joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42307a
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x43c7df
call 0x44fd08
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.0041722d
and dword [ebp - 4], 0
lea ecx, [esi + 0xc]
call fcn.0041722d
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.0041722d
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.0041722d
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.0041722d
and byte [esi + 0x3c], 0
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 4
call fcn.0041722d
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 5
call fcn.0041722d
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4237f9
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x43c907
call 0x44fd08
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00417345
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.00417345
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.00417345
lea eax, [edi + 0x24]
lea ecx, [esi + 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.00417345
lea eax, [edi + 0x30]
lea ecx, [esi + 0x30]
push eax
mov byte [ebp - 4], 3
call fcn.00417345
mov al, byte [edi + 0x3c]
lea ecx, [esi + 0x40]
mov byte [esi + 0x3c], al
lea eax, [edi + 0x40]
push eax
mov byte [ebp - 4], 4
call fcn.00417345
add edi, 0x4c
lea ecx, [esi + 0x4c]
push edi
mov byte [ebp - 4], 5
call fcn.00417345
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x4289d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx + 4]
push ebx
push esi
mov esi, dword [ecx]
xor edx, edx
push edi
test eax, eax
mov ebx, 0x159a55e5
mov edi, 0x1f123bb5
mov dword [ebp - 4], eax
jbe 0x428a24
mov eax, 0xffff
mov ecx, ebx
and ecx, eax
imul ecx, ecx, 0x9069
shr ebx, 0x10
add ebx, ecx
mov ecx, edi
and ecx, eax
imul ecx, ecx, 0x4650
shr edi, 0x10
add edi, ecx
mov ecx, edi
xor cl, byte [ebp + 8]
mov byte [edx + esi], cl
inc edx
cmp edx, dword [ebp - 4]
jb 0x4289f8
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x428a2b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ecx + 4]
and dword [ebp - 4], 0
mov ecx, dword [ecx]
push ebx
push edi
push 1
pop edx
mov edi, 0x159a55e5
test eax, eax
mov ebx, 0x1f123bb5
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], edx
jbe 0x428bef
push esi
mov esi, 0xffff
jmp 0x428a68
push 1
pop edx
mov eax, edi
and eax, esi
imul eax, eax, 0x9069
shr edi, 0x10
add edi, eax
mov eax, ebx
and eax, esi
imul eax, eax, 0x4650
shr ebx, 0x10
add ebx, eax
mov eax, edi
shl eax, 0x10
add eax, ebx
xor eax, dword [ebp + 0xc]
mov ecx, eax
and ecx, edx
shr eax, 1
test ecx, ecx
mov dword [ebp - 8], eax
je 0x428bd6
cmp dword [ebp - 4], 0x400
jb 0x428bd6
lea ecx, [ebp - 8]
call fcn.00428bf5
mov ecx, eax
mov eax, dword [ebp - 8]
shr dword [ebp - 8], 3
and eax, 7
inc ecx
test eax, eax
mov dword [ebp - 0xc], ecx
je 0x428b9f
lea ecx, [ebp - 8]
call fcn.00428bf5
add dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
push 1
pop eax
shl eax, cl
cmp eax, dword [ebp - 4]
jae 0x428af4
push 1
inc ecx
pop eax
shl eax, cl
cmp eax, dword [ebp - 4]
jb 0x428ae6
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
cmp eax, ecx
mov dword [ebp - 0x10], eax
jbe 0x428b01
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x15
mov dword [ebp - 0x18], 5
ja 0x428b15
mov dword [ebp - 0x18], 4
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
push 1
pop eax
shl eax, cl
mov ecx, edi
and ecx, esi
imul ecx, ecx, 0x9069
shr edi, 0x10
add edi, ecx
mov ecx, ebx
and ecx, esi
dec eax
imul ecx, ecx, 0x4650
shr ebx, 0x10
add ebx, ecx
mov ecx, edi
shl ecx, 0x10
add ecx, ebx
and eax, edx
xor ecx, dword [ebp + 0xc]
add eax, 6
cmp eax, dword [ebp - 0x10]
mov edx, ecx
mov dword [ebp - 8], edx
ja 0x428b18
mov dword [ebp - 0x24], 1
mov ecx, eax
mov eax, dword [ebp - 0x24]
shl eax, cl
dec eax
and eax, edx
cmp eax, dword [ebp - 4]
jb 0x428b98
mov eax, edi
and eax, esi
imul eax, eax, 0x9069
shr edi, 0x10
add edi, eax
mov eax, ebx
and eax, esi
mov edx, edi
imul eax, eax, 0x4650
shr ebx, 0x10
add ebx, eax
shl edx, 0x10
add edx, ebx
xor edx, dword [ebp + 0xc]
jmp 0x428b18
mov ecx, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 4]
cmp ecx, eax
jbe 0x428bae
mov dword [ebp - 0xc], eax
