joyce8/EMBER2024-capa huggingface dataset:
Function at 0x497df0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x497e4a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00497de0
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00487370
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00486f70
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497e51
lea eax, [ebp - 4]
call fcn.00404a98
ret

Function at 0x4a4f14
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffff7f4
mov ebx, eax
mov eax, ebx
call fcn.00404a98
lea eax, [esp + 0xc]
xor ecx, ecx
mov edx, 0x800
call fcn.004032f8
mov dword [esp], 0xffffffff
push esp
push 0x20019
push 0
push 0x4a4fb0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4a4f9c
mov dword [esp + 8], 0x800
mov dword [esp + 4], 1
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x4a4fc8
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4a4f9c
cmp dword [esp + 4], 1
jne 0x4a4f9c
mov eax, ebx
lea edx, [esp + 0xc]
call fcn.00404c90
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
add esp, 0x80c
pop ebx
ret

Function at 0x4a7378
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f48
xor eax, eax
push ebp
push 0x4a7458
push dword fs:[eax]
mov dword fs:[eax], esp
or esi, 0xffffffff
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00409d3c
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4a7442
xor esi, esi
lea edx, [ebp - 0x4a]
mov ecx, 0x40
mov eax, ebx
call fcn.00409dc0
cmp eax, 0x40
jne 0x4a743b
cmp word [ebp - 0x4a], 0x5a4d
jne 0x4a743b
xor ecx, ecx
mov edx, dword [ebp - 0xe]
mov eax, ebx
call fcn.00409e18
cmp eax, dword [ebp - 0xe]
jne 0x4a743b
lea edx, [ebp - 8]
mov ecx, 4
mov eax, ebx
call fcn.00409dc0
cmp eax, 4
jne 0x4a743b
cmp dword [ebp - 8], 0x4550
jne 0x4a743b
lea edx, [ebp - 0xa]
mov ecx, 2
mov eax, ebx
call fcn.00409dc0
cmp eax, 2
jne 0x4a743b
mov ax, word [ebp - 0xa]
sub ax, 0x14c
je 0x4a742f
sub ax, 0xb4
je 0x4a7436
sub ax, 0x84
je 0x4a7436
sub ax, 0x83e0
je 0x4a7436
jmp 0x4a743b
mov esi, 0x20
jmp 0x4a743b
mov esi, 0x40
mov eax, ebx
call fcn.00409e5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a745f
lea eax, [ebp - 4]
call fcn.00404a98
ret

Function at 0x4b15ac
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004b217c
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x4b2078
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff20
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x40
jle 0x4b20bd
lea eax, [ebp - 0x60]
call fcn.004b15ac
mov edx, ebx
lea eax, [ebp - 0x60]
mov ecx, dword [ebp + 0xc]
call fcn.004b15d4
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.004b16a4
mov dword [ebp + 0xc], 0x10
mov esi, dword [ebp + 8]
jmp 0x4b20bf
mov esi, ebx
xor ecx, ecx
lea eax, [ebp - 0xa0]
lea edx, [ebp - 0xe0]
lea ebx, [ecx + 1]
cmp ebx, dword [ebp + 0xc]
jg 0x4b20e6
mov bl, byte [esi]
xor bl, 0x36
mov byte [eax], bl
mov bl, byte [esi]
xor bl, 0x5c
mov byte [edx], bl
inc esi
jmp 0x4b20ec
mov byte [eax], 0x36
mov byte [edx], 0x5c
inc ecx
inc edx
inc eax
cmp ecx, 0x40
jne 0x4b20cd
lea eax, [ebp - 0x60]
call fcn.004b15ac
lea edx, [ebp - 0xa0]
lea eax, [ebp - 0x60]
mov ecx, 0x40
call fcn.004b15d4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x60]
mov ecx, dword [ebp - 8]
call fcn.004b1f58
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.004b16a4
lea eax, [ebp - 0x60]
call fcn.004b15ac
lea edx, [ebp - 0xe0]
lea eax, [ebp - 0x60]
mov ecx, 0x40
call fcn.004b15d4
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x60]
mov ecx, 0x10
call fcn.004b15d4
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.004b16a4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4bece8
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, ecx
mov dword [esp], edx
mov ebp, eax
xor esi, esi
mov ebx, dword [esp]
jmp 0x4becfc
inc ebx
mov eax, ebx
mov ecx, 3
cdq
idiv ecx
test edx, edx
jg 0x4becfb
mov eax, ebx
mov ecx, 3
cdq
idiv ecx
shl eax, 2
mov ebx, eax
mov eax, edi
mov edx, ebx
call fcn.004050e4
xor ebx, ebx
cmp esi, dword [esp]
jge 0x4bee65
inc ebx
mov eax, edi
call fcn.00404fb0
mov dl, byte [ebp + esi]
and dl, 0xfc
and edx, 0xff
shr edx, 2
mov dl, byte [edx + 0x507028]
mov byte [eax + ebx - 1], dl
lea eax, [esi + 1]
cmp eax, dword [esp]
jge 0x4bee1d
inc ebx
mov eax, edi
call fcn.00404fb0
mov dl, byte [ebp + esi]
and dl, 3
and edx, 0xff
shl edx, 4
mov cl, byte [ebp + esi + 1]
and cl, 0xf0
and ecx, 0xff
shr ecx, 4
add edx, ecx
mov dl, byte [edx + 0x507028]
mov byte [eax + ebx - 1], dl
lea eax, [esi + 2]
cmp eax, dword [esp]
jge 0x4bedec
inc ebx
mov eax, edi
call fcn.00404fb0
mov dl, byte [ebp + esi + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov cl, byte [ebp + esi + 2]
and cl, 0xc0
and ecx, 0xff
shr ecx, 6
add edx, ecx
mov dl, byte [edx + 0x507028]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.00404fb0
mov dl, byte [ebp + esi + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edx + 0x507028]
mov byte [eax + ebx - 1], dl
jmp 0x4bee59
inc ebx
mov eax, edi
call fcn.00404fb0
mov dl, byte [ebp + esi + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov dl, byte [edx + 0x507028]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.00404fb0
mov byte [eax + ebx - 1], 0x3d
jmp 0x4bee59
inc ebx
mov eax, edi
call fcn.00404fb0
mov dl, byte [ebp + esi]
and dl, 3
and edx, 0xff
shl edx, 4
mov dl, byte [edx + 0x507028]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.00404fb0
mov byte [eax + ebx - 1], 0x3d
inc ebx
mov eax, edi
call fcn.00404fb0
mov byte [eax + ebx - 1], 0x3d
add esi, 3
cmp esi, dword [esp]
jl 0x4bed2d
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4c2224
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, 0x30
mov edi, 0x5071a0
mov ecx, dword [esp]
lea edx, [esp + 0xc]
xor ebx, ebx
mov bl, byte [edi]
mov bl, byte [eax + ebx - 1]
xor bl, byte [ecx]
mov byte [edx], bl
inc edx
inc ecx
inc edi
dec esi
jne 0x4c2243
mov esi, 1
mov edx, 0x5072a8
mov ecx, esi
dec ecx
mov eax, ecx
add eax, eax
lea eax, [eax + eax*2]
shl ecx, 2
xor ebx, ebx
mov bl, byte [esp + eax + 0xc]
mov edi, ebx
add edi, edi
xor ebx, ebx
mov bl, byte [esp + eax + 0x11]
add edi, ebx
xor ebx, ebx
mov bl, byte [esp + eax + 0xd]
shl ebx, 3
movzx ebp, byte [esp + eax + 0xe]
shl ebp, 2
add ebx, ebp
movzx ebp, byte [esp + eax + 0xf]
add ebp, ebp
add ebx, ebp
movzx eax, byte [esp + eax + 0x10]
add ebx, eax
mov dword [esp + 8], ebx
mov eax, 1
mov ebx, eax
dec ebx
je 0x4c22bd
dec ebx
je 0x4c22e1
dec ebx
je 0x4c2305
dec ebx
je 0x4c2328
jmp 0x4c2341
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 8
and ebx, 0xff
shr ebx, 3
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4c2341
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 4
and ebx, 0xff
shr ebx, 2
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4c2341
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 2
and ebx, 0xff
shr ebx, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
jmp 0x4c2341
mov ebx, edi
add ebx, ebx
lea ebx, [edx + ebx*8]
mov ebp, dword [esp + 8]
mov bl, byte [ebx + ebp - 0x40]
and bl, 1
lea ebp, [eax + ecx]
mov byte [esp + ebp + 0x3b], bl
inc eax
cmp eax, 5
jne 0x4c22aa
inc esi
add edx, 0x40
cmp esi, 9
jne 0x4c225f
mov esi, 0x20
mov eax, 0x5071d0
mov edx, dword [esp + 4]
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [esp + ecx + 0x3b]
mov byte [edx], cl
inc edx
inc eax
dec esi
jne 0x4c2366
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4c23a0
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], ecx
mov esi, eax
xor eax, eax
mov al, dl
mov bl, byte [eax + 0x507257]
test bl, bl
jbe 0x4c23d1
lea eax, [esi + 0x3e0]
call fcn.004c2380
lea eax, [esi + 0x3fc]
call fcn.004c2380
dec bl
jne 0x4c23b7
mov cl, 0x30
mov edi, 0x507228
mov eax, dword [esp]
mov dl, byte [edi]
cmp dl, 0x1c
ja 0x4c23f3
and edx, 0xff
mov dl, byte [esi + edx + 0x3df]
mov byte [eax], dl
jmp 0x4c2402
and edx, 0xff
mov dl, byte [esi + edx + 0x3df]
mov byte [eax], dl
inc eax
inc edi
dec cl
jne 0x4c23db
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4c2410
Capabilities:
Encode data using xor
Encrypt data using des
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov bl, 1
lea esi, [ebp - 0x421]
mov eax, edi
mov edx, ebx
call fcn.004c21b8
mov byte [esi], al
inc ebx
inc esi
cmp bl, 0x41
jne 0x4c242c
mov bl, 0x1c
mov esi, 0x5071f0
lea edi, [ebp - 0x41]
mov dl, byte [esi]
mov eax, dword [ebp - 8]
call fcn.004c21b8
mov byte [edi], al
mov dl, byte [esi + 0x1c]
mov eax, dword [ebp - 8]
call fcn.004c21b8
mov byte [edi + 0x1c], al
inc edi
inc esi
dec bl
jne 0x4c2448
mov bl, 1
lea esi, [ebp - 0x3a1]
mov ecx, esi
lea eax, [ebp - 0x421]
mov edx, ebx
call fcn.004c23a0
inc ebx
add esi, 0x30
cmp bl, 0x11
jne 0x4c2470
mov bl, 1
mov eax, 0x507120
lea edx, [ebp - 0xa1]
cmp bl, 0x20
ja 0x4c24a9
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [ebp + ecx - 0x422]
mov byte [edx], cl
jmp 0x4c24b6
xor ecx, ecx
mov cl, byte [eax]
mov cl, byte [ebp + ecx - 0x422]
mov byte [edx], cl
inc ebx
inc edx
inc eax
cmp bl, 0x41
jne 0x4c2495
mov byte [ebp - 9], 1
lea esi, [ebp - 0x3a1]
cmp byte [ebp + 8], 0
je 0x4c24e0
lea ecx, [ebp - 0x61]
mov edx, esi
lea eax, [ebp - 0x81]
call fcn.004c2224
jmp 0x4c2508
xor eax, eax
mov al, byte [ebp - 9]
mov edx, 0x11
sub edx, eax
mov eax, edx
add eax, eax
lea eax, [eax + eax*2]
lea edx, [ebp + eax*8 - 0x3d1]
lea ecx, [ebp - 0x61]
lea eax, [ebp - 0x81]
call fcn.004c2224
mov bl, 0x20
lea eax, [ebp - 0xa1]
mov dl, byte [eax]
xor byte [eax + 0x40], dl
inc eax
dec bl
jne 0x4c2510
push esi
lea esi, [ebp - 0x81]
lea edi, [ebp - 0xa1]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
lea esi, [ebp - 0x61]
lea edi, [ebp - 0x81]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
inc byte [ebp - 9]
add esi, 0x30
cmp byte [ebp - 9], 0x11
jne 0x4c24c8
mov bl, 0x40
mov esi, 0x507160
lea eax, [ebp - 0x3e1]
mov dl, byte [esi]
cmp dl, 0x20
ja 0x4c2576
and edx, 0xff
mov dl, byte [ebp + edx - 0x82]
mov byte [eax], dl
jmp 0x4c2585
and edx, 0xff
mov dl, byte [ebp + edx - 0xc2]
mov byte [eax], dl
inc eax
inc esi
dec bl
jne 0x4c255e
mov bl, 1
lea esi, [ebp - 0x3e1]
mov cl, byte [esi]
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.004c21e0
inc ebx
inc esi
cmp bl, 0x41
jne 0x4c2593
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c30a4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, ecx
mov dword [esp], edx
mov esi, eax
mov dl, byte [esi]
mov byte [esp + 4], dl
shl edx, 7
and dl, 0xff
mov al, byte [esi + 1]
xor ecx, ecx
mov cl, al
shr ecx, 1
or dl, cl
mov byte [esp + 5], dl
shl eax, 6
and al, 0xff
mov dl, byte [esi + 2]
xor ecx, ecx
mov cl, dl
shr ecx, 2
or al, cl
mov byte [esp + 6], al
shl edx, 5
and dl, 0xff
mov al, byte [esi + 3]
xor ecx, ecx
mov cl, al
shr ecx, 3
or dl, cl
mov byte [esp + 7], dl
shl eax, 4
and al, 0xff
xor edx, edx
mov dl, byte [esi + 4]
shr edx, 4
or al, dl
mov byte [esp + 8], al
mov al, byte [esi + 4]
shl eax, 3
and al, 0xff
xor edx, edx
mov dl, byte [esi + 5]
shr edx, 5
or al, dl
mov byte [esp + 9], al
mov al, byte [esi + 5]
shl eax, 2
and al, 0xff
xor edx, edx
mov dl, byte [esi + 6]
shr edx, 6
or al, dl
mov byte [esp + 0xa], al
mov al, byte [esi + 6]
add eax, eax
and al, 0xff
mov byte [esp + 0xb], al
mov edi, 8
lea eax, [esp + 4]
mov edx, 1
xor esi, esi
mov ecx, edx
xor ebx, ebx
mov bl, byte [eax]
shl ebx, cl
mov ecx, ebx
xor ecx, esi
and ecx, 1
mov esi, ecx
inc edx
cmp edx, 8
jne 0x4c3150
mov dl, byte [eax]
and dl, 0xfe
mov ecx, esi
or dl, cl
mov byte [eax], dl
inc eax
dec edi
jne 0x4c314b
mov eax, ebp
mov edx, 8
call fcn.004050e4
push 1
mov eax, ebp
call fcn.00404fb0
mov edx, eax
lea ecx, [esp + 8]
mov eax, dword [esp + 4]
call fcn.004c2410
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4c9c34
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret
Function at 0x4f5ed0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
shl eax, 2
mov ecx, 3
cdq
idiv ecx
mov edx, eax
add edx, 4
mov ecx, esi
xor eax, eax
call fcn.00405148
cmp byte [ebp - 1], 0
jne 0x4f5f2e
mov eax, esi
call fcn.00404fb0
mov dl, byte [ebp - 0xc]
dec edx
and dl, 0x3f
add dl, 0x21
mov byte [eax], dl
mov eax, dword [ebp - 0xc]
add eax, 2
mov ecx, 3
cdq
idiv ecx
lea eax, [eax + eax*2]
mov dword [ebp - 0xc], eax
mov edi, 2
xor eax, eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov al, byte [ebp - 1]
sub al, 1
jb 0x4f5f47
sub al, 2
jb 0x4f5f4e
jmp 0x4f5f53
mov ebx, 2
jmp 0x4f5f53
mov ebx, 1
mov eax, esi
call fcn.00404fb0
mov byte [eax + ebx - 1], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jge 0x4f6035
test edi, edi
jle 0x4f5faf
mov eax, esi
call fcn.00404fb0
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shl eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
and eax, edx
mov ecx, edi
shr eax, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
sub edi, 6
inc ebx
mov eax, esi
call fcn.00404fb0
mov byte [eax + ebx - 1], 0
jmp 0x4f6029
test edi, edi
jge 0x4f5ff5
mov eax, edi
cdq
xor eax, edx
sub eax, edx
mov edi, eax
mov eax, esi
call fcn.00404fb0
lea eax, [eax + ebx - 1]
push eax
mov ecx, edi
mov eax, 0x3f
shr eax, cl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
and al, byte [edx + ecx]
mov ecx, edi
shl al, cl
mov edx, dword [esi]
or al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
mov eax, 8
sub eax, edi
mov edi, eax
inc dword [ebp - 0x10]
jmp 0x4f6029
mov eax, esi
call fcn.00404fb0
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov dl, byte [edx + ecx]
and dl, 0x3f
mov ecx, dword [esi]
mov cl, byte [ecx + ebx - 1]
or dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
inc dword [ebp - 0x10]
mov eax, esi
call fcn.00404fb0
mov byte [eax + ebx - 1], 0
mov edi, 2
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x4f5f6b
mov al, byte [ebp - 1]
sub al, 1
jb 0x4f6045
sub al, 2
jb 0x4f607e
jmp 0x4f60c5
cmp edi, 2
jne 0x4f604b
dec ebx
mov eax, ebx
sub eax, 2
jl 0x4f60c5
inc eax
mov dword [ebp - 0x14], eax
mov edi, 2
mov eax, esi
call fcn.00404fb0
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x5076b0]
mov dl, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x4f605b
jmp 0x4f60c5
cmp edi, 2
jne 0x4f6084
dec ebx
test ebx, ebx
jle 0x4f60c0
mov dword [ebp - 0x14], ebx
mov edi, 1
mov eax, esi
call fcn.00404fb0
mov edx, dword [esi]
movzx edx, byte [edx + edi - 1]
mov ecx, dword [0x5076b4]
