joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a6ca
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
push ebx
xor ebx, ebx
xor edx, edx
mov dword [ebp + 0x10], ecx
cmp dword [ebp + 0xc], ebx
jle 0x40a794
mov al, byte [ebp + 0xf]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, edx
sub edi, 0
je 0x40a731
dec edi
je 0x40a718
dec edi
jne 0x40a73f
movzx edi, byte [esi]
movzx eax, al
shl eax, 2
shr edi, 6
or edi, eax
and edi, 0x3f
mov al, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx eax, byte [esi]
inc ecx
and eax, 0x3f
jmp 0x40a737
movzx edi, byte [esi]
movzx eax, al
shl eax, 4
shr edi, 4
or edi, eax
and edi, 0x3f
mov al, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x40a73d
movzx eax, byte [esi]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
lea eax, [edx + 1]
cdq
push 3
pop edi
idiv edi
mov al, byte [esi]
inc ecx
inc esi
inc ebx
cmp ebx, dword [ebp + 0xc]
jl 0x40a6e9
pop edi
pop esi
test edx, edx
jle 0x40a794
movzx eax, al
cmp edx, 1
jne 0x40a76e
and eax, 3
shl eax, 4
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x40a778
and eax, 0xf
mov al, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
inc ecx
sub edx, 0
je 0x40a788
dec edx
je 0x40a78c
dec edx
je 0x40a790
jmp 0x40a794
mov byte [ecx], 0x3d
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov byte [ecx], 0x3d
inc ecx
lea eax, [ecx + 1]
sub eax, dword [ebp + 0x10]
mov word [ecx], 0xa0d
inc eax
pop ebx
pop ebp
ret
Function at 0x40c65c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
test byte [0x413690], 1
push ebx
push esi
push edi
mov esi, 0x100000
jne 0x40c683
or dword [0x413690], 1
push esi
call fcn.0040ebcc
pop ecx
mov dword [0x41368c], eax
test byte [0x413690], 2
jne 0x40c69f
or dword [0x413690], 2
push esi
call fcn.0040ebcc
pop ecx
mov dword [0x413688], eax
push 0x19
push dword [ebp + 0x1c]
push dword [0x413688]
call fcn.0040ee08
mov eax, dword [0x413688]
mov ebx, dword [ebp + 0x18]
add esp, 0xc
lea edi, [eax + 0xc]
mov esi, eax
mov byte [edi], 0
cmp ebx, 0x800
jle 0x40c6fb
mov ecx, dword [ebp + 0xc]
test byte [ecx + 0x8c], 1
je 0x40c6fb
push dword [0x41368c]
add eax, 0x19
push ebx
push eax
push dword [ebp + 0x14]
mov byte [edi], 2
call fcn.004022b9
add esp, 0x10
test eax, eax
jg 0x40c6f7
xor eax, eax
jmp 0x40c758
mov dword [esi], eax
jmp 0x40c70d
push ebx
push dword [ebp + 0x14]
add eax, 0x19
push eax
call fcn.0040ee08
add esp, 0xc
mov dword [esi], ebx
mov eax, dword [0x413688]
push 0
push dword [esi]
add eax, 0x19
push eax
mov dword [esi + 4], ebx
call fcn.004024c2
or byte [edi], 1
mov dword [esi + 8], eax
mov esi, dword [esi]
add esi, 0x19
push esi
push dword [0x413688]
push dword [ebp + 0x10]
call fcn.00409004
add esp, 0x18
push 0
push esi
push dword [0x413688]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
sub eax, esi
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40db67
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push 0x104
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x40dbca
lea ecx, [ebp + eax - 0x104]
cmp byte [ecx - 1], 0x5c
jne 0x40dba0
lea ecx, [ebp + eax - 0x105]
mov byte [ecx], 0
push dword [ebp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push 0x80
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push 0
push 1
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
leave
ret
or eax, 0xffffffff
leave
ret

Function at 0x40dd05
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
push esi
push edi
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ebp, eax
mov edi, 0x4136b4
jmp 0x40dd41
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x4136b8]
je 0x40dd53
call ebx
sub eax, ebp
cmp eax, 0x2710
jae 0x40dd4c
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push edi
call esi
test eax, eax
jne 0x40dd20
jmp 0x40dd53
and dword [0x4136bc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
inc dword [0x4136bc]
pop edi
pop esi
pop ebp
mov dword [0x4136b8], eax
pop ebx
ret

Function at 0x40e095
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
xor esi, esi
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push 0x20106
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40e172
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40e0cc
push ebx
sub eax, ecx
push edi
mov edi, eax
mov dword [ebp - 4], esi
cmp edi, 0x1c
jle 0x40e0e4
push 0x1c
pop edi
push edi
push dword [ebp + 0x10]
lea eax, [ebp - 0x2c]
push eax
call fcn.0040ee08
mov ebx, dword [ebp + 0x18]
add esp, 0xc
cmp ebx, esi
jle 0x40e13f
mov esi, 0xff000
cmp ebx, esi