mov ecx, eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
add dword [ebp - 4], ecx
add eax, edx
mov dword [ebp - 0x24], eax
sub eax, dword [ebp - 0x18]
test ecx, ecx
jbe 0x428be2
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x24]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 0x10]
jne 0x428bc9
jmp 0x428be2
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
inc dword [ebp - 4]
mov byte [ecx + edx], al
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x20]
jb 0x428a65
pop esi
pop edi
pop ebx
leave
ret 8
Function at 0x42ad69
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
mov eax, ecx
jbe 0x42ae80
mov ecx, edx
mov edx, dword [esp + 4]
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
add eax, edx
xor eax, edx
dec ecx
jne 0x42ad79
ret 4

Function at 0x42f08c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x43d5f2
call 0x44fd08
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov byte [esi + 0x32], bl
mov byte [esi + 0x33], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x64], ebx
call fcn.0042f12c
lea eax, [esi + 0x8c]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov byte [ebp - 4], 5
mov byte [esi + 0x95], bl
mov dword [esi + 0x98], ebx
call fcn.0042390e
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x94], al
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x431a66
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x43d9ea
call 0x44fd08
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], al
mov byte [esi + 0x21], al
call fcn.0041722d
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.00431ab5
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x431b12
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x43da35
call 0x44fd08
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 3
call 0x43d93a
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.00431b5d
push dword [esi + 0x24]
call fcn.0041630c
and byte [ebp - 4], 0
pop ecx
lea ecx, [esi + 0xc]
call 0x4439bd
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00432121
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x43326a
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x43dc4a
call 0x44fd08
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x442b18
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
lea ecx, [esi + 0x48]
mov dword [ebp - 4], edi
call fcn.0041722d
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.0041722d
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x38], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x14], edi
mov dword [esi], 0x442b04
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x433e02
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
mov eax, 0x43dcd9
call 0x44fd08
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
mov byte [esi + 8], bl
mov byte [esi + 9], bl
mov byte [esi + 0xa], bl
mov byte [esi + 0xb], bl
call fcn.00416bcd
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.00416bcd
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.00416bcd
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.00416bcd
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x436048
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x43dfbe
call 0x44fd08
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 1
call 0x4439bd
and byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.0043608a
push dword [esi + 0xc]
call fcn.0041630c
pop ecx
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x43640b
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x43e086
call 0x44fd08
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
mov eax, dword [esi]
lea ecx, [ebx + 0xc]
mov dword [ebx], eax
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
mov eax, dword [esi + 8]
mov dword [ebx + 8], eax
lea eax, [esi + 0xc]
push eax
call fcn.00417345
and dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [ebx + 0x18]
call fcn.0043662e
mov eax, dword [esi + 0x24]
lea ecx, [ebx + 0x30]
mov dword [ebx + 0x24], eax
mov al, byte [esi + 0x28]
mov byte [ebx + 0x28], al
mov al, byte [esi + 0x29]
mov byte [ebx + 0x29], al
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x2c], eax
lea eax, [esi + 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.00436596
mov eax, dword [esi + 0x3c]
add esi, 0x44
mov dword [ebx + 0x3c], eax
mov eax, dword [esi - 4]
lea edi, [ebx + 0x44]
mov dword [ebx + 0x40], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x43649e
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x43e0b9
call 0x44fd08
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00430f30
mov al, byte [edi + 8]
and dword [ebp - 4], 0
mov byte [esi + 8], al
mov al, byte [edi + 9]
mov byte [esi + 9], al
mov al, byte [edi + 0xa]
mov byte [esi + 0xa], al
mov al, byte [edi + 0xb]
mov byte [esi + 0xb], al
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.00416c29
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.00416c29
lea eax, [edi + 0x24]
lea ecx, [esi + 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.00416c29
lea eax, [edi + 0x30]
lea ecx, [esi + 0x30]
push eax
mov byte [ebp - 4], 3
call fcn.00416c29
mov eax, dword [edi + 0x40]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x402344
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov ebx, dword [0x4238ff]
call fcn.004010aa
push ebx
push ecx
mov eax, dword [ebp + 8]
dec eax
jns 0x40236d
push 4
call fcn.00415938
add esp, 4
pop ecx
pop ebx
cmp eax, ecx
jl 0x402380
push 1
call fcn.00415938
add esp, 4
shl eax, 2
add ebx, eax
mov dword [ebp - 4], ebx
fild dword [ebp + 0xc]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x41b278]
fstp qword [ebp - 0x14]
mov dword [ebp - 0x18], esp
push 0
push dword [ebp + 0xc]
mov eax, 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
mov eax, 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push 1
fld qword [ebp - 0x14]
call fcn.00401408
push eax
mov ebx, dword [ebp - 4]
push dword [ebx]
call dword [sym.imp.WS2_32.dll_WSARecv]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x4023ec
push 6
call fcn.00415938
add esp, 4
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x402438
mov dword [ebp - 4], esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x402418
push 6
call fcn.00415938
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x3e5
jne 0x40242d
jmp 0x402438
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040243e
mov esp, ebp
pop ebp
ret 8

Function at 0x4026e8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov ebx, dword [0x4238ff]
call fcn.004010aa
push ebx
push ecx
mov eax, dword [ebp + 8]
dec eax
jns 0x402711
push 4
call fcn.00415938
add esp, 4
pop ecx
pop ebx
cmp eax, ecx
jl 0x402724
push 1
call fcn.00415938
add esp, 4
shl eax, 2
add ebx, eax
mov dword [ebp - 4], ebx
fild dword [ebp + 0xc]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x41b278]
fstp qword [ebp - 0x14]
mov dword [ebp - 0x18], esp
push 0
push dword [ebp + 0xc]
push 0
mov eax, 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push 1
fld qword [ebp - 0x14]
call fcn.00401408
push eax
mov ebx, dword [ebp - 4]
push dword [ebx]
call dword [sym.imp.WS2_32.dll_WSASend]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x402789
push 6
call fcn.00415938
add esp, 4
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
jne 0x4027dc
mov dword [ebp - 4], esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4027b5
push 6
call fcn.00415938
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x3e5
jne 0x4027ca
jmp 0x4027dc
push dword [ebp + 0xc]
call fcn.004027ec
mov eax, 0
jmp 0x4027e6
mov eax, 1
jmp 0x4027e6
mov esp, ebp
pop ebp
ret 8
Function at 0x402861
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4028b1
push 6
call fcn.00415938
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
jne 0x4028e5
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4028e0
push 6
call fcn.00415938
add esp, 4
jmp 0x4028ed
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
cmp dword [ebp - 4], 0
mov eax, 0
setne al
jmp 0x4028fe
mov esp, ebp
pop ebp
ret 0x14
Function at 0x41540c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x80000301
push 0
push 0x2000
push 0x80000301
push 0
push 0x1000
push 2
mov ebx, 0xc8
call fcn.004177e0
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x40
push dword [ebp - 4]
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x415471
push 6
call fcn.00415938
add esp, 4
jmp 0x415476
mov esp, ebp
pop ebp
ret 4

Function at 0x415c90
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
