joyce8/EMBER2024-capa huggingface dataset:
Function at 0xce355a
Capabilities:
Encode data using xor

Disassembly:
call fcn.00d4c587
jmp 0xa6877c
mov ecx, dword [edi]
mov ebp, dword [edi + 4]
add edi, 8
jmp 0x105a4e7
mov dword [esp], 0xee041098
xor dl, bl
sar dword [esp], 0x9e
not dl
jne 0xe95d0a
cmp cl, dl
adc esp, dword [edi - 0x286688fb]
sbb eax, 0xeb4d4f29
xchg ebp, eax
inc edi
jecxz 0xce35db
clc
add eax, 0x988bd580
pop ecx
and al, 0xf8
or eax, 0x8097f5bc
and edi, dword [eax - 0x7e]
mov ebx, dword [eax + 0xdf82459]
mov esp, 0x238097f5
js 0xce3515
insd dword es:[edi], dx
mov edx, 0x2d8dbb95
mov eax, dword [esi + edx*2 - 0x5b1b772a]
mov dx, word [esi + edx*2 - 0x5b1b7726]
jmp 0xd0126d
sbb eax, 0x8bb90001
loop 0xce3586
lodsd eax, dword [esi]
btr ecx, ecx
mov ecx, dword [edi]
mov eax, 0xb78256a3
and eax, eax
movzx ax, byte ss:[ecx]
push 0x90af5331
adc edi, 2
mov word [edi], ax
not dword [esp]
push 0x28bedb3b
lea esp, [esp + 8]
jmp fcn.01059611
add esi, 6
call 0xe5d2e9
push 0x261d7f33
dec dl
inc dword [esp + 4]
push 0x9e0c302f
not dl
push 0xfa096799
ror dl, 1
xor dword [esp + 6], 0x9591f499
jb 0xcc8052
retf 0x7481
xor bl, dl
or byte [esp + 6], 0x8a
lea edx, [esp + edx + 0x10]
call fcn.00d582ac
cdq
loopne 0xe95d22
pushal
push edx
invalid

Function at 0xcf22e8
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + eax*4 - 0x1f2c], 0xf21f17a4
lea edi, [edi + eax*8 - 0x3e54]
jbe 0x1045b89
test eax, 0xd8f265e8
and edx, dword [eax - 0x4c]
call 0x60a3e364
cmp al, 0x8e
fmul st(0), st(0)
lodsd eax, dword [esi]
invalid
mov ebp, esi
movzx ecx, ax
sub ax, 0x15a8
lea esi, [ecx + edx*8 + 0x74a619bc]
mov esi, edi
pop eax
jnp 0xa6b51e
mov ah, 0xd1
mov esp, 0x8b74a619
cmpsb byte [esi], byte es:[edi]
je 0xe8b457
neg dword [eax + 0xf]
mov ecx, dword [edx]
mov esi, 0xd9df33ff
add dl, byte [ebx + 0x73b3891e]
mov edi, 0xdef3b289
mov ecx, 0xc1969b32
xor ebx, edi
fld dword [edx]
xchg ebx, eax
push ds
mov dword [ebx - 0x4d76408d], esi
fidivr word [ecx - 0x3e6964ce]
xchg esi, eax
rcr dword [ebx], 0xb
sbb ecx, dword [ebx]
mov dh, 9
sub dword [ebx + 0x638b81c6], 0x5e
and dword [edx], edi
dec ebx
adc eax, 0xe8b466
xor ch, al
jb 0xe8b4e5
mov ah, 0xe8
add byte [eax], dh
lds esi, [edx - 0x1a]
ja 0xe8b4f8
cmpsd dword [esi], dword es:[edi]
loop 0xe8b505
xor byte [edx - 0x6aac9ed9], cl
mov ah, byte [edi]
popal
push ebx
xchg ebp, eax
adc byte [edx - 0x6d], al
fcom dword [edi - 0x74]
jae 0xe8b4c9
out dx, al
dec eax
dec byte [ecx - 0x10]
xor bl, byte [ecx + esi*2 + 0x3b]
sal edi, 1
mov dl, 0xd9
or al, 0x42
xchg ebp, eax
fstp xword [ebp - 0x6ecfe048]
je 0xe8b4d4
push edx
xor dh, byte [0x692d4c3]
insd dword es:[edi], dx
jo 0xe8b4c5
xchg esp, eax
sub esp, dword [edx - 0x2e]
cmpsb byte [esi], byte es:[edi]
cmp al, 0x58
cmovb eax, ecx
mov dword [0x7bbb25c2], eax
call 0x21524e3
das
mov ebx, 0xd60445f
lahf
invalid
movsx edx, byte [esp + eax - 0x7cb]
jb 0xe8b4bb
Function at 0xd27973
Capabilities:
Encode data using xor

