joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47bce0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x47bebc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404180
xor eax, eax
push ebp
push 0x47be94
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x47bd38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47be9e
push 0
push 0
push 0
push 0
push 0x47becc
call fcn.0042adc8
mov ebx, eax
test ebx, ebx
je 0x47be8a
push 0
push 0x80000000
push 0
push 0
mov eax, esi
call fcn.00404640
push eax
push ebx
call fcn.0042add0
mov esi, eax
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 0x10c]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.00402d44
mov dword [ebp - 0xc], 0x194
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0x13
push esi
call fcn.0042adb8
test eax, eax
je 0x47bdcc
lea eax, [ebp - 0x110]
lea edx, [ebp - 0x10c]
call fcn.00404378
mov eax, dword [ebp - 0x110]
call fcn.004086ec
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x194
jae 0x47be7a
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 0x10c]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.00402d44
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0x2f
push esi
call fcn.0042adb8
test eax, eax
je 0x47be7a
push edi
lea eax, [ebp - 0x114]
lea edx, [ebp - 0x10c]
mov ecx, pe_nt_image_headers32
call fcn.004043f0
mov edx, dword [ebp - 0x114]
mov eax, 0x47bee0
call fcn.00404784
add eax, 9
inc eax
push eax
lea eax, [ebp - 0x118]
lea edx, [ebp - 0x10c]
mov ecx, pe_nt_image_headers32
call fcn.004043f0
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 4]
pop edx
call fcn.004046a0
push edi
mov edx, dword [edi]
mov eax, 0x47bef4
call fcn.00404784
mov ecx, eax
dec ecx
mov eax, dword [edi]
xor edx, edx
call fcn.004046a0
test esi, esi
je 0x47be84
push esi
call fcn.0042adc0
push ebx
call fcn.0042adc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47be9e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47bec3
lea eax, [ebp - 0x118]
mov edx, 3
call fcn.004041a4
ret
Function at 0x47ca70
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47cc09
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, 0x47cc20
call fcn.004041d4
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00404218
mov edx, dword [ebp - 0x14]
mov eax, 0x47cc2c
call fcn.00404784
test eax, eax
jg 0x47cad5
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov edx, 0x47cc38
call fcn.0040448c
xor eax, eax
push ebp
push 0x47cbde
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
push 0x47cc40
call fcn.0042adc8
mov ebx, eax
test ebx, ebx
je 0x47cbd4
push 0
push 0x80000000
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.00404640
push eax
push ebx
call fcn.0042add0
mov esi, eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov edi, 0x194
mov dword [ebp - 0x10], pe_nt_image_headers32
lea eax, [ebp - 0x114]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.00402d44
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x114]
push eax
push 0x13
push esi
call fcn.0042adb8
test eax, eax
je 0x47cb75
lea eax, [ebp - 0x118]
lea edx, [ebp - 0x114]
call fcn.00404378
mov eax, dword [ebp - 0x118]
call fcn.004086ec
mov edi, eax
cmp edi, 0x194
jae 0x47cbc4
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], pe_nt_image_headers32
lea eax, [ebp - 0x114]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.00402d44
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
call fcn.0042adb8
test eax, eax
je 0x47cbc4
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x114]
call fcn.00404378
test esi, esi
je 0x47cbce
push esi
call fcn.0042adc0
push ebx
call fcn.0042adc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47cbe8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47cc10
lea eax, [ebp - 0x118]
call fcn.00404180
lea eax, [ebp - 0x14]
