joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d8e0
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40dae9
sub esp, 0x44
mov eax, dword [esp + 0x48]
cmp eax, 0x7000000
jle 0x40dace
mov eax, 0x7000000
mov dword [esp + 0x48], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov dword [ecx + 0x94], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x98], ebp
lea ecx, [ebp + ebx]
and ecx, 0x3ffffff
inc ecx
mov dword [esp], ecx
call fcn.0044ba70
fld qword [esp + 4]
fld st(0)
fstp qword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, dword [esp + 0x2c]
shr esi, 0x1b
shl ebx, 5
or esi, ebx
mov ebx, ebp
add ebp, 1
mov ebp, 0
adc ebp, 0
test ebp, ebp
fstp st(0)
jne 0x40dae2
cmp ecx, 0x21
jae 0x40dae2
mov dword [esp + 0x10], esi
lea ebp, [0x5be160]
fld qword [ebp + ebx*8]
fld st(0)
fstp qword [esp + 0x1c]
fld qword [ebp + ecx*8]
fld st(0)
fstp qword [esp + 0x24]
mov dword [esp], eax
add edx, 0xfffffc01
mov eax, 0xffffffff
adc eax, 0
mov dword [esp + 4], eax
fstp st(0)
fstp st(0)
call fcn.00446b70
mov eax, dword [esp + 0x10]
and eax, 0xfffff
fld qword [esp + 8]
fld st(0)
fstp qword [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], 0
fstp st(0)
call fcn.00446c60
fld qword [esp + 0x3c]
fld qword [esp + 0x1c]
fld st(0)
faddp st(2)
fld qword [esp + 0x24]
fld st(1)
fsubp st(1)
fld qword [esp + 8]
fstp st(2)
fld st(1)
fmulp st(1)
fld qword [0x540400]
fstp st(2)
fld st(0)
fmulp st(2)
fld st(1)
faddp st(3)
fld qword [0x540458]
fstp st(2)
fld st(1)
fsubp st(3)
fld st(2)
fstp qword [esp + 0x14]
fld qword [0x5403f8]
fstp st(2)
fld st(2)
fucomp st(2)
mov dword [esp + 0x34], eax
fnstsw ax
sahf
mov eax, dword [esp + 0x34]
fstp st(0)
fstp st(0)
fstp st(0)
jbe 0x40da89
fld qword [0x5403f8]
fld st(0)
fstp qword [esp + 0x14]
fstp st(0)
mov eax, dword [esp + 0x48]
mov dword [esp + 0x34], eax
fild dword [esp + 0x34]
fld qword [0x540478]
fld st(0)
fmulp st(2)
fld qword [esp + 0x14]
fstp st(1)
fld st(1)
fmulp st(1)
fld st(0)
fnstcw word [esp + 0x38]
fldcw word [0x5ba0b8]
fistp dword [esp + 0x34]
mov eax, dword [esp + 0x34]
fldcw word [esp + 0x38]
inc eax
mov dword [esp + 0x4c], eax
fstp st(0)
fstp st(0)
add esp, 0x44
ret
test eax, eax
jne 0x40d90d
mov dword [esp + 0x4c], 0
add esp, 0x44
ret
call fcn.00425280
ud2
call fcn.00449fd0
jmp fcn.0040d8e0
Function at 0x411810
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x411a51
sub esp, 0x24
mov eax, dword [0x5e0e00]
test eax, eax
jne 0x411a39
lea eax, [0x5e0df0]
mov dword [esp], eax
call fcn.0040bae0
mov eax, dword [0x5cd604]
test eax, eax
je 0x41185d
mov eax, dword [eax + 8]
cmp eax, 0xcc
jne 0x411924
mov eax, dword [0x5cd5fc]
test eax, eax
jne 0x411906
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x5e20b8]
mov dword [esp + 8], eax
call fcn.0040db00
mov eax, dword [esp + 0xc]
mov dword [0x5cd5fc], eax
mov ecx, dword [0x5cd5d8]
mov dword [eax], ecx
mov eax, dword [0x5cd5fc]
mov dword [0x5cd5d8], eax
movzx eax, byte [0x5e1120]
test al, al
jne 0x411906
xor eax, eax
jmp 0x4118c3
lea ebp, [0x5e1120]
mov byte [ebp + edx], bl
lea eax, [edx + 1]
cmp eax, 0x80
jge 0x411906
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov ebx, ecx
sar ecx, 0x1f
sub edx, ecx
lea ecx, [edx + edx*4]
mov edx, ebx
sub ebx, ecx
cmp ebx, 5
jae 0x411a32
lea ecx, [0x5ba0d8]
movzx ebx, byte [ecx + ebx]
cmp edx, 0x80
jb 0x4118b6
jmp 0x411a32
mov eax, dword [0x5cd5fc]
mov ecx, dword [eax + 4]
mov dword [0x5cd5fc], ecx
mov ecx, dword [0x5cd604]
mov dword [eax + 4], ecx
mov dword [0x5cd604], eax
mov eax, dword [0x5cd604]
mov ecx, dword [eax + 8]
lea edx, [eax + 8]
cmp ecx, 0xcc
jae 0x411a2b
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ecx
mov dword [esp], edx
mov dword [esp + 4], 1
call fcn.00401550
mov eax, dword [esp + 0x14]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x20]
lea edx, [ecx + eax*4 + 0x10]
mov ebx, dword [0x5e0f70]
test ebx, ebx
jne 0x411a0a
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x10], edx
mov edx, dword [esp + 0x30]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x5e0f70]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x4119c8
mov edx, dword [esp + 0x34]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x38]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x14], edx
mov byte [0x5e08e8], 1
lea eax, [0x5e0df0]
mov dword [esp], eax
call fcn.0040bcb0
add esp, 0x24
ret
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], esi
mov dword [esp], ebx
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call fcn.0040df80
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 4], eax
call fcn.0040df80
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
call fcn.0040df80
jmp 0x4119af
mov dword [esp + 0x10], eax
mov dword [esp], edx
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
call fcn.0040df80
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
jmp 0x411979
call fcn.00425280
ud2
call fcn.00425280
ud2
lea eax, [0x529ddc]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.004267e0
ud2
call fcn.00449fd0
jmp fcn.00411810
Function at 0x41ff30
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42004c
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x41ffc0
cmp cl, 2
jne 0x420034
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.00420ba0
lea eax, [0x5d4954]
mov dword [esp], eax
call fcn.0040bae0
lea eax, [0x5d4930]
test byte [eax], al
mov eax, dword [0x5d4948]
mov ecx, dword [0x5d4930]
sub eax, ecx
mov dword [0x5d4948], eax
mov eax, dword [0x5d493c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x5d493c], ecx
lea eax, [0x5d4954]
mov dword [esp], eax
call fcn.0040bcb0
add esp, 0x14
ret
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x1c]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call fcn.00411810
lea eax, [0x5d4954]
mov dword [esp], eax
call fcn.0040bae0
lea eax, [0x5d490c]
test byte [eax], al
mov eax, dword [0x5d4924]
mov ecx, dword [0x5d490c]
sub eax, ecx
mov dword [0x5d4924], eax
mov eax, dword [0x5d4918]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x5d4918], ecx
lea eax, [0x5d4954]
mov dword [esp], eax
call fcn.0040bcb0
jmp 0x41ffbc
lea eax, [0x5271a0]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.004267e0
ud2
call fcn.00449fd0
jmp fcn.0041ff30
Function at 0x43e640
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x10
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0x1d0]
inc ecx
mov dword [eax + 0x1d0], ecx
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
lea edx, [ecx + 0xc4]
test byte [edx], al
mov edx, eax
mov dword [ecx + 0xc4], eax
lea eax, [edx + 0x88]
test byte [eax], al
mov eax, dword [edx + 0x18]
mov dword [edx + 0x88], eax
mov dword [esp], 0
lea eax, [0x52f2d8]
mov dword [esp + 4], eax
call fcn.00425500
test eax, eax
jne 0x43e73b
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [esp + 0xc], eax
lea ecx, [eax + 0x21c]
test byte [ecx], al
mov edx, dword [esp + 0x14]
mov dword [eax + 0x21c], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 0x220], edx
lea edx, [esp + 0x1c]
mov dword [eax + 0x224], edx
mov edx, dword [0x5cd5e4]
mov dword [esp], edx
mov dword [esp + 4], ecx
call fcn.00402510
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x228]
mov edx, dword [eax + 0x22c]
mov eax, dword [eax + 0x230]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], eax
nop
call fcn.00425d20
add esp, 0x10
ret
nop
call fcn.00425d20
add esp, 0x10
ret
Function at 0x443af0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x443b8f
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.0044bb37
lea ecx, [0x4498c0]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.00449eb0
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.00449fd0
jmp fcn.00443af0
Function at 0x44b460
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x44b4a0
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x5e1020]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x44b4db
je 0x44b52a
cmp ebx, 0x20
jbe 0x44b530
cmp ebx, 0x40
jbe 0x44b56e
jmp 0x44b5ff
test ebx, ebx
je 0x44b520
add eax, 0x10
test ax, 0xff0
je 0x44b50c
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x541ee0]
aesenc xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x541fe0]
jmp 0x44b4f8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x44b4f8
pxor xmm1, xmmword [0x5e1030]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
aesenc xmm2, xmm0
aesenc xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x5e1030]
pxor xmm2, xmmword [0x5e1040]
pxor xmm3, xmmword [0x5e1050]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x5e1030]
pxor xmm2, xmmword [0x5e1040]
pxor xmm3, xmmword [0x5e1050]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x44b65e
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
Function at 0x44c580
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword fs:[0x14]
mov edx, esp
sub esp, 0x238
mov dword [esp], esp
mov dword [esp + 4], 0x238
call fcn.0044c060
lea ecx, [esp + 0x30]
mov dword fs:[0x14], ecx
mov ebx, esp
sub esp, 0xd8
mov dword [ecx], esp
mov dword [ebx], esp
mov dword [esp], esp
mov dword [esp + 4], 0xd8
call fcn.0044c060
lea ebx, [esp + 0xd8]
mov dword [esp + 0x18], ebx
lea ecx, [esp - 0x8000]
mov dword [esp], ecx
add ecx, 0xb70
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
push eax
push dword [ebp + 0x10]
call dword [ebp + 8]
pop ecx
pop eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov esp, dword [ecx + 4]
pop dword fs:[0x14]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x44c680
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov eax, esp
mov dword [edx + 4], eax
sub eax, 0x10000
mov dword [edx], eax
add eax, 0xb70
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
lea esi, [ecx + 0x30]
mov dword fs:[0x14], esi
mov dword [edx + 0x18], ecx
mov dword [esi], edx
cld
call fcn.0044b3c0
call fcn.0042a6d0
ret
Function at 0x479fb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x47a0d2
sub esp, 0x4c
mov eax, dword [esp + 0x64]
test eax, eax
jle 0x47a0cb
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x40], ecx
mov eax, dword [0x5cd700]
mov dword [esp], eax
call fcn.004769e0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x44], ecx
mov dword [esp], eax
mov dword [esp + 4], 7
mov eax, dword [esp + 0x50]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call fcn.0043e860
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
test eax, eax
jne 0x47a0c5
test ecx, ecx
je 0x47a0b7
cmp ecx, 0x3e5
jne 0x47a08b
mov ecx, dword [0x5ca384]
mov edx, dword [0x5ca380]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
add esp, 0x4c
ret
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
lea eax, [0x5412a0]
mov dword [esp], eax
lea eax, [esp + 0x3c]
mov dword [esp + 4], eax
call fcn.0040b130
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x38]
jmp 0x47a07b
lea ecx, [0x540358]
lea edx, [0x5412a0]
jmp 0x47a07b
xor edx, edx
mov ecx, edx
jmp 0x47a07b
xor ecx, ecx
jmp 0x479fd9
call fcn.00449fd0
jmp fcn.00479fb0
Function at 0x47ca00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x47cb0c
sub esp, 0x4c
mov eax, dword [0x5cd838]
mov dword [esp], eax
call fcn.004769e0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x3c], ecx
mov dword [esp], eax
mov dword [esp + 4], 9
mov eax, dword [esp + 0x50]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x28], eax
call fcn.0043e860
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
cmp eax, 0xffffffff
jne 0x47cb06
test ecx, ecx
je 0x47caf8
cmp ecx, 0x3e5
jne 0x47cad4
mov eax, dword [0x5ca380]
mov ecx, dword [0x5ca384]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x4c
ret
mov dword [esp + 0x38], ecx
lea eax, [0x5412a0]
mov dword [esp], eax
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
call fcn.0040b130
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
jmp 0x47cac8
lea ecx, [0x5402ec]
lea eax, [0x5412a0]
jmp 0x47cac8
xor ecx, ecx
mov eax, ecx
jmp 0x47cac8
call fcn.00449fd0
jmp fcn.0047ca00
Function at 0x4acfd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4ad06c
sub esp, 0xc
lea eax, [0x5047e0]
mov dword [esp], eax
call fcn.0040d710
mov eax, dword [esp + 4]
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
call fcn.004acf10
mov eax, dword [esp + 8]
xor ecx, ecx
jmp 0x4ad042
mov ebp, ebx
shl ebx, 0xa
lea esi, [eax + ebx]
mov dword [esi + ecx*4], edx
lea ebx, [ebp + 1]
cmp ebx, 8
jge 0x4ad041
mov ebp, edx
and edx, 0xff
mov edx, dword [eax + edx*4]
shr ebp, 8
xor edx, ebp
cmp ebx, 8
jb 0x4ad017
jmp 0x4ad05e
inc ecx
cmp ecx, 0x100
jge 0x4ad056
jae 0x4ad065
mov edx, dword [eax + ecx*4]
mov ebx, 1
jmp 0x4ad025
mov dword [esp + 0x14], eax
add esp, 0xc
ret
call fcn.00425280
ud2
call fcn.00425280
ud2
call fcn.00449fd0
jmp fcn.004acfd0
Function at 0x556280
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe4000]
push edi
jmp 0x55629a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5562a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x556290
mov eax, 1
add ebx, ebx
jne 0x5562b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5562c4
jne 0x5562e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5562e3
dec eax
add ebx, ebx
jne 0x5562d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5562a8
add ebx, ebx
jne 0x5562df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x556335
xor ecx, ecx
sub eax, 3
jb 0x5562fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x55636a
sar eax, 1
mov ebp, eax
jmp 0x556306
add ebx, ebx
jne 0x556306
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5562d4
inc ecx
add ebx, ebx
jne 0x556314
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5562d4
add ebx, ebx
jne 0x556321
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x556316
jne 0x556332
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x556316
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x556354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x556346
jmp 0x556296
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x556354
add edi, ecx
jmp 0x556296
pop esi
mov edi, esi
mov ecx, 0x5f9c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x556372
cmp byte [edi], 0x15
jne 0x556372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x556377
lea edi, [esi + 0x152000]
mov eax, dword [edi]
or eax, eax
je 0x5563ef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x171400]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x17157c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5563a4
mov ecx, edi
jns 0x5563d3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x171580]
or eax, eax
je 0x5563e9
mov dword [ebx], eax
add ebx, 4
jmp 0x5563c1
call dword [esi + 0x171590]
mov ebp, dword [esi + 0x171584]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x556423
sub esp, 0xffffff80
jmp 0x48e6c3
Function at 0x40269f
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, ecx
mov cl, byte [eax + 0x100]
mov byte [ebp - 1], cl
mov cl, byte [eax + 0x101]
mov byte [ebp - 2], cl
test edx, edx
je 0x402707
mov ecx, dword [ebp + 8]
sub ecx, edi
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
push esi
inc byte [ebp - 1]
movzx esi, byte [ebp - 1]
mov dl, byte [esi + eax]
add byte [ebp - 2], dl
movzx ecx, byte [ebp - 2]
mov bl, byte [ecx + eax]
mov byte [esi + eax], bl
mov byte [ecx + eax], dl
movzx ecx, byte [esi + eax]
movzx edx, dl
add ecx, edx
mov edx, dword [ebp - 0xc]
and ecx, 0xff
mov cl, byte [ecx + eax]
xor cl, byte [edx + edi]
mov byte [edi], cl
inc edi
dec dword [ebp - 8]
jne 0x4026cb
pop esi
pop ebx
mov cl, byte [ebp - 1]
mov byte [eax + 0x100], cl
mov cl, byte [ebp - 2]
mov byte [eax + 0x101], cl
pop edi
leave
ret

Function at 0x40280d
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
or dword [ebp - 4], 0xffffffff
push esi
push edi
xor eax, eax
lea edi, [ebp - 8]
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
xor edi, edi
push edi
lea eax, [ebp - 0x110]
push eax
xor esi, esi
push edi
inc esi
push edi
mov dword [ebp - 0x110], esi
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 0xc], esi
call dword [sym.imp.WS2_32.dll_select]
cmp eax, esi
jne 0x40285f
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret

Function at 0x402866
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40289e
push edi
push edi
push edi
push edi
push 0x10
push dword [esp + 0x20]
push esi
call dword [sym.imp.WS2_32.dll_WSAConnect]
cmp eax, 0xffffffff
jne 0x40289e
call fcn.004028cc
or esi, 0xffffffff
pop edi
mov eax, esi
pop esi
ret

Function at 0x4028cc
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp esi, 0xffffffff
je 0x402909
xor eax, eax
inc eax
mov word [ebp - 4], ax
xor eax, eax
push 4
mov word [ebp - 2], ax
lea eax, [ebp - 4]
push eax
push 0x80
push reloc.advapi32.dll_CopySid
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
push 2
push esi
call dword [sym.imp.WS2_32.dll_shutdown]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
leave
ret