mov dl, byte [ecx + edx]
mov byte [eax + edi - 1], dl
inc edi
dec dword [ebp - 0x14]
jne 0x4f6090
jmp 0x4f60c0
inc ebx
mov eax, esi
call fcn.00404fb0
mov byte [eax + ebx - 1], 0x3d
test bl, 3
jne 0x4f60b3
mov eax, esi
mov edx, ebx
call fcn.004050e4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4f70a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f48
lea esi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4f7203
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.0047994c
mov ebx, eax
mov dword [esi], 0x128
mov edx, esi
mov eax, ebx
call fcn.0047996c
jmp 0x4f71d5
lea eax, [ebp - 0x138]
lea edx, [esi + 0x24]
mov ecx, 0x104
call fcn.00404d08
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040a0c0
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00409210
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00409210
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00404ea4
je 0x4f71b7
lea eax, [ebp - 0x144]
lea edx, [esi + 0x24]
mov ecx, 0x104
call fcn.00404d08
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409210
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00409210
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404ea4
jne 0x4f71cc
push 0
mov eax, dword [esi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, esi
mov eax, ebx
call fcn.0047998c
test eax, eax
jne 0x4f7118
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f720a
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00404abc
lea eax, [ebp - 4]
call fcn.00404a98
ret
Function at 0x4025d0
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
push edi
mov dword [0x40e7cc], edi
call sub.WS2_32.dll_WSASetLastError
cmp word [0x40e7b0], di
je 0x4025f3
push 0x11
push 2
jmp 0x4025f7
push 6
push 1
push 2
call sub.WS2_32.dll_socket
cmp eax, edi
mov dword [0x40e9f0], eax
jge 0x402611
push str.Cant_get_socket
call fcn.004020f0
jne 0x402621
push edi
call fcn.0040a065
add esp, 4
mov dword [0x40e9f0], eax
mov ecx, dword [0x40ea48]
push 4
push ecx
push 4
push pe_overlay
push eax
call sub.WS2_32.dll_setsockopt
cmp eax, 0xffffffff
jne 0x402649
push str.nnetfd_reuseaddr_failed
call fcn.00402060
add esp, 4
mov edx, dword [0x40e780]
mov esi, dword [ebp + 0x10]
cmp esi, edi
mov word [edx], 2
mov eax, dword [0x40e784]
mov word [eax], 2
je 0x402670
mov ecx, dword [esi]
mov edx, dword [0x40e780]
mov dword [edx + 4], ecx
mov ebx, dword [ebp + 0x14]
cmp bx, di
je 0x402688
push ebx
call sub.WS2_32.dll_htons
mov ecx, dword [0x40e780]
mov word [ecx + 2], ax
test esi, esi
jne 0x402691
test bx, bx
je 0x4026fd
mov esi, 4
jmp 0x4026a0
mov edx, dword [0x40e780]
mov eax, dword [0x40e9f0]
push 0x10
push edx
push eax
call sub.WS2_32.dll_bind
mov edi, eax
test edi, edi
je 0x40271f
cmp dword [0x40e7cc], 0x2740
jne 0x4026fd
mov edx, dword [0x40e780]
mov eax, dword [edx + 4]
movzx ecx, bx
push ecx
push eax
call sub.WS2_32.dll_inet_ntoa
push eax
push str.retrying_local__s:_d
call fcn.00402060
push 1
call fcn.00404592
add esp, 0x10
dec esi
test esi, esi
mov dword [0x40e7cc], 0
jg 0x4026a0
test edi, edi
je 0x40271f
mov edx, dword [0x40e780]
mov eax, dword [edx + 4]
movzx ecx, bx
push ecx
push eax
call sub.WS2_32.dll_inet_ntoa
push eax
push str.Cant_grab__s:_d_with_bind
call fcn.004020f0
cmp word [0x40e7a0], 0
jne 0x4027ad
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x40e784]
push ecx
mov dword [eax + 4], edx
call sub.WS2_32.dll_htons
mov edx, dword [0x40e784]
mov word [edx + 2], ax
mov eax, dword [0x40e768]
test eax, eax
je 0x402763
push str.Warning:_source_routing_unavailable_on_this_machine__ignoring
call fcn.00402060
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff5
call edi
push 0
push 0x40ea00
call fcn.00404828
add esp, 8
test eax, eax
jne 0x402798
mov eax, dword [0x40e784]
mov ecx, dword [0x40e9f0]
push 0x10
push eax
push ecx
call sub.WS2_32.dll_connect
mov esi, eax
jmp 0x4027a5
push 0x274c
or esi, 0xffffffff
call sub.WS2_32.dll_WSASetLastError
push 0xfffffffffffffff5
call edi
test esi, esi
jne 0x4027b7
mov eax, dword [0x40e9f0]
pop edi
pop esi
pop ebx
pop ebp
ret
call sub.WS2_32.dll_WSAGetLastError
mov edx, dword [0x40e9f0]
push 2
push edx
mov dword [0x40e7cc], eax
call sub.WS2_32.dll_shutdown
mov eax, dword [0x40e9f0]
push eax
call sub.WS2_32.dll_closesocket
mov ecx, dword [0x40e7cc]
push ecx
call sub.WS2_32.dll_WSASetLastError
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
Function at 0x40a7c0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00407770
mov eax, dword [0x40e090]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, dword [0x40eca0]
mov dword [ebp - 4], eax
jae 0x40a903
mov eax, ebx
sar eax, 5
mov eax, dword [eax*4 + 0x40ecc0]
mov ecx, ebx
and ecx, 0x1f
test byte [eax + ecx*8 + 4], 1
je 0x40a903
push 1
push esi
push ebx
call fcn.00408f48
add esp, 0xc
cmp eax, 0xffffffff
mov dword [ebp - 0x1008], eax
je 0x40a90d
push 2
push esi
push ebx
call fcn.00408f48
add esp, 0xc
cmp eax, 0xffffffff
je 0x40a90d
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x40a8ad
push 0x1000
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.00408a30
push 0x8000
push ebx
call fcn.004048ed
add esp, 0x14
mov dword [ebp + 8], eax
mov eax, 0x1000
cmp edi, eax
jge 0x40a86c
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push ebx
call fcn.00406865
add esp, 0xc
cmp eax, 0xffffffff
je 0x40a88a
sub edi, eax
test edi, edi
jg 0x40a861
jmp 0x40a8a0
cmp dword [0x40e7d0], 5
jne 0x40a89d
mov dword [0x40e7cc], 0xd
or esi, 0xffffffff
push dword [ebp + 8]
push ebx
call fcn.004048ed
pop ecx
pop ecx
jmp 0x40a8ed
jge 0x40a8ed
push 0
push dword [ebp + 0xc]
push ebx
call fcn.00408f48
push ebx
call fcn.00408d72
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, 0xffffffff
jne 0x40a8ed
mov dword [0x40e7cc], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x40e7d0], eax
push 0
push dword [ebp - 0x1008]
push ebx
call fcn.00408f48
add esp, 0xc
mov eax, esi
pop edi
jmp 0x40a910
mov dword [0x40e7cc], 9
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0040406d
leave
ret

Function at 0x2647d1c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x2647d26
pushal
call 0x2647d2c
pop ebp
sub ebp, 0x10
sub ebp, 0x2247d1c
jmp 0x2647d42
mov eax, 0x2247d1c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b5
mov edx, 0x4bc2bb49
xor byte [eax], dl
inc eax
dec ecx
jne 0x2647d59
jmp 0x2647d6c
ret 0xc284
Function at 0x4035ab
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x403600
push dword [esp + 0x10]
push 0x40352a
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x5b75f8]
test esi, esi
je 0x403659
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x4035f8
cmp byte [esi + 0x10], 0
je 0x4035f8
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x4035d4
jmp 0x403659
mov esi, dword [0x5b75f8]
test esi, esi
je 0x403659
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x403652
cmp byte [esi + 0x11], 0
je 0x40362e
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x403645
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push ebp
push 0x5b75f8
call fcn.0040ef9f
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x40360d
pop ebp
pop edi
pop esi
pop ebx
ret 4