joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41fee0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x14
push ebx
push esi
mov ebx, ecx
call fcn.0041fea6
mov esi, eax
mov dword [0x429548], esi
test esi, esi
je 0x41fffe
test bl, 1
jne 0x41ff12
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x429544], eax
test eax, eax
jmp 0x41ff3a
mov edx, 0x407290
mov ecx, esi
call fcn.0041fde1
push eax
mov edx, 0x4072a0
mov ecx, esi
call fcn.0041fde1
mov ecx, dword [0x429544]
mov edx, eax
call fcn.0041d89c
test al, al
je 0x41fffe
lea edx, [esp + 8]
mov ecx, 0xe5
call fcn.004255fb
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x42954c], eax
test eax, eax
je 0x41fffe
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4072b0
push eax
call esi
push 0x4072c0
push dword [0x42954c]
mov dword [0x429550], eax
call esi
push 0x4072d4
push dword [0x42954c]
mov dword [0x429554], eax
call esi
push 0x4072f0
push dword [0x42954c]
mov dword [0x429558], eax
call esi
push 0x407304
push dword [0x42954c]
mov dword [0x42955c], eax
call esi
push 0x407310
push dword [0x42954c]
mov dword [0x429560], eax
call esi
cmp dword [0x429550], 0
mov dword [0x429564], eax
jne 0x41ffe5
cmp dword [0x429554], 0
je 0x41fffe
cmp dword [0x429558], 0
je 0x41fffe
cmp dword [0x429560], 0
je 0x41fffe
test eax, eax
setne al
jmp 0x420000
xor al, al
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x4201ac
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
xor esi, esi
push edi
test cl, 1
jne 0x4201fc
mov edi, 0x429590
push edi
push esi
push esi
push 0x1a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x4201f5
push 0x4075ac
push 2
push 0x1a5
push 0x407364
push 0x4075e0
call fcn.0041a5ac
add esp, 0x14
xor al, al
jmp 0x420235
push edi
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
push 0x104
lea eax, [ebp - 0x208]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, eax
lea ecx, [ebp - 0x208]
call fcn.004189e5
mov dword [0x42958c], eax
test eax, eax
jne 0x420233
push 0x401130
push 2
push 0x1b3
jmp 0x4201df
mov al, 1
pop edi
pop esi
leave
ret
Function at 0x42028c
Capabilities:
Get common file path

Disassembly:
sub esp, 0x498
push ebx
push esi
push edi
test cl, 1
je 0x42034b
cmp byte [0x42979c], 1
jbe 0x42035e
xor ebx, ebx
mov edi, ebx
mov esi, ebx
mov eax, 0x402bd0
lea edx, [esp + 0xc]
mov cx, word [esi + eax]
call fcn.004255fb
lea eax, [esp + 0x29c]
push eax
push ebx
push ebx
push dword [esi + 0x402bd8]
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x42030d
lea eax, [esp + 0xc]
lea edx, [esp + 0x29c]
push eax
mov ecx, edx
call fcn.0041e80a
test al, al
je 0x42030d
push dword [0x42958c]
lea eax, [esp + 0x2a0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x420318
add esi, 0xc
inc edi
cmp esi, 0x54
jae 0x42035e
jmp 0x4202b1
lea eax, [esp + 0xc]
push eax
push 0x4075ec
push ebx
push 0x20c
push 0x407364
push 0x40761c
call fcn.0041a5ac
imul eax, edi, 0xc
add esp, 0x18
mov eax, dword [eax + 0x402bd4]
or dword [0x429530], eax
jmp 0x42035e
mov eax, dword [0x429530]
test al, 1
je 0x42035e
or eax, 0x1e0
mov dword [0x429530], eax