call fcn.00404180
ret
Function at 0x47d7a4
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404630
mov eax, dword [ebp - 8]
call fcn.00404630
xor eax, eax
push ebp
push 0x47d86d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov dl, 1
mov eax, dword [0x42db04]
call fcn.0042dc04
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x47d84b
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 0x10]
call fcn.0042dca4
xor ecx, ecx
mov edx, 0x47d884
mov eax, dword [ebp - 0x10]
call fcn.0042dd08
test al, al
je 0x47d835
cmp dword [ebp - 4], 0
je 0x47d835
cmp dword [ebp - 8], 0
je 0x47d835
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.0042e05c
mov eax, dword [ebp - 0x10]
call fcn.0042dc74
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d852
mov eax, dword [ebp - 0x10]
call fcn.004033ac
ret

Function at 0x47da30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, edx
dec eax
test eax, eax
jb 0x47da5e
inc eax
xor edx, edx
mov dl, byte [ebx]
mov esi, dword [ecx]
and esi, 0xff
xor edx, esi
mov edx, dword [edx*4 + 0x486950]
mov esi, dword [ecx]
shr esi, 8
xor edx, esi
mov dword [ecx], edx
inc ebx
dec eax
jne 0x47da3c
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x994cdc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x994d03
call fcn.00937288
mov dword [eax], esi
call fcn.00937275
push 0x16
pop esi
mov dword [eax], esi
call fcn.00937eca
mov eax, esi
jmp 0x994d58
test dword [ebp + 0xc], 0xfffffff9
jne 0x994ce9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x994d30
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0093729b
pop ecx
call fcn.00937275
mov eax, dword [eax]
jmp 0x994d58
test al, 0x10
jne 0x994d56
test al, 1
je 0x994d56
test byte [ebp + 0xc], 2
je 0x994d56
call fcn.00937288
mov dword [eax], 5
call fcn.00937275
mov dword [eax], 0xd
jmp 0x994d27
xor eax, eax
pop esi
pop ebp
ret

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x2d243535
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x39027a6d
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x10004650
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
mov esi, edx
push ebx
mov ebx, ecx
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [eax]
mov eax, dword [eax + 0x60]
mov dword [esp], eax
call fcn.10026f30
mov eax, dword [edi + 0x1c]
movzx edx, si
lea ecx, [edx + edx*2]
lea esi, [eax + ecx*8]
mov eax, dword [edi + 0x28]
test eax, eax
je 0x100047a0
shl edx, 6
add eax, edx
mov edx, dword [eax]
mov dword [ebx], edx
mov edx, dword [eax + 4]
mov dword [ebx + 4], edx
mov edx, dword [eax + 8]
mov dword [ebx + 8], edx
mov edx, dword [eax + 0xc]
mov dword [ebx + 0xc], edx
mov edx, dword [eax + 0x10]
mov dword [ebx + 0x10], edx
mov edx, dword [eax + 0x14]
mov dword [ebx + 0x14], edx
mov edx, dword [eax + 0x18]
mov dword [ebx + 0x18], edx
mov edx, dword [eax + 0x1c]
mov dword [ebx + 0x1c], edx
mov edx, dword [eax + 0x20]
mov dword [ebx + 0x20], edx
mov edx, dword [eax + 0x24]
mov dword [ebx + 0x24], edx
mov edx, dword [eax + 0x28]
mov dword [ebx + 0x28], edx
mov edx, dword [eax + 0x2c]
mov dword [ebx + 0x2c], edx
mov edx, dword [eax + 0x30]
mov dword [ebx + 0x30], edx
mov edx, dword [eax + 0x34]
mov dword [ebx + 0x34], edx
mov edx, dword [eax + 0x38]
mov dword [ebx + 0x38], edx
mov eax, dword [eax + 0x3c]
mov dword [ebx + 0x3c], eax
mov eax, dword [esi + 4]
mov dword [ebx + 0x40], eax
mov eax, dword [esi + 0xc]
mov dword [ebx + 0x44], eax
movzx edx, byte [esi + 4]
mov ecx, edx
and ecx, 3
jne 0x10004760
movzx ecx, byte [esi + 7]
mov edx, 8
shr cl, 7
shl edx, cl
mov ecx, edx
xor edx, edx
sar ecx, 3
div ecx
xor edx, edx
mov dword [ebx + 0x44], eax
movzx ecx, byte [esi + 4]
shr cl, 2
and ecx, 7
div ecx
mov dword [ebx + 0x44], eax
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov esi, dword [ebp - 0x10]
mov dword [ebx + 0x48], eax
