joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471180
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b26f8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4ed0f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
or esi, 0xffffffff
mov dword [ebp - 4], 0
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocStringLen
push dword [ebp + 8]
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, esi
je 0x471239
push edi
push edi
push edi
push 2
push edi
mov esi, ebx
push ebx
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
je 0x471239
push 0
push 0
push 0
push 4
mov edi, eax
push eax
mov dword [ebp - 0x18], edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp + 8], eax
test eax, eax
je 0x471239
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
push eax
push ebx
call fcn.00470f20
mov eax, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov byte [ebp + 0xb], 1
test eax, eax
je 0x47123d
push ebx
call eax
jmp 0x47123d
mov byte [ebp + 0xb], 0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x47124e
test ebx, ebx
je 0x47124e
push edi
call ebx
cmp esi, 0xffffffff
je 0x47125a
test ebx, ebx
je 0x47125a
push esi
call ebx
mov al, byte [ebp + 0xb]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x48c346
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0047d1b2
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x48c37e
xor eax, eax
jmp 0x48c3aa
cmp esi, dword [ebp - 4]
je 0x48c3a7
cmp dword [ebp + 0xc], 0
je 0x48c3a7
push dword [edi + 0x9c]
call fcn.0048bf54
push dword [edi + 0x9c]
mov esi, eax
call fcn.00473c34
pop ecx
pop ecx
cmp esi, eax
je 0x48c37a
xor eax, eax
inc eax
pop edi
pop esi
leave
Function at 0x4062e2
Capabilities:
Get number of processors
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or eax, 0xec65
or eax, 0x19
call 0x4062e2
add byte [edi], bh
aaa
dec edi
xor eax, dword [ecx + 0x40]
inc ecx
xor dh, byte [edi]
cmp dword [ebx - 0x74a7fb3c], eax
test dword [eax], esi
cmc
invalid
Function at 0x407120
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push eax
xor eax, 0x117ec
sub eax, 0x596a
jmp 0x40713a
sub eax, 0x15998
pop eax
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0x50c], eax
mov ecx, dword [ebp - 0x50c]
cmp ecx, dword [ebp - 0xca8]
je 0x40716d
mov edx, dword [ebp - 0x50c]
cmp dword [edx + 0x30], 0
jne 0x406f23
mov dword [ebp - 0x754], 0
Function at 0x407c40
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add ch, bl
add eax, 0xffff3fe9
call dword [eax - 0x7f]
call 0x4138fe
add eax, 0x117c4
rol ah, 0x17
add dword [eax], eax
pop eax
push ebx
push eax
add esp, 4
and ebx, 0x441a
call 0x407c40
add byte [eax + 0x36], dl
inc edi
aaa
inc ebp
dec edi
cmp al, 0x42
push eax
add esp, 4
or ebx, 0xf4a4
pop ebx
mov edx, dword [ebp - 0x770]
add edx, dword [ebp - 0x198]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x198]
movsx edx, byte [ebp + ecx - 0x87c]
cmp eax, edx
jne 0x407c77
mov dword [ebp - 0xcbc], 0
jmp 0x407ce6
push ecx
push ecx
add esp, 4
add ecx, 0x2bbd
sub ecx, 0x3d8a
sub ecx, 0x24a
or ecx, 0x4362
pop ecx
push edx
xor edx, 0x14c13
and edx, 0x23f5
sub edx, 0x11844
pop edx
mov eax, dword [ebp - 0x770]
add eax, dword [ebp - 0x198]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x198]
movsx eax, byte [ebp + edx - 0x87c]
or eax, 0x20
cmp ecx, eax
jge 0x407cdc
mov dword [ebp - 0xcbc], 0xffffffff
jmp 0x407ce6
mov dword [ebp - 0xcbc], 1
cmp dword [ebp - 0xcbc], 0
jne 0x407cfd
mov ecx, dword [ebp - 0x1d48]
mov dword [ebp - 0x514], ecx
jmp 0x407d0e
jmp 0x407ae7

Function at 0x407d36
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push dword [ebp + 0x11]
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0x7a0], eax
push edx
and edx, 0x167a6
pop edx
push edi
push ebx
add esp, 4
call 0x407d36
add byte [edx + 0x37], al
xor ecx, dword [ebp + 0x4b]
cmp al, byte [eax + 0x3b]
dec eax
add esp, 4
jmp 0x407d3f
and edi, 0x861f
xor edi, 0x9d9
pop edi
mov ecx, dword [ebp - 0x3e4]
add ecx, 0xe
mov dword [ebp - 0x1a10], ecx
push edi
xor edi, 0x14fff
or edi, 0xfdfa
pop edi
push ebx
push ebx
add esp, 4
jmp 0x407d77
and ebx, 0x175bf
jmp 0x407d86
or ebx, 0x1e8f
pop ebx
cmp dword [ebp - 0x3e4], 0
je 0x407d9f
cmp dword [ebp - 0xac4], 0
jne 0x407de5
push esi
sub esi, 0x4f48
pop esi
push ecx
jmp 0x407db1
add ecx, 0xc7e
jmp 0x407dbf
pop ecx
push ecx
push ecx
add esp, 4
xor ecx, 0x2404
jmp 0x407dd0