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x498
ret

Function at 0x42036a
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x214
push ebx
push ebp
push esi
push edi
test cl, 2
je 0x4204b6
push 0x407630
xor ebp, ebp
push ebp
push 0x227
push 0x407364
push 0x40766c
call fcn.0041a5ac
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
add esp, 0x14
push 0x429ff4
call edi
xor eax, eax
mov dword [0x42a00c], ebp
push 0x42a034
mov word [0x429ff0], ax
mov word [0x42a010], ax
mov dword [0x42a014], ebp
mov dword [0x42a054], ebp
mov dword [0x42a04c], ebp
mov dword [0x42a050], ebp
call edi
lea edx, [esp + 0x18]
xor ecx, ecx
call fcn.00420b32
push ebp
push ebp
push 3
push ebp
push 1
push accept
lea eax, [esp + 0x30]
mov dword [esp + 0x2c], 0x1fe
push eax
or ebx, 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x420434
push ebp
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
lea eax, [esp + 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
push esi
cmovne ebx, dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0xffffffff
je 0x42043e
test bl, 1
je 0x420440
mov ebx, ebp
shr ebx, 1
lea ecx, [esp + 0x18]
xor eax, eax
mov word [esp + ebx*2 + 0x18], ax
call fcn.0040bb6f
lea ecx, [esp + 0x18]
call fcn.00412f35
push 0x429eb0
mov dword [0x429eac], ebp
mov dword [0x429ea8], ebp
call edi
call fcn.00414998
push 0x4046a4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4204b1
mov ecx, eax
call fcn.004157de
test al, al
je 0x4204b1
or dword [0x42a030], 1
push 0x405c88
push ebp
push 0x24f
push 0x407364
push 0x40766c
call fcn.0041a5ac
add esp, 0x14
call fcn.004155a8
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x214
ret
Function at 0x4204c3
Capabilities:
Accept command line arguments
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x384
push ebx
push esi
push edi
mov esi, ecx
mov edi, esi
push 0
pop ebx
and edi, 1
jne 0x4204e4
mov dword [0x429530], ebx
call fcn.0041fee0
test al, al
je 0x4206c6
push ebx
push 0x80000
push ebx
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x42ac50], eax
test eax, eax
jne 0x420512
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x42ac50], eax
push 0x42a018
mov dword [0x42b060], ebx
mov byte [0x4299fc], bl
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esp + 0x10]
mov dword [0x42a030], ebx
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
call fcn.0041a543
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
push 0x41a7f4
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov ecx, esi
call fcn.00420006
test al, al
je 0x4206c6
mov ecx, esi
call fcn.004200e2
test al, al
je 0x4206c6
call fcn.0042012c
test al, al
je 0x4206c6
mov ecx, esi
call fcn.004201ac
test al, al
je 0x4206c6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, esi
mov dword [0x4297a0], eax
mov dword [0x4297a4], ebx
call fcn.00420239
test al, al
je 0x4206c6
test edi, edi
jne 0x4205e1
lea ecx, [esp + 0x10]
call fcn.00420ab6
push ebx
lea eax, [esp + 0x25a]
mov edx, 0x84939312
push eax
push 0x42999e
push dword [0x42953c]
mov ecx, 0x4297a8
call fcn.0041d3e2
mov ecx, esi
call fcn.0042028c
test al, al
je 0x4206c6
xor eax, eax
