joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47bf90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x47bfa9
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x47bfa2
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
movzx edx, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x47bfbd
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0047b95c
test bl, bl
jne 0x47c097
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x48dd50
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x47bff5
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x47c00a
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0047be64
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
movzx ebx, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x47c03d
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x47bfea
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x47c061
mov eax, 4
mov edx, dword [ebp + 0xc]
movzx ecx, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x47c073
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x47c088
jmp 0x47c158
cmp bl, 1
jne 0x47c158
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x48ddaa
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x47c0b7
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x47c0cc
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0047be64
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
movzx ecx, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x47c0ff
sub ebx, 6
inc dword [ebp - 8]
jne 0x47c0ac
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x47c127
mov eax, 4
mov ebx, dword [ebp + 0xc]
movzx edx, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x47c139
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x47c14e
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0047b9dc
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x481014
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48121e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xfd
lea eax, [ebp - 4]
mov edx, 0xfe
call fcn.00405168
jmp 0x4811e1
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404ed8
push eax
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405168
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404a9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481225
lea eax, [ebp - 4]
call fcn.00404a48
ret

Function at 0x4817e0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ec8
mov eax, dword [ebp - 8]
call fcn.00404ec8
xor eax, eax
push ebp
push 0x481cb3
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
push 0x64
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, dword [0x4817bc]
call fcn.00405d6c
add esp, 4
mov eax, dword [ebp - 0x10]
push eax
push 0
call sub.user32.dll_GetKeyboardLayoutList
mov ebx, eax
jmp 0x4819e8
cmp ebx, 1
jl 0x481c7a
mov eax, dword [ebp - 0x10]
push eax
push ebx
call sub.user32.dll_GetKeyboardLayoutList
mov ebx, eax
mov esi, ebx
dec esi
test esi, esi
jl 0x481c7a
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + ebx*4]
push eax
call sub.imm32.dll_ImmIsIME
test al, al
je 0x481c72
lea eax, [ebp - 0x115]
xor ecx, ecx
mov edx, 0x104
call fcn.00403550
push 0x104
lea eax, [ebp - 0x115]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + ebx*4]
push eax
call sub.imm32.dll_ImmGetIMEFileNameA
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x115]
mov ecx, 0x105
call fcn.00404cb8
jmp 0x481bf9
lea edx, [ebp - 0x11c]
mov eax, dword [ebp - 0xc]
call fcn.00408a60
mov eax, dword [ebp - 0x11c]
push eax
lea edx, [ebp - 0x120]
mov eax, dword [ebp - 4]
call fcn.00408a60
mov edx, dword [ebp - 0x120]
pop eax
call fcn.00404e70
jne 0x481c32
mov eax, dword [ebp - 0x10]
mov edi, dword [eax + ebx*4]
jmp 0x481c7a
push 0x104
lea eax, [ebp - 0x115]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + ebx*4]
push eax
call sub.imm32.dll_ImmGetDescriptionA
