joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d7e50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
and ecx, 1
je 0x5d7e71
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 8], eax
jmp 0x5d7ecc
push 5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x5d7e95
call fcn.0050af50
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x5d7eb4
call fcn.0050af50
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5d7ecc
call fcn.0050af50
call fcn.0050e6b4
cmp dword [eax + 0x3c], 0
je 0x5d7ee6
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.00508674
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.005077d8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x5c], 0
je 0x5d7f16
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x5c], 0
cmp dword [ebp - 4], 0
je 0x5d7f2b
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov dword [edx + 0x5c], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
or ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x25763fa2
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x3f490df2
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x644d12c0
Capabilities:
Inspect section memory permissions

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
test eax, eax
js 0x644d12d0
add esp, 0xc
ret
neg eax
test eax, eax
js 0x644e5248
add esp, 0xc
ret
call sub.cygwin1.dll_abort
nop
nop
nop

Function at 0x644d12e0
Capabilities:
Inspect section memory permissions

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
test edx, edx
js 0x644d12f8
add esp, 0xc
ret
neg eax
adc edx, 0
neg edx
test edx, edx
js 0x644e5250
add esp, 0xc
ret
call sub.cygwin1.dll_abort
nop
nop
nop
call sub.cygwin1.dll_abort
nop
nop
nop
call sub.cygwin1.dll_abort
nop
nop
nop
call sub.cygwin1.dll_abort
nop
nop
nop
call sub.cygwin1.dll_abort
nop
nop
nop
call sub.cygwin1.dll_abort
nop
nop
nop

Function at 0x644d1310
Capabilities:
Inspect section memory permissions

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
lea eax, [edx + ecx]
test ecx, ecx
js 0x644d1338
cmp edx, eax
setg dl
test dl, dl
jne 0x644e5258
add esp, 0xc
ret
cmp edx, eax
setl dl
jmp 0x644d1327

Function at 0x644d1340
Capabilities:
Inspect section memory permissions

Disassembly:
push esi
push ebx
sub esp, 4
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
mov eax, ecx
mov edx, ebx
add eax, dword [esp + 0x18]
adc edx, dword [esp + 0x1c]
test esi, esi
js 0x644d1378
cmp eax, ecx
mov esi, edx
sbb esi, ebx
jl 0x644e5260
add esp, 4
pop ebx
pop esi
ret
cmp ecx, eax
sbb ebx, edx
jl 0x644e5260
jmp 0x644d136d

Function at 0x644d1390
Capabilities:
Inspect section memory permissions

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov eax, edx
sub eax, ecx
test ecx, ecx
js 0x644d13b8
cmp edx, eax
setl dl
test dl, dl
jne 0x644e5268
add esp, 0xc
ret
cmp edx, eax
setg dl
jmp 0x644d13a8

Function at 0x644d13c0
Capabilities:
Inspect section memory permissions

Disassembly:
push edi
push esi
push ebx
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov eax, ecx
mov edx, ebx
sub eax, esi
sbb edx, edi
test edi, edi
js 0x644d13f0
cmp ecx, eax
sbb ebx, edx
jl 0x644e5270
pop ebx
pop esi
pop edi
ret
cmp eax, ecx
mov edi, edx
sbb edi, ebx
jl 0x644e5270
jmp 0x644d13e9

Function at 0x644d1400
Capabilities:
Inspect section memory permissions

Disassembly:
push ebx
sub esp, 8
mov eax, dword [esp + 0x14]
imul dword [esp + 0x10]
mov ecx, eax
sar ecx, 0x1f
cmp ecx, edx
jne 0x644e5278
add esp, 8
pop ebx
ret
Function at 0x644d1420
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x34]
mov dword [esp + 0xc], edx
mov edx, eax
mov ebx, eax
sar edx, 0x1f
mov dword [esp + 8], eax
mov ecx, edi
mov eax, edx
mov edx, dword [esp + 0xc]
mov dword [esp], edx
mov edx, edi
sar edx, 0x1f
cmp edx, ebp
jne 0x644d1470
cmp eax, dword [esp]
jne 0x644d14c0
mov eax, edi
imul ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, ebp
cmp eax, dword [esp]
jne 0x644d150c
mov eax, edi
mul ebx
mov dword [esp], eax
mov dword [esp + 8], eax
mov eax, ebp
mov dword [esp + 4], edx
mul ebx
test ebp, ebp
jns 0x644d1498
mov esi, edx
sub esi, ebx
mov edx, esi
test ebx, ebx
jns 0x644d14a0
sub eax, edi
sbb edx, ebp
mov ecx, dword [esp + 4]
xor ebx, ebx
add ecx, eax
mov eax, ecx
adc ebx, edx
sar eax, 0x1f
cmp eax, ebx
jne fcn.644e5280
mov eax, dword [esp + 8]
mov edx, ecx
jmp 0x644d1463
mov eax, ebx
mul edi
mov edi, dword [esp]
mov esi, eax
mov eax, dword [esp]
mov ebp, edx
mul ecx
mov ebx, eax
test edi, edi
jns 0x644d14e2
mov eax, edx
sub eax, ecx
mov dword [esp], eax
mov edx, dword [esp]
mov eax, ebx
test ecx, ecx
jns 0x644d14ee
sub eax, dword [esp + 8]
sbb edx, dword [esp + 0xc]
mov ecx, ebp
xor ebx, ebx
add ecx, eax
mov eax, ecx
adc ebx, edx
sar eax, 0x1f
cmp eax, ebx
jne fcn.644e5280
mov eax, esi
mov edx, ecx
jmp 0x644d1463
test ebp, ebp
js 0x644d1530
mov eax, dword [esp]
test eax, eax
js 0x644d1560
or eax, ebp
jne fcn.644e5280
mov eax, edi
mul ebx
test edx, edx
jns 0x644d1463
jmp fcn.644e5280
mov eax, dword [esp]
test eax, eax
js 0x644d1588
jne fcn.644e5280
cmp ebp, 0xffffffff
jne fcn.644e5280
mov eax, edi
mul ebx
mov ecx, edx
mov esi, eax
sub ecx, ebx
js 0x644d1503
jmp fcn.644e5280
cmp dword [esp], 0xffffffff
jne fcn.644e5280
test ebp, ebp
jne fcn.644e5280
mov eax, ebx
mul edi
mov esi, eax
mov eax, edx
sub eax, ecx
mov ecx, eax
js 0x644d1503
jmp fcn.644e5280
and esi, dword [esp]
cmp esi, 0xffffffff
jne fcn.644e5280
mov eax, ebx
or eax, edi
je fcn.644e5280
mov eax, edi
mul ebx
mov esi, eax
mov eax, edx
sub eax, ecx
sub eax, ebx
mov ecx, eax
js fcn.644e5280
jmp 0x644d1503

Function at 0x644d15c0
Capabilities:
Inspect section memory permissions

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x10]
mov eax, edx
neg eax
mov ecx, eax
shr ecx, 0x1f
test edx, edx
js 0x644d15d9
test eax, eax
setg cl
test cl, cl
jne 0x644e5288
add esp, 0xc
ret

Function at 0x644d15f0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebx
sub esp, 8
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov eax, ecx
mov edx, ebx
neg eax
adc edx, 0
neg edx
test ebx, ebx
js 0x644d1630
mov ebx, edx
sar ebx, 0x1f
mov ecx, ebx
cmp ecx, eax
sbb ebx, edx
shr ebx, 0x1f
mov ecx, ebx
test cl, cl
jne 0x644e5290
add esp, 8
pop ebx
ret
mov ebx, edx
shr ebx, 0x1f
mov ecx, ebx
jmp 0x644d161b
Function at 0x644dea70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebx, dword [esp + 0x70]
mov edi, dword [esp + 0x74]
mov edx, dword [esp + 0x78]
mov eax, dword [esp + 0x7c]
fnstcw word [esp + 0x2e]
mov ebp, eax
mov dword [esp + 0x3c], eax
movzx esi, ax
shr eax, 0x1f
shr ebp, 0x10
mov dword [esp + 0x30], ebx
and ebp, 0x7fff
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], edx
cmp ebp, 0x3ffe
jg 0x644deb00
test ebp, ebp
je 0x644deae8
mov ebx, 0x20
xor eax, eax
mov dword [esp], ebx
mov dword [esp + 0x18], eax
call fcn.644d6e20
mov eax, dword [esp + 0x18]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, ebx
or eax, edi
or edx, eax
mov eax, edx
or eax, esi
je 0x644deadb
mov ebx, 0x22
xor eax, eax
jmp 0x644deacb
mov ecx, ebx
mov edi, 0x401f
movzx ebx, al
sub edi, ebx
cmp ebp, edi
jge 0x644deb80
test ebx, ebx
jne 0x644deb98
mov edi, 0x406f
or esi, 0x10000
sub edi, ebp
mov dword [esp + 0x18], esi
mov eax, edi
mov ebp, edi
xor edi, edi
mov dword [esp + 0x4c], esi
sar eax, 5
xor esi, esi
add edi, 1
or esi, ecx
cmp eax, edi
je 0x644deb4e
mov ecx, dword [esp + edi*4 + 0x40]
add edi, 1
or esi, ecx
cmp eax, edi
jne 0x644deb41
mov edi, ebp
and edi, 0x1f
jne 0x644deba0
mov edx, dword [esp + eax*4 + 0x40]
mov dword [esp + 0x40], edx
cmp eax, 2
jne 0x644deb6a
mov eax, dword [esp + 0x18]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x40]
mov ebx, 0x20
test esi, esi
jne 0x644deacb
jmp 0x644deadb
xor eax, 1
mov ebx, 1
movzx eax, al
neg eax
jmp 0x644deacb
xor eax, eax
jmp 0x644deacb
mov ebp, 0x20
sub ebp, edi
mov ecx, ebp
mov ebp, dword [esp + eax*4 + 0x40]
mov dword [esp + 0x1c], ecx
shl ebp, cl
or esi, ebp
cmp eax, 2
jne 0x644debd4
mov ecx, edi
mov eax, dword [esp + 0x18]
mov ebx, 1
shr edx, cl
movzx ecx, byte [esp + 0x1c]
shl eax, cl
or edx, eax
mov dword [esp + 0x40], edx
mov eax, dword [esp + 0x18]
mov ecx, edi
shr eax, cl
mov dword [esp + ebx*4 + 0x40], eax
jmp 0x644deb6a
Function at 0x644df0d0
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov edi, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov eax, dword [esp + 0x78]
mov ebx, dword [esp + 0x7c]
fnstcw word [esp + 0x2e]
mov edx, ebx
mov dword [esp + 0x3c], ebx
movzx ebp, bx
shr ebx, 0x1f
shr edx, 0x10
mov dword [esp + 0x30], edi
and edx, 0x7fff
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], eax
cmp edx, 0x3ffe
jg 0x644df160
test edx, edx
je 0x644df148
mov ecx, 0x20
xor esi, esi
xor edi, edi
mov dword [esp], ecx
call fcn.644d6e20
add esp, 0x5c
mov eax, esi
mov edx, edi
pop ebx
pop esi
pop edi
pop ebp
ret
or ecx, edi
or eax, ecx
or eax, ebp
je 0x644df210
mov ecx, 0x22
xor esi, esi
xor edi, edi
jmp 0x644df12d
movzx ecx, bl
mov eax, 0x403f
sub eax, ecx
cmp edx, eax
jge 0x644df1e0
test ecx, ecx
jne 0x644df200
mov eax, 0x406f
mov esi, edi
xor edi, edi
or ebp, 0x10000
sub eax, edx
add edi, 1
xor edx, edx
mov dword [esp + 0x14], ebp
mov ebx, eax
mov dword [esp + 0x4c], ebp
or edx, esi
sar ebx, 5
cmp ebx, edi
je 0x644df1ac
mov esi, dword [esp + edi*4 + 0x40]
add edi, 1
or edx, esi
cmp ebx, edi
jne 0x644df19f
