joyce8/EMBER2024-capa huggingface dataset:
Function at 0x663c158b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fseek
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._ftell
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.File_size_is__d_n
call sym._printf
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._malloc
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x663c15f9
mov dword [esp], str.Malloc_failed_
call sym._puts
mov dword [esp], 1
call sym._exit
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fseek
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._fread
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x663c16cb
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov eax, dword [ebp + 8]
call eax
nop
leave
ret

Function at 0x663c1714
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [esp], 0x1388
call sym._Sleep_4
sub esp, 4
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._DeleteFileA_4
sub esp, 4
nop
leave
ret

Function at 0x663c1aa0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x663c603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x663c6034]
sub esp, 4
test ebx, ebx
je 0x663c1aeb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x663c1ae4
test esi, esi
je 0x663c1ae4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x663c1ac0
mov dword [esp], 0x663c603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x663c1cd0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x663c4130
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x663c1d20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x663c1df8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x663c1d5e
cmp eax, 4
jne 0x663c1d80
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x663c1d6e
cmp edx, 4
je 0x663c1d6e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.663c1cd0
Function at 0x420dbd
Capabilities:
Encode data using xor

Disassembly:
dec esp
xchg ebp, eax
mov byte [0xc2daaca7], al
xchg edx, eax
xchg ebx, eax
push esi
sahf
cmc
wait
lar ebp, word [ecx - 0x2547bb35]
sub cl, byte [edx + ecx + 0x347980e5]
fisubr dword [edx]
mov word [edx], cs
in eax, 0x80
jns 0x420e0d
dec edx
xor eax, 0xea626e2b
stosb byte es:[edi], al
je 0x420dd1
invalid
cmp byte [eax + 0x5d], dl
push ebx
cmp eax, 0x66e48be2
invalid
Function at 0x43d7cd
Capabilities:
Encode data using xor

Disassembly:
invalid
wait
out 0xf, al
sub ah, byte [ecx]
dec edx
cwde
les ebx, [eax + 0x3831d547]
shr byte [eax], 0x97
aas
cli
aaa
and eax, 0x671e1e5
and esp, dword [ecx - 0x79]
add ah, cl
jb 0x43d71f
dec ebp
int1
ret 0x4883
aad 0x63
clc
and ch, al
loopne 0x43d761
popal
out dx, al
pop ebp
push cs
jle 0x43d800
stc
lodsd eax, dword [esi]
xor byte [0x45122e5b], al
cmpsd dword [esi], dword es:[edi]
push 0x5cbb9e5
jns 0x43d7af
aad 0xc1
lds eax, [ebx + 0x37]
or eax, 0xe688c09b
mov ah, 0x9a
fistp qword [edi + 0x63865e02]
pop esi