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x115]
mov ecx, 0x105
call fcn.00404cb8
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404e70
jne 0x481c72
mov eax, dword [ebp - 0x10]
mov edi, dword [eax + ebx*4]
jmp 0x481c7a
inc ebx
dec esi
jne 0x481a0b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481cba
lea eax, [ebp - 0x120]
mov edx, 2
call fcn.00404a6c
lea eax, [ebp - 0x10]
mov edx, dword [0x4817bc]
call fcn.00405d78
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404a6c
ret
Function at 0x481cc4
Capabilities:
Check if file exists
Copy file
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffddc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ec8
mov eax, dword [ebp - 8]
call fcn.00404ec8
xor eax, eax
push ebp
push 0x4821e2
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea eax, [ebp - 0x111]
xor ecx, ecx
mov edx, 0x104
call fcn.00403550
lea eax, [ebp - 0x216]
xor ecx, ecx
mov edx, 0x104
call fcn.00403550
push 0x104
lea eax, [ebp - 0x216]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov ebx, eax
jmp 0x481ee0
test ebx, ebx
jne 0x481ef3
mov dword [0x488a84], 0x271b
jmp 0x4821b7
cmp byte [ebp + ebx - 0x217], 0x5c
je 0x481f06
mov byte [ebp + ebx - 0x216], 0x5c
inc ebx
push 0x4821f4
lea eax, [ebp + ebx - 0x216]
push eax
call sub.kernel32.dll_lstrcpyA
jmp 0x4820b5
mov eax, 0x48eea4
lea edx, [ebp - 0x216]
mov ecx, 0x105
call fcn.00404cb8
lea eax, [ebp - 0x216]
push eax
call sub.shlwapi.dll_PathFileExistsA
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x482146
lea eax, [ebp - 0x21c]
lea edx, [ebp - 0x216]
mov ecx, 0x105
call fcn.00404cb8
mov eax, dword [ebp - 0x21c]
call fcn.00404ed8
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x48211b
mov dword [0x488a84], 0x271c
lea eax, [ebp - 0x216]
push eax
call sub.shlwapi.dll_PathFileExistsA
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x482146
mov eax, dword [ebp - 0xc]
call fcn.00404ed8
push eax
lea eax, [ebp - 0x216]
push eax
call sub.kernel32.dll_lstrcpyA
push 0
lea eax, [ebp - 0x216]
push eax
lea edx, [ebp - 0x224]
xor eax, eax
call fcn.004032c4
mov eax, dword [ebp - 0x224]
lea edx, [ebp - 0x220]
call fcn.00409578
lea eax, [ebp - 0x220]
mov edx, dword [ebp - 4]
call fcn.00404d14
mov eax, dword [ebp - 0x220]
call fcn.00404ed8
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4821a0
mov dword [0x488a84], 0x271d
mov eax, dword [ebp - 8]
call fcn.00404ed8
push eax
lea eax, [ebp - 0x216]
push eax
call sub.imm32.dll_ImmInstallIMEA
mov esi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4821e9
lea eax, [ebp - 0x224]
mov edx, 3
call fcn.00404a6c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404a6c
ret
Function at 0x482ec4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ec8
xor eax, eax
push ebp
push 0x483450
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403550
jmp 0x483092
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], bx
mov dword [ebp - 0x54], 0xc
jmp 0x483248
xor eax, eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x60], 0xc
xor eax, eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], 0xffffffff
jmp 0x483404
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x4000000
push 0
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 4]
call fcn.00404ed8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x483438
mov ebx, dword [ebp - 0x70]
jmp 0x48343a
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483457
lea eax, [ebp - 4]
call fcn.00404a48
ret
Function at 0x4104e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40c015
lea edi, [esi - 0xb015]
push edi
or ebp, 0xffffffff
jmp 0x410502
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x410509
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4104f8
mov eax, 1
add ebx, ebx
jne 0x41051b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x410510
jne 0x41052c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x410510