mov dword [ebx + 0x4c], edx
movzx eax, word [esi + 0x30]
mov dword [ebx + 0x50], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x60]
mov dword [esp], eax
call fcn.10026f50
add esp, 8
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
cmp cl, 2
jne 0x1000472b
movzx ecx, byte [esi + 6]
shr dl, 2
and edx, 7
shr cl, 7
movzx edi, cl
movzx ecx, byte [esi + 7]
and ecx, 0x7f
add ecx, ecx
or ecx, edi
lea edi, [ecx + 0x16]
add ecx, 0x10
imul edi, edx
xor edx, edx
div edi
imul eax, ecx
add eax, eax
mov dword [ebx + 0x44], eax
jmp 0x1000472b
mov ecx, 0x10
mov edi, ebx
rep stosd dword es:[edi], eax
jmp 0x100046e9
Function at 0x100089c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [0x1002b044]
push ebp
mov ebp, esp
push ebx
cmp eax, 0x9bf
ja 0x10008a0b
mov ecx, dword [eax + section..bss]
lea edx, [eax + 4]
mov dword [0x1002b044], edx
mov edx, ecx
mov ebx, dword [ebp - 4]
leave
shr edx, 0xb
xor edx, ecx
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
ret
cmp eax, 0x9c0
jne 0x10008b57
mov ecx, dword [section..bss]
xor edx, edx
nop
and ecx, 0x80000000
mov ebx, ecx
mov ecx, dword [edx*4 + 0x10045004]
mov eax, ecx
and eax, 0x7fffffff
or eax, ebx
mov ebx, eax
and eax, 1
shr ebx, 1
xor ebx, dword [edx*4 + 0x10045634]
neg eax
and eax, 0x9908b0df
xor eax, ebx
mov dword [edx*4 + section..bss], eax
add edx, 1
cmp edx, 0xe3
jne 0x10008a20
mov edx, 0x7fffffff
mov eax, 0x1004538c
movd xmm5, edx
mov edx, 0x80000000
movd xmm4, edx
mov edx, 1
pshufd xmm5, xmm5, 0
movd xmm3, edx
pshufd xmm4, xmm4, 0
pshufd xmm3, xmm3, 0
movdqa xmm1, xmmword [eax + 4]
add eax, 0x10
movdqu xmm0, xmmword [eax - 0x10]
pand xmm1, xmm5
pand xmm0, xmm4
por xmm1, xmm0
movdqa xmm2, xmm1
pand xmm1, xmm3
movdqa xmm0, xmm1
psrld xmm2, 1
pxor xmm2, xmmword [eax - 0x39c]
pslld xmm0, 3
paddd xmm0, xmm1
pslld xmm0, 9
paddd xmm0, xmm1
pslld xmm0, 5
paddd xmm0, xmm1
pslld xmm0, 2
psubd xmm0, xmm1
pslld xmm0, 3
psubd xmm0, xmm1
movdqa xmm6, xmm0
pslld xmm6, 4
paddd xmm0, xmm6
pslld xmm0, 5
psubd xmm0, xmm1
pxor xmm2, xmm0
movups xmmword [eax - 0x10], xmm2
cmp eax, 0x100459bc
jne 0x10008a90
mov ecx, dword [section..bss]
mov eax, dword [0x100459bc]
mov edx, ecx
and edx, 0x7fffffff
and eax, 0x80000000
or eax, edx
mov edx, eax
and eax, 1
shr edx, 1
xor edx, dword [0x10045630]
neg eax
and eax, 0x9908b0df
xor eax, edx
mov edx, 4
mov dword [0x100459bc], eax
jmp 0x100089d9
xor eax, eax
xor edx, edx
jmp 0x10008b80
imul eax, eax, 0x7ff8a3ed
add eax, 0x2aa01d31
mov ecx, eax
rol ecx, 0x10
xor ecx, 0x31415926
mov dword [edx*4 + section..bss], ecx
add edx, 1
cmp edx, 0x270
jne 0x10008b80
jmp 0x10008a16
Function at 0x10026fa0
Capabilities:
Create thread

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff8
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x20
movd xmm0, dword [ecx + 8]
movd xmm1, dword [ecx + 4]
mov ebx, dword [ecx]
punpckldq xmm1, xmm0
movq qword [ebp - 0x10], xmm1
mov dword [esp], 0xc
call dword [sym.imp.ucrtbase.dll_malloc]
test eax, eax
je 0x10027018
movq xmm1, qword [ebp - 0x10]
mov dword [eax], ebx
movq qword [eax + 4], xmm1
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x10025b60
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
sub esp, 0x18
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x1002a590
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x214
mov eax, dword [0x10045b00]
test eax, eax
je 0x1002a648
mov dword [esp], ebx
call eax
sub esp, 4
test eax, eax
mov dword [ebx + 8], eax
jns 0x1002a5d0
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x214]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x1002a5bc
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x1002a67d
mov dword [esp + 4], str.AtlCreateRegistrar
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
sub esp, 8
mov dword [0x10045b00], eax
