joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002c4e4
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1002c581
push ebx
push esi
call fcn.1002c4ad
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1002c441
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1002c52e
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002c580
push edi
push eax
call fcn.1002ade2
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1002c54e
call fcn.1002ae30
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002c57f
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1002c441
add esp, 0x20
test eax, eax
jne 0x1002c56d
push edi
call fcn.1002ae30
jmp 0x1002c575
push ebx
call fcn.1002ae30
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1002c7ee
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10035770
push 0x10035768
push str.FlsAlloc
push 0x1f
call fcn.1002c70a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002c822
push dword [ebp + 8]
mov ecx, esi
call dword [0x10033150]
call esi
jmp 0x1002c828
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1002c86c
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10035780
push 0x10035778
push str.FlsGetValue
push 0x21
call fcn.1002c70a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002c8a3
push dword [ebp + 8]
mov ecx, esi
call dword [0x10033150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1002c8ab
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10035788
push 0x10035780
push str.FlsSetValue
push 0x22
call fcn.1002c70a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002c8e5
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10033150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10031df0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10031e1d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10031e1d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401650
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [0x413904]
sub esp, 0x100
lea ecx, [esp]
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push esi
push eax
push str.c_nCount_d
push ecx
call ebx
lea edx, [esp + 0x14]
push edx
call fcn.004046c0
mov eax, dword [0x413904]
add esp, 0x10
xor esi, esi
test eax, eax
jle 0x4016bd
push edi
mov edi, 0x409538
mov eax, dword [edi + 4]
mov ecx, dword [edi]
push eax
push ecx
push esi
lea edx, [esp + 0x18]
push str.__d____X___X
push edx
call ebx
lea eax, [esp + 0x20]
push eax
call fcn.004046c0
mov eax, dword [0x413904]
add esp, 0x18
inc esi
add edi, 8
cmp esi, eax
jl 0x40168e
pop edi
push 0
push 0x4014f0
call dword [sym.imp.USER32.dll_EnumWindows]
pop esi
pop ebx
add esp, 0x100
ret

Function at 0x401ef0
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
push 0x4090f8
call fcn.004046c0
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.MSVCRT.dll_strtoul]
lea eax, [esp + 0xc]
push 0x10
add ecx, 3
push eax
push ecx
mov dword [esp + 0x18], 0
call esi
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x401f84
mov eax, dword [esp + 8]
lea edx, [esp + 8]
push 0x10
push edx
push eax
call esi
add esp, 0xc
test eax, eax
je 0x401f84
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
push 0
push 0x1f0fff
call edi
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebp
push ebx
push 0
push 0x1f0fff
call edi
mov esi, eax
test esi, esi
je 0x401f7c
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call ebp
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
pop ecx
ret
pop esi
mov eax, 1
pop ebx
pop ecx
ret

Function at 0x402010
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
push eax
push 0
push 0
push 0
push SysReAllocStringLen
push 0
push SysReAllocStringLen
push 0xcf0000
push 0x413974
push 0x413910
push 0x80
mov dword [0x4139d8], eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
jne 0x402051
pop esi
ret
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0
push 0x414
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, 1
pop esi
ret
Function at 0x403f80
Capabilities:
Delete directory
Delete file

Disassembly:
mov al, byte [0x413e28]
sub esp, 0x400
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
test al, 0x40
jne 0x403feb
mov eax, dword [0x413e1c]
cmp eax, ebx
je 0x403fbc
cmp eax, 0xffffffff
je 0x403fbc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x413e1c], ebx
push 0x413af0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
call ebp
push eax
push esi
push 0x413af0
lea eax, [esp + 0x1c]
push str.DeleteFile__s__d___d
push eax
call edi
lea ecx, [esp + 0x24]
push ecx
call fcn.004046c0
add esp, 0x18
cmp byte [0x4139e8], bl
je 0x404022
push 0x4139e8
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov esi, eax
call ebp
push eax
push esi
push 0x4139e8
lea edx, [esp + 0x1c]
push str.RemoveDirectory__s__d___d
push edx
call edi
lea eax, [esp + 0x24]
push eax
call fcn.004046c0
add esp, 0x18
pop edi
pop esi
mov byte [0x413af0], bl
mov byte [0x4139e8], bl
pop ebp
pop ebx
add esp, 0x400
ret

Function at 0x4040f0
Capabilities:
Read file on windows
Timestomp file
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov edi, dword [esp + 0x20]
push ebp
push 0x80
push 3
push ebp
push 3
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x404132
push str.UnPatchFile._cannnot_open_the_file.
call fcn.004046c0
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
push ebp
push ebp
push esi
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov ebx, dword [edi + 0x88]
cmp ebx, ebp
jne 0x404157
mov ebx, 4
push ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x40417d
push str.UnPatchFile._cannnot_allocate_buffer.
call fcn.004046c0
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, dword [edi + 0x80]
push 0
push 0
push ecx
push esi
mov byte [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, dword [edi + 0x80]
jne 0x40420f
lea edx, [esp + 0x10]
push 0
push edx
push ebx
push ebp
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40420f
cmp dword [esp + 0x10], ebx
jne 0x40420f
mov eax, dword [esp + 0x24]
push eax
push edi
push ebp
call fcn.00404800
mov ecx, dword [edi + 0x80]
add esp, 0xc
mov byte [esp + 0x20], al
push 0
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov al, byte [esp + 0x20]
test al, al
je 0x40420f
lea edx, [esp + 0x10]
push 0
push edx
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40420f
lea eax, [esp + 0x14]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4043b0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x60
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x7c]
mov ebx, dword [edi + 0x88]
test ebx, ebx
jne 0x4043ca
mov ebx, 4
push ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x4043f0
push str.SdwPatchProcess._cannnot_allocate_buffer.
call fcn.004046c0
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret
mov esi, dword [edi + 0x80]
mov edx, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
lea eax, [esp + 0x10]
push eax
add esi, edx
push ebx
push ebp
push esi
push ecx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x40444f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x34]
push str.ReadProcessMemory_failed.__d_
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x3c]
push eax
call fcn.004046c0
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0x14
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret
mov ecx, dword [esp + 0x80]
push ecx
push edi
push ebp
call fcn.00404800
add esp, 0xc
mov byte [esp + 0x7c], al
test al, al
je 0x4044d9
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x14], 0
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x74]
lea edx, [esp + 0x14]
push 0x1c
push edx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x28]
push eax
push 0x40
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x4044b4
push str.VirtualProtectEx_failed.
jmp 0x4044cc
lea eax, [esp + 0x10]
push eax
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x4044d9
push str.WriteProcessMemory_failed.
call fcn.004046c0
add esp, 4
mov byte [esp + 0x7c], 0
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov al, byte [esp + 0x80]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret

Function at 0x4045f0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x413d00]
push ebx
xor bl, bl
test eax, eax
je 0x40461d
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
mov bl, 1
mov dword [0x413d00], eax
mov dword [0x413d04], eax
mov dword [0x413d08], eax
mov dword [0x413d0c], eax
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00403f80
mov al, bl
pop ebx
ret

Function at 0x404650
Capabilities:
Create process on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x54
test edx, edx
jne 0x404660
mov edx, 0x413bf8
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov dword [esp + 4], eax
lea ecx, [esp + 4]
mov dword [esp + 8], eax
push ecx
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push eax
push ecx
push 0
push 0x20
push 0
push 0
push 0
push 0
push edx
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
setne al
pop edi
add esp, 0x54
ret
Function at 0x4050b0
Capabilities:
Hash data using crc32b

Disassembly:
push ecx
push ebx
mov ebx, 1
push esi
mov dword [0x4148f0], ebx
xor edx, edx
mov ecx, 0x4144f0
mov eax, edx
mov esi, 8
shl eax, 0x18
test eax, 0x80000000
je 0x4050df
add eax, eax
xor eax, 0x4c11db7
jmp 0x4050e1
shl eax, 1
dec esi
jne 0x4050cf
mov dword [ecx], eax
add ecx, 4
inc edx
cmp ecx, 0x4148f0
jb 0x4050c5
xor ecx, ecx
mov eax, 0x4142f0
mov dword [esp + 8], ecx
mov edx, 8
test byte [esp + 8], bl
je 0x40511c
mov si, word [esp + 8]
shr si, 1
xor esi, 0x8408
mov dword [esp + 8], esi
jmp 0x405121
shr word [esp + 8], 1
dec edx
jne 0x405102
mov dx, word [esp + 8]
inc ecx
mov word [eax], dx
add eax, 2
cmp eax, 0x4144f0
jb 0x4050f9
pop esi
pop ebx
pop ecx
ret

Function at 0x405140
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x4148f0]
test eax, eax
jne 0x40514e
call fcn.004050b0
mov ecx, dword [esp + 4]
mov eax, 0xffff
dec ecx
js 0x40518a
push ebx
push esi
lea esi, [ecx + 1]
mov ecx, dword [esp + 0x10]
mov dl, byte [ecx]
xor ebx, ebx
xor dl, al
mov bl, ah
mov byte [esp + 0xc], dl
inc ecx
mov edx, dword [esp + 0xc]
and edx, 0xff
mov ax, word [edx*2 + 0x4142f0]
xor ax, bx
dec esi
jne 0x405163
pop esi
pop ebx
not eax
ret

Function at 0x405190
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x40676b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x828
push ebx
push esi
lea ecx, [esp + 8]
call fcn.00405db0
mov eax, dword [esp + 0x848]
xor esi, esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x83c], esi
call fcn.00405dd0
mov ebx, dword [esp + 0x840]
cmp ebx, esi
jle 0x4051fa
push edi
mov edi, dword [esp + 0x848]
lea ecx, [esp + 0xc]
call fcn.00405e70
mov dl, byte [esi + edi]
xor dl, al
mov byte [esi + edi], dl
inc esi
cmp esi, ebx
jl 0x4051e3
pop edi
lea ecx, [esp + 8]
mov dword [esp + 0x838], 0xffffffff
call fcn.00405dc0
mov ecx, dword [esp + 0x830]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x834
ret

Function at 0x4052a0
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
sub esp, 0x108
lea eax, [esp]
push esi
mov esi, dword [esp + 0x110]
push eax
push 0x104
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
ja 0x4052d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
add esp, 0x108
ret
push esi
push 0
lea ecx, [esp + 0xc]
push 0x409394
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4052f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
add esp, 0x108
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40531a
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
add esp, 0x108
ret
xor eax, eax
pop esi
add esp, 0x108
ret
Function at 0x4061e0
Capabilities:
Terminate thread
Write file on windows

Disassembly:
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov eax, dword [0x445b0c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, edi
je 0x406260
push esi
push edi
push edi
push 3
push edi
push edi
push 0x40000000
push edi
push 0x445a04
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], 0x1f40
mov dword [esp + 0x3c], edi
call fcn.00406450
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40624d
lea eax, [esp + 0xc]
push edi
push eax
lea ecx, [esp + 0x18]
push 0x10
push ecx
push esi
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call ebx
push 0x3e8
mov edx, dword [0x445b0c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
mov eax, dword [0x445b08]
cmp eax, edi
je 0x406281
mov eax, dword [0x445b08]
cmp eax, 0xffffffff
je 0x406281
mov eax, dword [0x445b08]
push eax
call ebx
mov dword [0x445b08], edi
mov eax, dword [0x445b0c]
cmp eax, edi
je 0x4062a9
mov eax, dword [0x445b0c]
cmp eax, 0xffffffff
je 0x4062a9
push 0xffffffffffffffff
mov ecx, dword [0x445b0c]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x445b0c], edi
call fcn.004063b0
mov dword [0x445b14], edi
pop edi
pop ebx
add esp, 0x14
ret

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x7ff3532b
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0xa3b50e1
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401660
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
push edi
push 0
push 0xf4240
push esi
push ebx
call fcn.00409960
push 0
push 0xf4240
push esi
push ebx
mov edi, eax
call fcn.004098a0
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea esi, [eax + eax*4]
shl esi, 3
test edi, edi
mov dword [esp + 0x20], esi
jle 0x4016cb
mov eax, 0x431bde83
imul esi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [edi + edi*4]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
lea edx, [edx + ecx*8]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebx
add esp, 0x10
ret
fld qword [0x431450]
fcomp qword [0x40a188]
fnstsw ax
test ah, 0x40
je 0x40171c
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x40170c
mov eax, 0x431bde83
imul esi
sar edx, 0x12
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebx
add esp, 0x10
ret
fild qword [esp + 0x14]
fmul qword [0x40a198]
fstp qword [0x431450]
fild dword [esp + 0x20]
push ebp
fmul qword [0x431450]
call sub.MSVCRT.dll__ftol
mov ebp, eax
mov eax, 0x431bde83
mov dword [esp + 0x28], edx
imul esi
sar edx, 0x12
mov eax, edx
lea ecx, [esp + 0x10]
shr eax, 0x1f
push ecx
lea ebx, [edx + eax - 0xa]
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
add edi, ebp
adc esi, ecx
pop ebp
test ebx, ebx
jle 0x40176c
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea edx, [esp + 0x20]
push edx
call ebx
mov eax, dword [esp + 0x24]
cmp eax, esi
jg 0x4017a4
jl 0x40178b
mov ecx, dword [esp + 0x20]
cmp ecx, edi
jae 0x4017a4
lea edx, [esp + 0x20]
push edx
call ebx
mov eax, dword [esp + 0x24]
cmp eax, esi
jl 0x40178b
jg 0x4017a4
mov ecx, dword [esp + 0x20]
cmp ecx, edi
jb 0x40178b
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x401980
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x414
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x420]
mov word [esp + 0xc], 2
push edi
call sub.WS2_32.dll_inet_addr
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x424]
push eax
call sub.WS2_32.dll_htons
push 0
push 1
push 2
mov word [esp + 0x1a], ax
call sub.WS2_32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
je 0x401b56
lea ecx, [esp + 0xc]
push 0x10
push ecx
push esi
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
je 0x401b50
push 0
push 0x58
push 0x42e3d0
push esi
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
je 0x401b50
push 0
lea edx, [esp + 0x20]
push 0x400
push edx
push esi
call sub.WS2_32.dll_recv
cmp eax, 0xffffffff
je 0x401b50
push 0
push 0x67
push 0x42e42c
push esi
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
je 0x401b50
push 0
lea eax, [esp + 0x20]
push 0x400
push eax
push esi
call sub.WS2_32.dll_recv
cmp eax, 0xffffffff
je 0x401b50
mov cl, byte [esp + 0x3c]
mov dl, byte [esp + 0x3d]
lea eax, [esp + 0xa]
mov byte [esp + 0xa], cl
push eax
push edi
mov byte [esp + 0x13], dl
call fcn.004017b0
add esp, 8
push 0
push eax
push 0x42e494
push esi
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
je 0x401b50
push 0
lea ecx, [esp + 0x20]
push 0x400
push ecx
push esi
call sub.WS2_32.dll_recv
cmp eax, 0xffffffff
je 0x401b50
mov al, byte [esp + 0x38]
mov cl, byte [esp + 0x39]
mov dl, byte [esp + 0x3e]
mov byte [0x42e510], al
mov byte [0x42e512], al
mov al, byte [esp + 0x3c]
mov byte [esp + 0xa], al
mov byte [0x42e514], al
mov al, byte [esp + 0x3d]
push 0
mov byte [esp + 0xf], al
mov byte [0x42e515], al
mov al, byte [esp + 0x43]
push 0x4e
push 0x42e4f4
push esi
mov byte [0x42e511], cl
mov byte [0x42e513], cl
mov byte [0x42e516], dl
mov byte [0x42e517], al
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
je 0x401b50
push 0
lea ecx, [esp + 0x20]
push 0x400
push ecx
push esi
call sub.WS2_32.dll_recv
cmp eax, 0xffffffff
je 0x401b50
cmp byte [esp + 0x25], 5
jne 0x401b50
cmp byte [esp + 0x26], 2
jne 0x401b50
mov al, byte [esp + 0x27]
test al, al
jne 0x401b50
cmp byte [esp + 0x28], 0xc0
jne 0x401b50
push esi
call sub.WS2_32.dll_closesocket
pop edi
mov eax, 1
pop esi
add esp, 0x414
ret
push esi
call sub.WS2_32.dll_closesocket
pop edi
xor eax, eax
pop esi
add esp, 0x414
ret