xor ecx, ecx
sub eax, 3
jb 0x410540
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4105b2
mov ebp, eax
add ebx, ebx
jne 0x41054b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x410558
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41057c
inc ecx
add ebx, ebx
jne 0x410568
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41055d
jne 0x410579
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41055d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41059c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41058d
jmp 0x4104fe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41059c
add edi, ecx
jmp 0x4104fe
pop esi
mov edi, esi
mov ecx, 0x210
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4105ba
cmp byte [edi], 5
jne 0x4105ba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4105bf
lea edi, [esi + 0xe000]
mov eax, dword [edi]
or eax, eax
je 0x41062e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x123e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1249c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4105ec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x124a0]
or eax, eax
je 0x410628
mov dword [ebx], eax
add ebx, 4
jmp 0x410609
call dword [esi + 0x124b0]
mov ebp, dword [esi + 0x124a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x410662
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x4010c3
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, eax
mov eax, dword [ebp + 0x18]
and dword [esi], 0
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x40113b
cmp word [ebx + 8], 2
jne 0x401118
cmp word [ebx + 0xa], 4
jne 0x401118
mov edi, dword [ebx + 0xc]
jmp 0x401112
push dword [eax]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401060
test eax, eax
mov dword [esi], eax
je 0x401136
lea esi, [eax + 0x1c]
add edi, 4
mov eax, dword [edi]
test eax, eax
jne 0x4010f6
mov esi, dword [ebp + 0x18]
push 0x400
push dword [ebx]
push esi
call fcn.0040cb50
add esp, 0xc
mov byte [esi + 0x400], 0
xor eax, eax
jmp 0x401161
push 8
pop eax
jmp 0x401161
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
mov eax, 0x2af9
sub ecx, eax
je 0x401161
dec ecx
je 0x40115c
dec ecx
je 0x401155
dec ecx
jmp 0x401161
mov eax, 0x2afb
jmp 0x401161
mov eax, 0x2afa
pop edi
pop esi
pop ebx
pop ebp
ret 0x14

Function at 0x40170f
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1b0]
sub esp, 0x230
cmp dword [0x423f08], 0
mov eax, dword [0x4220b8]
mov dword [ebp + 0x1ac], eax
mov dword [ebp - 0x80], str.getaddrinfo
mov dword [ebp - 0x7c], 0x4012ea
mov dword [ebp - 0x78], str.getnameinfo
mov dword [ebp - 0x74], 0x401564
mov dword [ebp - 0x70], str.freeaddrinfo
mov dword [ebp - 0x6c], fcn.004012b1
jne 0x401864
push 0x104
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x40185a
push ebx
push esi
push edi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp + 0xa0]
push eax
call fcn.0040c9e0
lea eax, [ebp + 0xa0]
push str.ws2_32
push eax
call fcn.0040c9f0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x10
lea eax, [ebp + 0xa0]
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4017d1
push str.getaddrinfo
push esi
call edi
test eax, eax
jne 0x4017cd
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
jne 0x40181d
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp + 0xa0]
push eax
call fcn.0040c9e0
lea eax, [ebp + 0xa0]
push str.wship6
push eax
call fcn.0040c9f0
add esp, 0x10
lea eax, [ebp + 0xa0]
push eax
call ebx
mov esi, eax
test esi, esi
je 0x401857
push str.getaddrinfo
push esi
call edi
test eax, eax
jne 0x401819
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
je 0x401857
xor ebx, ebx
push dword [ebp + ebx*8 - 0x80]
push esi
call edi
test eax, eax
mov dword [ebp + ebx*8 - 0x7c], eax
je 0x401836
inc ebx
cmp ebx, 3
jl 0x40181f
jmp 0x40183f
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
je 0x401857
xor eax, eax