mov dword [0x42aa40], ebx
mov ecx, esi
mov word [0x429a00], ax
mov word [0x429e30], ax
mov word [0x42b1f0], ax
mov word [0x42b188], ax
mov word [0x429f30], ax
mov word [0x429ec8], ax
call fcn.0042036a
test al, al
je 0x4206c6
lea eax, [esp + 0xc]
push eax
mov eax, dword [0x429534]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
jne 0x420645
mov dword [esp + 0xc], ebx
lea ecx, [esp + 0x10]
call fcn.00420ab6
mov edx, 0x37c
lea ecx, [esp + 0x10]
call fcn.00419bf3
cmp dword [esp + 0xc], 0
push eax
mov eax, 0x407678
cmovne eax, dword [esp + 0x10]
push eax
push 0x429590
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push dword [0x42958c]
movzx eax, byte [0x42979c]
push dword [0x429530]
push eax
push 9
push 8
push ebx
push 2
push 0x407680
push ebx
push 0x2ae
push 0x407364
push 0x4077ec
call fcn.0041a5ac
add esp, 0x40
cmp dword [esp + 0xc], 0
je 0x4206c2
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, 1
jmp 0x4206c8
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420955
Capabilities:
Get hostname

Disassembly:
sub esp, 0x1fc
push esi
lea eax, [esp + 8]
mov dword [esp + 8], 0x28
push eax
lea eax, [esp + 0x3c]
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x420988
lea edx, [esp + 0x38]
mov ecx, 0xdc
call fcn.004255fb
push ebp
push edi
mov ebp, 0x11c
lea eax, [esp + 0xec]
push ebp
xor edi, edi
push edi
push eax
call fcn.0041869b
lea eax, [esp + 0xec]
mov dword [esp + 0xec], ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
lea edx, [ebp - 0x1c]
mov ecx, ebp
cmovne ecx, edx
lea edx, [esp + 0xec]
push ecx
lea ecx, [esp + 0x104]
push edi
cmove ecx, edx
push ecx
call fcn.0041869b
lea edx, [esp + 0x90]
lea ecx, [ebp - 0x45]
call fcn.004255fb
lea edx, [esp + 0x1c]
lea ecx, [ebp - 0x44]
call fcn.004255fb
lea eax, [esp + 0x1c]
mov ecx, reloc.WS2_32.dll_bind
push eax
lea edx, [esp + 0x94]
call fcn.0041cf49
lea edx, [esp + 0x1c]
mov dword [esp + 0x14], eax
lea ecx, [ebp - 0x43]
call fcn.004255fb
lea eax, [esp + 0xc]
mov ecx, reloc.WS2_32.dll_bind
push eax
push edi
lea eax, [esp + 0x24]
push eax
lea edx, [esp + 0x9c]
call fcn.0041d01c
cmp eax, 0xffffffff
je 0x420a54
test eax, eax
je 0x420a54
mov ecx, dword [esp + 0xc]
mov edx, eax
call fcn.00419bf3
mov ecx, dword [esp + 0xc]
mov edi, eax
call fcn.00418601
lea edx, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov ecx, 0xda
call fcn.004255fb
push 8
pop edx
lea ecx, [esp + 0x14]
call fcn.00419bf3
push eax
mov edx, ebp
lea ecx, [esp + 0xf0]
call fcn.00419bf3
push eax
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x28]
push eax
push 0x3c
push esi
call fcn.004194ac
add esp, 0x18
mov dword [esp + 0x10], eax
pop edi
pop ebp
cmp eax, 1
jge 0x420aae
mov edx, esi
mov ecx, 0xdb
call fcn.004255fb
pop esi
add esp, 0x1fc
ret

Function at 0x420ab6
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, 0x37c
mov esi, ecx
push edi
push 0x401840
push esi
call fcn.0041863c
mov ecx, dword [0x4299f0]
add ecx, dword [0x429544]
sub ecx, esi
mov al, byte [ecx + esi]
xor byte [esi], al
inc esi
sub edi, 1
jne 0x420ad9
pop edi
pop esi
ret
Function at 0x42143b
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ecx, ecx
