joyce8/EMBER2024-capa huggingface dataset:
Function at 0x400424d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp ebx, ecx
je 0x40042e5
cmp dword [ebp + 0xc], ecx
je 0x40042e5
mov eax, dword [ebp + 0x10]
cmp eax, ecx
je 0x40042e5
imul eax, eax, 0x19660d
push esi
mov esi, 0x3c6ef35f
add eax, esi
push edi
mov edi, eax
mov eax, dword [ebp + 0xc]
cdq
and edx, 3
add eax, edx
sar eax, 2
test eax, eax
jle 0x40042a8
mov edx, eax
shl edx, 2
mov dword [ebp - 8], edx
xor dword [ebx + ecx*4], edi
imul edi, edi, 0x19660d
add edi, esi
inc ecx
cmp ecx, eax
jl 0x4004298
mov ebx, dword [ebp + 0xc]
and ebx, 0x80000003
jns 0x40042b8
dec ebx
or ebx, 0xfffffffc
inc ebx
je 0x40042e3
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
lea esi, [eax + ecx*4]
push ebx
lea eax, [ebp - 4]
push esi
push eax
call fcn.04004094
xor dword [ebp - 4], edi
push ebx
lea eax, [ebp - 4]
push eax
push esi
call fcn.04004094
add esp, 0x18
add dword [ebp - 8], ebx
pop edi
pop esi
mov eax, dword [ebp - 8]
pop ebx
leave
ret

Function at 0x400430d
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using rc4 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
mov dword [ebp - 0xc], esi
cmp dword [ebp + 8], esi
je 0x400440d
cmp dword [ebp + 0xc], esi
je 0x400440d
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push esi
push 1
mov ebx, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push ebx
push esi
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], esi
call edi
test eax, eax
jne 0x4004363
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x4004363
push 8
push 1
push ebx
push esi
lea eax, [ebp - 4]
push eax
call edi
cmp dword [ebp - 4], esi
je 0x400440b
lea eax, [ebp - 8]
push eax
push 0x800001
push 0x6801
push dword [ebp - 4]
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
je 0x4004401
push dword [ebp + 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_CryptExportKey]
push dword [ebp + 8]
push esi
push 8
push esi
push dword [ebp - 8]
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
test eax, eax
je 0x40043fc
cmp dword [ebp + 0x10], esi
je 0x40043f5
cmp dword [ebp + 0x14], esi
je 0x40043f5
cmp dword [ebp + 0x18], esi
je 0x40043f5
cmp dword [ebp + 0x1c], esi
je 0x40043f5
lea eax, [ebp + 8]
push eax
push 1
push esi
push dword [ebp + 0x1c]
mov dword [ebp + 8], esi
push dword [ebp + 0x18]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x40043fc
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push 1
push dword [ebp + 8]
push dword [ebp - 8]
call edi
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
call ebx
jmp 0x40043fc
mov dword [ebp - 0xc], 1
push dword [ebp - 8]
call ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop ebx
mov eax, dword [ebp - 0xc]
pop esi
leave
ret
Function at 0x4004413
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
mov dword [ebp - 0xc], esi
cmp dword [ebp + 8], esi
je 0x40044cb
cmp dword [ebp + 0xc], esi
je 0x40044cb
cmp dword [ebp + 0x10], esi
je 0x40044cb
cmp dword [ebp + 0x14], esi
je 0x40044cb
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push esi
push 1
mov ebx, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push ebx
push esi
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], esi
call edi
test eax, eax
jne 0x400447b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x400447b
push 8
push 1
push ebx
push esi
lea eax, [ebp - 4]
push eax
call edi
pop edi
pop ebx
cmp dword [ebp - 4], esi
je 0x40044cb
lea eax, [ebp - 8]
push eax
push 1
push esi
push dword [ebp + 0x14]
mov dword [ebp - 8], esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x40044c1
mov eax, dword [ebp + 0xc]
push dword [eax]
push eax
push dword [ebp + 8]
push esi
push 1
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [ebp - 8]
mov dword [ebp - 0xc], eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 0xc]
pop esi
leave
ret

Function at 0x40044d1
Capabilities:
Create new key via cryptacquirecontext
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
xor edi, edi
