joyce8/EMBER2024-capa huggingface dataset:
Function at 0x131b0070
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x20
call fcn.1314d090
push ebx
mov ebx, dword [esp + 0x30]
push ebp
push esi
test ebx, ebx
push edi
jle 0x131b01c4
cmp ebx, 0x80
jg 0x131b01c4
mov edi, dword [esp + 0x44]
mov eax, edi
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x14], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x18], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x40]
push eax
push edi
push edi
mov dword [esp + 0x28], edx
call fcn.131b0980
lea eax, [ebx + 7]
add esp, 0xc
cdq
and edx, 7
add eax, edx
mov ebp, eax
mov eax, dword [esp + 0x48]
sar ebp, 3
test eax, eax
je 0x131b0107
test ebp, ebp
jle 0x131b0155
mov edx, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
lea esi, [esp + 0x20]
sub edx, edi
sub esi, edi
mov ecx, edi
sub ebx, edi
mov al, byte [edx + ecx]
xor al, byte [ecx]
inc ecx
dec ebp
mov byte [esi + ecx - 1], al
mov byte [ebx + ecx - 1], al
jne 0x131b00f4
jmp 0x131b0151
xor esi, esi
test ebp, ebp
jle 0x131b0155
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x20]
mov ebx, edi
lea edx, [esp + 0x20]
sub eax, ecx
mov ecx, dword [esp + 0x38]
sub ebx, edx
lea edx, [esp + 0x20]
sub ecx, edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ecx
jmp 0x131b0137
mov ebx, dword [esp + 0x34]
lea ecx, [esp + esi + 0x20]
mov dl, byte [eax + ecx]
mov bl, byte [ebx + ecx]
mov byte [ecx], dl
xor bl, dl
mov edx, dword [esp + 0x38]
inc esi
cmp esi, ebp
mov byte [edx + ecx], bl
jl 0x131b0133
mov ebx, dword [esp + 0x3c]
mov ebp, ebx
and ebp, reloc.WS2_32.dll_getsockopt
jns 0x131b0164
dec ebp
or ebp, 0xfffffff8
inc ebp
mov eax, ebx
cdq
and edx, 7
add eax, edx
sar eax, 3
test ebp, ebp
jne 0x131b0195
lea eax, [esp + eax + 0x10]
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov dword [edi + 4], edx
mov ecx, dword [eax + 8]
mov dword [edi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [edi + 0xc], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov ecx, 8
xor esi, esi
sub ecx, ebp
lea eax, [esp + eax + 0x10]
mov dword [esp + 0x3c], ecx
jmp 0x131b01ac
mov ecx, dword [esp + 0x3c]
mov dl, byte [eax + esi + 1]
mov bl, byte [eax + esi]
shr dl, cl
mov ecx, ebp
shl bl, cl
or dl, bl
mov byte [esi + edi], dl
inc esi
cmp esi, 0x10
jl 0x131b01a8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x131b8d50
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
mov eax, 1
ret
Function at 0x131ba660
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], 0x1c
mov eax, 1
ret

Function at 0x131ba6c0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], 0x20
mov eax, 1
ret
Function at 0x131bbe00
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x40], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x44], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x30
mov eax, 1
ret

Function at 0x131bbea0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x40], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x44], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
mov eax, 1
ret
Function at 0x131bff80
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
test edi, edi
je 0x131bffe1
mov al, byte [edi]
test al, al
je 0x131bffe1
push ebx
push ebp
mov ebx, 0x100
movsx eax, al
or eax, ebx
mov ebp, esi
mov edx, eax
mov ecx, eax
shr edx, 2
and edx, 0xf
and ecx, 0xf
xor edx, ecx
mov ecx, 0x20
sub ecx, edx
add ebx, 0x100
shr ebp, cl
mov ecx, edx
mov edx, eax
imul edx, eax
shl esi, cl
mov al, byte [edi + 1]
or ebp, esi
xor ebp, edx
inc edi
test al, al
mov esi, ebp
jne 0x131bff99
mov eax, esi
pop ebp
shr eax, 0x10
pop ebx
xor eax, esi
pop edi
pop esi
ret
pop edi
xor eax, eax
pop esi
ret

Function at 0x131d6900
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
push esi
test edx, edx
je 0x131d69b5
mov esi, dword [esp + 0x10]
test esi, esi
je 0x131d69b5
mov eax, dword [esp + 8]
cmp esi, 4
push ebx
not eax
jb 0x131d698a
push edi
mov edi, esi
shr edi, 2
mov ebx, dword [edx]
add edx, 4
xor eax, ebx
sub esi, 4
mov ecx, eax
mov ebx, eax
and ecx, 0xff
shr ebx, 8
mov eax, dword [ecx*4 + 0x1320b81c]
xor eax, ebx
mov ecx, eax
and ecx, 0xff
shr eax, 8
mov ecx, dword [ecx*4 + 0x1320b81c]
xor ecx, eax
mov eax, ecx
and eax, 0xff
shr ecx, 8
mov eax, dword [eax*4 + 0x1320b81c]
xor eax, ecx
mov ecx, eax
and ecx, 0xff
shr eax, 8
mov ecx, dword [ecx*4 + 0x1320b81c]
xor eax, ecx
dec edi
jne 0x131d692b
pop edi
mov ecx, esi
dec esi
test ecx, ecx
je 0x131d69b0
inc esi
mov ecx, eax
xor ebx, ebx
mov bl, byte [edx]
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x1320b81c]
xor eax, ecx
inc edx
dec esi
jne 0x131d6992
pop ebx
pop esi
not eax
ret
mov eax, dword [esp + 8]
pop esi
ret
Function at 0x131e2020
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x131e2070
lea eax, [esi + 4]
push eax
push 4
push esi
push 0x131e2240
push 0
push 0
call fcn.1314f1e3
add esp, 0x18
mov dword [esi + 8], eax
test eax, eax
je 0x131e2070
mov ecx, dword [esi + 0x1c]
mov dword [esi + 0xc], 1
test ecx, ecx
je 0x131e205f
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x131e20c0
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x131e20d4
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 8]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 8]
push 0
push ecx
push 2
mov dword [esp + 0x18], edx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edx, dword [esi + 8]
push 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x131e2121
mov eax, dword [esi + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push ecx
call edi
mov edx, dword [esi + 0x14]
push edx
call edi
mov dword [esi + 0xc], 0
pop edi
mov eax, 1
pop esi
add esp, 8
ret
Function at 0x131ec6d5
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x131ec70d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.131e7d65
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.131e7d3c
jmp 0x131ec719
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3a9f6c2f
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x1851627a
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4239d9
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x423a3d
push 0x3d
push dword [ebp + 8]
call fcn.0041c080
push eax
pop esi
pop ecx
cmp esi, edi
pop ecx
mov dword [ebp - 8], esi
je 0x423a3d
cmp dword [ebp + 8], esi
je 0x423a3d
mov eax, dword [0x434390]
xor ebx, ebx
cmp byte [esi + 1], bl
sete bl
cmp eax, dword [0x434394]
jne 0x423a23
push eax
call fcn.00423bb8
pop ecx
mov dword [0x434390], eax
cmp eax, edi
jne 0x423a7b
cmp dword [ebp + 0xc], edi
je 0x423a45
cmp dword [0x434398], edi
je 0x423a45
call fcn.004235c2
test eax, eax
je 0x423a7b
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
cmp ebx, edi
jne 0x423b59
push 4
call fcn.0041d367
cmp eax, edi
pop ecx
mov dword [0x434390], eax
je 0x423a3d
mov dword [eax], edi
cmp dword [0x434398], edi
jne 0x423a7b
push 4
call fcn.0041d367
cmp eax, edi
pop ecx
mov dword [0x434398], eax
je 0x423a3d
mov dword [eax], edi
sub esi, dword [ebp + 8]
mov edi, dword [0x434390]
mov dword [ebp - 4], edi
push esi
push dword [ebp + 8]
call fcn.00423b60
mov esi, eax
pop ecx
or esi, esi
pop ecx
jl 0x423adb
cmp dword [edi], 0
je 0x423adb
or ebx, ebx
je 0x423ad3
push dword [edi + esi*4]
lea edi, [edi + esi*4]
call fcn.0041d2aa
pop ecx
cmp dword [edi], 0
je 0x423abd
mov eax, dword [edi + 4]
inc esi
mov dword [edi], eax
add edi, 4
jmp 0x423aad
push esi
pop eax
shl eax, 2
push eax
push dword [ebp - 4]
call fcn.0041e8e3
pop ecx
test eax, eax
pop ecx
je 0x423b0d
jmp 0x423b08
mov eax, dword [ebp + 8]
mov dword [edi + esi*4], eax
jmp 0x423b0d
test ebx, ebx
jne 0x423b59
or esi, esi
jge 0x423ae5
neg esi
lea eax, [esi*4 + 8]
push eax
push edi
call fcn.0041e8e3
pop ecx
or eax, eax
pop ecx
je 0x423a3d
mov ecx, dword [ebp + 8]
mov dword [eax + esi*4], ecx
and dword [eax + esi*4 + 4], 0
mov dword [0x434390], eax
cmp dword [ebp + 0xc], 0
je 0x423b59
push dword [ebp + 8]
call fcn.00420d10
inc eax
inc eax
push eax
call fcn.0041d367
push eax
pop esi
pop ecx
test esi, esi
pop ecx
je 0x423b59
push dword [ebp + 8]
push esi
call fcn.00422cf0
mov eax, esi
pop ecx
sub eax, dword [ebp + 8]
pop ecx
add eax, dword [ebp - 8]
and byte [eax], 0
inc eax
neg ebx
sbb ebx, ebx
not ebx
and ebx, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableA]
push esi
call fcn.0041d2aa
pop ecx
sub eax, eax
jmp 0x423a40
Function at 0x424040
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x350
push ebx
push ebp
push esi
mov esi, dword [esp + 0x360]
push edi
xor edi, edi
mov dword [esp + 0x14], ecx
push esi
mov dword [esp + 0x14], edi
call fcn.0040c9d0
add esp, 4
test eax, eax
je 0x42420e
mov ebx, dword [esp + 0x368]
or ebx, ebx
je 0x42420e
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [esp + 0x18]
push esi
push eax
call edi
lea ecx, [esp + 0x18]
push 0x104
push ecx
call fcn.0040ce70
mov ebp, dword [sym.imp.KERNEL32.DLL_lstrcatA]
add esp, 8
lea edx, [esp + 0x18]
push ebx
push edx
call ebp
lea eax, [esp + 0x220]
lea ecx, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
push eax
pop ebx
cmp ebx, 0xffffffff
je 0x424137
call fcn.004246e0
lea edx, [esp + 0x11c]
push esi
push edx
call edi
lea eax, [esp + 0x11c]
push 0x104
push eax
call fcn.0040ce70
add esp, 8
lea ecx, [esp + 0x24c]
lea edx, [esp + 0x11c]
push ecx
push edx
call ebp
test byte [esp + 0x220], 0x10
jne 0x42411d
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x11c]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
or eax, eax
jl 0x42411d
inc dword [esp + 0x10]
lea eax, [esp + 0x220]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
or eax, eax
jne 0x4240c3
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
lea ecx, [esp + 0x18]
push esi
push ecx
call edi
lea edx, [esp + 0x18]
push 0x104
push edx
call fcn.0040ce70
add esp, 8
lea eax, [esp + 0x18]
push 0x42b1bc
push eax
call ebp
lea ecx, [esp + 0x220]
lea edx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4241fd
call fcn.004246e0
test byte [esp + 0x220], 0x10
je 0x4241e3
cmp byte [esp + 0x24c], 0x2e
je 0x4241e3
lea eax, [esp + 0x11c]
push esi
push eax
call edi
lea ecx, [esp + 0x11c]
push 0x104
push ecx
call fcn.0040ce70
add esp, 8
lea edx, [esp + 0x24c]
lea eax, [esp + 0x11c]
push edx
push eax
call ebp
mov ecx, dword [esp + 0x368]
lea edx, [esp + 0x11c]
push ecx
mov ecx, dword [esp + 0x18]
push edx
call fcn.00424040
add dword [esp + 0x10], eax
lea eax, [esp + 0x220]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x42417b
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret 8
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret 8
Function at 0x401ba1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00404640
push edi
mov byte [ebp - 0x1000], 0
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0xfff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0
push 0x80
push 3
push 0
push 0
push closesocket
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 0x1004], eax
cmp dword [ebp - 0x1004], 0xffffffff
jne 0x401bfa
xor eax, eax
jmp 0x401c9a
mov ecx, 1
test ecx, ecx
je 0x401c88
mov dword [ebp - 0x1008], 0
push 0x1000
push 0
lea edx, [ebp - 0x1000]
push edx
call sub.MSVCRT.DLL_memset
add esp, 0xc
push 0
lea eax, [ebp - 0x1008]
push eax
push 0x1000
lea ecx, [ebp - 0x1000]
push ecx
mov edx, dword [ebp - 0x1004]
push edx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
cmp dword [ebp - 0x1008], 0
jne 0x401c54
jmp 0x401c88
mov eax, dword [ebp - 0x1008]
push eax
lea ecx, [ebp - 0x1000]
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
add eax, dword [edx]
push eax
call sub.MSVCRT.DLL_memcpy
add esp, 0xc
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
add edx, dword [ebp - 0x1008]
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
jmp 0x401bfa
mov ecx, dword [ebp - 0x1004]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x403a45
Capabilities:
Create raw socket
Create thread
Create udp socket
Get hostname
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov dword [ebp - 0x150], ecx
push 0
push 3
push 2
call dword [sym.imp.WS2_32.DLL_socket]
mov ecx, dword [ebp - 0x150]
mov dword [ecx + 0xa], eax
mov edx, dword [ebp - 0x150]
cmp dword [edx + 0xa], 0xffffffff
jne 0x403a80
call dword [sym.imp.WS2_32.DLL_WSAGetLastError]
jmp 0x403c2f
push 0x100
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.WS2_32.DLL_gethostname]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x403aa6
call dword [sym.imp.WS2_32.DLL_WSAGetLastError]
jmp 0x403c2f
lea ecx, [ebp - 0x14c]
push ecx
call dword [sym.imp.WS2_32.DLL_gethostbyname]
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x150]
mov eax, dword [ebp + 8]
mov dword [edx + 0xe], eax
mov word [ebp - 0x40], 2
mov ecx, dword [ebp - 0x150]
mov dx, word [ecx + 0xe]
push edx
call dword [sym.imp.WS2_32.DLL_htons]
mov word [ebp - 0x3e], ax
mov eax, dword [ebp - 0x4c]
movsx ecx, word [eax + 0xa]
push ecx
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x3c]
push edx
call sub.MSVCRT.DLL_memcpy
add esp, 0xc
push 0x10
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x150]
mov edx, dword [ecx + 0xa]
push edx
call dword [sym.imp.WS2_32.DLL_bind]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x403b24
call dword [sym.imp.WS2_32.DLL_WSAGetLastError]
jmp 0x403c2f
mov dword [ebp - 0x44], 1
push 4
lea eax, [ebp - 0x44]
push eax
push 4
push 0xffff
mov ecx, dword [ebp - 0x150]
mov edx, dword [ecx + 0xa]
push edx
call dword [sym.imp.WS2_32.DLL_setsockopt]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x44], 1
push 4
lea eax, [ebp - 0x44]
push eax
push 2
push 0
mov ecx, dword [ebp - 0x150]
mov edx, dword [ecx + 0xa]
push edx
call dword [sym.imp.WS2_32.DLL_setsockopt]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x403b80
call dword [sym.imp.WS2_32.DLL_WSAGetLastError]
jmp 0x403c2f
mov dword [ebp - 0x48], 1
mov dword [ebp - 4], 0
push 0
push 0
lea eax, [ebp - 4]
push eax
push 0x28
lea ecx, [ebp - 0x2c]
push ecx
push 4
lea edx, [ebp - 0x48]
push edx
push 0x98000001
mov eax, dword [ebp - 0x150]
mov ecx, dword [eax + 0xa]
push ecx
call dword [sym.imp.WS2_32.DLL_WSAIoctl]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x403bc8
call dword [sym.imp.WS2_32.DLL_WSAGetLastError]
jmp 0x403c2f
mov edx, dword [ebp - 0x150]
mov byte [edx + 8], 1
push 0
push 0
mov eax, dword [ebp - 0x150]
push eax
push 0x4039a2
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ecx, dword [ebp - 0x150]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x150]
cmp dword [edx + 4], 0
jne 0x403c2d
mov eax, dword [ebp - 0x150]
mov byte [eax + 8], 0
mov ecx, dword [ebp - 0x150]
mov edx, dword [ecx + 0xa]
push edx
call dword [sym.imp.WS2_32.DLL_closesocket]
mov eax, dword [ebp - 0x150]
mov dword [eax + 0xa], 0xffffffff
or eax, 0xffffffff
jmp 0x403c2f
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x403c35
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 8], 0
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 0
je 0x403c72
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0xa], 0
je 0x403c88
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xa]
push eax
call dword [sym.imp.WS2_32.DLL_closesocket]
mov esp, ebp
pop ebp
ret

Function at 0x433dda
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00433e59
jae 0x433de6
xor ecx, ecx
call fcn.00433e59
jae 0x433e10
xor eax, eax
call fcn.00433e59
jae 0x433e21
mov al, 0x10
call fcn.00433e59
adc al, al
jae 0x433e02
jne 0x433e4e
stosb byte es:[edi], al
jmp 0x433de7
call fcn.00433e65
dec ecx
loop 0x433e2d
mov eax, ebp
call fcn.00433e63
jmp 0x433e4f
lodsb al, byte [esi]
shr eax, 1
je 0x433e75
adc ecx, 2
mov ebp, eax
jmp 0x433e4f
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00433e63
cmp eax, 0x7d00
jae 0x433e4d
cmp eax, 0x500
jae 0x433e4e
cmp eax, 0x7f
ja 0x433e4f
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x433de7
pop ebp
ret 8
Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d7a
sub eax, 0x403d20
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x6b4b71ba
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
mov ecx, 0x2e5b447f
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x433006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219