xor bl, bl
call fcn.004204c3
test al, al
je 0x42151c
lea eax, [ebp - 8]
mov byte [ebp - 2], bl
push eax
mov byte [ebp - 1], 1
xor bh, bh
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edx, eax
test edx, edx
je 0x4214f7
xor ecx, ecx
cmp dword [ebp - 8], ecx
jle 0x4214be
push esi
mov eax, dword [edx + ecx*4]
test eax, eax
je 0x4214b7
cmp word [eax], 0x2d
jne 0x4214b7
movzx esi, word [eax + 2]
mov eax, esi
cmp eax, 0x66
je 0x4214b3
cmp eax, 0x69
je 0x4214af
cmp eax, 0x6e
je 0x4214a9
cmp esi, 0x76
jne 0x4214b7
mov bl, 1
jmp 0x4214b7
mov byte [ebp - 1], 0
jmp 0x4214b7
mov bh, 1
jmp 0x4214b7
mov byte [ebp - 2], 1
inc ecx
cmp ecx, dword [ebp - 8]
jl 0x42147e
pop esi
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
test bh, bh
je 0x4214d0
call fcn.00420e2b
jmp 0x421502
test bl, bl
je 0x4214f7
call fcn.00414998
call fcn.0040b3a6
test byte [0x429530], 4
mov bl, al
je 0x421504
xor dl, dl
mov ecx, 0x4293a0
call fcn.004147ce
jmp 0x421504
mov dl, byte [ebp - 1]
mov cl, byte [ebp - 2]
call fcn.00421040
mov bl, al
test bl, bl
je 0x42151c
test byte [0x429530], 2
je 0x42152d
pop ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
leave
ret
push 0x10
push 0
push 0x407c78
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
movzx eax, bl
xor eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4236d0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, edx
test esi, esi
jne 0x4236ff
push 0x2e
pop eax
push 3
push 3
lea edx, [ebp - 0xa]
mov word [ebp - 0xc], ax
xor ecx, ecx
lea esi, [ebp - 0xc]
call fcn.0041d0fb
push 6
push ecx
push 0
lea eax, [ebp - 0x214]
mov edx, ebx
push eax
push 2
pop ecx
call fcn.0041d255
test al, al
je 0x4237bf
push 0
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4237bf
mov bl, byte [ebp + 0xc]
test bl, bl
je 0x423748
push 1
lea ecx, [ebp - 0x214]
call fcn.0041c3ac
push 5
push ecx
push esi
push edi
lea edx, [ebp - 0x214]
xor ecx, ecx
call fcn.0041d255
test al, al
je 0x4237ad
xor esi, esi
xor ecx, ecx
push esi
push 0x80
push 2
test bl, bl
mov eax, 0x429568
cmove eax, ecx
push eax
push esi
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4237ad
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push 0x407e10
push esi
push 0x64
push 0x407d80
push 0x407dc8
call fcn.0041a5ac
add esp, 0x18
mov al, 1
jmp 0x4237e3
lea eax, [ebp - 0x214]
push eax
push 0x407ddc
push 2
push 0x5f
jmp 0x4237cf
lea eax, [ebp - 0x214]
push eax
push 0x407d48
push 2
push 0x4b
push 0x407d80
push 0x407dc8
call fcn.0041a5ac
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4237ea
Capabilities:
Set file attributes

Disassembly:
push ebx
push ebp
push edi
push 0x20
push dword [esp + 0x14]
mov edi, edx
mov ebp, ecx
xor bl, bl
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [esp + 0x10]
mov edx, ebp
push edi
call fcn.0041e184
test al, al
jne 0x423867
mov bh, byte [esp + 0x14]
push 0x407e30
push 2
push 0x92
push 0x407d80
push 0x407e60
call fcn.0041a5ac
add esp, 0x14
test bh, bh
jne 0x42383a
cmp bl, 0xa
je 0x42386f
movzx eax, bl
add eax, 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x20
push dword [esp + 0x14]