jge 0x40e106
mov esi, ebx
push 0xa
lea eax, [ebp + edi - 0x2c]
push eax
push dword [ebp - 4]
call fcn.0040f1ed
add esp, 0xc
push esi
push dword [ebp - 8]
lea eax, [ebp - 0x2c]
push 3
push 0
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40e13d
add dword [ebp - 8], esi
sub ebx, esi
inc dword [ebp - 4]
test ebx, ebx
jg 0x40e0fb
xor esi, esi
push 0xa
lea eax, [ebp + edi - 0x2c]
push eax
push dword [ebp - 4]
call fcn.0040f1ed
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp ebx, esi
pop edi
sete al
pop ebx
jmp 0x40e174
xor eax, eax
pop esi
leave
ret
Function at 0x40e177
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
jne 0x40e193
xor eax, eax
inc eax
cmp dword [0x4120ec], eax
jne 0x40e315
cmp dword [0x4136c0], ebx
je 0x40e312
test byte [ebp + 8], 1
push esi
push edi
mov edi, 0xc8
lea esi, [edi + 0x1c]
je 0x40e223
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 1
call fcn.0040dfe2
add esp, 0xc
test eax, eax
je 0x40e223
cmp dword [ebp + 0xc], ebx
je 0x40e223
push 2
push 0x40000000
call fcn.0040dbcf
pop ecx
pop ecx
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x40e223
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40e21a
cmp dword [ebp + 0xc], 0
je 0x40e21a
push edi
push esi
push dword [ebp + 0xc]
push ebx
push ebx
call fcn.00402544
add esp, 0x14
push 0
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
push ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40e21a
and dword [0x4136c0], 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test byte [ebp + 8], 2
je 0x40e310
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 2
call fcn.0040dfe2
add esp, 0xc
test eax, eax
je 0x40e310
cmp dword [ebp + 0xc], 0
je 0x40e310
push edi
push esi
push dword [ebp + 0xc]
push dword [ebp - 4]
push dword [ebp - 4]
call fcn.00402544
add esp, 0x14
push dword [ebp + 0xc]
push dword [ebp - 4]
push edi
push esi
push 7
push 0x4110d0
push 0x4128f8
call fcn.00402544
add esp, 0x14
push eax
push edi
push esi
push 0x14
push 0x4110bc
mov ebx, 0x4122f8
push ebx
call fcn.00402544
add esp, 0x14
push eax
push 0x80000001
call fcn.0040e095
add esp, 0x14
test eax, eax
jne 0x40e2eb
push dword [ebp + 0xc]
push dword [ebp - 4]
push edi
push esi
push 7
push 0x4110d0
push 0x4128f8
call fcn.00402544
add esp, 0x14
push eax
push edi
push esi
push 0x19
push 0x4110a0
push ebx
call fcn.00402544
add esp, 0x14
push eax
push 0x80000001
call fcn.0040e095
add esp, 0x14
test eax, eax
je 0x40e2f2
and dword [0x4136c0], 0
mov esi, 0x100
push esi
push 0
push ebx
call fcn.0040ee2a
push esi
push 0
push 0x4128f8
call fcn.0040ee2a
add esp, 0x18
pop edi
pop esi
xor eax, eax
inc eax
pop ebx
leave
ret
Function at 0x40e3ca
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
lea eax, [ebp - 0xc]
push eax
push 0x20119
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x20], ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e528
mov eax, dword [ebp + 0x10]
push esi
push edi
xor esi, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40e3fe
sub eax, edi
mov edi, eax
mov dword [ebp - 4], ebx
cmp edi, 0x1c
jle 0x40e414
push 0x1c
pop edi
push edi
push dword [ebp + 0x10]
lea eax, [ebp - 0x40]
push eax
call fcn.0040ee08
lea eax, [ebp + edi - 0x40]
push 0xa
push eax
push ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], eax
call fcn.0040f1ed
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 0x18
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0xc]
call edi
test eax, eax
jne 0x40e51d
add esi, dword [ebp - 8]
inc dword [ebp - 4]
push 0xa
push dword [ebp - 0x10]
mov dword [ebp - 8], ebx
push dword [ebp - 4]
call fcn.0040f1ed
add esp, 0xc
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0xc]
call edi
test eax, eax
je 0x40e458
cmp esi, ebx
jle 0x40e51d
push esi
mov dword [ebp - 0x1c], esi
call fcn.0040db2e
mov eax, dword [0x4136c4]
pop ecx
cmp eax, ebx
je 0x40e51d
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
push 0xa
push dword [ebp - 0x10]
mov dword [ebp - 0x18], esi
push dword [ebp - 4]
call fcn.0040f1ed
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0xc]
call edi
test eax, eax
jne 0x40e4e8
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x40e4e8
add dword [ebp - 8], eax
sub esi, eax
inc dword [ebp - 4]
cmp esi, ebx
jg 0x40e4a9
cmp esi, ebx
jne 0x40e51d
mov eax, dword [0x4136c4]
push 0xc8
push 0xe4
push dword [ebp - 0x1c]
push eax
push eax
call fcn.00402544
push dword [ebp - 0x1c]
push dword [0x4136c4]
call fcn.0040e332
add esp, 0x1c
mov dword [ebp - 0x20], 1
