x110]
push 0x104
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x401276
lea eax, [ebp - 0x110]
push eax
call fcn.0040c438
xor edi, edi
pop ecx
cmp dword [ebp - 0xc], edi
jle 0x40126e
push edi
push ebx
call fcn.00403434
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00403b7d
add esp, 0x10
test eax, eax
je 0x401268
push 0x40fb6f
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x401268
push 2
push 0x40fc6f
call fcn.00403434
pop ecx
pop ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401261
lea ecx, [ebp - 0x110]
push ecx
push dword [ebp - 4]
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
inc edi
cmp edi, dword [ebp - 0xc]
jl 0x40120f
inc dword [ebp - 8]
jmp 0x4011df
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401284
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
lea eax, [ebp + 0xc]
push esi
and dword [ebp - 4], 0
push eax
push dword [ebp + 0xc]
mov esi, 0x400
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4012b8
xor eax, eax
jmp 0x4013a4
push ebx
push edi
mov edi, 0x40f967
push 0
push edi
call fcn.00403464
pop ecx
mov dword [ebp + 8], eax
pop ecx
lea eax, [ebp - 8]
xor ebx, ebx
push eax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0xc], esi
push eax
mov dword [ebp - 8], esi
push dword [ebp - 4]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x401397
cmp dword [ebp - 0x10], 1
je 0x40130f
and byte [ebp - 0x814], al
lea eax, [ebp - 0x414]
push eax
call fcn.0040c438
lea eax, [ebp - 0x814]
push eax
call fcn.0040c438
cmp dword [ebp + 8], 0
pop ecx
pop ecx
jle 0x40138f
push ebx
push edi
call fcn.00403434
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.00403b7d
add esp, 0x10
test eax, eax
jne 0x401379
push dword [ebp - 0x14]
lea eax, [ebp - 0x814]
push eax
call fcn.00403b7d
pop ecx
test eax, eax
pop ecx
jne 0x401379
lea eax, [ebp - 0x414]
push str.____
push eax
call fcn.004072d0
pop ecx
test eax, eax
pop ecx
jne 0x401389
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
inc ebx
cmp ebx, dword [ebp + 8]
jl 0x40132f
inc dword [ebp - 4]
jmp 0x4012cc
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop ebx
pop esi
leave
ret 8
Function at 0x4013fa
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
push ebx
push 0x40e0c0
call fcn.004074b0
xor ebx, ebx
mov dword [esp], 0x40fde0
push ebx
mov dword [ebp - 0x14], eax
call fcn.0040530f
push ebx
push 0x40fba1
call fcn.00403464
add esp, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 0x444]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push dword [ebp + 8]
mov dword [ebp - 0x340], 0x224
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x340]
mov dword [ebp - 0x18], eax
push ecx
push eax
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x4015ef
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.004073c0
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.0040c590
add esp, 0x10
test eax, eax
je 0x4015ef
push dword [ebp - 0x338]
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x4015ef
push esi
mov esi, 0x80000
push edi
push esi
mov edi, 0x4119e0
push ebx
push edi
call fcn.00407360
mov eax, dword [ebp - 0x328]
add esp, 0xc
cmp eax, esi
jb 0x4014e1
mov eax, esi
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 8], ebx
jne 0x401506
lea ecx, [ebp - 8]
push ecx
push eax
push edi
push dword [ebp - 0x32c]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x4015e1
cmp dword [ebp - 4], ebx
mov dword [ebp + 8], ebx
jbe 0x4015e1
push dword [ebp + 8]
push 0x40fba1
call fcn.00403434
push eax
mov dword [ebp - 0x10], eax
call fcn.004074b0
xor esi, esi
add esp, 0xc
cmp dword [ebp + 0xc], esi
mov ebx, eax
je 0x40153c
lea eax, [ebx + 0x6e]
mov dword [ebp - 8], eax
jmp 0x40153f
mov eax, dword [ebp - 8]
sub eax, ebx
sub eax, 0xa
je 0x4015d2
push dword [ebp - 0x14]
lea edi, [esi + 0x4119e0]
push edi
push 0x40e0c0
call fcn.0040c4e0
add esp, 0xc
test eax, eax
je 0x4015cb
cmp dword [ebp + 0xc], 0
jne 0x40158b
push ebx
push edi
push dword [ebp - 0x10]
call fcn.0040c4e0
add esp, 0xc
test eax, eax
je 0x40158b
mov eax, dword [ebp - 8]
inc esi
sub eax, ebx
sub eax, 0xa
cmp esi, eax
jb 0x40154a
jmp 0x4015d2
push 0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0x40fdcc
call fcn.00403434
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.00403b7d
add esp, 0x10
test eax, eax
jne 0x4015cb
lea eax, [ebp - 0x11c]
push eax
call fcn.00403dfa
pop ecx
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp + 8], eax
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
jb 0x401512
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop ebx
pop edi
pop esi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x40174e
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 2
pop edx
mov esi, ecx
push 4
xor edi, edi
cmp dword [ebp + 0x10], edi
pop ecx
mov eax, closesocket
mov ebx, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
jne 0x401784
mov eax, 0xc0000000
mov ebx, ecx
mov dword [ebp - 8], edx
cmp dword [ebp + 8], edi
je 0x4017be
push edi
push 0x20
push 3
push edi
push 1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x4017ff
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp - 4], edi
mov dword [esi + 0xc], eax
jne 0x4017d2
mov ecx, dword [ebp + 0xc]
cmp ecx, edi
je 0x4017be
mov dword [ecx], eax
push edi
push edi
push edi
push ebx
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, edi
mov dword [esi + 4], eax
jne 0x4017dc
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4017ff
push edi
push edi
push edi
push dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, edi
mov dword [esi + 8], eax
jne 0x401801
push dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi]
call edi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4031d8
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push ebx
push esi
push 1
lea eax, [ebp - 0x190]
pop ebx
mov esi, ecx
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
movsx eax, word [ebp + 0xc]
dec eax
dec eax
jne 0x403202
push 2
pop ebx
movsx eax, bx
push 6
push eax
push 2
call dword [sym.imp.WS2_32.dll_socket]
xor ecx, ecx
cmp eax, 0xffffffff
mov dword [esi], eax
pop esi
setne cl
mov eax, ecx
pop ebx
leave
ret 0xc

Function at 0x403222
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
lea eax, [ebp + 0xc]
push eax
mov ecx, esi
push dword [ebp + 8]
mov word [ebp - 0x10], 2
call fcn.004032c5
mov eax, dword [ebp + 0xc]
push 0x10
mov byte [ebp - 0xc], al
mov al, byte [ebp + 0xe]
mov byte [ebp - 0xa], al
mov al, byte [ebp + 0xf]
mov byte [ebp - 0xb], ah
mov byte [ebp - 9], al
lea eax, [ebp - 0x10]
push eax
push dword [esi]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
pop esi
je 0x40327e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor eax, eax
jmp 0x403281
push 1
pop eax
leave
ret 8

Function at 0x403285
Capabilities:
Send data
Send data on socket

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [ecx]
call dword [sym.imp.WS2_32.dll_send]
ret 0xc

Function at 0x40329c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [ecx]
call dword [sym.imp.WS2_32.dll_recv]
ret 0xc

Function at 0x4032c5
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 1
xor esi, esi
pop ebx
mov dword [ebp - 8], ecx
push edi
mov dword [ebp - 4], esi
call fcn.004074b0
test eax, eax
pop ecx
jle 0x403312
mov al, byte [esi + edi]
cmp al, 0x2e
jne 0x4032f2
inc dword [ebp - 4]
jmp 0x4032fc
cmp al, 0x30
jl 0x4032fa
cmp al, 0x39
jle 0x4032fc
xor ebx, ebx
push edi
inc esi
call fcn.004074b0
cmp esi, eax
pop ecx
jl 0x4032e6
test ebx, ebx
je 0x403324
cmp dword [ebp - 4], 3
je 0x403316
xor eax, eax
jmp 0x403350
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push edi
call fcn.00403357
jmp 0x40334d
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test esi, esi
je 0x40334d
xor eax, eax
mov ecx, dword [esi + 0xc]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ecx]
mov cl, byte [ecx + eax]
mov byte [eax + edx], cl
inc eax
cmp eax, 4
jl 0x403339
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4034cd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
and dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
push ebx
mov cl, byte [eax]
mov al, byte [eax + 1]
push esi
push edi
mov byte [ebp - 2], cl
mov byte [ebp - 1], al
jle 0x403521
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
add eax, ecx
mov dword [ebp - 0xc], eax
mov al, byte [eax]
mov byte [ebp + 0x13], al
pushal
mov al, byte [ebp + 0x13]
mov cl, byte [ebp - 2]
rol al, cl
xor al, byte [ebp - 1]
mov byte [ebp + 0x13], al
popal
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp + 0x13]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jl 0x4034ee
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403529
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
and dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
push ebx
mov cl, byte [eax]
mov al, byte [eax + 1]
push esi
push edi
mov byte [ebp - 2], cl
mov byte [ebp - 1], al
jle 0x40357d
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
add eax, ecx
mov dword [ebp - 0xc], eax
mov al, byte [eax]
mov byte [ebp + 0x13], al
pushal
mov al, byte [ebp + 0x13]
mov cl, byte [ebp - 2]
xor al, byte [ebp - 1]
ror al, cl
mov byte [ebp + 0x13], al
popal
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp + 0x13]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jl 0x40354a
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403cbb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
push edi
push esi
push 0x20
push 2
push esi
push 3
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp + 8], esi
cmp edi, 0xffffffff
je 0x403d05
cmp dword [ebp + 0xc], esi
je 0x403d05
lea eax, [ebp + 8]
push esi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
jmp 0x403d07
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x403d0b
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push 0
push 0x27
push 3
push 0
push 3
push closesocket
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
and dword [ebp + 8], 0
mov edi, eax
or ebx, 0xffffffff
cmp edi, ebx
je 0x403d52
lea eax, [ebp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp + 8], 0
mov ebx, eax
je 0x403d4b
or ebx, 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop ebx
pop ebp
ret