Disassembly:
jb 0x103e440
not byte [esp + 3]
lea esp, [esp + 8]
jmp fcn.00d2d28d
mov dword [esp + 4], 0x113f7201
add edi, 2
push 0xeca72937
shr al, cl
mov word [edi], ax
call fcn.010a7d27
call fcn.00e77e82
mov edx, 0xb091f5bb
mov ecx, edx
mov edx, dword [esi]
ror cl, 0x24
mov ecx, dword [esi + 4]
jb 0xa6dcce
xor bh, al
invalid
adc esi, 7
mov dword ss:[edx], ecx
jmp fcn.00a6b538

Function at 0xd287ec
Capabilities:
Encode data using xor

Disassembly:
dec cl
not cl
add dword [esp + 9], 0xbb31f408
inc cl
inc byte [esp + 9]
push 0x318ed205
xor cl, 0x83
rol byte [esp + 1], 0x23
add dword [ebx], esp
mov dword [esp + 4], 0x4a304891
jb 0xce233f
rol cl, 1
ror dword [esp + 0xf], 0x53
push 0x86a98a00
jb 0x10acb16
xor bl, cl
or byte [esp + 0x14], 5
jnp 0xe77de9
sub byte [ebx - 0x3cc7210e], 0x62
outsd dx, dword [esi]
cmp byte [ebx + 0x338671a], dh
inc edx
vmread dword [ebx + 0x1a], esi
cmpsd dword [esi], dword es:[edi]
sbb byte [edx], dl
cli
push edi
lock sub bh, byte [edx]
pop es
js 0xd28809
cmp ah, dh
enter 0x1bd2, 0x75
salc
std
mov ecx, 0xa2195fc7
jns 0xd288d2
sti
pop ebx
cmp dword [esi - 0x38b0fe83], ebx
inc ebp
inc edx
push ecx
cmp eax, 0x5ee9bb13
pop ebp
add dword [edi - 9], esi
pop ebp
pushfd
ja 0xd28924
std
invalid
cli
invalid
jne 0x1094e8e
mov eax, 0x19aa6eaf
movzx ecx, ax
mov ecx, dword [edi + eax*2 - 0x3354dd5e]
cbw
mov al, byte [eax + edi - 0x19aaffab]
call fcn.00e62e60
sbb byte [esi - 0x7927c1c4], 0x44
invalid
call fcn.00d2e3e1
lea ecx, [esp + ecx + 0x18]
call fcn.00cd3f9c
mov ecx, 0x5bb2bcb3
mov ecx, dword [esi + ecx - 0x5bb2bcb3]
push 0x2599beba
add esi, 4
rol dword [esp], 0xf1
rol dword [esp], 0x7c
dec byte [esp]
mov dword [esp], ecx
jp 0xd6c84e
add cx, ax
push 0x69bc8295
call fcn.0108d389
popfd
jmp 0xe772b9
jmp 0x10777f2

Function at 0x1066f9c
Capabilities:
Encode data using xor

Disassembly:
call int.00e7f1fe
jl fcn.00d2c97a
mov word [eax], dx
push 0x582524b5
jge 0xcff5ad

Function at 0x107f232
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4a326f9c
and dl, dh
call fcn.010a7a01
jmp 0xe80074
push 0x3c3f418f
mov dword [eax], edi
push 0x27a167b8
jmp 0x107f22d
Function at 0x1080f8e
Capabilities:
Encode data using xor