inc bl
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [esp + 0x10]
mov edx, ebp
push edi
call fcn.0041e184
test al, al
je 0x423813
mov al, 1
pop edi
pop ebp
pop ebx
ret 8
xor al, al
jmp 0x423869
Function at 0x423979
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
lea eax, [ebp - 4]
mov edi, edx
push eax
push edi
call ecx
test eax, eax
je 0x423a2d
mov ecx, dword [ebp - 4]
push esi
call fcn.0041c42d
mov esi, eax
test esi, esi
je 0x423a03
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x4239fa
push edi
push 0x407ea0
push 0
push 0xf5
push 0x407d80
push 0x407ee4
call fcn.0041a5ac
push dword [ebp + 0xc]
mov edi, dword [ebp - 4]
lea eax, [ebp + 8]
push 0x4063c8
push eax
call fcn.00419554
add esp, 0x24
test eax, eax
jle 0x4239fa
sub esp, 0xc
push dword [ebp + 8]
push ecx
mov ecx, edi
call fcn.0041a1a7
mov ecx, dword [ebp + 8]
call fcn.00418601
mov ecx, esi
call fcn.00418601
jmp 0x423a21
push 0x407f00
push 2
push 0xfb
push 0x407d80
push 0x407ee4
call fcn.0041a5ac
add esp, 0x14
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
jmp 0x423a4b
push 0x407f4c
push 2
push 0x100
push 0x407d80
push 0x407ee4
call fcn.0041a5ac
add esp, 0x14
pop edi
leave
ret 8
Function at 0x4248f3
Capabilities:
Delete registry key
Delete registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc60
lea edx, [esp + 0x3d8]
xor ecx, ecx
inc ecx
push ebx
push esi
call fcn.00420b32
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [esp + 0x3e0]
push eax
call esi
push 2
lea edx, [esp + 0x5ec]
pop ecx
call fcn.00420b32
lea eax, [esp + 0x5e8]
push eax
call esi
or dword [0x429530], 2
push 0
call fcn.00423949
push 0
lea edx, [esp + 0x6c]
mov ecx, 0xff220829
call fcn.00420763
push 3
lea edx, [esp + 0xc]
pop ecx
call fcn.004255fb
xor bl, bl
mov esi, reloc.WS2_32.dll_accept
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
test eax, eax
jne 0x4249a3
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x68]
push eax
lea edx, [esp + 0xc]
call fcn.0041d0b2
test al, al
je 0x4249a3
inc bl
cmp bl, 5
jb 0x42496a
lea ecx, [esp + 0x3e0]
call fcn.0041e63c
lea ecx, [esp + 0x5e8]
call fcn.0041e63c
push 3
lea edx, [esp + 0x1dc]
pop ecx
call fcn.00420b32
lea eax, [esp + 0x1d8]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov esi, dword [sym.imp.USER32.dll_CharToOemW]
lea eax, [esp + 0x1d8]
push eax
lea eax, [esp + 0x3e4]
push eax
call esi
lea eax, [esp + 0xd0]
push eax
lea eax, [esp + 0x5ec]
push eax
call esi
push 7
lea edx, [esp + 0xc]
pop ecx
call fcn.004255ad
lea eax, [esp + 0xd0]
push eax
lea eax, [esp + 0x1dc]
push eax
lea eax, [esp + 0xd8]
push eax
lea eax, [esp + 0x1e4]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x804]
push 0x474
push eax
call fcn.004194c3
add esp, 0x1c
test eax, eax
jle 0x424a59
lea ecx, [esp + 0x7f0]
call fcn.0041a357
cmp dword [0x4299f8], 0xffffffff
jne 0x424a6a
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4255ad
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
movzx esi, cx
xor ebx, ebx
push edi
mov edi, edx
xor edx, edx
movzx eax, word [esi*8 + 0x402c32]
mov ecx, eax
cmp bx, ax
jae 0x4255f1
mov eax, dword [esi*8 + 0x402c34]
movzx ecx, dx
mov al, byte [eax + ecx]
xor al, byte [esi*8 + 0x402c30]
xor al, dl
inc edx
mov byte [ecx + edi], al
movzx eax, word [esi*8 + 0x402c32]
cmp dx, ax
jb 0x4255c8
mov ecx, eax
movzx eax, cx
mov byte [eax + edi], bl
pop edi
pop esi
pop ebx
ret

Function at 0x4255fb
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
movzx edi, cx
mov ebx, edx
xor edx, edx
xor esi, esi
movzx eax, word [edi*8 + 0x402c32]
mov ecx, eax
cmp dx, ax
jae 0x42564f
mov eax, dword [edi*8 + 0x402c34]
movzx edx, si
movsx cx, byte [edx + eax]
mov eax, 0xff
xor cx, si
and cx, ax
movzx eax, byte [edi*8 + 0x402c30]
xor cx, ax
inc esi
mov word [ebx + edx*2], cx
movzx eax, word [edi*8 + 0x402c32]
cmp si, ax
jb 0x425616
mov ecx, eax
movzx eax, cx
xor ecx, ecx
pop edi
pop esi
mov word [ebx + eax*2], cx
pop ebx
ret
Function at 0x42565c
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
push ebx
push esi
push edi
mov edi, ecx
cmp edx, 0xffffffff
je 0x4256fb
test byte [ebp + 0xc], 2
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xa8]
mov dword [ebp - 4], 0x80
push eax
push edx
je 0x425694
call dword [sym.imp.WS2_32.dll_getpeername]
jmp 0x42569a
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x4256f6
push 2
pop ebx
cmp word [ebp - 0xa8], bx
jne 0x4256be
push 6
pop eax
mov byte [ebp + 0xf], 1
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0xa4]
push 4
jmp 0x4256da
cmp word [ebp - 0xa8], 0x17
jne 0x4256f6
push 0x12
pop eax
mov byte [ebp + 0xf], 4
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0xa0]
push 0x10
pop esi
push esi
push ecx
lea ecx, [ebp - 0x20]
push ecx
call fcn.0041863c
push ebx
lea ecx, [ebp - 0xa6]
push ecx
push edx
call fcn.0041863c
jmp 0x42571d
or eax, 0xffffffff
jmp 0x425751
push 0x1c
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.0041869b
test byte [ebp + 0xc], 1
je 0x425716
mov byte [ebp + 0xf], 4
push 0x12
jmp 0x42571c
mov byte [ebp + 0xf], 1
push 6
pop eax
mov dword [ebp - 4], eax
mov al, byte [ebp + 8]
mov byte [ebp + 0xd], al
lea eax, [ebp + 0xc]
push 4
push eax
lea eax, [ebp - 0x24]
mov byte [ebp + 0xc], 5
push eax
mov byte [ebp + 0xe], 0
call fcn.0041863c
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x24]
add eax, 4
mov ecx, edi
push eax
call fcn.0041bd49
movzx eax, al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x426120
Capabilities:
Get local ipv4 addresses
Get socket information
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, ecx
cmp edx, 0xffffffff
je 0x426170
test byte [ebp + 0xc], 2
mov dword [ebp - 4], 0x10
je 0x42615a
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
push edx
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x42616b
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov ax, word [ebp - 0x1a]
jmp 0x426176
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_getsockname]
jmp 0x42614a
or eax, 0xffffffff
jmp 0x42619b
and dword [ebp - 8], 0
xor eax, eax
mov word [ebp - 0xa], ax
mov al, byte [ebp + 8]
push 0
mov byte [ebp - 0xb], al
lea eax, [ebp - 0xc]
push 8
push eax
push esi
mov byte [ebp - 0xc], 0
call dword [sym.imp.WS2_32.dll_send]
sub eax, 8