mov ecx, dword [ebp + eax - 0x7c]
mov dword [eax + 0x422d20], ecx
add eax, 8
cmp eax, 0x18
jl 0x401845
pop edi
pop esi
pop ebx
mov dword [0x423f08], 1
movzx eax, word [ebp + 0x1b8]
mov ecx, dword [ebp + 0x1ac]
mov eax, dword [eax*8 + 0x422d20]
call fcn.0040f3d9
add ebp, 0x1b0
leave
ret 4
Function at 0x4022ec
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x1b4]
sub esp, 0x234
mov eax, dword [0x4220b8]
and dword [ebp - 0x7c], 0
push edi
mov dword [ebp + 0x1b0], eax
xor eax, eax
mov ecx, 0x8a
lea edi, [ebp - 0x78]
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 2
mov edi, eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
mov dword [ebp - 0x80], eax
je 0x40238a
lea ecx, [ebp - 0x7c]
push ecx
push eax
mov dword [ebp - 0x7c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40238a
push esi
cmp dword [ebp - 0x74], edi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x402362
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x402345
jmp 0x402384
push dword [ebp - 0x64]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x402381
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call esi
push dword [ebp - 0x80]
call esi
pop esi
mov ecx, dword [ebp + 0x1b0]
pop edi
call fcn.0040f3d9
add ebp, 0x1b4
leave
ret

Function at 0x40255d
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, eax
push 3
xor edx, edx
lea eax, [esi + 2]
pop edi
div edi
shl eax, 2
cmp dword [ebp + 8], 0
je 0x402616
cmp dword [ebp + 0xc], eax
jae 0x402587
xor eax, eax
jmp 0x402616
mov eax, dword [ebp + 8]
push ebx
lea ebx, [ecx + esi]
jmp 0x4025ee
movzx esi, byte [ecx]
mov edi, esi
shr esi, 2
mov dl, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__ccccccc]
and edi, 3
shl edi, 4
mov byte [eax], dl
inc eax
inc ecx
cmp ecx, ebx
jae 0x4025f4
movzx edx, byte [ecx]
mov esi, edx
and edx, 0xf
shr esi, 4
shl edx, 2
or esi, edi
mov dword [ebp + 0xc], edx
mov dl, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__ccccccc]
mov byte [eax], dl
inc eax
inc ecx
cmp ecx, ebx
jae 0x402602
movzx esi, byte [ecx]
mov edi, esi
shr edi, 6
or edi, dword [ebp + 0xc]
and esi, 0x3f
mov dl, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__ccccccc]
mov byte [eax], dl
mov dl, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__ccccccc]
inc eax
mov byte [eax], dl
inc eax
inc ecx
cmp ecx, ebx
jb 0x402590
jmp 0x402612
mov cl, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__ccccccc]
mov byte [eax], cl
inc eax
mov byte [eax], 0x3d
jmp 0x40260d
mov ecx, dword [ebp + 0xc]
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ccccccccccccccccccccccccccccccccccccccccccc_ccc_456789:__ccccccc]
mov byte [eax], cl
inc eax
mov byte [eax], 0x3d
inc eax
sub eax, dword [ebp + 8]
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x402c36
Capabilities:
Resume thread

Disassembly:
push esi
push edi
mov esi, eax
call fcn.00402c11
mov edi, eax
test edi, edi
jne 0x402c75
mov eax, dword [esp + 0xc]
and dword [esi + 8], edi
mov dword [esi + 4], eax
lea eax, [esi + 0x10]
push eax
push 4
push esi
push 0x402b55
push edi
push edi
call fcn.0040da7a
mov edi, eax
add esp, 0x18
test edi, edi
je 0x402c75
push edi
mov dword [esi + 0xc], edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, edi
pop edi
pop esi
ret 4

Function at 0x403432
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, eax
test esi, esi
mov eax, dword [ecx]
jbe 0x403457
push ebx
push edi
movzx ebx, byte [edx]
mov edi, eax
shl eax, 8
shr edi, 0x18
or eax, ebx
xor eax, dword [edi*4 + 0x41be68]
inc edx
dec esi
jne 0x40343d
pop edi
pop ebx
mov dword [ecx], eax
pop esi
ret

Function at 0x4034aa
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor esi, esi
mov edi, ecx
cmp edi, esi
mov dword [eax + 0x14], esi
je 0x40350b
cmp word [edi], si
je 0x40350b
push eax
push edi
call fcn.0040dd0c
test eax, eax
pop ecx
pop ecx
jne 0x40350b
push esi
push 0x8000000
push 3
push esi
push 3
push connect
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp - 0xc], ebx
je 0x40350b
mov edi, 0x1000
push edi
call fcn.0040dbac
cmp eax, esi
pop ecx
mov dword [ebp - 4], eax
jne 0x403514
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
mov ecx, dword [ebp + 8]
push esi
mov dword [ecx], esi
lea ecx, [ebp - 8]
push ecx
push edi
push eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x403547
mov eax, dword [ebp - 8]
cmp eax, esi
je 0x40354d
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
call fcn.00403432
push esi
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp - 4]
push dword [ebp - 0xc]
call ebx
test eax, eax
jne 0x403529
push dword [ebp - 4]
call fcn.0040cad8
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp + 8]
call fcn.0040345b
jmp 0x40350d
Function at 0x403c40
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4192f6
call fcn.0040fbd0
sub esp, 0x5c
mov eax, dword [0x4220b8]
push esi
push str.CDownloadFile::ContinueDownload_begin.__n
mov dword [ebp - 0x10], eax
call fcn.00408fb4
lea ecx, [ebp - 0x68]
lea esi, [ebx + 0x38]
mov eax, dword [esi]
push ecx
push eax
call fcn.0040dd0c
add esp, 0xc
test eax, eax
je 0x403c7d
xor eax, eax
jmp 0x403df9
mov eax, dword [esi]
push edi
mov edi, dword [eax - 0xc]
push 0x5c
call fcn.004045cd
mov ecx, edi
sub ecx, eax
lea eax, [ebp - 0x38]
push eax
dec ecx
mov eax, esi
call fcn.004045eb
xor edi, edi
mov dword [ebp - 4], edi
push dword [ebx + 0x40]
push str.CDownloadFile::ContinueDownload_m_nThreadNumber_d.__n
call fcn.00408fb4
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop ecx
pop ecx
push dword [ebx + 0x48]
push edi
push str.ThreadNumber
push dword [ebp - 0x38]
call esi
cmp dword [ebx + 0x40], eax
jne 0x403deb
push dword [ebx + 0x48]
push edi
push str.DownloadSize
push dword [ebp - 0x38]
call esi
mov dword [ebp - 0x40], eax
mov eax, dword [ebx + 0x40]
shl eax, 3
push eax
call fcn.0040c69e
and dword [ebp - 0x3c], 0
cmp dword [ebx + 0x40], 0
mov edi, eax
mov eax, dword [ebp - 0x40]
pop ecx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x34], eax
jle 0x403d65
push dword [ebp - 0x3c]
lea eax, [ebp - 0x30]
push str.Thread_dEnd
push eax
call fcn.0040e1dc
add esp, 0xc
push dword [ebx + 0x48]
lea eax, [ebp - 0x30]
push 0
push eax
push dword [ebp - 0x38]
call esi
mov ecx, dword [ebp - 0x3c]
push ecx
mov dword [edi + ecx*8], eax
lea eax, [ebp - 0x30]
push str.Thread_dDownload
push eax
call fcn.0040e1dc
add esp, 0xc
push dword [ebx + 0x48]
lea eax, [ebp - 0x30]
push 0
push eax
push dword [ebp - 0x38]
call esi
mov ecx, dword [ebp - 0x3c]
mov edx, dword [edi + ecx*8]
mov dword [edi + ecx*8 + 4], eax
sub edx, eax
mov eax, dword [ebp - 0x34]
inc ecx
cmp ecx, dword [ebx + 0x40]
lea eax, [eax + edx + 1]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x3c], ecx
jl 0x403cfe
push dword [ebp - 0x34]
push str.CDownloadFile::ContinueDownload_lTmp_d.__n
call fcn.00408fb4
mov eax, dword [ebx + 0x30]
cmp dword [ebp - 0x34], eax
pop ecx
pop ecx
je 0x403d86
push edi
call fcn.0040e24b
xor edi, edi
jmp 0x403dea
mov ecx, dword [ebp - 0x40]
mov dword [ebx + 0x3c], ecx
cmp dword [ebx + 0x3c], eax
jge 0x403dd5
and dword [ebp - 0x34], 0
cmp dword [ebx + 0x40], 0
jle 0x403dd5
push 0x44
call fcn.0040c6a3
test eax, eax
pop ecx
je 0x403dc0
mov ecx, dword [ebp - 0x34]
shl ecx, 3
push dword [ecx + edi]
mov edi, dword [ecx + edi + 4]
mov esi, eax
call fcn.00405472
mov edi, dword [ebp - 0x44]
jmp 0x403dc2
xor eax, eax
push ebx
mov esi, eax
call fcn.00402df2
inc dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebx + 0x40]
jl 0x403d9b
push edi
call fcn.0040e24b
mov dword [esp], str.CDownloadFile::ContinueDownload_OK.__n
call fcn.00408fb4
xor edi, edi
inc edi
pop ecx
mov eax, dword [ebp - 0x38]
add eax, 0xfffffff0
call fcn.0040252d
mov eax, edi
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
call fcn.0040f3d9
leave
ret