Disassembly:
mov word [edi], dx
not dword [esp + 4]
lea esp, [esp + 8]
jmp fcn.00e6d2e1
mov ecx, 0xb0114794
bt ecx, ecx
not cl
mov cl, byte [edi + 2]
jb 0xe91cca
clc
fidivr dword [edi + 0x1f80e685]
pop eax
add dword [ebx], ebp
inc edx
cmp byte [ebx], bh
xor eax, 0xc6c4e9f6
mov byte [0x416d8b3e], al
xchg ebx, eax
rcr dword [esp + ecx], 0x77
lodsb al, byte [esi]
mov byte [eax + 0x44], bl
enter 0xfffffffffffffb4d, 0xffffffffffffffa9
cmp al, 0x6c
add dl, byte [ecx - 0x611e5d4a]
xchg ecx, eax
mov dh, 0xa2
loope fcn.00e6bcfe
mov ch, 0xc4
dec esi
pop edx
rol dh, cl
push eax
inc esp
mov eax, 0x67785880
xor byte [edi + 0x68], dl
jno 0xe6bd5b
xor byte [ebp + 0x21], ch
add byte [ebx + ecx - 0x11], al
adc edi, 1
push 0xe70d8606
push 0x50974627
shr dx, cl
jmp 0xe656dd
rol al, 1
sar byte [esp + 5], 0x62
push 0x7083f01f
mov dword [esp + 4], 0x51a1f801
inc al
push 0xb29cdc34
xor bl, al
neg dword [esp + 0xc]
sar dword [esp + 5], 0x1a
or dword [esp + 7], 0x2c3983ab
lea eax, [esp + eax + 0x10]
mov dword [eax], edx
jp 0xe6bd20
jle 0xe8e95b
Function at 0x108a16a
Capabilities:
Encode data using xor

Disassembly:
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x1049590]
call fcn.00cdf41d
call fcn.010a1689
mov dx, word [edi]
mov ecx, 0x97aa3004
rol ecx, cl
setb cl
mov cl, byte [ecx + edi - 0x7aa2ffff]
jb 0x10390c8
arpl word [esi + 0x7f630a01], bx
mov cl, 0x2b
sbb esi, dword [esi]
push ecx
cmp eax, ebx
test eax, 0xc1270b23
or al, byte [ebx - 0x24249e81]
push es
test eax, 0x51c64ba3
push ecx
dec edx
cmp eax, dword [esi]
jp 0x108a1a2
mov eax, dword [0xc5300108]
cli
push ebx
pop ebp
test al, 0x13
mov dh, 0xf8
jmp 0x108a20b
and dword [bx + 0x77], ebp
and al, ah
jae 0x108a213
lahf
adc eax, 0x5fbb2fff
xor ebp, dword [esi]
leave
add byte [edi + 0x13], bl
in eax, 0x4f
push edi
imul esi, ebx, 0x31
test byte [ecx], 0x2e
and ecx, dword [ecx - 0x1bb901a0]
add ebp, esp
push ecx
cmp eax, 0x3fd51dcd
push edi
jne 0x108a242
int3
or bl, byte [0x13b2fb12]
mov ah, 0xc0
test al, 0xa
nop
loopne 0x108a24b
or dl, byte [eax + 0xaa8fce0]
test al, 0xa
add ecx, dword [edx + 0x18]
adc esp, edx
cmpsb byte gs:[esi], byte es:[edi]
imul ebx, dword [ebx], 0xffffffbf
add bl, byte [ecx + 0x1845dedc]
mov dl, 0xd3
or ecx, ebp
push ecx
cmp dword [edi], 0x57
cmc
jns 0x108a2a7
cld
pop esi
sbb edi, dword [edi - 0x1a77537e]
xor al, 0x65
dec bh
cdq
int 0x18
inc edi
inc eax
mov byte [edi], bl
inc eax
xchg esi, eax
int 0xf
inc ecx
mov dl, 0xac
les edi, [edi]
push edi
jne 0x108a22e
mov esp, 0x3f0a6f01
cmpsb byte [esi], byte es:[edi]
stosb byte es:[edi], al
iretd
push edi
fild dword [ebp + 0x39]
mov eax, dword [0x1875e21f]
shr byte [ecx + 0x30107557], 1
cld
add eax, 0x5d287aa4
mov cl, 0x5a
lea edx, [esi + 0x57]
std
jle 0x108a2ff
cmp eax, edi
aad 0xe0
push esi
xchg esi, eax
int3
lcall 0x162a, 0xdac0a78a