neg eax
sbb eax, eax
inc eax
pop esi
leave
ret 8
Function at 0x40dc63
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Execute anti-debugging instructions
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
cmp dword [0x40d27c], 0xc85eea
je 0x40dda7
jmp 0x40dc80
mov ebx, 0xff78ba4d
xor edx, 0xf91f68a3
mov edx, 0xfbf95aaf
xor edx, 0xfb121dec
mov ebx, 0xfbd146fe
call fcn.0040dd6c
xor ebx, 0xfe7b8cc9
mov ebx, 0xfce1a5e8
xor edx, 0xfa829642
cmp eax, 0x62dff5b8
jne 0x40d023
jmp 0x40dd2f
mov dword [0x40d27c], 0xc85eea
call fcn.0040dce7
mov ebx, 0x923f0509
jmp 0x40dd65
jmp 0x40dda7
jmp 0x40e1ac
push esi
push edi
push ebx
push ecx
push edx
xor ecx, ecx
mov esi, 0x40d3ac
mov eax, ecx
mov edx, 8
test eax, 1
jbe 0x40e1cf
shr eax, 1
xor eax, 0xedb88320
jmp 0x40e1d1
shr eax, 1
dec edx
jne 0x40e1bf
mov dword [esi], 1
mov dword [esi], eax
add esi, 4
inc ecx
cmp ecx, 0x100
jne 0x40e1b8
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, 0x40d3ac
mov edi, 0xffffffff
xor ecx, ecx
mov eax, dword [esp]
movzx eax, byte [ecx + eax]
mov edx, edi
and edx, 0xff
xor eax, edx
mov ebx, dword [esi + eax*4]
shr edi, 8
xor edi, ebx
inc ecx
cmp ecx, dword [esp + 4]
jne 0x40e1fa
add esp, 8
not edi
mov eax, edi
pop edx
pop ecx
pop ebx
pop edi
pop esi
mov dword [ebp - 4], eax
mov dword [0x40d27c], 0x81e946
rdtsc
xor dword [0x40d33f], eax
xor dword [0x40d368], eax
xor dword [0x40d2c4], eax
call fcn.0040dd6c
mov dword [0x40d2b2], eax
call fcn.0040dce7
nop
nop
popal
mov eax, dword [ebp - 4]
leave
ret 8
Function at 0x4018cf
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
mov eax, ebp
add eax, 0xffffffb4
mov edi, eax
push edi
xor ecx, ecx
mov cl, 0x30
mov dword [edi], ecx
sub cl, 0x25
xor eax, eax
inc edi
inc edi
inc edi
inc edi
mov dword [edi], eax
dec ecx
jne 0x4018e8
mov eax, 0x400000
mov dword [0x404850], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], 0x401778
mov dword [ebp - 0x24], str.grita
call dword [sym.imp.USER32.dll_RegisterClassExW]
xor eax, eax
push eax
push dword [0x404850]
push eax
push eax
push 0x1a4
push 0x2a8
push 0xfffff9c0
push 0xfffff63c
push 0
push str.kovice
push str.grita
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x404858], eax
push eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x401997
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x401978
mov esp, ebp
pop ebp
ret 0x10
Function at 0x510ade
Capabilities:
Execute anti-debugging instructions

Disassembly:
and al, 0x80
neg dx
rdtsc
jmp 0x5108f8
mov word [esp + 1], dx
sub esp, 0xb
js 0x510959
jns 0x510913

Function at 0x51ceea
Capabilities:
Check for trap flag exception

Disassembly:
push ebx
jmp 0x503792
pushfd
or dword [esp], 0x100
popfd
cpuid
nop
jmp 0x5037a9
pop ebx
ret
mov dword [esp], eax
lea esp, [esp + 4]
jmp 0x503786
Function at 0x6073e3
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg di, dx
lea ebp, reloc.MSVCRT.dll_strncpy
neg ebx
mov edi, dword [esp]
mov ecx, edi
mov di, bx
mov esi, 0x2feea29c
add esp, 4
neg bp
xchg bp, ax
xchg bx, dx
jmp 0x607397
xchg dword [esp], ecx
mov cl, ch
rcl dl, 5
mov dx, word [esp + 1]
lea ecx, [ebx*4]
jmp 0x6073ad