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, dword [ebp - 0x20]
pop ebx
leave
ret
Function at 0x40e52e
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call fcn.0040dd05
push 3
push 0x80000000
call fcn.0040dbcf
mov ebx, eax
pop ecx
mov edi, 0xc8
pop ecx
lea esi, [edi + 0x1c]
cmp ebx, 0xffffffff
je 0x40e5b8
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x10], eax
test eax, eax
je 0x40e5b1
push eax
call fcn.0040db2e
mov eax, dword [0x4136c4]
pop ecx
test eax, eax
je 0x40e5b1
push 0
lea ecx, [esp + 0x14]
push ecx
push dword [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40e5b1
mov eax, dword [0x4136c4]
push edi
push esi
push dword [esp + 0x18]
push eax
push eax
call fcn.00402544
push dword [esp + 0x24]
push dword [0x4136c4]
call fcn.0040e332
add esp, 0x1c
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push esi
push 7
push 0x4110d0
mov ebp, 0x4128f8
push ebp
call fcn.00402544
add esp, 0x14
push eax
push edi
push esi
push 0x14
push 0x4110bc
mov ebx, 0x4122f8
push ebx
call fcn.00402544
add esp, 0x14
push eax
push 0x80000001
call fcn.0040e3ca
add esp, 0xc
test eax, eax
jne 0x40e62c
push edi
push esi
push 7
push 0x4110d0
push ebp
call fcn.00402544
add esp, 0x14
push eax
push edi
push esi
push 0x19
push 0x4110a0
push ebx
call fcn.00402544
add esp, 0x14
push eax
push 0x80000001
call fcn.0040e3ca
add esp, 0xc
mov esi, 0x100
push esi
push 0
push ebx
call fcn.0040ee2a
push esi
push 0
push ebp
call fcn.0040ee2a
add esp, 0x18
call fcn.0040dd69
pop edi
pop esi
xor eax, eax
pop ebp
inc eax
pop ebx
pop ecx
ret
Function at 0x40f315
Capabilities:
Connect socket
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edi
cmp esi, edi
jne 0x40f33b
xor eax, eax
jmp 0x40f424
push 0x10
lea eax, [ebp - 0x18]
push edi
push eax
call fcn.0040ee2a
add esp, 0xc
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_htons]
push 2
mov word [ebp - 0x16], ax
pop eax
push edi
xor edi, edi
inc edi
push edi
push eax
mov word [ebp - 0x18], ax
mov dword [ebp - 0x14], esi
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40f382
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, esi
jmp 0x40f424
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_ioctlsocket]
lea eax, [ebp + 8]
push eax
push 0x8004667e
push esi
mov dword [ebp + 8], edi
call ebx
cmp eax, 0xffffffff
jne 0x40f3aa
or edi, eax
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, edi
jmp 0x40f423
push 0x10
lea eax, [ebp - 0x18]
push eax
push esi
mov dword [ebp - 0x118], esi
mov dword [ebp - 0x11c], edi
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x220], edi
call dword [sym.imp.WS2_32.dll_connect]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x220]
push eax
xor edi, edi
push edi
lea eax, [esi + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x40f421
lea eax, [ebp - 0x11c]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x40f39f
lea eax, [ebp + 8]
push eax
push 0x8004667e
push esi
mov dword [ebp + 8], edi
call ebx
push dword [ebp + 0x10]
push esi
call fcn.0040f26d
pop ecx
pop ecx
mov eax, esi
jmp 0x40f423
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret

Function at 0x40f43e
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [sym.imp.WS2_32.dll_recv]
push edi
push dword [ebp + 0x14]
xor edi, edi
push dword [ebp + 0x10]
push ebx
jmp 0x40f473
cmp eax, 0x2746
je 0x40f47c
add edi, eax
cmp edi, dword [ebp + 0x10]
jge 0x40f47c
push dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
sub eax, edi
push eax
lea eax, [edi + ebx]
push eax
push dword [ebp + 8]
call esi
test eax, eax
jg 0x40f458
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4014a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x4014f8
cmp byte [esi + ebx - 1], 0xa
je 0x4014cc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x405084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x401aa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov edi, dword [0x405094]
mov esi, dword [ebp + 8]
test edi, edi
je 0x401c60
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x405094]
movzx eax, al
bt eax, esi
jae 0x401cc0
mov ecx, dword [0x405084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x401b65
test byte [0x402018], 8
jne 0x401c00
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x402028], 8
jne 0x401bb0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x401b34
cmp esi, 3
jbe 0x401b70
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x4030e8]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x401b34
mov ecx, dword [0x405094]
test ecx, ecx
je 0x401ca0
mov dword [esp], 0x402028
call dword [0x405094]
test al, 8
je 0x401b0b
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x401b0b
mov ebx, dword [0x405094]
test ebx, ebx
je 0x401c80
mov dword [esp], 0x402018
call dword [0x405094]
test al, 8
je 0x401af6
call dword [sym.imp.kernel32.dll_GetTickCount]
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mov eax, 0x10624dd3
mov dword [esp], ebx
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x401afe
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x405094
call sym._load_func.part.0
jmp 0x401abd
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x405094
call sym._load_func.part.0
jmp 0x401c0a
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x405094
call sym._load_func.part.0
jmp 0x401bbe
mov eax, 0xffffffff
jmp 0x401b65
Function at 0x401e20
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dbg.wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x40235f
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor esi, esi
test ebx, ebx
jne 0x402378
push 1
pop eax
jmp 0x4023ed
mov eax, dword [0x408488]
push 0
mov dword [ebp - 0x100], eax
push 0
lea eax, [ebp - 0x104]
push 0
push eax
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x104], 1
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x4023e6
test eax, eax
je 0x402378
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x402378
mov eax, ebx
push 0
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x4023e6
cmp eax, 0xffffffff
je 0x4023e6
add esi, eax
cmp esi, ebx
jb 0x402378
xor eax, eax
cmp esi, ebx
sete al
pop esi
pop ebx
leave
ret

Function at 0x402b47
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
push ebx
push 0x80
push 4
push ebx
push 2
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x402bbc
push edi
push 2
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
xor eax, eax
lea edi, [ebp - 0xb]
mov byte [ebp - 0xc], bl
mov dword [ebp + 8], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, dword [ebp + 0xc]
cmp edi, ebx
jbe 0x402bb4
lea eax, [ebp - 0xc]
push 0xa
push eax
call fcn.00401bc2
pop ecx
lea eax, [ebp + 8]
pop ecx
push ebx
push eax
lea eax, [ebp - 0xc]
push 0xa
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
dec edi
jne 0x402b92
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402bc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push edi
mov ebx, 0x407144
push str.WinExec
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
call edi
push str.GetWindowsDirectoryA
push ebx
call esi
push eax
call edi
push str.GetModuleFileNameA
push ebx
mov dword [ebp - 4], eax
call esi
push eax
call edi
push str.CopyFileA
push ebx
mov dword [ebp - 0x20], eax
call esi
push eax
call edi
mov dword [ebp - 0x1c], eax
mov esi, 0x104
lea eax, [ebp - 0x278]
push esi
push eax
push 0
call dword [ebp - 0x20]
lea eax, [ebp - 0x174]
push esi
push eax
call dword [ebp - 4]
and byte [ebp - 0xa], 0
push 0x1a
mov byte [ebp - 0x18], 0x25
mov byte [ebp - 0x17], 0x63
mov byte [ebp - 0x16], 0x25
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x14], 0x25
mov byte [ebp - 0x13], 0x63
mov byte [ebp - 0x12], 0x68
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xe], 0x2e
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x78
mov byte [ebp - 0xb], 0x65
call fcn.00403ae0
pop ecx
add eax, 0x61
push eax
push 0x1a
call fcn.00403ae0
pop ecx
add eax, 0x61
push eax
push 0x1a
call fcn.00403ae0
pop ecx
add eax, 0x61
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov byte [ebp - 8], 0x5c
mov byte [ebp - 7], 0x44
mov byte [ebp - 6], 0x65
mov byte [ebp - 5], 0x62
mov byte [ebp - 4], 0x75
mov byte [ebp - 3], 0x67
and byte [ebp - 1], 0
or ebx, 0xffffffff
lea edi, [ebp - 8]
mov ecx, ebx
xor eax, eax
mov byte [ebp - 2], 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x174]
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebx
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp - 0x174]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x70]
mov ecx, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebx
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x174]
mov ecx, edx
push eax
and ecx, 3
lea eax, [ebp - 0x278]
rep movsb byte es:[edi], byte [esi]
push eax
call dword [ebp - 0x1c]
lea eax, [ebp - 0x174]
push 5
push eax
call fcn.00402b47
mov edi, dword [ebp + 8]
pop ecx
pop ecx
xor eax, eax
push 0x41
pop ecx
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x174]
mov ecx, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
leave
ret