push ss
call 0x1177f557
sub ebp, dword [edx + 0x37]
outsd dx, dword [esi]
adc byte [ebx], ch
push 0x37
pop eax
xor cl, dl
xchg eax, esi
cli
adc bh, byte [esi]
fadd st(3)
mov dl, 0xbe
push 0x60569a42
pop edx
mov ecx, 0x108a2ca
das
mov ebx, 0x847b3c5f
mov dword [0xcf759cf1], eax
pushfd
jne 0x108a2f9
sub ecx, dword [ecx - 0x18667e92]
jg 0x108a303
xor ch, byte [0xa123eb65]
cmpsb byte [esi], byte es:[edi]
pop ecx
xor dword [ebx + 0x3f], edx
test eax, 0x27bda162
mov dword [0x3135de25], eax
xchg dword [edi + 0x19], eax
stosb byte es:[edi], al
movsd dword es:[edi], dword [esi]
add dh, ch
jle 0x108a327
retf 0x9f85
Function at 0x4088e0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x1c
mov dword [esp + 4], 0x5c
mov dword [esp], eax
call sub.msvcrt.dll_wcsrchr
cmp eax, ebx
mov esi, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jbe 0x408980
test eax, eax
je 0x408980
cmp word [eax], 0x3a
je 0x408980
cmp word [eax - 2], 0x5c
je 0x408980
xor edi, edi
mov word [eax], di
mov dword [esp + 4], 0x5c
mov dword [esp], ebx
call sub.msvcrt.dll_wcsrchr
cmp ebx, eax
mov edi, eax
jae 0x408960
test eax, eax
je 0x408960
cmp word [eax], 0x3a
je 0x408960
cmp word [eax - 2], 0x5c
je 0x408960
xor edx, edx
mov word [eax], dx
mov eax, ebx
call fcn.004088e0
mov ecx, 0x5c
mov word [edi], cx
nop
lea esi, [esi]
mov dword [esp], ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call edi
sub esp, 4
cmp eax, 0xffffffff
je 0x4089c0
mov eax, 0x5c
mov word [esi], ax
nop
lea esi, [esi]
mov dword [esp], ebx
call edi
sub esp, 4
cmp eax, 0xffffffff
je 0x4089a0
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
sub esp, 8
test eax, eax
jne 0x40898d
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40898f
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
sub esp, 8
test eax, eax
jne 0x408973
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x408973
Function at 0x408cf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebx + 8]
mov dword [ebp - 0x10], edx
cmp eax, 1
je 0x408dd0
cmp eax, 2
je 0x408da0
test eax, eax
je 0x408d23
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
je 0x408e00
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x408e10
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x408d1c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], eax
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
mov eax, dword [ebp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
call fcn.00409e50
mov ebx, dword [ebp - 4]
leave
ret
mov eax, dword [ebp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
call fcn.0040a220
mov ebx, dword [ebp - 4]
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x408d50
jmp 0x408e16
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
ja 0x408e30
movzx eax, byte [eax + 0x412200]
jmp 0x408d1e
mov eax, 1
jmp 0x408d1e

Function at 0x409db0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00409690
mov ebx, eax
mov eax, 2
test ebx, ebx
je 0x409e3f
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x20
mov dword [esp + 0x10], 0x20
mov dword [esp + 0xc], 1
mov dword [esp + 8], 1
mov dword [esp + 4], 3
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
sub esp, 0x20
mov esi, eax
mov dword [esp], ebx
call fcn.004099e0
cmp esi, 0xffffffff
mov eax, 4
je 0x409e3f
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov dword [eax], esi
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov dword [eax + 4], 0
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x409e50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0xc]
sub esp, 0x34
mov ebx, dword [ebp + 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x409ea0
test ebx, ebx
je 0x409eb3
mov eax, dword [ebp - 0xc]
mov dword [ebx], eax
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], eax
call fcn.00409ca0
mov ebx, dword [ebp - 4]
leave
ret
xor eax, eax
jmp 0x409e97

Function at 0x409ec0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0xc]
sub esp, 0x34
mov ebx, dword [ebp + 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x409f10
test ebx, ebx
je 0x409f23
mov eax, dword [ebp - 0xc]
mov dword [ebx], eax
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], eax
call fcn.00409ca0
mov ebx, dword [ebp - 4]
leave
ret
xor eax, eax
jmp 0x409f07
Function at 0x40a040
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea esi, [ebp - 0x118]
sub esp, 0x14c
mov eax, dword [str.socket.]
mov dword [ebp - 0x130], 1
mov ebx, dword [ebp + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
add eax, dword [ebp + 8]
lea edx, [ebp - 0x12c]
mov dword [esp + 8], esi
mov dword [esp + 4], str._255_:_:_d
mov dword [esp + 0xc], edx
mov dword [esp], eax
call sub.msvcrt.dll_sscanf
mov edi, dword [ebx]
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
call dword [sym.imp.WSOCK32.DLL_socket]
sub esp, 0xc
cmp eax, 0xffffffff
mov dword [edi + 4], eax
jne 0x40a0c4
mov eax, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x130]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 1
mov dword [esp + 4], 6
mov dword [esp + 0xc], eax
mov eax, dword [ebx]
mov eax, dword [eax + 4]
mov dword [esp], eax
call dword [sym.imp.WSOCK32.DLL_setsockopt]
sub esp, 0x14
cmp eax, 0xffffffff
je 0x40a0b7
mov dword [esp], esi
lea esi, [ebp - 0x128]
call dword [sym.imp.WSOCK32.DLL_gethostbyname]
mov edi, eax
mov eax, 2
mov dword [ebp - 0x128], 0
mov word [ebp - 0x128], ax
movzx eax, word [ebp - 0x12c]
sub esp, 4
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0
mov dword [esp], eax
call dword [sym.imp.WSOCK32.DLL_htons]
mov word [ebp - 0x126], ax
mov eax, dword [edi + 0xc]
sub esp, 4
test byte [ebp + 0xc], 4
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp + 8], 0x10
mov dword [esp + 4], esi
mov dword [ebp - 0x124], eax
mov eax, dword [ebx]
mov eax, dword [eax + 4]
mov dword [esp], eax
je 0x40a1e0
call dword [sym.imp.WSOCK32.DLL_bind]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x40a0b7
mov dword [esp + 4], 1
mov eax, dword [ebx]
mov eax, dword [eax + 4]
mov dword [esp], eax
call dword [sym.imp.WSOCK32.DLL_listen]
sub esp, 8
cmp eax, 0xffffffff
je 0x40a0b7
mov eax, dword [ebx]
mov dword [eax], 0
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov dword [eax + 4], 0
xor eax, eax
jmp 0x40a0bc
call dword [sym.imp.WSOCK32.DLL_connect]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x40a0b7
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [ebx]
mov dword [eax], 0xffffffff
xor eax, eax
jmp 0x40a0bc
Function at 0x40a220
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea edx, [ebp - 0x164]
lea esi, [ebp - 0x10c]
sub esp, 0x180
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10c], 1
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x164], 0
mov eax, dword [ebx + 4]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [ebp - 0x108], eax
add eax, 1
mov dword [esp], eax
call dword [sym.imp.WSOCK32.DLL_select]
sub esp, 0x14
test eax, eax
js 0x40a320
mov dword [esp + 4], esi
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sub.WSOCK32.DLL___WSAFDIsSet
sub esp, 8
test eax, eax
je 0x40a310
cmp dword [ebx], 0xffffffff
je 0x40a363
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebx + 4]
mov dword [esp], eax
call dword [sym.imp.WSOCK32.DLL_accept]
sub esp, 0xc
cmp eax, 0xffffffff
mov esi, eax
je 0x40a310
mov eax, dword [ebx + 4]
mov dword [esp], eax
call dword [sym.imp.WSOCK32.DLL_closesocket]
mov ecx, dword [ebp + 0x1c]
sub esp, 4
mov dword [ebx + 4], esi
mov dword [ebx], 0xffffffff
test ecx, ecx
je 0x40a398
mov eax, dword [ebp + 0x1c]
mov dword [eax], 0
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea esp, [ebp - 8]
mov eax, 1
pop ebx
pop esi
pop ebp
ret
lea ebx, [ebp - 0x15c]
mov dword [esp + 0xc], 0x8b
mov dword [esp + 8], str..._.._.._.._.._src_osd_windows_winsocket.c
mov dword [esp + 4], str.win_read_socket_:__s_:__d
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
mov dword [esp], ebx
call sub.msvcrt.dll_perror
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], eax
call fcn.00409230
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov eax, dword [ebp + 0x18]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
mov dword [esp], eax
call dword [sym.imp.WSOCK32.DLL_recv]
sub esp, 0x10
test eax, eax
js 0x40a3a1
mov edx, dword [ebp + 0x1c]
test edx, edx
je 0x40a398
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], eax
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], eax
call fcn.00409230
jmp 0x40a303

Function at 0x40a3c0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x1c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [esp], eax
call dword [sym.imp.WSOCK32.DLL_send]
sub esp, 0x10
test eax, eax
js 0x40a410
test ebx, ebx
je 0x40a403
mov dword [ebx], eax
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
xor eax, eax
jmp 0x40a3fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], eax
call fcn.00409230
jmp 0x40a3fe
Function at 0x40ad90
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.0040adf0

Function at 0x40adf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov eax, dword [0x35ee4800]
test eax, eax
jle 0x40aef3
mov edx, dword [0x35ee4804]
xor ebx, ebx
mov ecx, dword [edx + 4]
cmp ecx, esi
ja 0x40ae21
mov edi, dword [edx + 8]
add ecx, dword [edi + 8]
cmp esi, ecx
jb 0x40ae96
add ebx, 1
add edx, 0xc
cmp ebx, eax
jne 0x40ae10
mov dword [esp], esi
call fcn.0040b730
test eax, eax
mov edi, eax
je 0x40af1a
lea esi, [ebx + ebx*2]
mov ebx, dword [0x35ee4804]
shl esi, 2
add ebx, esi
mov dword [ebx + 8], eax
mov dword [ebx], 0
call fcn.0040b820
add eax, dword [edi + 0xc]
mov dword [ebx + 4], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [0x35ee4804]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + esi + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40aefa
mov eax, dword [ebp - 0x20]
cmp eax, 0x40
jne 0x40aea0
add dword [0x35ee4800], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 4
je 0x40ae8f
cmp eax, 0x80
je 0x40ae8f
cmp eax, 8
je 0x40ae8f
mov eax, dword [ebp - 0x28]
add esi, dword [0x35ee4804]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0xc], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x40ae8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0040ad90
xor ebx, ebx
jmp 0x40ae2b
mov eax, dword [0x35ee4804]
mov eax, dword [eax + esi + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0040ad90
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0040ad90
lea esi, [esi]

Function at 0x40b650
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x40b688
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x40b67e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x40b68a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x40b670
xor eax, eax
pop ebx
pop esi
ret
Function at 0x417cd0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
xor esi, esi
call fcn.00417c10
lea eax, [esp + 4]
push eax
push 0x20019
push esi
push str.CLSIDED834ED6_4B5A_4bfe_8F11_26DCA6B6A921InProcServer32
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x417d03
xor eax, eax
pop esi
add esp, 8
ret 4
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 4]
lea ecx, [esp + 8]
mov dword [esp + 8], 0x104
push ecx
push edx
push 0
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x417d2f
mov esi, 1
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret 4

Function at 0x45c1b0
Capabilities:
Encode data using xor

Disassembly:
mov dh, 0x1f
insd dword es:[edi], dx
push 4
sbb eax, 0xf44508fd
out dx, al
scasd eax, dword es:[edi]
mov bh, 0x29
cmp byte [0x4cc36645], 0x2d
sub al, 0x3f
aas
fnstsw word [0x78c3ea7d]
lodsd eax, dword [esi]
sbb dword [ebx + 0x27bb948f], edi
call edx
xor byte [edi + eax - 0x19], al
jbe 0x45c1c6
push ss
sbb eax, ecx
scasd eax, dword es:[edi]
sub cl, byte [esi - 0x79]
mov esi, 0x6cad373a
lodsb al, byte [esi]
and eax, 0x840b3272
out dx, eax
jle 0x45c22b
out 0x37, eax
mov eax, 0xfb153bc4
out dx, eax
outsd dx, dword [esi]
xchg esi, eax
iretd
scasb al, byte es:[edi]
cmp eax, 0xdb87d7f5
inc edx
std
mov byte [0x6bc500f9], al
insd dword es:[edi], dx
xor eax, 0xffee016b
aam 0x17
std
pop edi
mov esi, ebp
mov ecx, 0x3330fd3
cmp dword [ecx - 0x6c], ebp
sbb dword [ecx + 0x7f], edi
rcr eax, 1
xchg edi, eax
push ds
pop esp
invalid

Function at 0x4a1b6c
Capabilities:
Encode data using xor

Disassembly:
add byte [bp + di + 0x44f7], dh
mov edi, 0x8dad7010
lodsd eax, dword [esi]
lea ebp, [edx - 0x3f]
push edi
mov ebp, 0x1ce364df
jecxz 0x4a1b9a
retf