mov dword [ebp - 0x10], edi
cmp dword [ebp + 8], edi
je 0x40045bc
cmp dword [ebp + 0xc], edi
je 0x40045bc
cmp dword [ebp + 0x10], edi
je 0x40045bc
cmp dword [ebp + 0x14], edi
je 0x40045bc
cmp dword [ebp + 0x18], edi
je 0x40045bc
cmp dword [ebp + 0x1c], edi
je 0x40045bc
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push edi
push 1
mov ebx, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push ebx
push edi
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], edi
call esi
test eax, eax
jne 0x400454b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x400454b
push 8
push 1
push ebx
push edi
lea eax, [ebp - 4]
push eax
call esi
cmp dword [ebp - 4], edi
je 0x40045ba
mov esi, dword [sym.imp.ADVAPI32.dll_CryptImportKey]
lea eax, [ebp - 0xc]
push eax
push 1
push edi
push dword [ebp + 0x1c]
mov dword [ebp - 0xc], edi
push dword [ebp + 0x18]
push dword [ebp - 4]
call esi
test eax, eax
je 0x40045b0
lea eax, [ebp - 8]
push eax
push 1
push dword [ebp - 0xc]
mov dword [ebp - 8], edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 4]
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
test eax, eax
je 0x40045ab
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push 1
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
push dword [ebp - 8]
mov dword [ebp - 0x10], eax
call esi
push dword [ebp - 0xc]
call esi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop esi
pop ebx
mov eax, dword [ebp - 0x10]
pop edi
leave
ret
Function at 0x40045c2
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 8], ebx
je 0x40046ba
cmp dword [ebp + 0xc], ebx
je 0x40046ba
cmp dword [ebp + 0x10], ebx
je 0x40046ba
cmp dword [ebp + 0x14], ebx
je 0x40046ba
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push edi
push ebx
push 1
mov edi, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push edi
push ebx
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x400462a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x400462a
push 8
push 1
push edi
push ebx
lea eax, [ebp - 4]
push eax
call esi
cmp dword [ebp - 4], ebx
je 0x40046b8
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x8003
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x40046ae
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x40046a5
mov esi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push 4
pop eax
push ebx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp + 8]
push ecx
push eax
push dword [ebp - 8]
mov dword [ebp + 8], ebx
mov dword [ebp - 0x14], eax
call esi
test eax, eax
je 0x40046a5
mov eax, dword [ebp + 0x14]
cmp eax, dword [ebp + 8]
jb 0x40046a5
push ebx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
push 2
push dword [ebp - 8]
call esi
test eax, eax
je 0x40046a5
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop esi
mov eax, dword [ebp - 0x10]
pop ebx
leave
ret
Function at 0x400488f
Capabilities:
Reference public rsa key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
mov dword [ebp - 0x20], eax
cmp dword [ebp + 8], eax
je 0x4004a64
cmp dword [ebp + 0xc], eax
je 0x4004a64
cmp dword [ebp + 0x10], eax
je 0x4004a64
mov ecx, dword [ebp + 0x14]
cmp ecx, eax
je 0x4004a64
cmp ecx, dword [ebp + 0xc]
jb 0x4004a64
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 4
mov ebx, 0x3000
push ebx
mov edi, 0x1000
push edi
push eax
call esi
push 4
push ebx
push edi
push 0
mov dword [ebp - 8], eax
call esi
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x4004a4b
test eax, eax
je 0x4004a3b
push 0x94
push 0x400cc10
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
call fcn.0400430d
add esp, 0x18
test eax, eax
je 0x4004a3b
mov eax, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
lea eax, [eax + edi + 0x10]
cmp dword [ebp + 0x14], eax
jb 0x4004a3b
push 2
call fcn.040046c0
push 0xffffffffffffffff
mov dword [ebp - 0x24], eax
call fcn.040042eb
pop ecx
pop ecx
push 4
push ebx
push edi
push 0
mov dword [ebp - 0x14], eax
call esi
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x4004a3b
push edi