mov ebp, 3
sub ebp, ebx
and eax, 0x1f
jne 0x644df220
lea esi, [esp + ebx*4 + 0x40]
mov eax, dword [esi + ecx*4]
mov dword [esp + ecx*4 + 0x40], eax
add ecx, 1
cmp ecx, ebp
jle 0x644df1bc
mov esi, 4
sub esi, ebx
jmp 0x644df288
xor ebx, 1
xor edi, edi
mov ecx, 1
movzx ebx, bl
mov esi, ebx
neg esi
adc edi, 0
neg edi
jmp 0x644df12d
xor esi, esi
xor edi, edi
jmp 0x644df12d
add esp, 0x5c
xor esi, esi
xor edi, edi
pop ebx
mov eax, esi
mov edx, edi
pop esi
pop edi
pop ebp
ret
mov esi, dword [esp + ebx*4 + 0x40]
mov ecx, 0x20
sub ecx, eax
shl esi, cl
mov dword [esp + 0x10], ecx
or edx, esi
mov esi, 1
test ebp, ebp
je 0x644df277
lea edi, [esp + ebp*4 + 0x40]
mov dword [esp + 0x1c], edx
lea esi, [esp + 0x40]
mov dword [esp + 0x18], edi
mov edi, dword [esi + ebx*4]
mov ecx, eax
mov edx, dword [esi + ebx*4 + 4]
add esi, 4
shr edi, cl
movzx ecx, byte [esp + 0x10]
shl edx, cl
or edi, edx
mov dword [esi - 4], edi
cmp esi, dword [esp + 0x18]
jne 0x644df24c
mov esi, 4
mov edx, dword [esp + 0x1c]
sub esi, ebx
mov edi, dword [esp + 0x14]
mov ecx, eax
shr edi, cl
mov dword [esp + ebp*4 + 0x40], edi
lea esi, [esi]
nop
mov dword [esp + esi*4 + 0x40], 0
add esi, 1
cmp esi, 4
jne 0x644df288
mov esi, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
xor ebx, ebx
mov edi, esi
xor esi, esi
add esi, ecx
mov ecx, 0x20
adc edi, ebx
test edx, edx
jne 0x644df12d
jmp 0x644df135
Function at 0x644df680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebx, dword [esp + 0x70]
fnstcw word [esp + 0x2e]
mov edx, dword [esp + 0x74]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov edi, edx
mov ebp, edx
mov esi, edx
mov dword [esp + 0x44], 0
shr edi, 0x17
shr ebp, 0x1f
and esi, 0x7fffff
mov ecx, edi
mov dword [esp + 0x1c], ebp
mov eax, esi
movzx ecx, cl
mov dword [esp + 0x40], esi
lea ebp, [ecx + 1]
and ebp, 0xfe
je 0x644df730
shr esi, 7
shl eax, 0x19
lea edx, [ecx + 0x3f80]
movzx ecx, word [esp + 0x3e]
mov word [esp + 0x3c], si
xor edi, edi
xor ebp, ebp
and cx, 0x8000
or ecx, edx
movzx edx, byte [esp + 0x1c]
mov word [esp + 0x3e], cx
movzx ecx, ch
shl edx, 7
and ecx, 0x7f
or ecx, edx
mov byte [esp + 0x3f], cl
mov esi, dword [esp + 0x3c]
mov dword [ebx + 8], eax
mov eax, ebx
mov dword [ebx], edi
mov dword [ebx + 4], ebp
mov dword [ebx + 0xc], esi
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov ecx, edi
test cl, cl
jne 0x644df808
test esi, esi
je 0x644df860
bsr edi, esi
xor edi, 0x1f
lea eax, [edi + 0x51]
mov ebp, eax
sar ebp, 5
and eax, 0x1f
je 0x644df880
cmp ebp, 2
je 0x644df8b0
mov edx, 2
mov ebp, 3
mov ecx, eax
shl esi, cl
mov dword [esp + ebp*4 + 0x40], esi
mov eax, dword [esp + 0x4c]
lea esi, [esi]
nop
mov dword [esp + edx*4 + 0x40], 0
sub edx, 1
cmp edx, 0xffffffff
jne 0x644df780
mov ecx, dword [esp + 0x40]
mov word [esp + 0x3c], ax
mov eax, 0x3f89
sub eax, edi
mov edx, ecx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov edx, 2
mov dword [esp + 0x34], ecx
mov ecx, eax
movzx eax, word [esp + 0x3e]
and cx, 0x7fff
mov ebp, dword [esp + 0x34]
and ax, 0x8000
or eax, ecx
movzx ecx, byte [esp + 0x1c]
mov word [esp + 0x3e], ax
movzx eax, ah
shl ecx, 7
and eax, 0x7f
or eax, ecx
mov byte [esp + 0x3f], al
mov eax, dword [esp + 0x48]
mov esi, dword [esp + 0x3c]
mov dword [esp], edx
mov dword [esp + 0x1c], eax
call fcn.644d6e20
mov eax, dword [esp + 0x1c]
jmp 0x644df715
test esi, esi
je 0x644df870
shr eax, 7
movzx ecx, byte [esp + 0x1c]
xor edi, edi
xor ebp, ebp
or ah, 0x80
mov word [esp + 0x3c], ax
movzx eax, word [esp + 0x3e]
shl ecx, 7
or ax, 0x7fff
mov word [esp + 0x3e], ax
movzx eax, ah
and eax, 0x7f
or eax, ecx
mov byte [esp + 0x3f], al
mov eax, esi
mov esi, dword [esp + 0x3c]
shl eax, 0x19
and edx, 0x400000
jne 0x644df715
mov edx, 1
jmp 0x644df7ec
xor edx, edx
xor esi, esi
jmp 0x644df6e3
mov edx, 0x7fff
xor esi, esi
jmp 0x644df6e3
mov eax, 3
mov edx, 2
sub eax, ebp
mov eax, dword [esp + eax*4 + 0x40]
cmp ebp, 2
jne 0x644df780
mov dword [esp + 0x48], esi
mov edx, 1
jmp 0x644df780
mov ecx, 0x20
mov edx, esi
sub ecx, eax
shr edx, cl
mov dword [esp + 0x4c], edx
mov edx, 1
jmp 0x644df76c
Function at 0x644e18c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ebp, 0xfffffccd
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.644e0ff3
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.644e0fa8
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], pe_nt_image_headers32
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.644e0ff3
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.644e0fa8
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.644e0fe3
dec esi
jbe 0x644e1a70
sti
and byte [ebp - 0x534], 0
and byte [ebp - 0x533], 0
mov byte [ebp - 0x532], 0x68
and byte [ebp - 0x531], 0
mov byte [ebp - 0x530], 0xd4
mov byte [ebp - 0x52f], 0xfb
mov byte [ebp - 0x52e], 0xf8
mov byte [ebp - 0x52d], 0xe4
mov byte [ebp - 0x52c], 0xf2
mov byte [ebp - 0x52b], 0xdf
mov byte [ebp - 0x52a], 0xf6
mov byte [ebp - 0x529], 0xf9
mov byte [ebp - 0x528], 0xf3
mov byte [ebp - 0x527], 0xfb
mov byte [ebp - 0x526], 0xf2
mov byte [ebp - 0x525], 0x97
lea eax, [ebp - 0x534]
push eax
call fcn.644e0ff3
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.644e0fa8
add esp, 0xc
mov dword [ebp - 0x680], eax
call fcn.644e0fe3
and eax, 0x805c1a51
movsd dword es:[edi], dword [esi]
pushfd
stc
invalid
add dh, al
test eax, edx
cli
invalid
Function at 0x8df5f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x8e54cc]
cmp dword [eax + 0x28], 0
jne 0x8df608
xor eax, eax
jmp 0x8df737
mov ecx, dword [0x8e543c]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, 0xe
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [0x8e5430], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [0x8e542c], eax
push 0
call dword [0x8e3138]
mov dword [ebp - 0x10], eax
push 1
call dword [0x8e3138]
mov dword [ebp - 0x18], eax
mov ecx, dword [0x8e5430]
mov dword [ebp - 0x40], ecx
mov edx, dword [0x8e542c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x40]
shr eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 8]
shr ecx, 1
mov dword [ebp - 0x1c], ecx
push 0
mov edx, dword [0x8e54b8]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0x80000000
push 0x8e3680
push 0x8e36d0
push 0x88
call dword [0x8e3134]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [0x8e5428], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [0x8e310c]
push eax
call fcn.008df530
push 5
mov eax, dword [ebp - 0xc]
push eax
call dword [0x8e3148]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [0x8e312c]
push 0x8df5c0
mov edx, dword [0x8e54cc]
mov eax, dword [edx + 0x34]
imul eax, eax, 0x3e8
push eax
push 0
push 0
call dword [0x8e313c]
mov dword [0x8e5434], eax
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
call dword [0x8e3130]
test eax, eax
je 0x8df737
cmp dword [ebp - 0x38], 0x12
jne 0x8df72b
mov dword [0x8e5444], 0
call fcn.008df740
xor eax, eax
jmp 0x8df737
lea edx, [ebp - 0x3c]
push edx
call dword [0x8e3140]
jmp 0x8df6fc
mov esp, ebp
pop ebp
ret 4

Function at 0x8e0b00
Capabilities:
Read .ini file
Read and send data from client to server
Send data
Send data on socket
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebp
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
pop ebp
mov eax, dword [ebp + 8]
push eax
call dword [fcn.008e30dc]
call dword [fcn.008e3124]
call dword [fcn.008e3128]
call dword [fcn.008e3094]
call dword [fcn.008e30fc]
call dword [fcn.008e30f4]
call dword [fcn.008e3150]
call dword [fcn.008e300c]
call dword [fcn.008e3000]
call dword [fcn.008e3160]
call fcn.008e2644
mov eax, 1
pop ebp
ret 4
Function at 0x8e169c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x8e3168
sub eax, eax
test esi, esi
je 0x8e1774
sub eax, 1
test ecx, ecx
je 0x8e1772
test esi, 3
je 0x8e16da
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x8e16bf
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x8e1759
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x8e16e4
mov ecx, edx
test ecx, ecx
je 0x8e1772
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x8e175f
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x8e177c
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.008e17ff
jae 0x8e178a
xor ecx, ecx
call fcn.008e17ff
jae 0x8e17b9
xor eax, eax
call fcn.008e17ff
jae 0x8e17c9
mov bl, 2
inc ecx
mov al, 0x10
call fcn.008e17ff
adc al, al
jae 0x8e17ab
jne 0x8e17f5
stosb byte es:[edi], al
jmp 0x8e178d
call fcn.008e180b
sub ecx, ebx
jne 0x8e17d2
call fcn.008e1809
jmp 0x8e17f1
lodsb al, byte [esi]
shr eax, 1
je 0x8e181b
adc ecx, ecx
jmp 0x8e17ee
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.008e1809
cmp eax, 0x7d00
jae 0x8e17ee
cmp ah, 5
jae 0x8e17ef
cmp eax, 0x7f
ja 0x8e17f0
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8e178d
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x8e214c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x8e5000]
jne 0x8e2156
repz ret
jmp fcn.008e23fd
Function at 0x401113
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push 0
push dword [ebp + 8]
push 0
push 0x8000040
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40115b
push 0
push 0
push 0
push 0xf001f
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
jne 0x401176
push 0x40
push 0x101000
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401197
push 0
push 0
push 0x40119c
push 0x40119c
push 0x80030008
call fcn.004010a1
add esp, 0x14
mov eax, dword [ebp - 4]
leave
ret

Function at 0x438c85
Capabilities:
Encode data using xor

Disassembly:
push 0x438a14
pop edx
dec esi
add edi, 0x88150c18
call fcn.00438cbc
sub esi, esi
mov esi, edi
xor dword [eax], edx
mov esi, edi
inc eax
add edi, 0x60f42003
inc esi
mov esi, edi
cmp eax, ebx
jne fcn.00438c85
or edi, edi
or edi, edi
or esi, esi
ret