xchg byte [ebx - 0x43], ah
movsb byte es:[edi], byte [esi]
push ss
mov eax, 0x4a1d4873
push cs
xor al, 0x4b
pop esi
xchg byte [ebx - 0x43], ah
movsb byte es:[edi], byte [esi]
push ss
mov eax, 0x4a1d4873
push cs
xor al, 0x4b
push ebp
sbb byte [0xff7974ea], ch
mov ch, 0x50
fldpi
and eax, 0xa9fbfd60
mov byte [esi + 0x23], dh
cli
rcr edx, 0x2d
call 0x988062b4
xchg byte [edx + 0x28db3db5], bl
ja 0x43d86d
ficomp dword [ebx + 0x51]
pop ebx
push ecx
cmp dl, byte [esi + edi*2]
xchg dword [eax - 0xd], esp
xchg ecx, eax
and eax, 0x30cd83be
jle 0x43d7a1
or al, 0xb5
jecxz 0x43d817
sahf
ret 0x26c7
int1
arpl word [ecx + 0x6958420], di
push ebx
xor ch, byte [eax]
mov dword [edx + 0x754eacbc], edi
jg 0x43d805
idiv edx
out dx, al
retf 0x5c95
daa
and eax, 0xf0d2e250
out dx, al
shl ecx, 1
push ss
mov ebx, 0x582cb1e2
cmp eax, 0x24503b2a
adc ecx, dword [ebp + 0x6abafba5]
sbb eax, 0xb8ef3deb
out dx, eax
cmp eax, 0x1d6a0ccf
jmp 0x43d896
pushal
stc
imul ebp, dword [edi + 0x16], 0xffffffad
imul ebx, dword [eax - 0x51], 0x3b
jbe 0x43d836
movsb byte es:[edi], byte [esi]
xor eax, 0xe727fffd
stosd dword es:[edi], eax
xchg esp, eax
leave
push cs
pop ss
add eax, 0x6bd1ecb6
fcmovnbe st(0), st(5)
salc
sbb esp, ebp
shl dword [ecx + 0x72], cl
aad 0x7e
sahf
mov byte [0x505ef286], al
xchg dl, dh
pop esi
push eax
ljmp 0xfde7:0x25ef3918
Function at 0x46565d
Capabilities:
Encode data using xor

Disassembly:
push eax
cmpsd dword [esi], dword es:[edi]
inc ebx
and edx, edi
les esi, [esi + 0x59afc218]
movsb byte es:[edi], byte [esi]
shl bl, 1
shl bl, 1
shl bl, 1
nop
adc ah, byte [edx]
ja 0x4656d0
and bl, byte [eax + ebp - 0x125b6931]
cmc
cmp dword [0xf7a5144b], edx
sbb edx, esp
test esp, eax
add bh, byte [esi - 0x6f]
mov al, 0xea
in eax, 0xb3
pop ecx
jecxz 0x46564f
xor dword [ebx], esi
nop
out dx, eax
cli
add ebp, dword [edi + 0x36]
mov dl, 0x94
invalid
dec edi
xor byte [ebp - 0x2e], 0xf8
arpl ax, sp
push ecx
cld
sbb dword ds:[eax - 0x37d9ac96], ecx
aam 0x9d
cmp al, 0x3f
mov dl, 0x8c
jecxz 0x4656cf
adc byte [edi + 0x50b3406a], 0x75
dec edx
dec esp
invalid
Function at 0x47d47d
Capabilities:
Encode data using xor

Disassembly:
popal
push edi
wait
cmp eax, 0x4bea5b39
rcl dword [ecx - 0x576d6c48], 0xdf
xor dword [ecx + 0x6c], esp
stc
dec dword [eax]
mov eax, dword [0xc9edb28c]
shl byte [ebp - 0x5ee65dcf], 1
mov edi, ecx
sub dword [ebx + 0x39], esp
mov al, byte [0x22873df]
adc ecx, dword [ebp - 0x17]
dec ecx
mov bl, 0xf6
mov edi, 0x869b2199
jecxz 0x47d413
cld
int1
xor ecx, edx
clc
add al, byte [edi]
cmc
push cs
pop ebp
jge 0x47d44e
lodsb al, byte [esi]
into
fcom qword [ebp - 0x613aca24]
fadd st(6)
xchg ebp, eax
fdiv qword [0xc6d89ec5]
cmp esp, ecx
jp 0x47d420
or al, 4
pop ss
add al, 0x17
mov al, 0xc2
sti
xchg ebp, eax
pushfd
adc byte [edi], 0xbd
wait
hlt
inc edx
mov ah, 0x6b
aas
insb byte es:[edi], dx
imul edi, dword [esi + edx*4 - 0x7f9264c], 0x627ee828
adc ebx, dword [esi + 0x78]
mov dword [eax], esp
jne 0x47d42e
call 0x5e5b36b1
js 0x47d3be
and byte [ebp - 0xa], dh
clc
cmpsd dword [esi], dword es:[edi]
add dword [ebx - 0x6770ced], eax
dec esp
imul esi, edx, 0xbb9c5dcf
push cs
ja 0x47d41e
aad 0x7f
xchg ebp, eax
nop
sar byte [esi + edx*8], cl
pop esp
mov ebx, 0xa691926d
aaa
invalid
jo 0x47d413
pop ebx
mov word [ebx - 0x1c], cs
fcomp dword [eax + edx*8 - 0x5a]
pop ds
mov ebp, 0x2bdee2c0
mov edi, 0xe69ba3f8
cwde
mov bh, 0xf5
pop ebx
and al, 0x7e
jle 0x47d409
push 0x6e
jle 0x47d409
push 0x6e
xor eax, 0xc8a5443c
adc eax, 0xfee2dd76
lodsd eax, dword fs:[esi]
fiadd word [edx + ebp*8]
dec esp
fist word fs:[eax]
sahf
std
les esi, [edx]
dec eax
inc esi
frstor dword [esi]
sti
xchg esi, eax
inc esp
pop esi
in eax, dx
out 0x63, eax
sbb dword [esi], esi
sbb eax, 0xcdf4d9dd
cmp edx, dword [edx + 0x4924db6]
arpl word es:[edx + edi*2], sp
xchg edx, eax
add al, 0x26
arpl word [edx + edi*2], sp
movzx edx, word [esi]
nop
fistp qword [ebp - 0x46]
shr byte [edx - 0x6f], 1
jle 0x47d46d
push es
or al, 0xbe
xor dword [esi - 0x27], esi
cmp byte [ecx - 0x4376a5b], dh
jle 0x47d4e5
jnp 0x47d539
adc ebx, dword [ecx]
cld
jnp 0x47d463
loop 0x47d4af
xlatb
stc
xchg edx, eax
pushfd
xchg ebp, eax
stosb byte es:[edi], al
js 0x47d47f
cmc
jge 0x47d528
enter 0x2aa8, 0x1c
xor ah, byte [edi - 0x62402c02]
cmp ebx, ebx
faddp st(5)
mov byte [edx + edi*8], dh
dec edx
add ecx, dword [eax]
xor byte [ebx], al
push ds
cmpsd dword [esi], dword es:[edi]
cdq
fmul qword [ecx]
cdq
mov ebp, 0xfd067659
or byte [di], ch
fcom qword [esi]
jmp 0x47d4d7
sbb al, 0x32
cmpsd dword [esi], dword es:[edi]
invalid
or esi, dword [esi + 0x173d91cc]
dec esi
jp 0x47d53a
iretd
Function at 0x4a9c9d
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
mov ebx, ecx
mov dword [ebp - 0xc], ebx
push esi
push edi
test ebx, ebx
jne 0x4a9cb9
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebx + 0xc984], 0xffffffff
jle 0x4a9cce
mov eax, 0xfffffff6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
lea edi, [ebx + 0x11fb0]
mov eax, 0x4a2d20
mov ecx, 0x62
cmovne eax, edx
lea edx, [ebx + 0x12838]
mov esi, eax
mov dword [ebp - 0x2c], eax
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebx + 0x12138]
mov edi, 0x40
lea esi, [ebx + 0x9a0]
nop dword [eax]
nop dword [eax + eax]
lea eax, [esi - 0x80]
mov dword [ecx - 0x11e14], esi
mov dword [ecx - 0x11e18], eax
lea ecx, [ecx + 0x18]
mov dword [ecx - 0x14], edx
lea eax, [edx - 0x100]
mov dword [ecx - 0x18], eax
lea eax, [esi + 0x80]
mov dword [ecx - 0x11e28], eax
lea eax, [edx + 0x100]
mov dword [ecx - 0x10], eax
lea eax, [esi + 0x100]
mov dword [ecx - 0x11e24], eax
lea eax, [edx + 0x200]
mov dword [ecx - 0xc], eax
lea eax, [esi + 0x180]
mov dword [ecx - 0x11e20], eax
lea eax, [edx + 0x300]
mov dword [ecx - 8], eax
lea eax, [esi + 0x200]
mov dword [ecx - 0x11e1c], eax
add esi, 0x300