push dword [ebp + 8]
mov dword [ebp - 0x18], edi
push esi
call fcn.04004094
push dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push dword [ebp - 8]
push eax
push esi
call fcn.04004413
add esp, 0x1c
test eax, eax
je 0x4004a2b
mov edi, dword [ebp + 0x10]
push 4
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 8]
push eax
mov dword [ebp + 8], edi
call fcn.04002481
push 4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
call fcn.04002481
and dword [ebp - 0x20], 0
mov ebx, dword [ebp + 8]
push 4
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 8]
push eax
call fcn.04002481
mov esi, dword [ebp + 8]
push 4
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
call fcn.04002481
push dword [ebp - 4]
lea eax, [ebp + 8]
push dword [ebp - 0xc]
push eax
call fcn.04002481
push dword [ebp - 0x14]
mov eax, dword [ebp + 8]
sub eax, esi
push eax
push esi
call fcn.0400424d
add esp, 0x48
push dword [ebp - 0x18]
lea eax, [ebp + 8]
push dword [ebp - 0x1c]
push eax
call fcn.04002481
mov esi, dword [ebp + 8]
sub esi, edi
lea eax, [esi - 0xc]
push eax
add edi, 0xc
push edi
call fcn.040014bd
mov dword [ebx], eax
add esp, 0x14
mov dword [ebp - 0x20], esi
push 0x8000
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x8000
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
cmp dword [ebp - 0xc], 0
pop edi
pop esi
pop ebx
je 0x4004a64
push 0x8000
push 0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [ebp - 0x20]
leave
ret
Function at 0x4004aa2
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0xc4
push ebx
mov ebx, dword [ebp + 0x74]
xor eax, eax
mov dword [ebp + 0x68], eax
cmp ebx, eax
je 0x4004cb8
cmp dword [ebp + 0x78], eax
je 0x4004cb8
push edi
mov edi, dword [ebp + 0x7c]
cmp edi, eax
je 0x4004cb7
push esi
push dword [ebp + 0x78]
push eax
push ebx
call fcn.04004174
mov esi, 0x9c
push esi
lea eax, [ebp - 0x34]
push 0
push eax
call fcn.04004174
push 0x24
lea eax, [ebp - 0x58]
push 0
push eax
mov dword [ebp - 0x34], esi
call fcn.04004174
add esp, 0x24
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test eax, eax
je 0x4004cae
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x30], 5
jne 0x4004be8
cmp dword [ebp - 0x2c], 0
jne 0x4004b47
push str.Win2K
push ebx
call esi
mov dword [edi], 1
jmp 0x4004c74
cmp dword [ebp - 0x2c], 1
jne 0x4004b60
push str.WinXP
push ebx
call esi
mov dword [edi], 2
jmp 0x4004c74
cmp dword [ebp - 0x2c], 2
jne 0x4004c74
cmp byte [ebp + 0x66], 1
jne 0x4004b8a
cmp word [ebp - 0x58], 9
jne 0x4004b8a
push str.WinXP64
push ebx
call esi
mov dword [edi], 3
jmp 0x4004c74
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x4004ba9
push str.WinServer2003
push ebx
call esi
mov dword [edi], 5
jmp 0x4004c74
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x4004bc8
push str.WinServer2003R2
push ebx
call esi
mov dword [edi], 6
jmp 0x4004c74
test dword [ebp + 0x64], 0x8000
je 0x4004c74
push str.WinHomeServer
push ebx
call esi
mov dword [edi], 4
jmp 0x4004c74
cmp dword [ebp - 0x30], 6
jne 0x4004c74
cmp dword [ebp - 0x2c], 0
jne 0x4004c1e
cmp byte [ebp + 0x66], 1
jne 0x4004c0e
push str.Vista
push ebx
call esi
mov dword [edi], 7
jmp 0x4004c74
push str.WinServer2008
push ebx
call esi
mov dword [edi], 9
jmp 0x4004c74
cmp dword [ebp - 0x2c], 1
jne 0x4004c4a
cmp byte [ebp + 0x66], 1
je 0x4004c3a
push str.WinServer2008R2
push ebx
call esi
mov dword [edi], 0xa
jmp 0x4004c74
push str.Win7
push ebx
call esi
mov dword [edi], 8
jmp 0x4004c74
cmp dword [ebp - 0x2c], 2
jne 0x4004c74
cmp byte [ebp + 0x66], 1
je 0x4004c66
push str.WinServer2012
push ebx
call esi
mov dword [edi], 0xc
jmp 0x4004c74
push str.Win8
push ebx
call esi
mov dword [edi], 0xb
call fcn.04004a69
test eax, eax
je 0x4004c85
push str._x64
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x20]
push eax
call edi
test eax, eax
je 0x4004ca4
push 0x40064a8
push ebx
call esi
lea eax, [ebp - 0x20]
push eax
push ebx
call esi
push ebx
call edi
mov dword [ebp + 0x68], eax
test eax, eax
jne 0x4004cb6
push str.UndefinedOS
push ebx
call esi
pop esi
pop edi
mov eax, dword [ebp + 0x68]
pop ebx
add ebp, 0x6c
leave
ret
Function at 0x4004fee
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4005103
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
push ebx
push 1
push dword [ebp - 0xc]
mov dword [ebp - 4], ebx
call esi
cmp dword [ebp - 4], 0x400
jae 0x40050fa
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x80c]
push eax
push 1
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x40050fa
mov esi, dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x40c]
push eax
push ebx
push 0xc
mov dword [ebp - 8], 0x44
call esi
push dword [ebp - 0x80c]
mov edi, dword [sym.imp.ADVAPI32.dll_EqualSid]
lea eax, [ebp - 0x40c]
push eax
call edi
test eax, eax
je 0x4005091
mov al, 1
jmp 0x4005105
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x40c]
push eax
push ebx
push 0x16
call esi
push dword [ebp - 0x80c]
lea eax, [ebp - 0x40c]
push eax
call edi
test eax, eax
jne 0x400508d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x40c]
push eax
push ebx
push 0x17
call esi
push dword [ebp - 0x80c]
lea eax, [ebp - 0x40c]
push eax
call edi
test eax, eax
jne 0x400508d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x40c]
push eax
push ebx
push 0x18
call esi
push dword [ebp - 0x80c]
lea eax, [ebp - 0x40c]
push eax
call edi
test eax, eax
jne 0x400508d
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4005164
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
je 0x4005211
push ebx
mov ebx, dword [ebp + 0xc]
cmp ebx, 5
jle 0x4005210
push esi
mov eax, ebx
cdq
push 6
pop ecx
idiv ecx
xor ecx, ecx
mov edx, 0x288
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.04004edc
mov esi, eax
pop ecx
test esi, esi
je 0x400520f
mov eax, ebx
imul eax, eax, 0x288
push 6
pop ecx
xor edx, edx
div ecx
mov dword [ebp - 8], esi
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x4005206
push edi
xor edi, edi
cmp edi, ebx
jge 0x4005200
mov eax, dword [esi + 0x190]
mov ecx, ebx
sub ecx, edi
cmp eax, ecx
jae 0x4005200
push eax
lea eax, [esi + 0x194]
push eax
mov eax, dword [ebp + 8]
add eax, edi
push eax
call fcn.04004094
add edi, dword [esi + 0x190]
mov esi, dword [esi]
add esp, 0xc
test esi, esi
jne 0x40051cc
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
pop edi
push dword [ebp - 8]
call fcn.04004ef0
pop ecx
pop esi
pop ebx
xor eax, eax
inc eax
leave
ret
Function at 0x4005216
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
push edi
cmp dword [ebp + 8], esi
je 0x4005287
cmp word [ebp + 0xc], si
je 0x4005287
push 6
push 1
push 2
call sub.WS2_32.dll_socket
mov edi, eax
cmp edi, 0xffffffff
je 0x4005287
push 2
pop eax
push dword [ebp + 0xc]
mov word [ebp - 0x10], ax
call sub.WS2_32.dll_htons
push dword [ebp + 8]
mov word [ebp - 0xe], ax
call sub.WS2_32.dll_gethostbyname
cmp eax, esi
je 0x4005287
cmp dword [ebp + 0x10], esi
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
jle 0x4005281
push 0x10
lea eax, [ebp - 0x10]
push eax
push edi
call sub.WS2_32.dll_connect
test eax, eax
je 0x400528e
inc esi
cmp esi, dword [ebp + 0x10]
jl 0x400526b
push edi
call sub.WS2_32.dll_closesocket
or eax, 0xffffffff
pop edi
pop esi
leave
ret
mov eax, edi
jmp 0x400528a

Function at 0x4005292
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
push 0x100
xor edi, edi
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.04004174
add esp, 0xc
lea eax, [ebp - 0x10c]
xor esi, esi
mov ecx, 0xff
inc eax
mov dl, al
lea ebx, [ebp - 0x10c]
inc esi
sub dl, bl
cmp esi, ecx
mov byte [eax], dl
jl 0x40052c2
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
xor edx, edx
mov eax, edi
div dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
lea esi, [ebp + edi - 0x10c]
mov bl, byte [esi]
movsx eax, byte [edx + eax]
add eax, dword [ebp - 4]
movsx edx, bl
add edx, eax
and edx, ecx
mov eax, edx
mov dword [ebp - 4], eax
lea eax, [ebp + eax - 0x10c]
mov dl, byte [eax]
inc edi
mov byte [eax], bl
mov byte [esi], dl
cmp edi, 0x100
jb 0x40052da
mov edx, dword [ebp + 0x10]
and dword [ebp - 4], 0
test edx, edx
jbe 0x4005378
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
sub eax, edi
mov dword [ebp - 0xc], eax
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 8]
inc eax
and eax, ecx
mov dword [ebp - 8], eax
lea eax, [ebp + eax - 0x10c]
mov dl, byte [eax]
movsx esi, dl
add esi, dword [ebp - 4]
and esi, ecx
mov dword [ebp - 4], esi
lea esi, [ebp + esi - 0x10c]
mov bl, byte [esi]
mov byte [eax], bl
mov byte [esi], dl
movsx eax, byte [eax]
movsx edx, dl
add eax, edx
mov edx, dword [ebp - 0xc]
and eax, ecx
mov al, byte [ebp + eax - 0x10c]
xor al, byte [edx + edi]
mov byte [edi], al
inc edi
dec dword [ebp + 0x10]
jne 0x400532f
pop edi
pop esi
pop ebx
leave
ret
Function at 0x400537d
Capabilities:
Encode data using xor
Get common file path
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x344
push ebx
xor ebx, ebx
mov byte [ebp + 0x6b], bl
cmp dword [ebp + 0x74], ebx
je 0x40054a9
cmp dword [ebp + 0x78], ebx
je 0x40054a9
cmp dword [ebp + 0x7c], ebx
jle 0x40054a9
push esi
mov esi, 0x103
push esi
lea eax, [ebp - 0x170]
push eax
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x58], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x40054a8
push 0x63
lea eax, [ebp - 0x1d4]
push eax
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x60]
push eax
push esi
lea eax, [ebp - 0x2d8]
push eax
lea eax, [ebp - 0x170]
push eax
mov byte [ebp - 0x16d], bl
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x40054a8
push edi
add esi, 0xffffffbd
push esi
lea eax, [ebp - 0x6c]
push ebx
push eax
or edi, 0xffffffff
call fcn.04004174
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp - 0x6c]
push esi
push eax
mov dword [ebp + 0x64], ebx
call fcn.04005164
add esp, 0x18
test eax, eax
je 0x4005445
mov ecx, dword [ebp + 0x64]
shr ecx, 2
xor eax, eax
cmp ecx, ebx
jle 0x4005445
xor edi, dword [ebp + eax*4 - 0x6c]
inc eax
cmp eax, ecx
jl 0x400543c
mov ecx, dword [ebp + 0x60]
xor eax, eax
mov esi, dword [ebp + 0x74]
imul ecx, ecx, 0x19660d
add ecx, 0x3c6ef35f
mov edx, ecx
xor edx, edi
mov dword [esi + eax*4], edx
inc eax
cmp eax, 4
jl 0x400544a
lea eax, [ebp + 0x5c]
push eax
push esi
call dword [sym.imp.ole32.dll_StringFromCLSID]
pop edi
test eax, eax
jl 0x400549f
mov esi, dword [ebp + 0x78]
push ebx
push ebx
push dword [ebp + 0x7c]
push esi
push 0xffffffffffffffff
push dword [ebp + 0x5c]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add eax, 0xfffffffe
push eax
lea eax, [esi + 1]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov byte [ebp + 0x6b], 1
push dword [ebp + 0x5c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
pop esi
mov al, byte [ebp + 0x6b]
pop ebx
add ebp, 0x6c
leave
ret

Function at 0x40054ef
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push 1
push 0x19
push dword [0x400cf20]
xor bl, bl
call fcn.04005216
mov esi, dword [esp + 0x18]
add esp, 0xc
cmp eax, 0xffffffff
je 0x4005518
push eax
call sub.WS2_32.dll_closesocket
inc bl
jmp 0x4005531
xor eax, eax
push eax
push eax
push esi
push 0x40054b2
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x4005537
mov byte [esi], bl
pop esi
mov al, bl
pop ebx
ret
Function at 0x41f980
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x542a1a
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5a49f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.005198e0
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x41fa40
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.0051c525
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x59acd4
push eax
call fcn.0051ed3c
push edi
push esi
call fcn.00519c28
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051ad3f
mov esp, ebp
pop ebp
ret 4

Function at 0x427bc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x542b46
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5a49f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0051b191
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00519b25
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret