joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b460
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x458778]
jne 0x42b46a
repz ret
jmp fcn.0043443c

Function at 0x43ce57
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00431245
xor ebx, ebx
cmp dword [0x45c738], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x43cf2c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x43ce97
xor eax, eax
jmp 0x43cff0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x44c088
push edi
call esi
cmp eax, ebx
je 0x43ce90
push eax
call fcn.004311e2
mov dword [esp], 0x44c078
push edi
mov dword [0x45c738], eax
call esi
push eax
call fcn.004311e2
mov dword [esp], 0x44c064
push edi
mov dword [0x45c73c], eax
call esi
push eax
call fcn.004311e2
mov dword [0x45c740], eax
lea eax, [ebp - 8]
push eax
call fcn.0042c3b4
test eax, eax
pop ecx
pop ecx
je 0x43cefa
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004317bc
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x43cf2c
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004311e2
cmp eax, ebx
pop ecx
mov dword [0x45c748], eax
je 0x43cf2c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004311e2
pop ecx
mov dword [0x45c744], eax
mov eax, dword [0x45c744]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x43cfa5
cmp dword [0x45c748], esi
je 0x43cfa5
push eax
call fcn.0043124e
pop ecx
call eax
cmp eax, ebx
je 0x43cf72
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x45c748]
call fcn.0043124e
pop ecx
call eax
test eax, eax
je 0x43cf72
test byte [ebp - 0x18], 1
jne 0x43cfa5
lea eax, [ebp - 0xc]
push eax
call fcn.0042c3eb
test eax, eax
pop ecx
je 0x43cf8d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004317bc
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x43cf9c
or dword [ebp + 0x10], 0x200000
jmp 0x43cfd6
or dword [ebp + 0x10], 0x40000
jmp 0x43cfd6
mov eax, dword [0x45c73c]
cmp eax, esi
je 0x43cfd6
push eax
call fcn.0043124e
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x43cfd6
mov eax, dword [0x45c740]
cmp eax, esi
je 0x43cfd6
push dword [ebp - 4]
push eax
call fcn.0043124e
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x45c738]
call fcn.0043124e
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x440ab8
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x458778]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00440a4d
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0042b470
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x440b07
cmp dword [ebp - 0x1c], 5
jb 0x440b1f
jmp 0x440b1b
cmp dword [ebp - 0x10], 1
jne 0x440b1f
cmp dword [ebp - 0x1c], 4
ja 0x440b1b
jne 0x440b1f
cmp dword [ebp - 0x18], 0
jbe 0x440b1f
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x44c90c
call fcn.00440921
test eax, eax
jge 0x440b40
mov byte [0x459e4c], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0042b460
add ebp, 0x78
leave
ret
Function at 0x3db2d5
Capabilities:
Encode data using base64

Disassembly:
push 0x18
mov eax, 0x4997a9
call fcn.00451205
mov dword [ebp - 0x20], edx
mov eax, ecx
mov dword [ebp - 0x1c], eax
xor ebx, ebx
mov dword [ebp - 0x24], ebx
call fcn.003d9b08
mov eax, dword [ebp + 8]
mov edi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], 1
test eax, eax
je 0x3db446
push 3
pop esi
mov ecx, dword [ebp - 0x20]
dec eax
mov dword [ebp + 8], eax
mov al, byte [ecx]
mov byte [ebp + edi - 0x14], al
inc edi
mov dl, byte [ebp - 0x13]
inc ecx
mov dword [ebp - 0x20], ecx
mov ch, byte [ebp - 0x12]
mov cl, byte [ebp - 0x14]
mov byte [ebp - 0xf], ch
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xe], cl
cmp edi, esi
jne 0x3db39a
mov esi, dword [ebp - 0x1c]
mov al, cl
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov edi, ebx
shl cl, 4
mov al, dl
shr al, 4
add cl, al
mov al, ch
mov byte [ebp - 0x17], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, ch
and al, 0x3f
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], al
movzx eax, byte [ebp + edi - 0x18]
mov ecx, 0x4be24c
push eax
call fcn.003db5f9
mov ecx, esi
movzx eax, byte [eax]
push eax
call fcn.003db5e8
inc edi
cmp edi, 4
jl 0x3db36b
mov dl, byte [ebp - 0xd]
mov edi, ebx
mov cl, byte [ebp - 0xe]
mov ch, byte [ebp - 0xf]
push 3
pop esi
mov eax, dword [ebp + 8]
test eax, eax
jne 0x3db30d
mov dword [ebp + 8], edi
test edi, edi
je 0x3db446
mov eax, edi
cmp edi, esi
jge 0x3db3d0
cmp eax, esi
jae 0x3db44f
mov byte [ebp + eax - 0x14], bl
inc eax
cmp eax, esi
jl 0x3db3b8
mov ch, byte [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, dl
shr al, 4
and dl, 0xf
shl cl, 4
add cl, al
shl dl, 2
mov al, ch
mov byte [ebp - 0x17], cl
shr al, 6
and ch, 0x3f
add dl, al
mov byte [ebp - 0x15], ch
lea eax, [edi + 1]
mov byte [ebp - 0x16], dl
mov dword [ebp - 0x20], eax
test eax, eax
jle 0x3db433
mov esi, dword [ebp - 0x1c]
mov edi, eax
movzx eax, byte [ebp + ebx - 0x18]
mov ecx, 0x4be24c
push eax
call fcn.003db5f9
mov ecx, esi
movzx eax, byte [eax]
push eax
call fcn.003db5e8
inc ebx
cmp ebx, edi
jl 0x3db40d
mov edi, dword [ebp + 8]
push 3
pop esi
cmp edi, esi
jge 0x3db446
sub esi, edi
mov ecx, dword [ebp - 0x1c]
push 0x3d
call fcn.003db5e8
dec esi
jne 0x3db439
mov eax, dword [ebp - 0x1c]
call fcn.004511d3
ret
call fcn.0044efd3
int3
Function at 0x3ef15f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
lea edx, [ebp - 1]
push edi
push 1
mov eax, dword [esi + 0x640]
dec eax
cmp dword [esi + 0x644], eax
jne 0x3ef186
mov byte [ebp - 1], 0x86
call fcn.003ef0a4
jmp 0x3ef1ad
mov byte [ebp - 1], 6
mov byte [ebp - 2], 0x80
call fcn.003ef0a4
mov eax, dword [esi + 0x640]
lea edx, [ebp - 2]
dec eax
mov ecx, esi
push 1
mov dword [esi + 0x644], eax
call fcn.003ef0a4
pop ecx
xor edi, edi
pop ecx
cmp dword [esi + 0x640], edi
jbe 0x3ef1d8
mov eax, dword [esi + 0x648]
lea edx, [edi + esi]
mov ecx, dword [esi + 0x640]
xor eax, edi
inc edi
mov al, byte [eax + esi]
mov byte [edx + ecx], al
cmp edi, dword [esi + 0x640]
jb 0x3ef1b8
mov eax, dword [esi + 0x640]
pop edi
add eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x3f7a58
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ecx + 8]
mov eax, edx
push edi
mov edi, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 4], eax
test edi, edi
jle 0x3f7a8a
push ebx
mov ebx, dword [ecx]
mov al, byte [edx + eax]
xor byte [ebx + esi], al
inc esi
xor eax, eax
cmp esi, dword [ecx + 4]
cmovge esi, eax
mov eax, dword [ebp - 4]
inc edx
cmp edx, edi
jl 0x3f7a72
pop ebx
add dword [ecx + 0xc], edi
pop edi
mov dword [ecx + 8], esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x409341
Capabilities:
Terminate process

Disassembly:
push esi
push edx
push 0x35
pop edx
mov esi, ecx
call fcn.0040917e
mov eax, dword [esi + 0xc]
pop ecx
mov byte [eax + 0x13], 0
mov eax, dword [esi + 0xc]
pop esi
and dword [eax + 0x1c], 0
ret

Function at 0x4136a5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.003f3d13

Function at 0x4169a5
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
xor esi, esi
mov dword [ebp - 4], ebx
push edi
mov ecx, dword [ebx]
mov dword [ebp - 8], ecx
test edx, edx
je 0x416a8a
test dword [edx + 4], 0x200
movzx eax, byte [edx]
jne 0x416a87
cmp eax, 0x25
je 0x416a7c
cmp eax, 0x9c
je 0x416a7c
cmp eax, 0x5e
je 0x416ac9
cmp eax, 0x9d
jne 0x416a00
cmp byte [edx + 0x26], 0x5e
je 0x416ac9
cmp eax, 0x9a
je 0x416a1a
cmp eax, 0x98
je 0x416a1a
cmp eax, 0x9d
je 0x416a1a
cmp eax, 0x3d
jne 0x416a23
cmp dword [edx + 0x2c], esi
jne 0x416aa3
test dword [edx + 4], 0x100
je 0x416a87
mov eax, dword [edx + 0xc]
test eax, eax
je 0x416a40
test dword [eax + 4], 0x100
je 0x416a40
mov edx, eax
jmp 0x416a7f
mov ecx, dword [edx + 0x14]
mov ebx, dword [edx + 0x10]
test ecx, ecx
je 0x416a78
test dword [edx + 4], 0x800
jne 0x416a78
mov edx, esi
cmp dword [ecx], edx
jle 0x416a78
lea edi, [ecx + 8]
mov eax, dword [edi]
test dword [eax + 4], 0x100
jne 0x416a71
inc edx
add edi, 0x18
cmp edx, dword [ecx]
jl 0x416a5c
jmp 0x416a78
imul eax, edx, 0x18
mov ebx, dword [eax + ecx + 8]
mov edx, ebx
jmp 0x416a7f
mov edx, dword [edx + 0xc]
test edx, edx
jne 0x4169c2
mov ebx, dword [ebp - 4]
mov edx, esi
mov ecx, ebx
call fcn.00421ed2
xor ecx, ecx
test eax, eax
pop edi
cmovne esi, ecx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movsx edi, word [edx + 0x20]
test edi, edi
js 0x416a87
mov eax, dword [edx + 0x2c]
add edi, edi
mov ecx, dword [ebp - 8]
push esi
mov eax, dword [eax + 4]
mov dl, byte [ecx + 0x42]
push dword [eax + edi*8 + 8]
call fcn.00421f8c
pop ecx
pop ecx
mov esi, eax
jmp 0x416a87
mov eax, dword [ebp - 8]
push dword [edx + 8]
mov ebx, dword [ebp - 4]
mov ecx, ebx
push esi
mov dl, byte [eax + 0x42]
call fcn.00421e46
pop ecx
pop ecx
mov esi, eax
jmp 0x416a8a

Function at 0x41829e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, edx
mov ebx, ecx
push 0
push 0x38
pop edx
call fcn.00409192
push edi
push 0x25
pop edx
mov ecx, ebx
call fcn.0040917e
add esp, 0xc
mov ecx, ebx
mov esi, eax
push dword [ebp + 8]
push 0
push edi
push 0x60
pop edx
call fcn.0040910e
add esp, 0xc
mov edx, 0x80
mov ecx, ebx
call fcn.0040962b
mov edx, esi
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.00409643
Function at 0x41d1b5
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
mov dword [ebp - 0xc], edi
cmp dword [esi + 0x24], 0
mov ebx, dword [esi]
jne 0x41d2d5
push 0x20
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.0044ab50
mov edx, dword [ebp + 0x10]
lea ecx, [ebp - 0x2c]
add esp, 0xc
mov dword [ebp - 0x2c], esi
call fcn.0041ccfa
test eax, eax
jne 0x41d2d5
mov edx, dword [ebp + 0x14]
lea ecx, [ebp - 0x2c]
call fcn.0041ccfa
test eax, eax
jne 0x41d2d5
mov edx, dword [ebp + 0x18]
lea ecx, [ebp - 0x2c]
call fcn.0041ccfa
test eax, eax
jne 0x41d2d5
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x41d249
cmp byte [eax], 0x61
jne 0x41d22e
mov eax, dword [eax + 8]
jmp 0x41d230
xor eax, eax
push 0
push 0
push eax
mov edx, edi
mov ecx, esi
call fcn.0041d74f
add esp, 0xc
test eax, eax
jne 0x41d2d5
mov ecx, esi
call fcn.0042df3f
push 4
pop edx
mov ecx, esi
mov dword [ebp - 8], eax
call fcn.0041b45d
mov edx, dword [ebp + 0x10]
mov edi, eax
push edi
mov ecx, esi
call fcn.0041a4a0
mov edx, dword [ebp + 0x14]
pop ecx
lea ecx, [edi + 1]
push ecx
mov ecx, esi
call fcn.0041a4a0
mov edx, dword [ebp + 0x18]
lea eax, [edi + 2]
pop ecx
push eax
mov ecx, esi
call fcn.0041a4a0
cmp dword [ebp - 8], 0
pop ecx
je 0x41d2d5
mov esi, dword [ebp + 8]
lea eax, [edi + 3]
push 0xfffffffffffffff8
push esi
push eax
movsx eax, byte [esi]
mov edx, 0xa2
sub edi, eax
add edi, 3
push edi
mov edi, dword [ebp - 8]
mov ecx, edi
push 0
call fcn.00409258
movzx edx, byte [esi]
add esp, 0x14
mov ecx, edi
call fcn.0040962b
xor eax, eax
mov edx, 0x97
cmp dword [ebp - 0xc], 0x18
sete al
push eax
call fcn.0040917e
pop ecx
mov edx, dword [ebp + 0x10]
mov ecx, ebx
call fcn.004174e2
mov edx, dword [ebp + 0x14]
mov ecx, ebx
call fcn.004174e2
mov edx, dword [ebp + 0x18]
mov ecx, ebx
call fcn.004174e2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42df4e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
cmp dword [edi + 0xc], 0
jne 0x42e04f
call fcn.004196be
cmp dword [edi + 0x38], 0
je 0x42e04f
inc dword [ebx + 0x2c]
mov ecx, ebx
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 4], eax
mov dword [edi + 0xc], eax
call fcn.0042df3f
mov ecx, dword [edi + 0x38]
lea edx, [ebp - 0xc]
mov esi, eax
mov dword [ebp - 8], esi
call fcn.004180dc
push dword [ebp - 4]
test eax, eax
je 0x42dfe1
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
push esi
push 0x38
pop edx
call fcn.00409192
pop ecx
pop ecx
test esi, esi
jne 0x42dfc0
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.004091a7
jmp 0x42e00c
js 0x42e00c
mov eax, esi
cdq
push edx
push eax
call fcn.003f5577
pop ecx
pop ecx
cmp word [edi + 6], ax
jle 0x42e00c
or dword [edi + 8], 0x4000
mov word [edi + 6], ax
jmp 0x42e00c
mov edx, dword [edi + 0x38]
mov ecx, ebx
call fcn.0041a4a0
pop ecx
push dword [ebp - 4]
mov ecx, esi
push 0x11
pop edx
call fcn.0040917e
pop ecx
push dword [ebp + 8]
mov ecx, esi
push dword [ebp - 4]
push 0x16
pop edx
call fcn.00409192
pop ecx
pop ecx
cmp dword [edi + 0x3c], 0
je 0x42e04f
inc dword [ebx + 0x2c]
mov ecx, ebx
mov esi, dword [ebx + 0x2c]
mov dword [edi + 0x10], esi
inc dword [ebx + 0x2c]
mov edx, dword [edi + 0x3c]
push esi
call fcn.0041a4a0
pop ecx
mov ecx, dword [ebp - 8]
push esi
push 0x11
pop edx
call fcn.0040917e
pop ecx
mov ecx, dword [ebp - 8]
lea eax, [esi + 1]
push esi
push eax
push dword [ebp - 4]
mov edx, 0x93
call fcn.0040910e
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42e056
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, edx
mov edx, dword [edi + 0x30]
test edx, edx
je 0x42e073
push esi
call fcn.0042e056
pop ecx
jmp 0x42e075
xor eax, eax
test eax, eax
jne 0x42e091
mov ecx, dword [edi]
cmp esi, dword [ecx]
jge 0x42e091
imul edx, esi, 0x18
mov edx, dword [edx + ecx + 8]
mov ecx, ebx
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.004169a5
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4331ee
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [ebx + 0xc], 0
mov edi, ecx
jne 0x433244
and dword [ebp + 8], 0
lea eax, [ebp + 8]
mov edx, esi
shl edx, 4
add edx, dword [ebx + 4]
push eax
movzx eax, byte [edx + 0xd]
push eax
call fcn.003d3f49
movzx eax, byte [eax + 0x42]
push eax
call fcn.003d3f49
mov edx, dword [edx + 4]
mov ecx, eax
call fcn.00408e79
mov edx, dword [ebp + 8]
add esp, 0xc
test edx, edx
je 0x433244
push 0xfffffffffffffff5
mov ecx, edi
call fcn.004098c3
pop ecx
mov eax, dword [ebx + 4]
add esi, esi
cmp byte [eax + esi*8 + 0xd], 0x45
jne 0x43325e
push dword [ebp + 0xc]
mov ecx, edi
push 0x48
pop edx
call fcn.0040917e
pop ecx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x449172
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
mov edx, dword [ebp + 8]
mov ax, word [edx]
cmp ax, 0x5a4d
jne 0x4491a1
mov eax, dword [edx + 0x3c]
add edx, eax
mov eax, dword [edx]
cmp eax, 0x4550
jne 0x4491a1
add edx, 4
mov dword [ebp - 4], edx
popal
mov eax, dword [ebp - 4]
leave
ret 8
popal
sub eax, eax
leave
ret 8

Function at 0x449dff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ecx, 3
mov edx, 1
push ecx
push dword [ebp + 8]
call fcn.00449f04
rol eax, 8
push dword [ebp + 0xc]
push eax
call fcn.00449f20
push edx
push dword [ebp + 0x10]
push eax
call fcn.00449eec
inc edx
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00449f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00449ecb
push ecx
push dword [ebp + 8]
call fcn.00449f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00449f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00449ecb
push ecx
push dword [ebp + 8]
call fcn.00449f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00449f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00449ecb
push ecx
push dword [ebp + 8]
call fcn.00449f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00449f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00449ecb
cmp ecx, 0x2b
jne 0x449e0f
leave
ret 0xc

Function at 0x44b4b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov byte [ebp - 0x118], 0x42
mov byte [ebp - 0x117], 0x72
mov byte [ebp - 0x116], 0x75
mov byte [ebp - 0x115], 0x74
mov byte [ebp - 0x114], 0x65
mov byte [ebp - 0x113], 0x66
mov byte [ebp - 0x112], 0x6f
mov byte [ebp - 0x111], 0x72
mov byte [ebp - 0x110], 0x63
mov byte [ebp - 0x10f], 0x69
mov byte [ebp - 0x10e], 0x6e
mov byte [ebp - 0x10d], 0x67
mov byte [ebp - 0x10c], 0x20
mov byte [ebp - 0x10b], 0x4b
mov byte [ebp - 0x10a], 0x65
mov byte [ebp - 0x109], 0x79
mov byte [ebp - 0x108], 0
mov eax, 1
lea edi, [ebp - 0x14]
mov ecx, 0x10
mov al, 0
mov byte [edi], al
inc edi
dec ecx
jne 0x44b544
mov eax, dword [ebp + 8]
push 4
push 0x3000
push 0x3b380
push 0
call dword [eax + 0x20]
test eax, eax
je 0x44b5d6
mov dword [ebp - 4], eax
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, 0x3b380
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push 0x3b380
call fcn.0044b3fa
push 0x3b380
push dword [ebp + 0xc]
call fcn.004491a8
test eax, eax
jne 0x44b5b8
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov ecx, 0x3b380
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
call fcn.0044b5dd
test eax, eax
je 0x44b5d6
jmp 0x44b574
mov eax, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 4]
call dword [eax + 0x28]
test eax, eax
je 0x44b5d6
popal
mov eax, 1
leave
ret 8
popal
sub eax, eax
leave
ret 8
Function at 0x44b60b
Capabilities:
Terminate process

Disassembly:
call fcn.0044b618
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x496c38
Capabilities:
Create raw socket
Create tcp socket
Create udp socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov ebx, eax
lea ebp, [esp + 8]
mov eax, dword [ebx + 0x4c]
call fcn.00405abc
inc eax
je 0x496d3c
mov eax, dword [ebx + 0x4c]
call fcn.00405abc
inc eax
push eax
lea eax, [ebx + 0x48]
mov ecx, 1
mov edx, dword [0x496a2c]
call fcn.00405c70
add esp, 4
mov eax, dword [ebx + 0x4c]
call fcn.00405abc
mov edi, eax
test edi, edi
jl 0x496d3c
inc edi
xor esi, esi
push 0
push 3
push 2
call sub.wsock32.dll_socket
mov edx, dword [ebx + 0x48]
mov dword [edx + esi*4], eax
mov word [ebp], 2
push esi
call sub.wsock32.dll_htons
mov word [ebp + 2], ax
mov eax, dword [ebx + 0x4c]
mov eax, dword [eax + esi*4]
call fcn.00404a34
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp + 4], eax
push 0x10
push ebp
mov eax, dword [ebx + 0x48]
mov eax, dword [eax + esi*4]
push eax
call sub.wsock32.dll_bind
mov edx, eax
mov eax, ebx
call fcn.00497230
mov dword [esp], 1
xor eax, eax
mov dword [esp + 4], eax
push 0
push 0
lea eax, [esp + 0xc]
push eax
push 0x2c
lea eax, [esp + 0x28]
push eax
push 4
lea eax, [esp + 0x18]
push eax
push 0x98000001
mov eax, dword [ebx + 0x48]
mov eax, dword [eax + esi*4]
push eax
call dword [ebx + 0x6c]
mov edx, eax
mov eax, ebx
call fcn.00497230
push 0x21
lea eax, [esi + 0x4c8]
push eax
mov eax, dword [ebx + 0x34]
push eax
mov eax, dword [ebx + 0x48]
mov eax, dword [eax + esi*4]
push eax
call sub.wsock32.dll_WSAAsyncSelect
mov edx, eax
mov eax, ebx
call fcn.00497230
inc esi
dec edi
jne 0x496c89
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x499fe8
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a24
xor eax, eax
push ebp
push 0x49a05d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040461c
push 0x4401
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00404a34
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x164]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a064
lea eax, [ebp - 8]
mov edx, 2
call fcn.004045a8
ret
Function at 0x49a06c
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49a11e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea eax, [ebp - 0x1d4]
push eax
push 2
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x49a105
push 0x40
lea eax, [ebp - 0x44]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x44]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x49a0ca
call sub.wsock32.dll_WSACleanup
jmp 0x49a105
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x49a0f4
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x1d8]
call fcn.00404774
mov edx, dword [ebp - 0x1d8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
je 0x49a100
cmp ebx, 0x14
jl 0x49a0d1
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a125
lea eax, [ebp - 0x1d8]
call fcn.00404584
ret

Function at 0x49a12c
Capabilities:
Get hostname
Initialize winsock library

Disassembly:
push ebx
add esp, 0xfffffe0c
mov ebx, eax
lea eax, [esp + 0x64]
push eax
push 2
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x49a15f
push 0x64
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
call sub.wsock32.dll_WSACleanup
mov edx, ebx
mov eax, esp
call fcn.00409610
add esp, 0x1f4
pop ebx
ret

Function at 0x49a5c4
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe5c
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a24
xor eax, eax
push ebp
push 0x49a647
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1a4]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.00404a34
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x10], eax
push 2
push 4
lea eax, [ebp - 0x10]
push eax
call sub.wsock32.dll_gethostbyaddr
mov ebx, eax
test ebx, ebx
je 0x49a62a
mov edx, esi
mov eax, dword [ebx]
call fcn.00409610
jmp 0x49a631
mov eax, esi
call fcn.00404584
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a64e
lea eax, [ebp - 4]
call fcn.00404584
ret