joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10039bb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xed
mov dword [ebp - 8], 0
jmp 0x10039bd2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xe
jge 0x10039c11
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x1840a797]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10039c0c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10039bc9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xe], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10039c30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xcb
mov dword [ebp - 8], 0
jmp 0x10039c52
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x10
jge 0x10039c91
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x54bc3c8a]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10039c8c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10039c49
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x10], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10039cb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xb2
mov dword [ebp - 8], 0
jmp 0x10039cd2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x11
jge 0x10039d11
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x72a25e56]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10039d0c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10039cc9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x11], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10039d30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 3
mov dword [ebp - 8], 0
jmp 0x10039d52
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x17
jge 0x10039d91
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x607cf8b3]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10039d8c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10039d49
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x17], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10039db0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x18
mov dword [ebp - 8], 0
jmp 0x10039dd2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x18
jge 0x10039e11
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x3f850b1e]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10039e0c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10039dc9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x18], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10039e30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xf0
mov dword [ebp - 8], 0
jmp 0x10039e52
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x11
jge 0x10039e91
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x1051c42b]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10039e8c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10039e49
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x11], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10039eb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xc6
mov dword [ebp - 8], 0
jmp 0x10039ed2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x10
jge 0x10039f11
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x288e10e7]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10039f0c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10039ec9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x10], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10039f30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x74
mov dword [ebp - 8], 0
jmp 0x10039f52
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x15
jge 0x10039f91
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x2273ea1d]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10039f8c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10039f49
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x15], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10039fb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xfd
mov dword [ebp - 8], 0
jmp 0x10039fd2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xf
jge 0x1003a011
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x6be90bf8]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003a00c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10039fc9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xf], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003a030
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xa2
mov dword [ebp - 8], 0
jmp 0x1003a052
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x12
jge 0x1003a091
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x4f349485]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003a08c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003a049
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x12], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003a0b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x9f
mov dword [ebp - 8], 0
jmp 0x1003a0d2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x13
jge 0x1003a111
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x3c8a13b2]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003a10c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003a0c9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x13], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003a130
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x27
mov dword [ebp - 8], 0
jmp 0x1003a152
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xe
jge 0x1003a191
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x4fd82c96]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003a18c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003a149
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xe], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1003a1b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x39
mov dword [ebp - 8], 0
jmp 0x1003a1d2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x10
jge 0x1003a211
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x7bb6f8e8]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003a20c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003a1c9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x10], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003a230
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x6b
mov dword [ebp - 8], 0
jmp 0x1003a252
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 9
jge 0x1003a291
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x46cbf18e]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003a28c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003a249
mov eax, dword [ebp - 0xc]
mov byte [eax + 9], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003a2b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xd4
mov dword [ebp - 8], 0
jmp 0x1003a2d2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 6
jge 0x1003a311
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x162539dc]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003a30c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003a2c9
mov eax, dword [ebp - 0xc]
mov byte [eax + 6], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1003a330
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xa0
mov dword [ebp - 8], 0
jmp 0x1003a352
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xd
jge 0x1003a391
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x2efa48c0]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003a38c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1003a349
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xd], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1003c8b6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10071b3c]
jne 0x1003c8c0
repz ret
jmp fcn.1003ce5c

Function at 0x1003e460
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1003e568
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1003e568
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x1003e568
push 2
push ebx
lea eax, [ebp + 8]
push eax
push esi
call fcn.1003d190
add esp, 0x10
cmp eax, 2
je 0x1003e4a9
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [ebp + 8], ax
jne 0x1003e49d
push 4
lea eax, [ebx + 0x3c]
push eax
lea eax, [ebp - 4]
push eax
push esi
call fcn.1003d190
add esp, 0x10
cmp eax, 4
jne 0x1003e49d
add ebx, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1003e4d8
mov dword [eax], ebx
push 2
lea eax, [ebx + 4]
push eax
lea eax, [ebp + 8]
push eax
push esi
call fcn.1003d190
add esp, 0x10
cmp eax, 2
jne 0x1003e49d
movzx eax, word [ebp + 8]
cmp eax, 0x14c
je 0x1003e533
cmp eax, 0x8664
jne 0x1003e49d
push 0x108
push ebx
push edi
push esi
call fcn.1003d190
add esp, 0x10
cmp eax, 0x108
jne 0x1003e49d
cmp dword [edi], 0x4550
mov eax, 0x40
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0xf8
push ebx
push edi
push esi
call fcn.1003d190
add esp, 0x10
cmp eax, 0xf8
jne 0x1003e49d
cmp dword [edi], 0x4550
mov eax, 0x20
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001398
Capabilities:
Initialize winsock library

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
push dword [esp + 0x10]
call fcn.010016dd
add esi, 4
mov eax, dword [esi]
xor edi, edi
inc edi
test eax, eax
je 0x10013db
cmp byte [eax], 0x2d
jne 0x10013d6
jmp 0x10013c6
cmp cl, 0x6c
jne 0x10013db
mov dword [0x1002060], edi
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x10013bb
add esi, 4
mov eax, dword [esi]
test eax, eax
jne 0x10013b4
cmp dword [esi], 0
jne 0x10013e4
call fcn.01001118
mov eax, edi
jmp 0x100143a
push 0x1002080
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
jne 0x1001433
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x271a
call fcn.010016a1
jmp 0x1001433
push 0xa
call dword [sym.imp.msvcrt.dll_putchar]
pop ecx
push dword [esi]
call fcn.01001127
test eax, eax
jne 0x1001430
push dword [esi]
push 0x2710
push edi
call fcn.01001632
add esp, 0xc
add esi, 4
cmp dword [esi], 0
jne 0x100140c
xor eax, eax
pop edi
pop esi
ret

Function at 0x100143d
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x10010f0
call fcn.010015dc
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1001478
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001478
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1001490
cmp eax, 0x20b
je 0x100147d
mov dword [ebp - 0x1c], edi
jmp 0x10014a4
cmp dword [ecx + 0x84], 0xe
jbe 0x1001478
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x100149e
cmp dword [ecx + 0x74], 0xe
jbe 0x1001478
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1002210], 0xffffffff
or dword [0x1002214], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1002070]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x100206c]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1002218], eax
call fcn.010015d6
cmp dword [0x100205c], edi
jne 0x10014ff
push fcn.010015d6
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.010015c4
push 0x10010b8
push 0x10010b4
call sub.msvcrt.dll__initterm
mov eax, dword [0x1002068]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x1002064]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x10010b0
push 0x10010ac
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x24]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01001398
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x1c], edi
jne 0x1001576
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x10015ab
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01001615
ret
Function at 0x10016e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [sym.imp.WS2_32.dll_send]
push 0xa
pop esi
jmp 0x100170a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2747
jne 0x100171f
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
lea esi, [esi + esi*4]
shl esi, 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10016f1
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0x10
Function at 0x401864
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 8]
cmp dword [0x474380], 0
jne 0x401915
mov dword [esp + 0x2c], 0
mov eax, dword [0x4742a0]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
mov eax, dword [0x474310]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0x19
mov dword [esp + 0x18], 0x46
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x40800805
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x4600d1
mov dword [esp], 0
call sub.USER32.dll_CreateWindowExA
sub esp, 0x30
mov dword [0x474380], eax
mov dword [esp + 0x14], 0x800000
mov dword [esp + 0x10], 0x3c
mov dword [esp + 0xc], 0xaf
mov dword [esp + 8], 0x4b
mov dword [esp + 4], 0x19
mov dword [esp], eax
call fcn.004036a6
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc
mov eax, dword [0x474380]
mov dword [esp], eax
call sub.USER32.dll_SendMessageA
sub esp, 0x10
mov dword [esp + 4], 1
mov eax, dword [0x474380]
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
call sub.USER32.dll_GetCursor
mov dword [0x474350], eax
mov dword [esp + 4], 0x7f02
mov eax, dword [0x4742a0]
mov dword [esp], eax
call sub.USER32.dll_LoadCursorA
sub esp, 8
mov dword [esp], eax
call sub.USER32.dll_SetCursor
sub esp, 4
mov dword [esp + 0xc], 0x100
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [0x474380]
mov dword [esp], eax
call sub.USER32.dll_RedrawWindow
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x4019ab
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [esp + 4], 0
mov eax, dword [0x474380]
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
mov eax, dword [0x474350]
mov dword [esp], eax
call sub.USER32.dll_SetCursor
sub esp, 4
leave
ret
Function at 0x403873
Capabilities:
Contain obfuscated stackstrings
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x54
mov dword [esp + 8], 0x403859
mov dword [esp + 4], 0x4037f0
mov dword [esp], 0x28
call fcn.004132bb
mov dword [0x471260], eax
mov dword [esp], str.ProgramFiles
call sub.msvcrt.dll_getenv
mov ebx, eax
test eax, eax
je 0x4038b6
cmp byte [eax], 0
jne 0x40393e
mov dword [esp], str.SystemDrive
call sub.msvcrt.dll_getenv
mov ebx, eax
test eax, eax
je 0x403939
movsx edx, byte [eax]
mov eax, dword [sym.imp.msvcrt.dll___mb_cur_max]
cmp dword [eax], 1
jne 0x4038e7
mov eax, dword [sym.imp.msvcrt.dll__pctype]
mov eax, dword [eax]
movzx eax, word [eax + edx*2]
and eax, 0x103
jmp 0x4038f7
mov dword [esp + 4], 0x103
mov dword [esp], edx
call sub.msvcrt.dll__isctype
test eax, eax
je 0x403939
cmp byte [ebx + 1], 0x3a
jne 0x403939
mov dword [esp + 8], 2
mov dword [esp + 4], ebx
lea ebx, [ebp - 0x48]
mov dword [esp], ebx
call sub.msvcrt.dll_strncpy
mov dword [ebp - 0x46], 0x6f72505c
mov dword [ebp - 0x42], 0x6d617267
mov dword [ebp - 0x3e], 0x6c694620
mov word [ebp - 0x3a], 0x7365
mov byte [ebp - 0x38], 0
jmp 0x40393e
mov ebx, str.C:Program_Files
mov dword [esp + 4], ebx
mov dword [esp], str.ProgramFiles
call fcn.00403954
add esp, 0x54
pop ebx
pop ebp
ret

Function at 0x4040f5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov eax, 0x1020
call fcn.0044e410
mov dword [esp], str.PUBLICKEY
call fcn.00403a4f
mov dword [ebp - 0x100c], eax
test eax, eax
jne 0x404126
mov dword [esp], str.Public_key_not_defined
call fcn.00401520
mov dword [esp + 4], 0x460731
mov eax, dword [ebp - 0x100c]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov esi, eax
test eax, eax
jne 0x404172
mov eax, dword [ebp - 0x100c]
mov dword [esp], eax
call fcn.004123aa
mov dword [esp + 4], 0x460731
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov esi, eax
test eax, eax
jne 0x404172
mov dword [esp], str.Could_not_open_public_key_file
call fcn.00401520
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 1
lea eax, [ebp - 0x1008]
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov ebx, eax
test eax, eax
jne 0x4041a6
mov dword [esp], str.Public_key_read_failed
call fcn.00401520
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x100c], eax
mov dword [esp + 8], ebx
lea eax, [ebp - 0x100c]
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.0041de30
mov dword [0x471290], eax
test eax, eax
jne 0x4041e1
mov dword [esp], str.Public_key_convert_failed
call fcn.00401520
mov dword [esp], esi
call sub.msvcrt.dll_fclose
add esp, 0x1020
pop ebx
pop esi
pop ebp
ret