test eax, eax
jne 0x1002a5ad
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x1002a5be
Function at 0x9ec058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009ec1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x9ec07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9ec06a
add dl, dl
jne 0x9ec089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9ec0dc
xor eax, eax
add dl, dl
jne 0x9ec096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9ec17d
add dl, dl
jne 0x9ec0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9ec0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9ec0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9ec0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9ec0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x9ec075
mov eax, 1
add dl, dl
jne 0x9ec0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9ec0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9ec0e1
sub eax, ebx
mov ebx, 1
jne 0x9ec128
mov ecx, 1
add dl, dl
jne 0x9ec10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9ec119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9ec105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9ec075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x9ec13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9ec14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9ec136
cmp eax, 0x7d00
jae 0x9ec16d
cmp eax, 0x500
jb 0x9ec168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9ec075
cmp eax, 0x7f
ja 0x9ec170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9ec075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x9ec19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x9ec075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4034a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
dec dword [str.__Cp]
movzx eax, word [0x44c2a0]
mov cx, word [0x44c3cc]
movsx edx, cx
mov ecx, dword [str.__Cp]
cwde
sub edx, eax
lea eax, [edx - 0x4937d257]
add ecx, eax
mov word [0x44c3cc], cx
call fcn.004198a0
mov edx, dword [0x44c0a8]
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fld qword [0x44c240]
movzx eax, word [0x44c2d4]
fsub qword [0x4466e0]
movsx ecx, ax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ecx
push eax
fild dword [ebp - 4]
fsubp st(1)
fsubp st(1)
fistp qword [ebp - 8]
mov edx, dword [ebp - 8]
mov dword [0x44c0a8], edx
fld qword [0x44c240]
fsub qword [0x444e40]
fstp qword [0x44c240]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x42c8f0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
fld dword [0x445e90]
fstp dword [0x44c03c]
mov dword [ecx], 0
dec word [0x44c480]
fld qword [0x44c278]
mov ax, word [0x44c480]
fsub qword [0x445e88]
movsx edx, ax
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fsubp st(1)
fcomp qword [0x445e80]
fnstsw ax
test ah, 0x41
jp 0x42c94c
mov ax, word [0x44c01c]
movsx edx, ax
add edx, 0x2a2b3266
mov dword [0x44c1f0], edx
mov dword [ecx + 4], 0
fld qword [0x44c380]
fcomp qword [0x445e78]
fnstsw ax
test ah, 5
jp 0x42c9cf
fld qword [0x44c1a8]
mov eax, dword [0x44c420]
fsubr qword [0x445e70]
add eax, 0x3430c6a3
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fcompp
fnstsw ax
fld qword [0x44c1a8]
fld1
fadd st(1), st(0)
fxch st(1)
fstp qword [0x44c1a8]
test ah, 5
jp 0x42c9cd
fld qword [0x44c460]
fsub dword [0x44c484]
fld qword [0x44c338]
fld qword [0x44c240]
faddp st(2)
fsubrp st(1)
fstp qword [0x44c338]
fadd qword [0x44c460]
fstp qword [0x44c460]
jmp 0x42c9cf
fstp st(0)
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dx, word [0x44c26c]
movsx eax, dx
mov edx, dword [0x44c120]
sub edx, eax
mov dword [ebp - 4], edx
mov eax, 0xffff8648
fild dword [ebp - 4]
fmul qword [0x44c058]
fstp qword [0x44c058]
inc dword [0x44c120]
fld dword [0x445e68]
mov dword [ecx + 0x10], 0x98badcfe
fstp dword [0x44c148]
mov dword [ecx + 0x14], 0x10325476
mov word [0x44c480], ax
mov esp, ebp
pop ebp
ret

Function at 0x431810
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
dec dword [0x44c134]
fld qword [0x44c1a8]
mov eax, dword [0x44c134]
sub eax, 0x655a121f
push esi
mov dword [ebp - 8], eax
fild dword [ebp - 8]
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
imul esi, dword [ebp + 0x10]
fsubp st(1)
fstp qword [0x44c1a8]
mov cx, word [0x44c0bc]
movsx eax, cx
mov dword [ebp - 4], 0
add dword [0x44c1f0], eax
test esi, esi
jne 0x431883
movzx edx, word [0x44c0b8]
add edx, 0x3d9d909f
mov word [0x44c254], dx
inc word [0x44c0b8]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
fld qword [0x44c298]
fadd qword [0x444e40]
fstp qword [0x44c298]
fld qword [0x44c298]
mov eax, dword [0x44c06c]
mov dword [ebp + 0xc], eax
fild dword [ebp + 0xc]
fmulp st(1)
fistp qword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [0x44c06c], ecx
mov ecx, dword [ebp + 0x14]
call fcn.0043d390
fld qword [0x44c240]
mov ecx, dword [ebp + 8]
fmul qword [0x446288]
push 0
lea edx, [ebp - 4]
push edx
push esi
push ecx
fstp qword [0x44c240]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
fld qword [0x446280]
mov eax, dword [ebp - 4]
fstp qword [0x44c2c0]
xor edx, edx
div edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x20fa0d1
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, pe_nt_image_headers32
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.020fa154
jae 0x20fa0df
xor ecx, ecx
call fcn.020fa154
jae 0x20fa10e
xor eax, eax
call fcn.020fa154
jae 0x20fa11e
mov bl, 2
inc ecx
mov al, 0x10
call fcn.020fa154
adc al, al
jae 0x20fa100
jne 0x20fa14a
stosb byte es:[edi], al
jmp 0x20fa0e2
call fcn.020fa160
sub ecx, ebx
jne 0x20fa127
call fcn.020fa15e
jmp 0x20fa146
lodsb al, byte [esi]
shr eax, 1
je 0x20fa170
adc ecx, ecx
jmp 0x20fa143
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.020fa15e
cmp eax, 0x7d00
jae 0x20fa143
cmp ah, 5
jae 0x20fa144
cmp eax, 0x7f
ja 0x20fa145
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x20fa0e2
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret
Function at 0x401e40
Capabilities:
Terminate process

Disassembly:
enter 0x40c0, 0x69
add eax, 0x40
push str.Finished__d_requests_n
push eax
invalid
push ebp
dec edx
in al, dx
sub esp, 0x78
push esi
mov dh, byte [ebp + 0xc]
mov al, 0x8d
inc ebp
mov byte [edi], dl
js 0x401ded
push esi
call 0x2d4086e0
dec edx
dec ebp
xor dword [ebx - 0x603f3798], ecx
add byte [eax + 0x51], dl
add edx, 0x40
push str._s:__s___d__n
push edx
cmp dword [0x405355], edx
mov eax, dword [0xbb02ac]
add esp, 0x14
test dword [ebp + 0x74], edi
invalid

Function at 0x406840
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
xchg byte [ebx + 0x5756085d], cl
std
inc ebx
add al, 0x83
clc
dec dword [edi]
test byte [esp + edx*2 + 0x4b8b0000], dl
adc bh, ch
leave
lgs ecx, [ecx - 0x74ffffff]
mov ecx, dword [esp + edx*8]
dec esi
adc al, 0x8d
push esi
sub byte [ecx - 0x58], dl
push eax
call dword [sym.imp.WSOCK32.dll_connect]
pop esp
clc
dec dword [edi]

Function at 0x40b2d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
xor dword [esi - 0x75], edx
outsd dx, dword [esi]
ror byte [edx - 0x3f45d3ba], 1
mov esi, cr7
add byte [eax], al
pop edx
invalid
Function at 0x403770
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x4037c8
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x4037ca
not eax
xor esi, esi
nop
nop
nop
nop
movzx ebx, byte [ecx + esi]
mov edi, eax
shr edi, 4
xor eax, ebx
and eax, 0xf
xor edi, dword [eax*4 + 0x43f80c]
mov eax, edi
shr eax, 4
shr ebx, 4
mov ebp, ebx
and ebp, edi
and edi, 0xf
or edi, ebx
xor edi, ebp
xor eax, dword [edi*4 + 0x43f80c]
inc esi
cmp edx, esi
jne 0x403790
not eax
jmp 0x4037ca
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret