joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cd060
Capabilities:
Find taskbar

Disassembly:
push ebx
mov ebx, eax
push 0
push 0x4cd09c
call sub.user32.dll_FindWindowA
test eax, eax
jbe 0x4cd099
push 0
push 0
mov edx, dword [ebx + 0x60c]
mov ecx, dword [edx + 0x210]
cmp ecx, dword [edx + 0x208]
setl cl
mov dl, byte [edx + 0x210]
xchg edx, ecx
call fcn.0045c494
pop ebx
ret

Function at 0x4cd4b0
Capabilities:
Find taskbar
Hide graphical window
Hide the windows taskbar

Disassembly:
push ebx
add esp, 0xffffff98
push 0
push 0x4cd528
call sub.user32.dll_FindWindowA
test eax, eax
jbe 0x4cd522
push 0
push 0x4cd538
push 0
push eax
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
jbe 0x4cd522
push esp
push ebx
call sub.user32.dll_GetWindowRect
test eax, eax
je 0x4cd522
cmp byte [0x4d7c30], 0
je 0x4cd4f7
push 0
push ebx
call sub.user32.dll_ShowWindow
jmp 0x4cd4ff
push 5
push ebx
call sub.user32.dll_ShowWindow
mov al, byte [0x4d7c30]
xor al, 1
mov byte [0x4d7c30], al
lea eax, [esp + 0x10]
push eax
push 0
push 0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x495d74]
call fcn.00498fd8
add esp, 0x68
pop ebx
ret

Function at 0x4cd594
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x6c1], 0
jne 0x4cd693
push 0
push 0x4cd69c
call sub.user32.dll_FindWindowA
test eax, eax
jbe 0x4cd687
push 0
push 0x4cd6ac
push 0
push eax
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
jbe 0x4cd693
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.user32.dll_GetWindowRect
test eax, eax
je 0x4cd693
mov eax, dword [ebp - 4]
call fcn.00439e38
push eax
call sub.user32.dll_SetForegroundWindow
xor eax, eax
push ebp
push 0x4cd650
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004d1c5c
test al, al
jne 0x4cd62d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2e0]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0x40]
jmp 0x4cd646
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.00410238
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.004d1b5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cd65a
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00439e38
push eax
call sub.user32.dll_PostMessageA
call fcn.0045c374
test al, al
je 0x4cd693
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x6c4]
call fcn.004963b4
jmp 0x4cd693
mov cl, 1
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004c8d14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d3adc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404054
mov eax, dword [ebp - 8]
call fcn.00404054
mov eax, dword [ebp + 0xc]
call fcn.00404054
mov eax, dword [ebp + 8]
call fcn.00404054
xor eax, eax
push ebp
push 0x4d3ba1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00407684
mov dword [ebp - 0x44], 0x3c
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ebx
mov eax, dword [ebp - 4]
call fcn.00404064
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
call fcn.00404064
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
call fcn.00404064
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
call fcn.00404064
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExA
neg eax
sbb ebx, ebx
neg ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3ba8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403c28
lea eax, [ebp + 8]
mov edx, 2
call fcn.00403c28
ret

Function at 0x4d3bb4
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x4d3bd9
cmp dword [esp + 0x10], 2
jne 0x4d3bd9
cmp dword [esp + 4], 6
jae 0x4d3bdd
xor eax, eax
jmp 0x4d3bdf
mov al, 1
add esp, 0x94
ret
Function at 0xa527b4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0xa6603c], 0x8088405
inc edx
mov dword [0xa6603c], edx
mul edx
mov eax, edx
ret

Function at 0xa58e4c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ecx, edx
mov dword [ebp - 4], eax
xor ebx, ebx
mov esi, dword [ebp - 4]
lea edi, [ebp - 0x109]
mov byte [esi], bl
mov eax, ebx
cdq
idiv dword [ebp - 8]
add edx, ecx
mov al, byte [edx]
mov byte [edi], al
inc ebx
inc edi
inc esi
cmp ebx, 0x100
jne 0xa58e6b
xor esi, esi
mov ebx, pe_nt_image_headers32
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x109]
xor ecx, ecx
mov cl, byte [eax]
add esi, ecx
xor ecx, ecx
mov cl, byte [edx]
add esi, ecx
and esi, 0xff
mov cl, byte [eax]
mov byte [ebp - 9], cl
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + esi]
mov byte [eax], cl
mov ecx, dword [ebp - 4]
lea edi, [ecx + esi]
mov cl, byte [ebp - 9]
mov byte [edi], cl
inc edx
inc eax
dec ebx
jne 0xa58e94
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
add eax, 0x100
mov ecx, pe_nt_image_headers32
call fcn.00a551d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xa58ef4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
xor ecx, ecx
xor edx, edx
mov ebx, dword [ebp + 8]
dec ebx
test ebx, ebx
jl 0xa58f85
inc ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], 0
inc ecx
and cl, 0xff
xor ebx, ebx
mov bl, cl
add dl, byte [eax + ebx]
and dl, 0xff
xor ebx, ebx
mov bl, cl
mov bl, byte [eax + ebx]
mov byte [ebp - 9], bl
mov esi, edx
and esi, 0xff
xor ebx, ebx
mov bl, cl
lea edi, [eax + ebx]
mov bl, byte [eax + esi]
mov byte [edi], bl
mov bl, byte [ebp - 9]
mov byte [eax + esi], bl
xor ebx, ebx
mov bl, cl
mov bl, byte [eax + ebx]
mov esi, edx
and esi, 0xff
add bl, byte [eax + esi]
and bl, 0xff
mov byte [ebp - 9], bl
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 0x10]
mov bl, byte [ebx + esi]
movzx esi, byte [ebp - 9]
xor bl, byte [eax + esi]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0x10]
mov byte [esi + edi], bl
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0xa58f1a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0xa5f1e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
mov ebx, eax
xor ecx, ecx
cmp dword [0xa6530c], 4
jge 0xa5f206
mov eax, dword [edx + ecx*4]
xchg al, ah
rol eax, 0x10
xchg al, ah
mov dword [ebx], eax
add ebx, 4
inc ecx
cmp ecx, 0x10
jne 0xa5f1ef
jmp 0xa5f216
mov eax, dword [edx + ecx*4]
bswap eax
mov dword [ebx], eax
add ebx, 4
inc ecx
cmp ecx, 0x10
jne 0xa5f206
mov ecx, 0x40
pop edx
cmp dl, 0
je 0xa5f239
mov eax, dword [ebx - 0xc]
xor eax, dword [ebx - 0x20]
xor eax, dword [ebx - 0x38]
xor eax, dword [ebx - 0x40]
rol eax, 1
mov dword [ebx], eax
add ebx, 4
dec ecx
jne 0xa5f221
pop ebx
ret
mov eax, dword [ebx - 0xc]
xor eax, dword [ebx - 0x20]
xor eax, dword [ebx - 0x38]
xor eax, dword [ebx - 0x40]
mov dword [ebx], eax
add ebx, 4
dec ecx
jne 0xa5f239
pop ebx
ret
Function at 0xa604a4
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff58
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x58], eax
xor edi, edi
mov dword [ebp - 0x10], 0x67452301
mov dword [ebp - 0xc], 0xefcdab89
mov dword [ebp - 8], 0x98badcfe
mov dword [ebp - 4], 0x10325476
mov eax, ebx
shl eax, 3
mov edx, eax
add edx, dword [ebp - 0x54]
cmp edx, dword [ebp - 0x54]
jae 0xa604ed
inc dword [ebp - 0x58]
add dword [ebp - 0x54], eax
mov eax, ebx
shr eax, 0x1d
add dword [ebp - 0x58], eax
mov esi, dword [ebp + 0xc]
cmp ebx, 0x40
jb 0xa60515
mov edx, esi
lea eax, [ebp - 0x10]
call fcn.00a605b4
add esi, 0x40
sub ebx, 0x40
cmp ebx, 0x40
jae 0xa60500
test ebx, ebx
jbe 0xa6052a
mov edi, ebx
lea eax, [ebp - 0xa8]
mov ecx, edi
mov edx, esi
call fcn.00a551d0
push edi
lea esi, [ebp - 0x10]
lea edi, [ebp - 0x68]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop edi
lea edx, [ebp - 0xa8]
lea eax, [ebp - 0x50]
mov ecx, edi
call fcn.00a551d0
mov byte [ebp + edi - 0x50], 0x80
lea eax, [edi + 1]
cmp eax, 0x38
jbe 0xa60573
mov edx, 0x40
sub edx, eax
lea eax, [ebp + eax - 0x50]
call fcn.00a551e4
lea edx, [ebp - 0x50]
lea eax, [ebp - 0x68]
call fcn.00a605b4
xor eax, eax
mov edx, 0x38
sub edx, eax
lea eax, [ebp + eax - 0x50]
call fcn.00a551e4
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x50]
lea eax, [ebp - 0x68]
call fcn.00a605b4
mov eax, dword [ebp + 8]
mov edi, eax
lea esi, [ebp - 0x68]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0xa6b651
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0xa6b66e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa6b65f
add dl, dl
jne 0xa6b679
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa6b6c5
xor eax, eax
add dl, dl
jne 0xa6b686
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa6b762
add dl, dl
jne 0xa6b695
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa6b6a0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa6b6ab
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa6b6b6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa6b6c0
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0xa6b665
mov eax, 1
add dl, dl
jne 0xa6b6d3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa6b6de
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa6b6ca
sub eax, 2
jne 0xa6b70d
mov ecx, 1
add dl, dl
jne 0xa6b6f3
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa6b6fe
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa6b6ea
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa6b665
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa6b724
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa6b72f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa6b71b
cmp eax, 0x7d00
jae 0xa6b752
cmp eax, 0x500
jb 0xa6b74d
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa6b665
cmp eax, 0x7f
ja 0xa6b755
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa6b665
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa6b77e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa6b665
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8
Function at 0x9eb920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x9eb96c
mov cl, byte [ebx + esi]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [ebx + esi], cl
inc esi
cmp esi, edi
jb 0x9eb932
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x9eb9d0
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9eba22
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x9eba28
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0xa03f15
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a03bd5

Function at 0xa08d0f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a08b8e

Function at 0xa0e2c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xa0e2ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xa0e2ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x629474
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [esp], bl
lea esp, [esp + 4]
jae fcn.0061403d
seta bh
lea edi, [edx - 0x5478548a]
setge bl
mov ebx, eax
xadd ecx, edi
sar di, cl
pushfd
mov edi, eax
call fcn.0057de79
lea edi, [ecx + 0x6973b4b7]
mov edi, dword [edx + 0x1c]
clc
add edi, eax
pushfd
pushal
mov edi, dword [edi + ecx*4]
cmc
cmp si, si
test edi, edi
lea esp, [esp + 0x24]
jle 0x57f21f
pushal
pushfd
pushal
lea esp, [esp + 0x44]
je 0x614030
pushfd
add eax, edi
mov byte [esp], 0x4e
cmc
cmp eax, edx
push 0x2a2f2df
lea esp, [esp + 8]
jb fcn.0061403d
pushfd
cmp eax, dword [esp + 4]
jmp 0x57f2d0
movsx si, al
mov esi, dword [esp + 0x34]
pushfd
pushfd
mov byte [esp + 4], bh
lea esp, [esp + 0x40]
jne 0x57e639
clc
stc
stc
movzx ecx, word [edi + ecx*2]
btr di, 2
jmp 0x5ffea9
Function at 0x4063e4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x406409
mov eax, dword [0x40a8a0]
cmp eax, 0xffffffff
je 0x406400
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40a8a0], 0xffffffff
jmp 0x40647c
cmp dword [0x440a60], ebx
je 0x40647c
cmp byte [0x440660], bl
je 0x406448
cmp dword [0x40a8a0], 0xffffffff
jne 0x406451
push 4
push 0x40000000
push 0x440660
call fcn.00405d98
cmp eax, 0xffffffff
mov dword [0x40a8a0], eax
je 0x40647c
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40a8a0], 0xffffffff
je 0x40647c
push esi
mov esi, 0x444a80
push 0x40aae8
push esi
call fcn.004060e6
lea eax, [ebp + 8]
push ebx
push eax
push esi
call fcn.004060d9
push eax
push esi
push dword [0x40a8a0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x40662e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x440254], esi
push edi
jne 0x406668
mov ecx, 0x440250
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x406644
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x440650
jl 0x40663f
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x40669d
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x440250]
xor eax, esi
inc ecx
dec edx
jne 0x406680
pop edi
pop esi
not eax
ret 0xc

Function at 0x34e3700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.034e378f
jae 0x34e370e
xor ecx, ecx
call fcn.034e378f
jae 0x34e373d
xor eax, eax
call fcn.034e378f
jae 0x34e374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.034e378f
adc al, al
jae 0x34e372f
jne 0x34e3779
stosb byte es:[edi], al
jmp 0x34e3711
call fcn.034e379b
sub ecx, ebx
jne 0x34e3756
call fcn.034e3799
jmp 0x34e3775
lodsb al, byte [esi]
shr eax, 1
je 0x34e3783
adc ecx, ecx
jmp 0x34e3772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.034e3799
cmp eax, 0x7d00
jae 0x34e3772
cmp ah, 5
jae 0x34e3773
cmp eax, 0x7f
ja 0x34e3774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x34e3711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x40637e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
test eax, 0x80000000
je 0x40639b
mov edx, eax
and edx, 0x7fffffff
mov dword [ebp - 0xc], edx
jmp 0x4063a0
xor edx, edx
mov dword [ebp - 0xc], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
and dword [ebp - 4], 0
mov eax, dword [ebx + 0x3c]
push edi
mov esi, dword [eax + ebx + 0x78]
lea eax, [eax + ebx + 0x18]
add esi, ebx
mov eax, dword [eax + 0x64]
mov edi, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x24]
add edi, ebx
add ecx, ebx
add eax, ebx
test edx, edx
mov dword [ebp - 0x10], eax
je 0x4063e0
mov eax, dword [esi + 0x10]
imul eax, eax, 0x3fffffff
add eax, edx
jmp 0x40641e
and dword [ebp + 8], 0
cmp dword [esi + 0x18], 0
jbe 0x406426
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
push dword [ebp + 0xc]
mov eax, dword [eax]
add eax, ebx
push eax
call fcn.0040644c
pop ecx
test eax, eax
pop ecx
jne 0x406414
inc dword [ebp + 8]
add dword [ebp - 8], 4
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x18]
jb 0x4063ed
jmp 0x406426
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
movzx eax, word [eax + ecx*2]
mov edi, dword [edi + eax*4]
add edi, ebx
mov dword [ebp - 4], edi
cmp dword [ebp + 0x10], 0
je 0x406444
cmp dword [ebp - 4], esi
jbe 0x406444
mov eax, dword [ebp - 0x14]
add eax, esi
cmp dword [ebp - 4], eax
jae 0x406444
push dword [ebp - 0xc]
push ebx
call dword [ebp + 0x10]
jmp 0x406447
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406476
Capabilities:
Encode data using xor

Disassembly:
push ecx
push eax
push esi
push edi
mov ecx, edi
sub ecx, eax
mov esi, eax
mov edi, esi
lodsb al, byte [esi]
xor al, 0x4c
stosb byte es:[edi], al
loop 0x406482
pop edi
pop esi
pop eax
pop ecx
ret

Function at 0x40648d
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
Function at 0x40981c
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
call fcn.0044cdd1
test byte [ebp + 8], 1
je 0x409817
push esi
call fcn.0044f050
pop ecx
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x40992a
Capabilities:
Delete file

Disassembly:
mov edi, edi
dec ecx
je 0x409990
dec ecx
je 0x409953
dec ecx
je 0x409933
push 3
pop edx
sub ecx, edx
je 0x409927
dec ecx
jne 0x409927
mov dword [eax + 0xc8], 1
mov dword [eax + 0xd8], 0x4e41
mov dword [eax + 0xdc], 0x4e42
mov dword [eax + 0xcc], edx
mov dword [eax + 0xd0], 0x4e92
mov dword [eax + 0xd4], 0x4e91
ret
mov dword [eax + 0xd4], 0x4e90
jmp 0x40999a
mov dword [eax + 0xc8], 1
mov dword [eax + 0xdc], 0x4e2c
mov dword [eax + 0xd4], 0x4e90
jmp 0x4099ae
mov dword [eax + 0xc8], 2
mov dword [eax + 0xd8], 0x4e2e
mov dword [eax + 0xdc], 0x4e2f
mov dword [eax + 0xcc], 3
mov dword [eax + 0xd0], 0x4e91
mov dword [eax + 0xd4], 0x4e8f
ret
mov dword [eax + 0xd4], 0x4e8f
mov dword [eax + 0xc8], 2
mov dword [eax + 0xdc], 0x4e3b
and dword [eax + 0xd0], 0
mov dword [eax + 0xd8], 0x4e2b
mov dword [eax + 0xcc], 5
ret

Function at 0x40cb2c
Capabilities:
Get hostname
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x32c
mov eax, dword [0x457694]
push esi
mov dword [ebp - 4], eax
mov esi, ecx
call fcn.0041eaa0
test eax, eax
je 0x40cb0f
push 2
jmp 0x40cb27
call fcn.0041fea7
test al, al
je 0x40cb33
cmp dword [0x4577a4], 0
jne 0x40cc32
push 5
mov ecx, esi
call fcn.0040c0b3
jmp 0x40cc32
cmp dword [0x4577a4], 0
jne 0x40cc32
push ebx
push edi
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x12c
call fcn.0041ff8a
test eax, eax
je 0x40cba1
mov edi, dword [esi + 0x18]
push edi
call fcn.0040bca5
test eax, eax
je 0x40cb89
push ebx
lea eax, [ebp - 0x108]
push eax
push 0x138
push dword [0x4577a0]
call dword [sym.imp.USER32.dll_LoadStringA]
lea edi, [ebp - 0x108]
push edi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x70
call fcn.0044f05c
test eax, eax
pop ecx
je 0x40cbbc
push esi
push 0x40caa4
mov ecx, eax
call fcn.0043b6aa
jmp 0x40cbbe
xor eax, eax
test eax, eax
mov dword [esi + 0x14], eax
je 0x40cc30
push 0
push 1
push 0x80000001
push dword [0x4575dc]
lea ecx, [ebp - 0x32c]
call fcn.0044f3e7
push 0x14
push 0x402140
lea ecx, [ebp - 0x32c]
call fcn.0044f593
mov edi, eax
lea eax, [esi + 0xc]
imul edi, edi, 0x3e8
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov ecx, dword [esi + 0x14]
push 0xffffffffffffffff
push 0xffffffffffffffff
push edi
push 0x514
push dword [0x4577a0]
lea eax, [ebp - 0x310]
push 2
push 1
push eax
call fcn.0043b4d0
lea ecx, [ebp - 0x32c]
call fcn.0044f73c
pop edi
pop ebx
mov ecx, dword [ebp - 4]
pop esi
call fcn.0044ed62
leave
ret
Function at 0x40d0a7
Capabilities:
Set socket configuration

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x457694]
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
push edi
mov edi, 0x80004005
mov dword [ebp - 4], eax
mov eax, edi
je 0x40d20d
cmp ecx, 1
je 0x40d1ee
cmp ecx, 2
je 0x40d202
cmp ecx, 4
je 0x40d1a1
cmp ecx, 5
je 0x40d116
cmp ecx, 6
jle 0x40d261
cmp ecx, 9
jg 0x40d261
push dword [esi]
call fcn.0040bca5
neg eax
sbb eax, eax
and eax, 0x80070057
jmp 0x40d261
push 0x2f
push dword [esi]
call fcn.004504b0
mov ebx, eax
test ebx, ebx
je 0x40d15b
mov byte [ebx], 0
push dword [esi]
mov ecx, esi
inc ebx
call fcn.0040c947
test eax, eax
jge 0x40d147
push dword [esi]
mov ecx, esi
call fcn.0040c8cf
test eax, eax
jl 0x40d261
push ebx
call fcn.0041f746
push dword [esi]
mov edi, eax
call fcn.0044f050
pop ecx
mov dword [esi], edi
jmp 0x40d101
push 0x104
lea eax, [ebp - 0x108]
push eax
call fcn.0040c5e7
test eax, eax
je 0x40d1c6
lea eax, [ebp - 0x108]
push eax
mov ecx, esi
call fcn.0040c947
test eax, eax
jge 0x40d101
lea eax, [ebp - 0x108]
push eax
mov ecx, esi
call fcn.0040c8cf
test eax, eax
jl 0x40d261
jmp 0x40d101
push 0x2f
push dword [esi]
call fcn.004504b0
test eax, eax
jne 0x40d1e3
push 0x100
push dword [esi]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.004206db
test eax, eax
jne 0x40d1cd
mov eax, edi
jmp 0x40d261
push dword [esi]
call fcn.0044f050
pop ecx
lea eax, [ebp - 0x104]
push eax
call fcn.0041f746
mov dword [esi], eax
push dword [esi]
mov ecx, esi
call fcn.0040d02c
jmp 0x40d261
push dword [esi]
mov ecx, esi
call fcn.0040c947
test eax, eax
jge 0x40d261
cmp eax, 0x810001fe
je 0x40d261
push dword [esi]
mov ecx, esi
call fcn.0040c8cf
jmp 0x40d261
push 0x2f
push dword [esi]
call fcn.004504b0
test eax, eax
je 0x40d230
push dword [esi]
mov ecx, esi
call fcn.0040d02c
test eax, eax
jl 0x40d261
mov dword [esi + 8], 4
jmp 0x40d261
mov edi, dword [esi]
push edi
call fcn.0040c439
test eax, eax
mov ecx, esi
push edi
je 0x40d251
call fcn.0040c947
test eax, eax
jl 0x40d261
mov dword [esi + 8], 1
jmp 0x40d261
call fcn.0040c8cf
test eax, eax
jl 0x40d261
mov dword [esi + 8], 2
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0044ed62
leave
ret

Function at 0x40e85a
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
xor edi, edi
lea ecx, [esi + 0x14]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
call fcn.004500f8
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
call fcn.0040e538
pop edi
mov eax, esi
pop esi
pop ebp
ret 8