pop ecx
mov edx, dword [ebp - 0x7a0]
mov dword [ebp - 0x19c4], edx
push 0
call dword [ebp - 0x19c4]
mov dword [ebp - 0x20dc], 0xa
push edi
Function at 0x421b00
Capabilities:
Encode data using xor

Disassembly:
sti
pop es
pop es
outsb dx, byte [esi]
xchg ecx, eax
lea eax, [esi + eax]
pop es
pop es
pop ecx
pop edi
mov ecx, esp
or al, 0x89
sal edx, 1
add al, 8
or byte [ecx + 0x97052f9], cl
or byte [ecx + 0x89923c9], cl
or byte [ecx + 0x5e], ah
mov esi, ebp
jl 0x421b35
or byte [eax], cl
or al, 0x48
inc eax
push eax
cmp al, 0x89
into
mov ah, 0x32
or dword [eax], ecx
mov esi, edx
lodsb al, byte [esi]
imul ecx, dword [ecx], 0xbf176608
xchg ebp, eax
add al, 6
pop es
pop es
invalid
Function at 0x426300
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov eax, dword [ebx + 4]
cmp eax, 0x100
jb 0x42631c
cmp eax, 0x109
jbe 0x42632a
add eax, 0xfffffe00
cmp eax, 0xe
ja 0x4263aa
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, eax
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x4263aa
cmp dword [ebx + 4], 0x100
jne 0x42636a
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x42636a
mov eax, dword [ebx + 8]
cmp eax, 0x4f
je 0x42639e
cmp eax, 0x4e
je 0x42639e
cmp eax, 0x4c
je 0x42639e
push esi
call dword [sym.imp.USER32.dll_GetParent]
cmp eax, dword [edi + 4]
je 0x42638b
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetParent]
cmp eax, dword [edi + 4]
jne 0x426376
push ebx
push 0
push 0x37f
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4263aa
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 4
Function at 0x402fa0
Capabilities:
Accept command line arguments
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call 0x403010
mov dword [esp], eax
call sub.ucrtbase.dll_exit
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x4030ab
cmp ax, 9
je 0x403098
cmp ax, 0x20
je 0x403098
mov dword [ebp - 0x6c], 0
xor edi, edi
lea esi, [esi]
cmp ax, 0x5c
je 0x403100
cmp ax, 0x22
je 0x403110
mov dword [ebp - 0x6c], 0
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x4030ab
cmp ax, 9
sete cl
cmp ax, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x403050
test edi, 1
jne 0x403050
lea esi, [esi]
movzx eax, word [ebx + 2]
add ebx, 2
cmp ax, 9
je 0x403098
cmp ax, 0x20
je 0x403098
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x30], 1
je 0x403128
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00402290
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
add dword [ebp - 0x6c], 1
jmp 0x40306b
and dword [ebp - 0x6c], 1
jne 0x403064
xor edi, 1
jmp 0x40306b
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
jmp 0x4030c4
Function at 0x403010
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call 0x403010
mov dword [esp], eax
call sub.ucrtbase.dll_exit
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x4030ab
cmp ax, 9
je 0x403098
cmp ax, 0x20
je 0x403098
mov dword [ebp - 0x6c], 0
xor edi, edi
lea esi, [esi]
cmp ax, 0x5c
je 0x403100
cmp ax, 0x22
je 0x403110
mov dword [ebp - 0x6c], 0
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x4030ab
cmp ax, 9
sete cl
cmp ax, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x403050
test edi, 1
jne 0x403050
lea esi, [esi]
movzx eax, word [ebx + 2]
add ebx, 2
cmp ax, 9
je 0x403098
cmp ax, 0x20
je 0x403098
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x30], 1
je 0x403128
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00402290
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
add dword [ebp - 0x6c], 1
jmp 0x40306b
and dword [ebp - 0x6c], 1
jne 0x403064
xor edi, 1
jmp 0x40306b
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
jmp 0x4030c4
Function at 0x402f08
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x42d008], 0x8088405
inc edx
mov dword [ebx + 0x42d008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x407684
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x407714
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x407714
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x4076c7
test edx, 3
jne 0x4076b6
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x4076c1
jmp 0x4076c7
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x4076c7
cmp dword [ecx - 8], 1
je 0x4076d1
mov edx, ebx
or edx, 3
call fcn.00404bcc
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x7b7b7b7b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x4076e3
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.004044dc

Function at 0x407720
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x4077b0
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x4077b0
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x407763
test edx, 3
jne 0x407752
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x40775d
jmp 0x407763
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x407763
cmp dword [ecx - 8], 1
je 0x40776d
mov edx, ebx
or edx, 3
call fcn.00404bcc
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x5b5b5b5b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x40777f
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.004044dc
Function at 0x41eb64
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x41eb83
add edx, 3
sar edx, 2
test edx, edx
jle 0x41ec91
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x41ebb8
je 0x41ebfb
sub ecx, 0x2b
je 0x41ebf1
sub ecx, 4
je 0x41ebf6
dec ecx
sub ecx, 0xa
jb 0x41ebe3
jmp 0x41ebfe
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x41ebca
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x41ebd5
jmp 0x41ebfe
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x41ebfe
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x41ebfe
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x41ebfe
mov byte [eax], 0x3e
jmp 0x41ebfe
mov byte [eax], 0x3f
jmp 0x41ebfe
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x41eb9b
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x41ec4f
cmp byte [esp + 7], 0xff
jne 0x41ec4f
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x41ec86
cmp dl, 0xff
je 0x41ec86
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x41eb92
add esp, 0x10
pop ebp
pop edi
pop esi
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0x408937
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov ebx, 0x4085d8
and ecx, edi
call fcn.00408968
sub esp, 4
mov dword [esp], ecx
pop ecx
xor dword [eax], ebx
mov edi, 0xbe545aa7
add edi, 1
inc eax
cmp eax, edx
jne fcn.00408937
inc edi
sub edi, ecx
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x100b35f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x100b94cc]
cmp dword [eax + 0x28], 0
jne 0x100b3608
xor eax, eax
jmp 0x100b3737
mov ecx, dword [0x100b943c]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, 0xe
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [0x100b9430], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [0x100b942c], eax
push 0
call dword [0x100b7138]
mov dword [ebp - 0x10], eax
push 1
call dword [0x100b7138]
mov dword [ebp - 0x18], eax
mov ecx, dword [0x100b9430]
mov dword [ebp - 0x40], ecx
mov edx, dword [0x100b942c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x40]
shr eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 8]
shr ecx, 1
mov dword [ebp - 0x1c], ecx
push 0
mov edx, dword [0x100b94b8]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0x80000000
push 0x100b7680
push 0x100b76d0
push 0x88
call dword [0x100b7134]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [0x100b9428], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [0x100b710c]
push eax
call fcn.100b3530
push 5
mov eax, dword [ebp - 0xc]
push eax
call dword [0x100b7148]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [0x100b712c]
push 0x100b35c0
mov edx, dword [0x100b94cc]
mov eax, dword [edx + 0x34]
imul eax, eax, 0x3e8
push eax
push 0
push 0
call dword [0x100b713c]
mov dword [0x100b9434], eax
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
call dword [0x100b7130]
test eax, eax
je 0x100b3737
cmp dword [ebp - 0x38], 0x12
jne 0x100b372b
mov dword [0x100b9444], 0
call fcn.100b3740
xor eax, eax
jmp 0x100b3737
lea edx, [ebp - 0x3c]
push edx
call dword [0x100b7140]
jmp 0x100b36fc
mov esp, ebp
pop ebp
ret 4

Function at 0x100b4b00
Capabilities:
Read .ini file
Read and send data from client to server
Send data
Send data on socket
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebp
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
pop ebp
mov eax, dword [ebp + 8]
push eax
call dword [fcn.100b70dc]
call dword [fcn.100b7124]
call dword [fcn.100b7128]
call dword [fcn.100b7094]
call dword [fcn.100b70fc]
call dword [fcn.100b70f4]
call dword [fcn.100b7150]
call dword [fcn.100b700c]
call dword [fcn.100b7000]
call dword [fcn.100b7160]
call fcn.100b6644
mov eax, 1
pop ebp
ret 4