joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405cc4
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
call fcn.00404e60
test eax, eax
je 0x405cea
test ebx, ebx
je 0x405cea
cmp word [ebx], 0
je 0x405cea
push 0
push ebx
call sub.KERNEL32.DLL_CreateDirectoryW
jmp 0x405cf2
push 0
push esi
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
je 0x405d05
mov ecx, edi
mov edx, ebx
mov eax, esi
call fcn.00405ee8
xor eax, eax
jmp 0x405d20
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
je 0x405d14
cmp eax, 3
jne 0x405d1b
mov eax, 2
jmp 0x405d20
mov eax, 1
pop edi
pop esi
pop ebx
ret

Function at 0x405e88
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.00404e60
test eax, eax
je 0x405eb3
test ebx, ebx
je 0x405eb3
cmp word [ebx], 0
je 0x405eb3
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret

Function at 0x405ee8
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
call fcn.00404e60
test eax, eax
je 0x405f15
test ebx, ebx
je 0x405f15
cmp word [ebx], 0
je 0x405f15
push esi
push ebx
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
setne al
and eax, 1
jmp 0x405f24
push esi
push edi
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
setne al
and eax, 1
pop edi
pop esi
pop ebx
ret

Function at 0x40777c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, 0x4140d8
push edi
push ebp
mov ebp, edx
cmp dword [esi + 4], 0
mov edi, ecx
mov ebx, eax
jne 0x407796
call fcn.00407744
mov eax, ebp
cmp edi, 8
jb 0x407821
xor ebx, dword [eax]
xor edx, edx
mov dl, bl
sub edi, 8
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
xor ebx, dword [eax + 4]
add eax, 8
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
xor edx, edx
mov ebx, ecx
mov dl, bl
shr ebx, 8
mov ecx, dword [esi + edx*4]
xor ecx, ebx
cmp edi, 8
mov ebx, ecx
jae 0x4077a1
xor edx, edx
jmp 0x40783b
mov ecx, ebx
xor cl, byte [eax + edx]
and ecx, 0xff
shr ebx, 8
mov ecx, dword [esi + ecx*4]
xor ecx, ebx
mov ebx, ecx
inc edx
cmp edi, edx
ja 0x407825
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x407dec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
test ebx, ebx
je 0x407e03
test esi, esi
jg 0x407e0a
xor eax, eax
jmp 0x407ebc
mov edx, dword [ebp - 4]
add edx, 4
lea eax, [ebp - 0x2c]
mov ecx, 0x10
call fcn.0040d81c
test esi, esi
jns 0x407e24
add esi, 0xf
sar esi, 4
mov dword [ebp - 8], esi
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jle 0x407ea3
lea ecx, [ebp - 0x1c]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00408178
lea edx, [ebp - 0x2c]
mov eax, edx
mov ecx, dword [eax]
xor dword [ebp - 0x1c], ecx
mov ecx, dword [eax + 4]
xor dword [ebp - 0x18], ecx
mov ecx, dword [eax + 8]
xor dword [ebp - 0x14], ecx
mov eax, dword [eax + 0xc]
xor dword [ebp - 0x10], eax
mov eax, edx
mov edx, ebx
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov edx, dword [edx + 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x18]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x14]
mov dword [eax + 8], edx
mov ecx, dword [ebp - 0x10]
mov dword [eax + 0xc], ecx
add ebx, 0x10
add dword [ebp + 8], 0x10
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jg 0x407e36
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
add eax, 4
mov ecx, 0x10
call fcn.0040d81c
mov eax, dword [ebp - 8]
shl eax, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4080e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov dword [esp], eax
mov esi, 1
xor eax, eax
xor ecx, ecx
mov edx, esi
mov ebx, ecx
shl edx, 4
add edx, dword [esp]
shl ebx, 2
add edx, ebx
xor ebx, ebx
add edx, 0x14
movzx edi, byte [edx + 1]
mov bl, byte [edx]
lea edi, [edi*4 + 0x416d9a]
lea ebx, [ebx*4 + 0x41699a]
mov bl, byte [ebx + eax]
xor bl, byte [edi + eax]
movzx edi, byte [edx + 2]
movzx edx, byte [edx + 3]
lea edi, [edi*4 + 0x41719a]
lea edx, [edx*4 + 0x41759a]
xor bl, byte [edi + eax]
xor bl, byte [edx + eax]
lea edx, [esp + ecx*4 + 4]
mov byte [edx + eax], bl
inc ecx
cmp ecx, 4
jl 0x4080f2
inc eax
cmp eax, 4
jl 0x4080f0
mov eax, esi
lea edx, [esp + 4]
shl eax, 4
mov ecx, 0x10
add eax, dword [esp]
add eax, 0x14
call fcn.0040d81c
inc esi
cmp esi, 0xa
jl 0x4080ee
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x409398
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
xor edx, edx
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], edx
ret
Function at 0x40c770
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, eax
push esi
push edi
xor eax, eax
mov dword [ebp - 4], edx
mov dword [ebx + 0xc18], eax
mov edi, ecx
cmp byte [ebp + 8], 0
mov esi, 0x80000000
je 0x40c799
or esi, 0x40000000
mov dword [ebp - 8], 1
cmp byte [ebx + 0x12], 0
jne 0x40c7ac
cmp byte [ebp + 0xc], 0
je 0x40c7b0
or dword [ebp - 8], 2
call fcn.00404e60
test eax, eax
je 0x40c7dc
test edi, edi
je 0x40c7dc
cmp word [edi], 0
je 0x40c7dc
push 0
push 0x8000000
push 3
push 0
push dword [ebp - 8]
push esi
push edi
call sub.KERNEL32.DLL_CreateFileW
mov esi, eax
jmp 0x40c7f5
push 0
push 0x8000000
push 3
push 0
push dword [ebp - 8]
push esi
push dword [ebp - 4]
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x40c80e
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
jne 0x40c80e
mov dword [ebx + 0xc18], 1
xor eax, eax
cmp esi, 0xffffffff
mov byte [ebx + 0x13], 0
setne dl
mov dword [ebx + 0xc], eax
and edx, 1
mov byte [ebx + 0x10], 0
mov byte [ebp - 9], dl
cmp byte [ebp - 9], 0
je 0x40c84c
mov dword [ebx + 4], esi
test edi, edi
je 0x40c841
lea eax, [ebx + 0x416]
mov edx, edi
call fcn.0040dfb0
lea eax, [ebx + 0x15]
mov edx, dword [ebp - 4]
call fcn.0040d908
mov al, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40c9b8
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0xc], 0
jne 0x40c9c7
cmp byte [ebx + 0x14], 0
jne 0x40c9cb
xor eax, eax
pop ebx
ret
cmp dword [ebx + 4], 0xffffffff
je 0x40c9d8
mov eax, ebx
call fcn.0040c94c
call fcn.00404e60
test eax, eax
je 0x40ca01
cmp word [ebx + 0x416], 0
je 0x40ca01
add ebx, 0x416
push ebx
call sub.KERNEL32.DLL_DeleteFileW
test eax, eax
setne al
and eax, 1
jmp 0x40ca12
add ebx, 0x15
push ebx
call sub.KERNEL32.DLL_DeleteFileA
test eax, eax
setne al
and eax, 1
pop ebx
ret
Function at 0x40ca14
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, ecx
test esi, esi
mov edi, eax
mov dword [esp], edx
je 0x40caf5
mov eax, dword [edi + 0xc]
test eax, eax
je 0x40ca4f
dec eax
je 0x40ca39
dec eax
je 0x40ca45
jmp 0x40ca4f
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
jmp 0x40ca4f
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0x40caa1
xor ebp, ebp
cmp esi, ebp
jle 0x40cabd
push 0
lea eax, [esp + 8]
push eax
mov edx, esi
sub edx, ebp
cmp edx, 0x4000
jge 0x40ca74
mov ecx, esi
sub ecx, ebp
jmp 0x40ca79
mov ecx, 0x4000
push ecx
mov eax, dword [esp + 0xc]
add eax, ebp
push eax
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne bl
and ebx, 1
test bl, bl
je 0x40cabd
add ebp, 0x4000
cmp esi, ebp
jg 0x40ca5b
jmp 0x40cabd
push 0
lea eax, [esp + 8]
push eax
push esi
push dword [esp + 0xc]
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne bl
and ebx, 1
test bl, bl
jne 0x40caf1
cmp dword [edi + 0xc], 0
jne 0x40caf1
lea ebp, [edi + 0x15]
mov eax, 0x41801c
mov edx, ebp
call fcn.0040b2e0
test al, al
jne 0x40ca4f
mov edx, ebp
mov eax, 0x41801c
call fcn.0040b2ac
jmp 0x40caf1
mov byte [edi + 8], 1
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40cbcc
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
push ecx
mov edi, edx
cmp dword [ebx + 0xc], 1
mov esi, ecx
jne 0x40cbf3
cmp esi, 0x4e20
jle 0x40cbe9
mov esi, 0x4e20
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebx + 4], eax
push 0
lea eax, [esp + 4]
push eax
push esi
push edi
push dword [ebx + 4]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x40cc44
mov eax, ebx
call fcn.0040cdfc
test al, al
je 0x40cc2b
cmp esi, 0x4e20
jle 0x40cc2b
mov ecx, 0x4e20
mov edx, edi
mov eax, ebx
call fcn.0040cbcc
jmp 0x40cc47
cmp dword [ebx + 0xc], 1
jne 0x40cc3f
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x6d
jne 0x40cc3f
xor eax, eax
jmp 0x40cc47
or eax, 0xffffffff
jmp 0x40cc47
mov eax, dword [esp]
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40deb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [0x412698], 0
jne 0x40dec9
call fcn.0040daa4
mov dword [0x412694], eax
inc byte [0x412698]
call fcn.0040daa4
sub eax, dword [0x412694]
cmp eax, 0x64
jle 0x40df05
cmp dword [0x412818], 0
je 0x40df00
mov eax, 0x41801c
mov edx, 0xff
call fcn.0040b414
mov eax, 0x41801c
mov edx, 0xff
call fcn.0040b40c
call fcn.004027c4
ret
Function at 0x410bb0
Capabilities:
Encode data using xor

Disassembly:
xor ebx, ebx
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x110]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004419d3
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x110]
push ecx
mov ecx, edi
mov edx, esi
mov dword [ebp - 0x110], ebx
call fcn.0057374b
test eax, eax
je 0x40e500
mov dword [ebp - 0x110], ebx
jmp 0x431440
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 4
push 0x3000
jmp 0x5738b0
jmp 0x40e500
xor eax, eax
lea ecx, [eax + 1]
imul ecx, ecx, 0x312e
xor cx, word [eax*2 + 0x59d2b0]
inc eax
mov word [ebp + eax*2 - 0x10e], cx
cmp eax, 6
jl 0x482b0c
push 0
push 0
lea edx, [ebp - 0x10c]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esi]
mov dword [ebp - 0x110], eax
test ebx, ebx
je 0x40e4fe
mov dword [ebp - 0x110], 0
jmp 0x40e4fe
push 0x1000
xor ebx, ebx
push ebx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x110], ebx
mov dword [edi], eax
cmp byte [0x6a6414], bl
je 0x40e526
mov eax, esi
cdq
cmp eax, 0xffffffff
jne 0x5738f2
cmp edx, ebx
jne 0x5738f2
or eax, eax
or edx, 0xffffffff
push edi
lea esi, [edi + 0x10]
push esi
push edx
push eax
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.005573d0
cmp dword [esi + 4], 0
mov ebx, eax
je 0x482b42
jmp 0x482b0a

Function at 0x42ee78
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x6a6654]
push edi
test esi, esi
jne 0x4979db
mov dword [0x6a6654], 0x100
xor edi, edi
jmp 0x42ee9c
mov esi, dword [sym.imp.msvcrt.dll_rand]
call esi
mov word [edi*4 + 0x6a6688], ax
call esi
mov esi, dword [0x6a6654]
jmp 0x4979ca
mov word [edi*4 + 0x6a668a], ax
inc edi
cmp edi, esi
jb 0x42ee9c
xor ecx, ecx
xor edx, edx
mov eax, ecx
div esi
inc ecx
mov edi, edx
xor edx, edx
div esi
mov eax, esi
sub eax, edx
mov edx, dword [eax*4 + 0x6a6684]
xor edx, dword [edi*4 + 0x6a6688]
xor edx, dword [ebx + ecx*4 - 4]
xor edx, dword [ebp + 8]
mov dword [ebx + ecx*4 - 4], edx
cmp ecx, 0x400
jb 0x4979dd
pop edi
pop esi
pop ebp
ret
Function at 0x43cda3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x33c
jmp 0x449c22
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x328], eax
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push edi
mov dword [ebp - 0x338], eax
mov dword [ebp - 0x324], ecx
mov dword [ebp - 0x330], 0x1000
cmp eax, ecx
je 0x449c65
mov byte [eax], cl
mov byte [eax + 0xff], cl
lea ebx, [ebp - 0x330]
lea edi, [ebp - 0x324]
call fcn.0050a2f7
xor ebx, ebx
mov dword [ebp - 0x1c], 0x68
jmp 0x51be1e
mov dword [ebp - 0x18], 0xb800
mov dword [ebp - 0x14], 0xd0ff0000
mov dword [ebp - 0x10], 0x589
mov dword [ebp - 0xc], 0x4c20000
mov byte [ebp - 8], bl
xor eax, eax
lea ecx, [eax + 1]
imul ecx, ecx, 0x18cd
xor cx, word [eax*2 + 0x59d5c0]
inc eax
mov word [ebp + eax*2 - 0x222], cx
cmp eax, 7
jl 0x51be3f
lea edx, [ebp - 0x220]
jmp 0x55a184
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x334], eax
xor eax, eax
lea ecx, [eax + 1]
imul ecx, ecx, 0x6f35
xor cx, word [eax*2 + 0x59d5d0]
inc eax
mov word [ebp + eax*2 - 0x222], cx
cmp eax, 7
jl 0x55a193
jmp dword [0x55a1be]
Function at 0x43e982
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx edx, ax
sub edx, dword [esi + 0x10]
mov eax, dword [esi + 0x1c]
lea ecx, [eax + edx*4]
mov esi, dword [ecx + edi]
mov eax, dword [ebx + edi + 0x78]
cmp esi, eax
jb 0x4df2e7
jmp 0x50f1ba
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004419d3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x414]
cmp ecx, 0xffffffff
je 0x43bfac
cmp dword [ebp + 0x10], 0
movzx eax, word [ebp + 0x14]
je 0x433955
jmp dword [0x43bfe5]
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ebx, dword [edi + 0x3c]
mov esi, dword [ebx + edi + 0x78]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp + 0xc]
add esi, edi
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x420], edx
test edx, edx
je 0x4fb8c5
jmp 0x4fb8b4
jl 0x4af105
lea edx, [ebp - 0x10c]
push edx
lea eax, [ebp - 0x30c]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.msvcrt.dll_sprintf]
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
add esp, 0xc
push edx
mov edx, dword [ebp - 0x418]
push ebx
push eax
push edi
lea ecx, [ebp - 0x20c]
push ecx
push edx
call fcn.004df31b
add esp, 0x18
mov esi, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
jmp 0x4df2dc
inc eax
test cl, cl
jne 0x50f1e8
lea ecx, [ebp - 0x40c]
push ecx
lea edx, [ebp - 0x10c]
mov eax, 0x2e
push edx
mov word [ebp - 0x40c], ax
call dword [sym.imp.msvcrt.dll_strstr]
mov edi, eax
add esp, 8
test edi, edi
je 0x4df308
mov byte [edi], 0
inc edi
xor eax, eax
lea ecx, [ecx]
lea ecx, [eax + 1]
imul ecx, ecx, 0x619
xor cx, word [eax*2 + 0x59d2ec]
inc eax
mov word [ebp + eax*2 - 0x30e], cx
cmp eax, 4
jmp 0x4439f6
xor ecx, ebp
call fcn.004419d3
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0x18], 0
jne 0x4df308
mov eax, dword [ebp - 0x41c]
mov ecx, dword [ebp - 0x418]
push eax
call fcn.0047ac15
add esp, 4
add esi, eax
mov ecx, dword [ebp - 8]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004419d3
mov esp, ebp
pop ebp
ret
je 0x4f5c4a
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4f5c51
add eax, 2
add ecx, 2
test dl, dl
jne 0x4fb8ff
xor eax, eax
jmp 0x4f5c56
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x43bfbf
mov eax, dword [ebp - 0x414]
add dword [ebp - 0x410], 4
inc eax
mov dword [ebp - 0x414], eax
cmp eax, dword [esi + 0x18]
jmp dword [0x4f5c7f]
sub edx, eax
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4fb8b7
xor ecx, ecx
cmp dword [ebp + 0x10], ecx
je 0x43bfce
mov dword [ebp - 0x414], ecx
cmp dword [esi + 0x18], ecx
jbe 0x43bfac
mov eax, dword [esi + 0x20]
add eax, edi
mov dword [ebp - 0x410], eax
jmp 0x4fb8f5
mov eax, dword [eax]
mov ecx, dword [ebp + 0x10]
add eax, edi
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4f5c51
test dl, dl
jmp 0x4f5c2a
mov edx, dword [ebx + edi + 0x7c]
add edx, eax
cmp esi, edx
ja 0x4df2e7
mov ebx, dword [ebp - 0x420]
test ebx, ebx
je 0x50f1dd
mov byte [ebx + 0xff], 1
lea eax, [esi + edi]
lea edx, [ebp - 0x10c]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
jmp 0x4af0c6
Function at 0x4410ef
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x59dc68
call fcn.004c98e5
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x8746dc
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x523a0f
cmp eax, esi
jne 0x41e6cd
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x523a12
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp dword [0x41e6e1]
push 0x40100a
call section..text
call 0x5813cb
jmp 0x41e687
cmp dword [ebp - 0x1c], ebx
jne 0x452431
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x8746e0], ebx
je 0x567936
push 0x8746e0
call fcn.0045075c
pop ecx
test eax, eax
je 0x567936
jmp 0x56792c
cmp dword [0x66106c], ebx
jne 0x4783d6
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
jmp dword [0x4783e3]
mov dword [0x66106c], esi
mov eax, dword [0x8746d8]
cmp eax, esi
jne 0x452420
push 0x59d164
push 0x59d15c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x8746d8], 2
jmp dword [0x4ff156]
xor esi, esi
inc esi
mov eax, dword [0x8746d8]
cmp eax, esi
jne 0x523a2c
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x4ff125
mov eax, dword [0x8746d8]
test eax, eax
jne 0x4ff11f
mov dword [0x8746d8], esi
push 0x59d174
push 0x59d168
call fcn.004419e7
pop ecx
pop ecx
test eax, eax
push 0x4ff108
ret
push ebx
push 2
push ebx
call dword [0x8746e0]
push dword [0x661054]
push dword [0x661058]
push dword [0x661050]
call fcn.004f7a28
add esp, 0xc
mov dword [0x661068], eax
cmp dword [0x66105c], ebx
jne 0x4783c4
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret

Function at 0x445300
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
push edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jmp 0x450728
jbe 0x450755
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x450749
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x450757
inc edx
add eax, 0x28
cmp edx, esi
jb 0x450731
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x476b96
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 8], 0
mov eax, dword [0x6a653c]
push ebx
mov bl, byte [ebp + 0xc]
push esi
push edi
mov edi, ecx
jmp 0x4871da
mov esi, edx
mov dword [ebp - 0x5c], eax
je 0x505198
call dword [sym.imp.msvcrt.dll_rand]
mov ecx, 0xbb8
cdq
idiv ecx
mov dword [ebp - 0x50], 0xc
mov dword [ebp - 0xc], edi
mov byte [ebp - 0x54], 1
mov byte [ebp - 0x53], bl
mov word [ebp - 0x58], dx
mov edx, ecx
sub edx, dword [ebp - 0x58]
xor ecx, ecx
mov word [ebp - 0x56], dx
lea ebx, [ebx]
jmp 0x4b2378
mov eax, ecx
and eax, 0x80000001
jns 0x4b238a
dec eax
or eax, 0xfffffffe
inc eax
je 0x4b239b
mov al, bl
not al
imul cl
jmp 0x4b23a5
mov al, cl
imul bl
mov dl, al
add dl, dl
add al, dl
xor byte [ebp + ecx - 0x52], al
inc ecx
cmp ecx, 0x4a
jl 0x4b2378
mov ecx, dword [ebp - 0x5c]
push 0
push 0x50
lea eax, [ebp - 0x58]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
cmp byte [ebp - 0x54], 0
je 0x505198
jmp 0x4f0eea
mov dl, byte [ebp - 0x53]
xor ecx, ecx
lea esp, [esp]
mov eax, ecx
and eax, 0x80000001
jns 0x4f0f08
dec eax
or eax, 0xfffffffe
inc eax
je 0x4f0f19
mov al, dl
not al
imul cl
jmp 0x4f0f26
mov al, cl
imul dl
mov bl, al
add bl, bl
add al, bl
mov bl, byte [ebp + 0xc]
xor byte [ebp + ecx - 0x52], al
inc ecx
cmp ecx, 0x4a
jl 0x4f0ef6
jmp 0x505198
test esi, esi
je 0x5051bc
mov dl, bl
call fcn.004618ec
mov ecx, dword [ebp - 0x5c]
push 0
push edi
push esi
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov dl, bl
call fcn.004618ec
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004419d3
mov esp, ebp
pop ebp
ret

Function at 0x47e445
Capabilities:
Create tcp socket
Create udp socket
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 1
push 2
mov esi, ecx
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x6a653c], eax
cmp eax, 0xffffffff
jne 0x4f582d
xor eax, eax
nop
lea ecx, [eax + 1]
jmp dword [0x47e483]
xor eax, eax
lea esp, [esp]
lea ecx, [eax + 1]
imul ecx, ecx, 0x973
xor cx, word [eax*2 + 0x59dabc]
inc eax
mov word [ebp + eax*2 - 0x11a], cx
cmp eax, 5
jl 0x4f5836
lea edx, [ebp - 0x118]
push edx
jmp dword [0x4f586a]

Function at 0x4f480c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
test edi, edi
jle 0x586a7a
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov edx, eax
sub esi, eax
lea ebx, [ecx + 1]
imul ebx, dword [ebp + 8]
xor bx, word [esi + edx]
inc ecx
mov word [edx], bx
add edx, 2
cmp ecx, edi
jl 0x4f4822
jmp 0x586a78
pop esi
pop ebx
pop ebp
ret 8