lea eax, [edx + 0x400]
add edx, 0x600
mov dword [ecx - 4], eax
sub edi, 1
jne 0x4a9d0d
push dword [ebp - 0x2c]
add ebx, 0x320
xor edx, edx
mov ecx, ebx
mov dword [ebp - 8], ebx
call fcn.004aef8d
mov eax, ebx
mov dword [ebp - 0x20], edi
add esp, 4
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x30], 3
Function at 0x4ab9cd
Capabilities:
Encode data using xor

Disassembly:
mov ah, 0x2e
popal
int1
mov edx, 0xe0c8d5ac
xor ebp, ebp

Function at 0x4ae56d
Capabilities:
Encode data using xor

Disassembly:
push 0xf3a72f51
mov ch, dl
in eax, dx
pop eax
sbb dword ss:[ecx + 0x4788288f], edi
jns 0x4ae59e
pop edx
std
movsd dword es:[edi], dword [esi]
in al, 0x3c
xor al, 0x40
fcom dword [ebx]
jge 0x4ae5da
jp 0x4ae5f1
salc
inc ebp
lahf
call 0xca5048b9
mov eax, dword [0x6da6edc9]
add byte [eax - 0x5d], ch
mov dh, 0x49
dec ecx
cmp ah, dh
sti
not byte [esi + 0x28]
mov ah, 0xf2
leave
mov eax, 0x3a3e5f69
push ebp
pop edx
call 0x1116fa49
sub byte [ecx - 0x3f], ch
shr dword [ecx - 0x2791f084], 1
cmp dword fs:[ebx], edx
lcall 0x3ef9, 0x8f60f820
inc eax
push 0x60daa270
out dx, al
mov eax, dword [0xeef92689]
xor dword [ecx + 0x6c06e0cb], ecx
jo 0x4ae5cd
iretd
iretd
aad 0xf6
cmp al, 0x61
retf 0x8db7
Function at 0x4aef8d
Capabilities:
Encode data using xor

Disassembly:
sbb dword [esi + 0xd], esp
adc eax, 0xbf6d458b
sal dword [eax - 0x4364897b], 0x14
or dword [eax], 0x48edd858
cwde
sub ebx, ebp
pop eax
fmul dword [ebx - 0x58]
insd dword es:[edi], dx
dec edx
and byte [esi - 0x574b7da8], dh
xchg esp, eax
inc edx
push 0xe8e8d4a8
outsb dx, byte [esi]
xchg esp, eax
inc eax
pop eax
xor byte [eax + ebp*4 - 0x5797bd6c], 0xd4
call 0x40df5ea4
mov byte [eax + 0x337ee254], ch
or byte [eax], ch
jne 0x4aefae
fmul st(0)
cmp byte [eax + 0x2d3d4957], ch
adc cl, byte [ecx - 0x77d704e8]
mov dword [0xb5c5c0d0], eax
mov esp, 0xe8f55699
mov byte [eax], dh
cdq
jns 0x4aefaa
xor byte [ecx + 0x395ec779], bl
push esp
cmc
lds eax, [edx - 0x1e]
arpl bx, dx
pushal
mov ecx, 0xbc421564
xchg ebx, eax
add dl, byte [edx + edx*2]
pop esi
cmp dword [ebp + esi*8 - 0x3b], edx
inc edx
loop 0x4af04e
shl dword [eax - 0x47], cl
adc eax, 0x293bc42
adc al, 0x52
sub esi, dword [0x74c779c4]
jge 0x4af06c
dec eax
test eax, 0x5c9a48ee
fsubr st(0)
pop ss
or byte [edx + 0x4252abc], ah
in al, dx
pushfd
call 0xa9246c28
mov dh, 0x98
or ah, dl
out dx, al
push esp
leave
push cs
movsb byte es:[edi], byte [esi]
outsb dx, byte [esi]
push esp
pop esp
fbstp tbyte [eax + ecx*4 - 0x62]
jbe 0x4af071
sub eax, 0x3465f097
dec ebp
scasd eax, dword es:[edi]
cmp cl, bl
mov eax, 0x79d474f8
test al, 0xbc
fstp dword [0x45f8a57c]
jl 0x4aefdf
clc
inc ebp
pushal
add al, 0xe4
mov ecx, 0xa26542e8
xor ah, byte [eax + 0x51d911e0]
and esi, dword [eax - 0xed8f2df]
and dword [edx + 0x61], eax
and dword [0x4221f127], ecx
popal
jno 0x4af038
lodsb al, byte [esi]
mov eax, dword [0x49f6c0c]
arpl word [ecx + edi + 0x41], cx
mov cl, 0x4d
sbb ecx, esp
lea ebp, [ebx + 0x6ab137f5]
lock and dword [edx + ebp*8 - 0x40], esi
and dword [edx + ebp*8 - 0x40], esi
add dword [ebx - 0x5f4b5bf0], ebp
shr ah, 1
mov dword [eax - 0x5cc28e08], esi
or eax, 0x462cfcbd
stosd dword es:[edi], eax
adc byte [esp + esi*4 - 0x76132f60], ah
mov al, 0xf8
jno 0x4af0ba
cmp eax, 0xbd0d36a3
cld
mov dword [0xfcbd0d36], eax
sub al, 0x46
mov eax, dword [0xadcd81ac]
je 0x4af07c
mov eax, dword [0x4d2d3c2d]
pop ss
cmp eax, 0xbc1f6774
and cl, byte [edx - 0x50]
mov esi, 0x79ff33e0
inc ecx
sar byte [ebp + 0x46], cl
sar edx, 0x92
mov dl, 0xfe
add ah, al
cmc
pop ss
xchg esp, eax
scasd eax, dword es:[edi]
mov ebp, 0x5e8cafaf
fist dword [ecx + 0x224eeef1]
out 0xee, eax
sub eax, 0xc8aefc52
ljmp 0xd34
Function at 0x4bb139
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c23d0
cmp edx, dword [eax]
je 0x4bb15b
add eax, 8
inc ecx
cmp eax, 0x4c2460
jl 0x4bb14c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c23d0]
jne 0x4bb289
mov eax, dword [0x4c6d54]
cmp eax, 1
je 0x4bb263
test eax, eax
jne 0x4bb18c
cmp dword [0x4c22fc], 1
je 0x4bb263
cmp edx, 0xfc
je 0x4bb289
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb1c3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bbb20
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bbfb0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb206
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bbfb0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c0734
push edi
call fcn.004bde80
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bbb20
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bbb30
lea eax, [ebp - 0xa0]
push 0x4c0714
push eax
call fcn.004bbb30
push dword [esi + 0x4c23d4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bbb30
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bddf4
add esp, 0x2c
pop edi
jmp 0x4bb289
lea eax, [ebp + 8]
lea esi, [esi + 0x4c23d4]
push 0
push eax
push dword [esi]
call fcn.004bbfb0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x424130
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4386c0
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x45e4c0]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov eax, dword [0x45e4c0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x30]
mov esi, dword [ebp + 0x20]
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x14], eax
test edi, edi
je 0x424192
mov cl, byte [esi]
cmp cl, 0x2b
je 0x42418b
cmp cl, 0x2d
jne 0x424192
mov ebx, 1
jmp 0x424194
xor ebx, ebx
mov eax, dword [eax + 0x14]
and eax, 0x3000
cmp eax, 0x3000
je 0x4241aa
mov edx, 0x455428
jmp 0x4241cc
lea eax, [ebx + 2]
mov edx, 0x45542c
cmp eax, edi
ja 0x4241cc
cmp byte [esi + ebx], 0x30
jne 0x4241cc
mov cl, byte [esi + ebx + 1]
cmp cl, 0x78
je 0x4241ca
cmp cl, 0x58
jne 0x4241cc
mov ebx, eax
push edx
push esi
call 0x4385c0
mov dword [esp + 0x38], eax
mov eax, 0x2e
mov word [esp + 0x20], ax
call 0x4381d5
mov eax, dword [eax]
mov al, byte [eax]
mov byte [esp + 0x20], al
lea eax, [esp + 0x20]
push eax
push esi
call 0x4385c0
mov ecx, dword [esp + 0x24]
add esp, 0x10
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x1c]
push eax
call fcn.0041bcb0
mov dword [esp + 0x80], 0
push eax
call 0x4251e0
add esp, 4
mov dword [esp + 0x28], eax
mov dword [esp + 0x80], 0xffffffff
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x42424a
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, eax
test ecx, ecx
je 0x42424a
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esp + 0x28]
push 0x30
mov eax, dword [ecx]
call dword [eax + 0x30]
movzx eax, ax
lea ecx, [esp + 0x40]
mov dword [esp + 0x24], eax
xor eax, eax
push eax
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
push edi
mov dword [esp + 0x5c], 7
mov dword [esp + 0x58], 0
mov word [esp + 0x48], ax
call 0x424e90
mov dword [esp + 0x80], 1
lea eax, [esp + 0x40]
cmp dword [esp + 0x54], 8
mov ecx, dword [esp + 0x28]
cmovae eax, dword [esp + 0x40]
push eax
lea eax, [edi + esi]
mov edx, dword [ecx]
push eax
push esi
call dword [edx + 0x2c]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
call fcn.0041bcb0
mov byte [esp + 0x80], 2
push eax
call 0x4257c0
mov esi, eax
add esp, 4
mov dword [esp + 0x28], esi
mov byte [esp + 0x80], 1
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x4242fc
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, eax
test ecx, ecx
je 0x4242fc
mov eax, dword [ecx]
push 1
call dword [eax]
lea eax, [esp + 0x58]
mov ecx, esi
push eax
call fcn.00423fd0
mov byte [esp + 0x80], 3
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 0x10]
mov ecx, dword [esp + 0x30]
push dword [esp + 0x24]
movzx eax, ax
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x30]
cmp eax, edi
jne 0x424338
mov eax, dword [ebp + 0x24]
Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0xf1ecbdc4]
lodsd eax, dword [esi]
cmp dword [ebx - 0xc], ebp
dec esp
xor dl, bh
out 0xe, al
pop eax
inc eax
add ah, byte [ebp - 0x4df569fe]
or dl, al
jo 0x4153ea
cmpsb byte [esi], byte es:[edi]
aad 0x4d
dec ebp
push 0x5cf7f469
sbb dh, byte [edi - 0x7b951fb3]
or al, 0x58
ret 0xb2a4
Function at 0x40105b
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4250b0]
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
mov dword [ebp - 4], eax
je 0x4010db
cmp byte [edi], 0
je 0x4010db
push esi
push 0x421230
push edi
call fcn.00416ac0
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
mov byte [esi], 0
push edi
mov word [ebp - 0x14], 2
call sub.WSOCK32.dll_inet_addr
test esi, esi
mov dword [ebp - 0x10], eax
jne 0x4010a4
xor eax, eax
jmp 0x4010b1
lea eax, [esi + 1]
push eax
call fcn.00416a29
pop ecx
movzx eax, ax
push eax
call sub.WSOCK32.dll_htons
test esi, esi
mov word [ebp - 0x12], ax
je 0x4010c2
mov byte [esi], 0x3a
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.WSOCK32.dll_sendto
pop esi
jmp 0x4010dd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
call fcn.004169c5
leave
ret
Function at 0x406b46
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x69
push dword [0x42a6dc]
push 0x429ba0
call fcn.00403aa7
pop ecx
push eax
push 0x1f4
mov ebp, 0x4275b8
push ebp
call fcn.00401000
xor ebx, ebx
add esp, 0x14
cmp byte [0x4275b8], bl
mov dword [esp + 0x10], ebx
je 0x406b8e
inc ebx
cmp byte [ebx + 0x4275b8], 0
jne 0x406b80
mov dword [esp + 0x10], ebx
mov esi, dword [esp + 0x18]
xor eax, eax
cmp byte [esi], al
je 0x406b9f
inc eax
cmp byte [eax + esi], 0
jne 0x406b98
push esi
push ebp
lea edi, [eax + 1]
call fcn.00406b27
pop ecx
pop ecx
push dword [0x426550]
lea ebp, [ebx + 0x4275b8]
push edi
push ebp
push esi
call fcn.00401186
pop ecx
push eax
push str.sending_vio__lu_with_extra___s__d_bytes___lu_
call fcn.00406774
mov eax, dword [0x426550]
and eax, 0xfef
add eax, 0x1e1b
mov dword [0x426af0], eax
xor eax, eax
add esp, 0x14
inc eax
mov ecx, dword [eax*4 + 0x426aec]
imul ecx, ecx, 0x10dcd
mov dword [eax*4 + 0x426af0], ecx
inc eax
cmp eax, 0x270
jl 0x406be5
and dword [esp + 0x18], 0
test edi, edi
mov dword [0x425040], eax
jle 0x406d46
mov esi, closesocket
cmp eax, 0x270
jl 0x406cf5
cmp eax, 0x271
jne 0x406c4e
mov dword [0x426af0], 0x1105
mov eax, 0x426af4
mov ecx, dword [eax - 4]
imul ecx, ecx, 0x10dcd
mov dword [eax], ecx
add eax, 4
cmp eax, 0x4274b0
jl 0x406c39
xor edx, edx
mov ecx, edx
shl ecx, 2
mov eax, dword [ecx + 0x426af4]
xor eax, dword [ecx + 0x426af0]
and eax, esi
xor eax, dword [ecx + 0x426af0]
mov ebx, eax
shr eax, 1
and ebx, 1
xor eax, dword [ebx*4 + 0x42505c]
xor eax, dword [ecx + 0x427124]
inc edx
cmp edx, 0xe3
mov dword [ecx + 0x426af0], eax
jl 0x406c50
cmp edx, 0x26f
jge 0x406cc8
lea ecx, [edx*4 + 0x426af0]
mov eax, dword [ecx]
lea edx, [ecx + 4]
xor eax, dword [edx]
and eax, esi
xor eax, dword [ecx]
mov ebx, eax
and ebx, 1
mov ebx, dword [ebx*4 + 0x42505c]
xor ebx, dword [edx - 0x390]
shr eax, 1
xor ebx, eax
mov dword [ecx], ebx
mov ecx, edx
cmp ecx, 0x4274ac
jl 0x406c9b
mov ecx, dword [0x4274ac]
mov eax, ecx
xor eax, dword [0x426af0]
and eax, esi
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
xor eax, dword [ecx*4 + 0x42505c]
xor eax, dword [0x427120]
mov dword [0x4274ac], eax
xor eax, eax
mov ecx, dword [eax*4 + 0x426af0]
mov edx, ecx
shr edx, 0xb
xor ecx, edx
mov edx, ecx
and edx, 0xff3a58ad
shl edx, 7
xor ecx, edx
mov edx, ecx
and edx, 0xffffdf8c
shl edx, 0xf
xor ecx, edx
mov edx, dword [esp + 0x18]
add edx, ebp
mov ebx, ecx
shr ebx, 0x12
xor bl, byte [edx]
inc eax
xor bl, cl
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
mov dword [0x425040], eax
mov byte [edx], bl
jl 0x406c18
mov ebx, dword [esp + 0x10]
add ebx, edi
push ebx
push 0x4275b8
call fcn.00406a01
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret