joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401558
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x40156a
mov eax, dword [0x4cd08b]
shl eax, 2
mov dword [0x4cd08f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.004b6488
pop edx
call fcn.004b63b0
call fcn.004b64c8
push 0
call fcn.004b764c
pop ecx
push 0x4cd034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4cd093], eax
push 0
jmp fcn.004c1818

Function at 0x406214
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push esi
push str.crc32:_len_d_n
push 4
call fcn.00409f1c
add esp, 0xc
xor ecx, ecx
mov eax, dword [ebp + 8]
cmp esi, ecx
mov edx, eax
jle 0x40625e
xor eax, eax
mov al, byte [edx]
xor ebx, eax
xor eax, eax
test bl, 1
je 0x406250
shr ebx, 1
xor ebx, 0xedb88320
jmp 0x406252
shr ebx, 1
inc eax
cmp eax, 8
jl 0x406241
inc ecx
inc edx
cmp esi, ecx
jg 0x406239
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x406264
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
mov eax, dword [ebp + 0xc]
push eax
push str.crc24q:_len_d_n
push 4
call fcn.00409f1c
add esp, 0xc
cmp dword [0x4d06b8], 0
jne 0x4062c5
mov dword [ebp - 4], 0x4d06b4
xor ecx, ecx
mov edx, ecx
mov eax, dword [ebp - 4]
shl edx, 0x10
mov dword [eax], edx
xor edx, edx
mov eax, dword [ebp - 4]
shl dword [eax], 1
mov ebx, dword [eax]
test ebx, 0x1000000
je 0x4062b2
xor dword [eax], 0x1864cfb
inc edx
cmp edx, 8
jl 0x4062a0
inc ecx
add dword [ebp - 4], 4
cmp ecx, 0x100
jl 0x406291
xor ecx, ecx
mov eax, dword [ebp + 8]
cmp ecx, dword [ebp + 0xc]
jge 0x4062f5
mov edx, esi
xor ebx, ebx
shr edx, 0x10
mov bl, byte [eax]
xor edx, ebx
inc eax
shl esi, 8
inc ecx
and esi, 0xffffff
mov edx, dword [edx*4 + 0x4d06b4]
xor edx, esi
cmp ecx, dword [ebp + 0xc]
mov esi, edx
jl 0x4062cf
mov eax, esi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x40a818
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffba8
mov ecx, 0x11
push ebx
push esi
push edi
lea edi, [ebp - 0x58]
mov ebx, dword [ebp + 8]
mov esi, 0x4d114c
rep movsd dword es:[edi], dword [esi]
push ebx
push str.execcmd:_cmd_s_n
push 0
call fcn.00409f1c
add esp, 0xc
lea eax, [ebp - 0x458]
mov dword [ebp - 0x58], 0x44
push ebx
push str.cmd__c__s
push eax
call fcn.004ba3e0
add esp, 0xc
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x58]
lea eax, [ebp - 0x458]
push edx
push ecx
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
jne 0x40a890
or eax, 0xffffffff
jmp 0x40a8c8
push 0xffffffffffffffff
mov edx, dword [ebp - 0x14]
push edx
call sub.KERNEL32.DLL_WaitForSingleObject
lea ecx, [ebp - 4]
push ecx
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
test eax, eax
jne 0x40a8b3
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
push edx
call sub.KERNEL32.DLL_CloseHandle
mov ecx, dword [ebp - 0x10]
push ecx
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ab20
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push ebx
push str.createdir:_path_s_n
push 3
call fcn.00409f84
add esp, 0xc
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x400]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x400]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x5c
push eax
call fcn.004b6900
add esp, 8
mov ebx, eax
test eax, eax
je 0x40ab8c
mov byte [ebx], 0
push 0
lea edx, [ebp - 0x400]
push edx
call sub.KERNEL32.DLL_CreateDirectoryA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d3dc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
push esi
mov eax, dword [ebx]
push eax
push str.readserial:_dev_d_n_d_n
push 4
call fcn.00409f84
add esp, 0x10
test ebx, ebx
jne 0x40d403
xor eax, eax
jmp 0x40d437
push 0
lea edx, [ebp - 4]
push edx
push esi
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x40d41e
xor eax, eax
jmp 0x40d437
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebx]
push ecx
push str.readserial:_exit_dev_d_nr_d_n
push 5
call fcn.00409f84
add esp, 0x10
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x40e378
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov eax, dword [0x4d3b48]
xor edx, edx
push ebx
push esi
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], edx
push ebx
push str.setsock:_sock_d_n
push 3
call fcn.00409f84
add esp, 0xc
lea ecx, [ebp - 0xc]
push 4
push ecx
push 0x1006
push 0xffff
push ebx
call sub.WSOCK32.DLL_setsockopt
inc eax
je 0x40e3dc
push 4
lea eax, [ebp - 0xc]
push eax
push 0x1005
push 0xffff
push ebx
call sub.WSOCK32.DLL_setsockopt
inc eax
jne 0x40e40d
push str.sockopt_error:_notimeo
push esi
call fcn.004ba3e0
add esp, 8
call fcn.0040e370
push eax
push ebx
push str.setsock:_setsockopt_error_1_sock_d_err_d_n
push 1
call fcn.00409f84
add esp, 0x10
push ebx
call sub.WSOCK32.DLL_closesocket
xor eax, eax
jmp 0x40e4a3
push 4
lea edx, [ebp - 4]
push edx
push 0x1002
push 0xffff
push ebx
call sub.WSOCK32.DLL_setsockopt
inc eax
je 0x40e43f
push 4
lea ecx, [ebp - 4]
push ecx
push 0x1001
push 0xffff
push ebx
call sub.WSOCK32.DLL_setsockopt
inc eax
jne 0x40e467
mov eax, dword [ebp - 4]
push eax
call fcn.0040e370
push eax
push ebx
push str.setsock:_setsockopt_error_2_sock_d_err_d_bs_d_n
push 1
call fcn.00409f84
add esp, 0x14
push str.sockopt_error:_bufsiz
push esi
call fcn.004ba3e0
add esp, 8
push 4
lea edx, [ebp - 8]
push edx
push 1
push 6
push ebx
call sub.WSOCK32.DLL_setsockopt
inc eax
jne 0x40e49e
call fcn.0040e370
push eax
push ebx
push str.setsock:_setsockopt_error_3_sock_d_err_d_n
push 1
call fcn.00409f84
add esp, 0x10
push str.sockopt_error:_nodelay
push esi
call fcn.004ba3e0
add esp, 8
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40e4ac
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
mov eax, dword [0x4d45a8]
xor edx, edx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [0x4d45ac]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10c], edx
xor eax, eax
lea edx, [ebp - 0x108]
jmp 0x40e4e7
cmp ebx, dword [edx]
jne 0x40e4e3
jmp 0x40e4ef
inc eax
add edx, 4
cmp eax, dword [ebp - 0x10c]
jb 0x40e4dd
mov edx, dword [ebp - 0x10c]
cmp eax, edx
jne 0x40e50b
cmp edx, 0x40
jae 0x40e50b
mov dword [ebp + eax*4 - 0x108], ebx
inc dword [ebp - 0x10c]
lea eax, [ebp - 8]
push eax
push 0
push 0
lea ecx, [ebp - 0x10c]
push ecx
lea eax, [ebx + 1]
push eax
call sub.WSOCK32.DLL_select
test eax, eax
jne 0x40e52b
xor eax, eax
jmp 0x40e539
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
push ebx
call sub.WSOCK32.DLL_accept
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40e540
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
mov dword [ebp - 4], 1
push eax
push 0x8004667e
push ebx
call sub.WSOCK32.DLL_ioctlsocket
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
push ebx
call sub.WSOCK32.DLL_connect
inc eax
jne 0x40e5a0
call fcn.0040e370
cmp eax, 0x2733
je 0x40e590
cmp eax, 0x2734
je 0x40e590
cmp eax, 0x2735
je 0x40e590
cmp eax, 0x2726
jne 0x40e594
xor eax, eax
jmp 0x40e5a5
cmp eax, 0x2748
je 0x40e5a0
or eax, 0xffffffff
jmp 0x40e5a5
mov eax, 1
pop ebx
pop ecx
pop ebp
ret

Function at 0x40e5ac
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
mov eax, dword [0x4d45b0]
xor edx, edx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [0x4d45b4]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10c], edx
xor eax, eax
lea edx, [ebp - 0x108]
jmp 0x40e5e7
cmp ebx, dword [edx]
jne 0x40e5e3
jmp 0x40e5ef
inc eax
add edx, 4
cmp eax, dword [ebp - 0x10c]
jb 0x40e5dd
mov edx, dword [ebp - 0x10c]
cmp eax, edx
jne 0x40e60b
cmp edx, 0x40
jae 0x40e60b
mov dword [ebp + eax*4 - 0x108], ebx
inc dword [ebp - 0x10c]
lea eax, [ebp - 8]
push eax
push 0
push 0
lea ecx, [ebp - 0x10c]
push ecx
lea eax, [ebx + 1]
push eax
call sub.WSOCK32.DLL_select
test eax, eax
jne 0x40e62b
xor eax, eax
jmp 0x40e63b
push 0
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
push ebx
call sub.WSOCK32.DLL_recv
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40e640
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
mov eax, dword [0x4d45b8]
xor edx, edx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [0x4d45bc]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10c], edx
xor eax, eax
lea edx, [ebp - 0x108]
jmp 0x40e67b
cmp ebx, dword [edx]
jne 0x40e677
jmp 0x40e683
inc eax
add edx, 4
cmp eax, dword [ebp - 0x10c]
jb 0x40e671
mov edx, dword [ebp - 0x10c]
cmp eax, edx
jne 0x40e69f
cmp edx, 0x40
jae 0x40e69f
mov dword [ebp + eax*4 - 0x108], ebx
inc dword [ebp - 0x10c]
lea eax, [ebp - 8]
lea ecx, [ebp - 0x10c]
push eax
push 0
push ecx
lea eax, [ebx + 1]
push 0
push eax
call sub.WSOCK32.DLL_select
test eax, eax
jne 0x40e6bf
xor eax, eax
jmp 0x40e6cf
push 0
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
push ebx
call sub.WSOCK32.DLL_send
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40e6d4
Capabilities:
Create raw socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push esi
push str.gentcp:_type_d_n
push 3
call fcn.00409f84
add esp, 0xc
push 0
push 1
push 2
call sub.WSOCK32.DLL_socket
mov dword [ebx + 0x118], eax
cmp eax, 0xffffffff
jne 0x40e73f
call fcn.0040e370
push eax
push str.socket_error___d_
push edi
call fcn.004ba3e0
add esp, 0xc
call fcn.0040e370
push eax
push str.gentcp:_socket_error_err_d_n
push 1
call fcn.00409f84
add esp, 0xc
mov dword [ebx], 0xffffffff
xor eax, eax
jmp 0x40e8a8
push edi
mov edx, dword [ebx + 0x118]
push edx
call fcn.0040e378
add esp, 8
test eax, eax
jne 0x40e760
mov dword [ebx], 0xffffffff
xor eax, eax
jmp 0x40e8a8
push 0x10
push 0
lea edx, [ebx + 0x108]
push edx
call fcn.004b65c0
add esp, 0xc
mov word [ebx + 0x108], 2
mov cx, word [ebx + 0x104]
push ecx
call sub.WSOCK32.DLL_htons
mov word [ebx + 0x10a], ax
test esi, esi
jne 0x40e80c
push 0x10
lea eax, [ebx + 0x108]
push eax
mov edx, dword [ebx + 0x118]
push edx
call sub.WSOCK32.DLL_bind
inc eax
jne 0x40e7fc
mov ecx, dword [ebx + 0x104]
push ecx
call fcn.0040e370
push eax
push str.bind_error___d__:__d
push edi
call fcn.004ba3e0
add esp, 0x10
call fcn.0040e370
push eax
mov eax, dword [ebx + 0x104]
push eax
push str.gentcp:_bind_error_port_d_err_d_n
push 1
call fcn.00409f84
add esp, 0x10
mov edx, dword [ebx + 0x118]
push edx
call sub.WSOCK32.DLL_closesocket
mov dword [ebx], 0xffffffff
xor eax, eax
jmp 0x40e8a8
push 5
mov edx, dword [ebx + 0x118]
push edx
call sub.WSOCK32.DLL_listen
jmp 0x40e87c
lea ecx, [ebx + 4]
push ecx
call sub.WSOCK32.DLL_gethostbyname
mov esi, eax
test eax, eax
jne 0x40e862
lea edx, [ebx + 4]
push edx
push str.address_error___s_
push edi
call fcn.004ba3e0
add esp, 0xc
call fcn.0040e370
push eax
lea ecx, [ebx + 4]
push ecx
push str.gentcp:_gethostbyname_error_addr_s_err_d_n
push 1
call fcn.00409f84
add esp, 0x10
mov dword [ebx], 1
mov eax, dword [ebx + 0x118]
push eax
call sub.WSOCK32.DLL_closesocket
mov dword [ebx], 0xffffffff
xor eax, eax
jmp 0x40e8a8
movsx edx, word [esi + 0xa]
push edx
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
push eax
lea edx, [ebx + 0x10c]
push edx
call fcn.004b652c
add esp, 0xc
mov dword [ebx], 1
call fcn.00407e50
mov dword [ebx + 0x120], eax
mov ecx, dword [ebx + 0x118]
push ecx
push str.gentcp:_exit_sock_d_n
push 5
call fcn.00409f84
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x410a90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
push eax
push str.readftp:_n_d_n
push 4
call fcn.00409f84
add esp, 0xc
lea edx, [ebp - 0x10]
push edx
call fcn.004079bc
pop ecx
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x10]
push dword [ecx + 0xc]
push dword [ecx + 8]
push dword [ecx + 4]
push dword [ecx]
push edx
call fcn.00407b84
add esp, 0x14
push dword [esi + 0xe2c]
push dword [esi + 0xe28]
push dword [esi + 0xe24]
push dword [esi + 0xe20]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call fcn.004079a0
add esp, 0x20
fcomp dword [0x410c54]
fnstsw ax
sahf
jae 0x410b14
xor eax, eax
jmp 0x410c4b
cmp dword [esi], 0
jg 0x410b94
mov dword [esi], 1
lea edx, [esi + 0xc]
push edx
cmp dword [esi + 4], 0
je 0x410b30
mov ecx, 0x4d8816
jmp 0x410b35
mov ecx, 0x4d881b
push ecx
push str._s:___s
mov eax, dword [ebp + 0x14]
push eax
call fcn.004ba3e0
add esp, 0x10
push 0
push 0
push esi
push 0x41034c
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [esi + 0xe30], eax
test eax, eax
jne 0x410b94
push str.readftp:_ftp_thread_create_error_n
push 1
call fcn.00409f84
add esp, 8
mov dword [esi], 3
mov edx, dword [ebp + 0x14]
mov esi, str.ftp_thread_error
mov edi, edx
mov eax, edi
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
jmp 0x410c4b
mov eax, dword [esi]
cmp eax, 1
jg 0x410ba2
xor eax, eax
jmp 0x410c4b
cmp eax, 3
jne 0x410bef
mov edx, dword [esi + 8]
push edx
cmp dword [esi + 4], 0
je 0x410bb8
mov ecx, str.http
jmp 0x410bbd
mov ecx, 0x4d8865
push ecx
push str._s_error___d_
mov eax, dword [ebp + 0x14]
push eax
call fcn.004ba3e0
add esp, 0x10
push 0
lea edx, [esi + 0xe0c]
push edx
lea eax, [esi + 0xe20]
push eax
call fcn.00410208
add esp, 0xc
xor edx, edx
mov dword [esi], edx
xor eax, eax
jmp 0x410c4b
mov ebx, edi
lea eax, [esi + 0xa0c]
jmp 0x410bfd
mov byte [ebx], dl
inc eax
inc ebx
mov dl, byte [eax]
test dl, dl
je 0x410c0c
mov ecx, ebx
sub ecx, edi
cmp ecx, dword [ebp + 0x10]
jl 0x410bf9
push 0x4d8869
push ebx
call fcn.004ba3e0
add esp, 8
add ebx, eax
lea eax, [esi + 0xe0c]
lea edx, [esi + 0xe20]
push 1
push eax
push edx
call fcn.00410208
add esp, 0xc
xor ecx, ecx
mov dword [esi], ecx
mov eax, dword [ebp + 0x14]
push edi
mov esi, 0x4d886c
mov edi, eax
mov eax, edi
movsb byte es:[edi], byte [esi]
pop edi
mov eax, ebx
sub eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x410c88
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
push str.strinitcom:_n
push 3
call fcn.00409f84
add esp, 8
push esp
push 2
call sub.WSOCK32.DLL_WSAStartup
add esp, 0x190
ret
Function at 0x4166d0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
push str.decode_solhead:_buff_s_n
push 4
call fcn.00409f1c
add esp, 0xc
push 1
push 0x4db16f
push esi
call fcn.004b67c4
add esp, 0xc
test eax, eax
je 0x416718
push 1
push 0x4db171
push esi
call fcn.004b67c4
add esp, 0xc
test eax, eax
jne 0x416877
push 0x4db173
push esi
call fcn.004b692c
add esp, 8
test eax, eax
je 0x416731
xor eax, eax
mov dword [ebx + 4], eax
jmp 0x416765
push 0x4db178
push esi
call fcn.004b692c
add esp, 8
test eax, eax
je 0x41674c
mov dword [ebx + 4], 1
jmp 0x416765
push 0x4db17c
push esi
call fcn.004b692c
add esp, 8
test eax, eax
je 0x416765
mov dword [ebx + 4], 2
push 0x4db180
push esi
call fcn.004b692c
add esp, 8
mov edi, eax
test eax, eax
je 0x41679f
mov dword [ebx], 1
xor edx, edx
mov dword [ebx + 0x10], edx
push 1
add edi, 9
push edi
lea eax, [ebx + 0x48]
push eax
call fcn.004b68b0
mov byte [ebx + 0x49], 0
add esp, 0xc
jmp 0x416877
push 0x4db18a
push esi
call fcn.004b692c
add esp, 8
mov edi, eax
test eax, eax
je 0x4167d9
xor edx, edx
add edi, 0xe
mov dword [ebx], edx
lea eax, [ebx + 0x48]
mov dword [ebx + 0x10], 1
push 1
push edi
push eax
call fcn.004b68b0
mov byte [ebx + 0x49], 0
add esp, 0xc
jmp 0x416877
push 0x4db198
push esi
call fcn.004b692c
add esp, 8
mov edi, eax
test eax, eax
je 0x41680e
xor edx, edx
xor ecx, ecx
mov dword [ebx], edx
mov dword [ebx + 0x10], ecx
add edi, 0xd
push 1
push edi
lea eax, [ebx + 0x48]
push eax
call fcn.004b68b0
mov byte [ebx + 0x49], 0
add esp, 0xc
jmp 0x416877
push 0x4db1a6
push esi
call fcn.004b692c
add esp, 8
mov edi, eax
test eax, eax
je 0x416845
mov dword [ebx], 2
xor edx, edx
mov dword [ebx + 0x10], edx
push 1
add edi, 0xd
push edi
lea eax, [ebx + 0x48]
push eax
call fcn.004b68b0
mov byte [ebx + 0x49], 0
add esp, 0xc
jmp 0x416877
push str.SITE_INF
push esi
call fcn.004b692c
add esp, 8
mov edi, eax
test eax, eax
je 0x416877
xor edx, edx
xor ecx, ecx
mov dword [ebx + 4], edx
mov dword [ebx], 4
mov dword [ebx + 0x10], ecx
add ebx, 0x48
mov edi, ebx
mov esi, 0x4db1be
mov eax, edi
movsw word es:[edi], word [esi]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x41ef74
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp + 8]
cmp esi, edx
jle 0x41ef8e
xor cl, byte [eax]
inc edx
inc eax
cmp esi, edx
jg 0x41ef86
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x428550
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
xor esi, esi
mov edx, dword [ebp + 8]
jmp 0x428576
mov ecx, eax
shl ecx, 2
and eax, 0xff
sar eax, 6
or cl, al
xor cl, byte [edx]
mov eax, ecx
inc esi
inc edx
lea ecx, [edi - 1]
cmp esi, ecx
jl 0x428561
mov edx, eax
shl edx, 2
and eax, 0xff
sar eax, 6
or dl, al
mov eax, edx
mov edx, dword [ebp + 8]
cmp al, byte [edx + edi - 1]
sete al
and eax, 1
pop edi
pop esi
pop ebp
ret

Function at 0x439cd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x5c4ddc
cmp dword [edi], 0
jne 0x439d4c
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [0x5c4dd8]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x5231c4
mov ecx, 2
call fcn.0044f7fc
mov edx, 0x439ca8
lea eax, [esi + 5]
call fcn.00439cc8
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00439cc8
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x439d21
mov dword [0x5c4dd8], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x43c06c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.004512e8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x43c0c4
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x52b450]
mov dl, 1
mov eax, dword [0x43bb90]
call fcn.00443544
call fcn.00450a74
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0043bc98
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43f534
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x43f5c4
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x43f5c4
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x43f577
test edx, 3
jne 0x43f566
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x43f571
jmp 0x43f577
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x43f577
cmp dword [ecx - 8], 1
je 0x43f581
mov edx, ebx
or edx, 3
call fcn.004515b8
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x7b7b7b7b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x43f593
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00450e24

Function at 0x43f5d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x43f660
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x43f660
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x43f613
test edx, 3
jne 0x43f602
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x43f60d
jmp 0x43f613
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x43f613
cmp dword [ecx - 8], 1
je 0x43f61d
mov edx, ebx
or edx, 3
call fcn.004515b8
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x5b5b5b5b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x43f62f
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00450e24

Function at 0x440074
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004512e8
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x44008d
test al, 0x10
jne 0x440091
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x442c84
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x442cbd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00450f14
jmp 0x442cc6
mov eax, ebx
mov edx, esi
call fcn.00450e78
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x442cd0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x442cf2
movzx eax, byte [esp]
jmp 0x442cf4
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret