joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ddf45
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5f1498]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004d185e
and dword [ebp - 0x14], 0
cmp dword [0x626f74], 0
mov dword [ebp - 0x18], eax
jne 0x4ddff8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4de0a0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress_1]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4de0a0
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x5d17d8
push ebx
mov dword [0x626f74], eax
call edi
push eax
call esi
push 0x5d17c4
push ebx
mov dword [0x626f78], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x626f7c], eax
call edi
push eax
call esi
mov dword [0x626f84], eax
test eax, eax
je 0x4ddff8
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x626f80], eax
mov eax, dword [0x626f80]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4de051
cmp dword [0x626f84], ecx
je 0x4de051
push eax
call esi
push dword [0x626f84]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4de051
test ebx, ebx
je 0x4de051
call edi
test eax, eax
je 0x4de048
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4de048
test byte [ebp - 8], 1
jne 0x4de051
or dword [ebp + 0x10], 0x200000
jmp 0x4de084
mov eax, dword [0x626f78]
cmp eax, dword [ebp - 0x18]
je 0x4de084
push eax
call esi
test eax, eax
je 0x4de084
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4de084
mov eax, dword [0x626f7c]
cmp eax, dword [ebp - 0x18]
je 0x4de084
push eax
call esi
test eax, eax
je 0x4de084
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x626f74]
call esi
test eax, eax
je 0x4de0a0
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4de0a2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d6464
leave
ret
Function at 0x4e5ba9
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x4f74d8
call fcn.004decf6
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x44], ebx
je 0x4e5ca0
cmp byte [esi + 0x4a], bl
je 0x4e5ca0
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 0xc]
movzx eax, ax
cmp di, ax
jne 0x4e5be5
xor al, al
jmp 0x4e5ca2
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.004e596f
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4e5c43
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [esi + 0x44]
mov edi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [esi + 0x4c]
push eax
call dword [edi + 0x18]
sub eax, 0
je 0x4e5c48
dec eax
je 0x4e5c4c
dec eax
dec eax
je 0x4e5c9c
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004e4edf
mov al, bl
jmp 0x4e5ca2
mov edx, dword [ebp - 0x2c]
jmp 0x4e5c0e
mov byte [esi + 0x4a], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4e5c58
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x4e5c7e
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4e5c6b
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call fcn.004cd68c
add esp, 0x10
cmp edi, eax
jne 0x4e5c31
cmp byte [esi + 0x4a], 0
je 0x4e5c9c
test edi, edi
jne 0x4e5c00
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.004e58c1
jmp 0x4e5c00
mov bl, 1
jmp 0x4e5c33
mov al, 1
call fcn.004ded40
ret
Function at 0x4e5ca8
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x4f7505
call fcn.004decf6
mov edi, dword [ebp + 8]
mov eax, 0xffff
mov esi, ecx
cmp ax, di
jne 0x4e5cca
xor eax, eax
jmp 0x4e5e3d
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
xor ebx, ebx
cmp ecx, ebx
je 0x4e5cf8
mov eax, dword [esi + 0x34]
mov edx, dword [eax]
lea edx, [ecx + edx*2]
cmp ecx, edx
jae 0x4e5cf8
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 2]
mov dword [esi], ecx
mov word [eax], di
mov ax, di
jmp 0x4e5e3d
cmp dword [esi + 0x54], ebx
je 0x4e5e38
mov ecx, esi
call fcn.004e4cc3
cmp dword [esi + 0x44], ebx
jne 0x4e5d28
push dword [esi + 0x54]
push edi
call fcn.004e5163
pop ecx
test al, al
pop ecx
movzx eax, di
jne 0x4e5e3d
jmp 0x4e5e38
movzx eax, di
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.004e596f
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4e5de5
lea eax, [ebp - 0x2c]
mov edx, eax
add eax, dword [ebp - 0x1c]
mov ecx, dword [esi + 0x44]
mov edi, dword [ecx]
lea ebx, [ebp - 0x34]
push ebx
push eax
push edx
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2e]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [esi + 0x4c]
push eax
call dword [edi + 0x14]
xor ebx, ebx
inc ebx
test eax, eax
js 0x4e5e2d
cmp eax, ebx
jg 0x4e5ded
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4e5d97
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x34]
sub edi, eax
je 0x4e5dbc
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4e5daa
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push ebx
push eax
call fcn.004cd68c
add esp, 0x10
cmp edi, eax
jne 0x4e5e2d
lea eax, [ebp - 0x30]
mov byte [esi + 0x4a], bl
cmp dword [ebp - 0x38], eax
jne 0x4e5e1c
test edi, edi
jne 0x4e5d49
cmp dword [ebp - 0x1c], 0x20
push edi
lea ecx, [ebp - 0x2c]
jae 0x4e5e32
push 8
call fcn.004e58c1
jmp 0x4e5d49
mov edx, dword [ebp - 0x2c]
jmp 0x4e5d5b
cmp eax, 3
jne 0x4e5e2d
push dword [esi + 0x54]
push dword [ebp - 0x30]
call fcn.004e5163
movzx esi, word [ebp + 8]
pop ecx
pop ecx
test al, al
jne 0x4e5e0c
mov esi, 0xffff
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.004e4edf
mov ax, si
jmp 0x4e5e3d
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.004e4edf
mov ax, word [ebp + 8]
jmp 0x4e5e3d
push 0
lea ecx, [ebp - 0x2c]
push ebx
call fcn.004e4edf
mov eax, 0xffff
call fcn.004ded40
ret 4

Function at 0x4ec32c
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4ec364
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004ea3d3
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004ea3ab
jmp 0x4ec370
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x4eda1d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4eda5f
call fcn.004f339a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4eda5f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4eda56
xor eax, eax
jmp 0x4eda67
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004eda6d
pop edi
pop esi
pop ebx
ret 4
Function at 0x403250
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x611008], 0x8088405
inc edx
mov dword [ebx + 0x611008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x42a94c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42a952
ret

Function at 0x438968
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x438b19
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00405178
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x438b30
call fcn.00404dd4
mov eax, ebx
call fcn.00428180
mov edi, eax
dec edi
test edi, edi
jl 0x438a20
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00428154
mov edx, dword [0x45e230]
call fcn.00403de4
test al, al
je 0x438a1c
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00428154
lea edx, [ebp - 0x14]
call fcn.0046db84
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00405178
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404e48
inc esi
dec edi
jne 0x4389ce
mov al, byte [0x438b34]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x438b40
mov eax, dword [ebp - 0xc]
call fcn.0040f0e8
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00404b60
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0046db84
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x438b30
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.0046db84
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x438b30
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x438b30
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x438b4c
call fcn.0040aa64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438b20
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404aec
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404aec
lea eax, [ebp - 0x14]
call fcn.00404ac8
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404aec
ret
Function at 0x492120
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x49214e
mov eax, ebx
call fcn.00492bd4
cmp dword [ebx + 0x40], 0
je 0x492147
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4921bf
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4921b1
cmp dword [ebx + 8], 0
je 0x492170
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x492182
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4921b1
cmp dword [ebx + 8], 0
je 0x492163
cmp eax, 3
je 0x492195
dec eax
jne 0x492163
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x492163
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x492163
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4921dd
cmp dword [ebx + 0x14], 0xcc
je 0x4921dd
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004921e8
pop ebx
ret
Function at 0x4e644c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x4e6466
add esp, 0xfffffff0
call fcn.00403fbc
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4e6503
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, edi
call fcn.00403c28
mov dword [edi + 0x20], esi
mov dl, 1
mov eax, dword [0x429c80]
call fcn.0042b494
mov esi, eax
mov dword [edi + 0x10], esi
mov eax, edi
call fcn.004e68ec
mov edx, eax
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [edi + 0x10]
mov dword [eax + 0xc], edi
mov dword [eax + 8], 0x4e6790
mov dl, 1
mov eax, dword [0x41c88c]
call fcn.00403c28
mov dword [edi + 4], eax
lea eax, [ebp - 0x10]
call fcn.00419b20
lea edx, [ebp - 0x10]
lea eax, [edi + 0x30]
call fcn.00411b78
mov byte [edi + 0x28], 1
mov dl, byte [0x4e6528]
mov ax, 0x2e
call fcn.0047d5a4
mov word [edi + 0x26], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e650a
lea eax, [ebp - 0x10]
call fcn.00411760
ret
Function at 0x550fd4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f78
xor eax, eax
push ebp
push 0x5511d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
shl eax, 8
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 1]
add eax, edx
cmp eax, 0xc2e8
jge 0x5510c3
cmp eax, 0xb7a2
jge 0x551066
cmp eax, 0xb2c1
jge 0x55103b
add eax, 0xffff4f5f
sub eax, 0x24
jb 0x551165
sub eax, 0x1fc
jb 0x551169
jmp 0x5511c1
add eax, 0xffff4d3f
sub eax, 0x22d
jb 0x55116d
sub eax, 0x1fc
jb 0x551171
sub eax, 0xb8
jb 0x551175
jmp 0x5511c1
cmp eax, 0xbbf7
jge 0x551098
add eax, 0xffff485e
sub eax, 0x11f
jb 0x551179
sub eax, 0x13d
jb 0x55117d
sub eax, 0x1f9
jb 0x551181
jmp 0x5511c1
add eax, 0xffff4409
sub eax, 0x3af
jb 0x551185
sub eax, 0x106
jb 0x551189
sub eax, 0x23c
jb 0x55118d
jmp 0x5511c1
cmp eax, 0xc8f6
jge 0x551123
cmp eax, 0xc5be
jge 0x5510fa
add eax, 0xffff3d18
sub eax, 0x1db
jb 0x551191
sub eax, 0xf3
jb 0x551195
sub eax, 8
jb 0x551199
jmp 0x5511c1
add eax, 0xffff3a42
sub eax, 0x11c
jb 0x55119d
sub eax, 0x1e1
jb 0x5511a1
sub eax, 0x3b
jb 0x5511a5
jmp 0x5511c1
cmp eax, 0xcef4
jge 0x551146
add eax, 0xffff370a
sub eax, 0x304
jb 0x5511a9
sub eax, 0x1e0
jb 0x5511ad
sub eax, 0x11a
jb 0x5511b1
jmp 0x5511c1
add eax, 0xffff310c
sub eax, 0x295
jb 0x5511b5
add eax, 0xffffffd0
sub eax, 0x318
jb 0x5511b9
sub eax, 0x329
jb 0x5511bd
jmp 0x5511c1
mov bl, 0x41
jmp 0x5511c3
mov bl, 0x42
jmp 0x5511c3
mov bl, 0x43
jmp 0x5511c3
mov bl, 0x44
jmp 0x5511c3
mov bl, 0x45
jmp 0x5511c3
mov bl, 0x46
jmp 0x5511c3
mov bl, 0x47
jmp 0x5511c3
mov bl, 0x48
jmp 0x5511c3
mov bl, 0x4a
jmp 0x5511c3
mov bl, 0x4b
jmp 0x5511c3
mov bl, 0x4c
jmp 0x5511c3
mov bl, 0x4d
jmp 0x5511c3
mov bl, 0x4e
jmp 0x5511c3
mov bl, 0x4f
jmp 0x5511c3
mov bl, 0x50
jmp 0x5511c3
mov bl, 0x51
jmp 0x5511c3
mov bl, 0x52
jmp 0x5511c3
mov bl, 0x53
jmp 0x5511c3
mov bl, 0x54
jmp 0x5511c3
mov bl, 0x57
jmp 0x5511c3
mov bl, 0x58
jmp 0x5511c3
mov bl, 0x59
jmp 0x5511c3
mov bl, 0x5a
jmp 0x5511c3
mov bl, 0x20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5511e0
lea eax, [ebp - 4]
call fcn.00404ac8
ret
Function at 0x5558a0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404f78
xor eax, eax
push ebp
push 0x555a3f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, esi
call fcn.00404ac8
fld qword [ebp + 8]
fcomp dword [0x555a50]
fnstsw ax
sahf
jae 0x5558f6
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
fld qword [ebp + 8]
fcomp dword [0x555a54]
fnstsw ax
sahf
jbe 0x555910
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x40000000
mov ecx, dword [ebx + 0x58]
mov dl, 1
mov eax, dword [0x503428]
call fcn.00503494
mov ebx, eax
mov edx, dword [ebp - 4]
mov eax, 0x555a60
call fcn.004050cc
test eax, eax
jle 0x55593f
lea eax, [ebp - 4]
mov edx, 0x555a60
call fcn.00404b60
mov edx, dword [ebp - 4]
mov eax, 0x555a6c
call fcn.004050cc
test eax, eax
jle 0x55595d
lea eax, [ebp - 4]
mov edx, 0x555a60
call fcn.00404b60
mov edx, dword [ebp - 4]
mov eax, 0x555a7c
call fcn.004050cc
test eax, eax
jle 0x55597b
lea eax, [ebp - 4]
mov edx, 0x555a7c
call fcn.00404b60
mov edx, dword [ebp - 4]
mov eax, 0x555a88
call fcn.004050cc
test eax, eax
jle 0x555999
lea eax, [ebp - 4]
mov edx, 0x555a88
call fcn.00404b60
push 0x555a94
push dword [ebp - 4]
push 0x555abc
push 0x555ac8
fld qword [ebp - 0x10]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x14]
call fcn.0040b484
push dword [ebp - 0x14]
push 0x555adc
fld qword [ebp - 0x10]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x18]
call fcn.0040b484
push dword [ebp - 0x18]
push 0x555aec
lea eax, [ebx + 0xc]
mov edx, 8
call fcn.00404e48
mov eax, ebx
call fcn.005038ec
mov eax, ebx
call fcn.005036f8
test al, al
je 0x555a07
mov eax, ebx
call fcn.00403c58
jmp 0x555a1c
mov ecx, esi
mov edx, 0x555afc
mov eax, ebx
call fcn.005037b8
mov eax, ebx
call fcn.00403c58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x555a46
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404aec
lea eax, [ebp - 4]
call fcn.00404ac8
ret
Function at 0x5a8f10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
mov edi, dword [ebp + 8]
add edi, 0xfffffff8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov word [eax], 0
test dl, dl
je 0x5a8f4a
test bl, bl
je 0x5a8f3b
mov eax, dword [edi]
mov esi, dword [eax + 0x21c]
jmp 0x5a8f45
mov eax, dword [edi]
movzx esi, byte [eax + 0x405]
dec esi
xor bl, 1
jmp 0x5a8f5b
mov eax, dword [edi]
mov edx, dword [eax + 0x420]
mov eax, dword [edi]
call fcn.0059a040
mov esi, eax
mov eax, esi
test bl, bl
je 0x5a8f64
inc esi
jmp 0x5a8f65
dec esi
mov edx, dword [edi]
cmp esi, dword [edx + 0x21c]
jl 0x5a8f7a
mov edx, dword [edi]
movzx esi, byte [edx + 0x405]
jmp 0x5a8f9a
mov edx, dword [edi]
movzx edx, byte [edx + 0x405]
cmp esi, edx
jge 0x5a8f9a
mov edx, dword [edi]
mov esi, dword [edx + 0x21c]
mov edx, dword [edi]
movzx edx, byte [edx + 0x405]
sub esi, edx
cmp eax, esi
je 0x5a8fde
jmp 0x5a8fb6
test bl, bl
je 0x5a8fa7
inc esi
jmp 0x5a8fa8
dec esi
test esi, esi
jl 0x5a8fde
mov eax, dword [edi]
cmp esi, dword [eax + 0x21c]
jge 0x5a8fde
mov eax, dword [edi]
mov edx, esi
call fcn.0059a034
mov edx, eax
mov eax, dword [edi]
call fcn.005a7f00
test al, al
je 0x5a8fa0
mov eax, dword [edi]
mov edx, esi
call fcn.0059a034
mov edx, eax
mov eax, dword [edi]
call fcn.005a7fd4
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5b3930
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x5b394a
add esp, 0xfffffff0
call fcn.00403fbc
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x5b39d8
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, edi
call fcn.00403c28
mov dword [edi + 4], esi
lea eax, [edi + 0x40]
call fcn.005855d4
mov byte [edi + 0x34], 1
mov dl, 1
mov eax, dword [0x41c88c]
call fcn.00403c28
mov dword [edi + 0x28], eax
mov dl, 1
mov eax, dword [0x41c88c]
call fcn.00403c28
mov dword [edi + 0x14], eax
mov dl, 1
mov eax, dword [0x4de550]
call fcn.004df5ac
mov esi, eax
mov dword [edi + 0x30], esi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x48], 0x5b4308
lea eax, [ebp - 0x10]
call fcn.00419b20
lea edx, [ebp - 0x10]
lea eax, [edi + 0x18]
call fcn.00411b78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b39df
lea eax, [ebp - 0x10]
call fcn.00411760
ret
Function at 0x623c80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x623d8c
test eax, eax
je 0x623d8c
push esi
push edi
mov ecx, 0x10
mov esi, 0x63eff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x623d73
lea edi, [eax + 4]
jmp 0x623cd7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x623cec
mov dword [ebp - 4], 2
jmp 0x623d0d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x623d03
mov dword [ebp - 4], 1
jmp 0x623d0d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x623d83
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x623d46
mov byte [ecx], 0x3d
jmp 0x623d52
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x623d5d
mov byte [ecx], 0x3d
jmp 0x623d63
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x623cd4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xe8d5f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0xe934cc]
cmp dword [eax + 0x28], 0
jne 0xe8d608
xor eax, eax
jmp 0xe8d737
mov ecx, dword [0xe9343c]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, 0xe
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [0xe93430], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [0xe9342c], eax
push 0
call dword [0xe91138]
mov dword [ebp - 0x10], eax
push 1
call dword [0xe91138]
mov dword [ebp - 0x18], eax
mov ecx, dword [0xe93430]
mov dword [ebp - 0x40], ecx
mov edx, dword [0xe9342c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x40]
shr eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 8]
shr ecx, 1
mov dword [ebp - 0x1c], ecx
push 0
mov edx, dword [0xe934b8]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0x80000000
push 0xe91680
push 0xe916d0
push 0x88
call dword [0xe91134]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [0xe93428], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [0xe9110c]
push eax
call fcn.00e8d530
push 5
mov eax, dword [ebp - 0xc]
push eax
call dword [0xe91148]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [0xe9112c]
push 0xe8d5c0
mov edx, dword [0xe934cc]
mov eax, dword [edx + 0x34]
imul eax, eax, 0x3e8
push eax
push 0
push 0
call dword [0xe9113c]
mov dword [0xe93434], eax
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
call dword [0xe91130]
test eax, eax
je 0xe8d737
cmp dword [ebp - 0x38], 0x12
jne 0xe8d72b
mov dword [0xe93444], 0
call fcn.00e8d740
xor eax, eax
jmp 0xe8d737
lea edx, [ebp - 0x3c]
push edx
call dword [0xe91140]
jmp 0xe8d6fc
mov esp, ebp
pop ebp
ret 4

Function at 0xe8eb00
Capabilities:
Read .ini file
Read and send data from client to server
Send data
Send data on socket
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebp
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
pop ebp
mov eax, dword [ebp + 8]
push eax
call dword [fcn.00e910dc]
call dword [fcn.00e91124]
call dword [fcn.00e91128]
call dword [fcn.00e91094]
call dword [fcn.00e910fc]
call dword [fcn.00e910f4]
call dword [fcn.00e91150]
call dword [fcn.00e9100c]
call dword [fcn.00e91000]
call dword [fcn.00e91160]
call fcn.00e90644
mov eax, 1
pop ebp
ret 4