mov al, 0x20
mov cl, byte [edi]
inc edi
cmp cl, 0x22
jne 0x415caa
mov al, cl
mov dl, byte [edi]
inc edi
cmp dl, al
je 0x415cb8
mov cl, byte [edi]
inc edi
cmp cl, al
jne 0x415cb1
cmp al, 0x20
je 0x415cc2
cmp byte [edi], 0x20
jne 0x415cc2
inc edi
lea ecx, [esp + 0xc]
call fcn.00417dd0
mov dword [esp + 0xc], 0x41a19c
mov al, byte [edi]
test al, al
je 0x415d86
mov esi, dword [esp + 0x28]
cmp al, 0x22
jne 0x415d2e
mov al, byte [edi + 1]
inc edi
test al, al
mov esi, edi
je 0x415d09
mov al, byte [esi]
cmp al, 0x22
je 0x415d09
test al, al
jge 0x415d01
mov al, byte [esi + 1]
test al, al
je 0x415d09
inc esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x415cef
mov edx, esi
sub edx, edi
push edx
push edi
call fcn.00418260
add esp, 8
lea ecx, [esp + 0xc]
push eax
call fcn.00418060
mov al, byte [esi]
mov edi, esi
test al, al
je 0x415d7c
lea edi, [esi + 1]
jmp 0x415d7c
cmp al, 0x20
jg 0x415d3a
cmp byte [esi], 0
jl 0x415d3a
inc edi
jmp 0x415d7c
test al, al
mov esi, edi
je 0x415d62
mov al, byte [esi]
cmp al, 0x22
je 0x415d62
cmp al, 0x20
jg 0x415d4e
test al, al
jge 0x415d62
test al, al
jge 0x415d5a
mov al, byte [esi + 1]
test al, al
je 0x415d62
inc esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x415d40
mov eax, esi
sub eax, edi
push eax
push edi
call fcn.00418260
add esp, 8
lea ecx, [esp + 0xc]
push eax
call fcn.00418060
mov edi, esi
mov al, byte [edi]
test al, al
jne 0x415ce1
mov ebx, dword [esp + 0x28]
mov eax, dword [ebx]
test eax, eax
je 0x415d99
push eax
call fcn.00418200
add esp, 4
mov edi, dword [esp + 0x1c]
shr edi, 2
shl edi, 2
lea ecx, [edi + 8]
push ecx
call fcn.00415af0
mov dword [eax], 1
mov edx, dword [esp + 0x20]
shr edx, 2
mov dword [eax + 4], edx
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
add esp, 4
neg esi
sbb esi, esi
and esi, ecx
mov ecx, edi
mov edx, ecx
lea edi, [eax + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
mov dword [ebx], eax
mov dword [esp + 0xc], 0x41a198
call fcn.00417fd0
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x4160d0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x4160ee
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x4160e3
pop esi
ret
Function at 0x4167d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x4167e3
xor eax, eax
pop esi
add esp, 0x10
ret
push esi
call fcn.00418bf0
add esp, 4
test eax, eax
jne 0x4167f5
pop esi
add esp, 0x10
ret
mov eax, dword [esi]
mov ecx, 1
push ebx
push ebp
cmp eax, ecx
push edi
mov dword [esp + 0x10], 0
jne 0x4168b6
mov eax, dword [esi + 4]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
cmp eax, ecx
mov dword [esp + 0x14], ecx
jle 0x416933
lea ebx, [esp + 0x34]
mov eax, dword [ebx + 8]
xor ebp, ebp
cmp eax, reloc.WS2_32.dll_connect
jne 0x41683e
mov esi, dword [ebx]
jmp 0x416852
push ebx
call fcn.00418a50
mov esi, eax
add esp, 4
test esi, esi
je 0x416896
mov ebp, 1
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x41687d
lea edx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push edx
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41687d
mov dword [esp + 0x10], eax
test ebp, ebp
je 0x41688a
push esi
call sub.MSVCRT.dll_free
add esp, 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x416933
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
inc eax
add ebx, 0xc
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x41682e
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret
cmp eax, 2
jne 0x416933
mov eax, dword [esp + 0x24]
mov edx, dword [esi + 4]
cmp eax, ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ecx
jle 0x416933
dec eax
lea ebx, [esp + 0x34]
mov dword [esp + 0x24], eax
mov eax, dword [ebx + 8]
xor ebp, ebp
cmp eax, reloc.WS2_32.dll_connect
jne 0x4168e7
mov esi, dword [ebx]
jmp 0x4168fb
push ebx
call fcn.00418a50
mov esi, eax
add esp, 4
test esi, esi
je 0x416925
mov ebp, 1
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x416918
mov eax, dword [esp + 0x18]
push ecx
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x24]
test ebp, ebp
je 0x416925
push esi
call sub.MSVCRT.dll_free
add esp, 4
mov eax, dword [esp + 0x24]
add ebx, 0xc
dec eax
mov dword [esp + 0x24], eax
jne 0x4168d7
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret