joyce8/EMBER2024-capa huggingface dataset:
Function at 0x63d790
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x672072
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x71ccd4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.005284b0
mov dword [edi], vtable.CSkyObject.0
mov dword [edi + 4], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea esi, [edi + 0x134]
mov byte [ebp - 4], 1
push 0x2c
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005c7d27
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x1bc], 0
mov dword [edi + 0x1c0], 0
mov dword [edi + 0x1c4], 0
mov dword [edi + 0x1c8], 0x3f800000
mov dword [edi + 0x1cc], 0x3f800000
mov dword [edi + 0x1d0], 0x3f800000
mov dword [edi + 0x1d8], 0
mov dword [edi + 0x1e8], 0
mov dword [edi + 0x1ec], 0xf
mov byte [edi + 0x1d8], 0
lea ecx, [edi + 0x1f4]
mov byte [ebp - 4], 3
call fcn.00539360
mov dword [edi + 0x174], 0
mov dword [edi + 0x170], 0
mov dword [edi + 0x16c], 0
mov dword [edi + 0x168], 0
mov dword [edi + 0x160], 0
mov dword [edi + 0x15c], 0
mov dword [edi + 0x158], 0
mov dword [edi + 0x154], 0
mov dword [edi + 0x14c], 0
mov dword [edi + 0x148], 0
mov dword [edi + 0x144], 0
mov dword [edi + 0x140], 0
mov dword [edi + 0x178], 0x3f800000
mov dword [edi + 0x164], 0x3f800000
mov dword [edi + 0x150], 0x3f800000
mov dword [edi + 0x13c], 0x3f800000
mov dword [edi + 0x1b4], 0
mov dword [edi + 0x1b0], 0
mov dword [edi + 0x1ac], 0
mov dword [edi + 0x1a8], 0
mov dword [edi + 0x1a0], 0
mov dword [edi + 0x19c], 0
mov dword [edi + 0x198], 0
mov dword [edi + 0x194], 0
mov dword [edi + 0x18c], 0
mov dword [edi + 0x188], 0
mov dword [edi + 0x184], 0
mov dword [edi + 0x180], 0
mov dword [edi + 0x1b8], 0x3f800000
mov dword [edi + 0x1a4], 0x3f800000
mov dword [edi + 0x190], 0x3f800000
mov dword [edi + 0x17c], 0x3f800000
mov byte [ebp - 4], 4
mov dword [edi + 0xf8], 0
mov dword [edi + 0xf4], 0
mov dword [edi + 0xf0], 0
mov dword [edi + 0xec], 0
mov dword [edi + 0xe4], 0
mov dword [edi + 0xe0], 0
mov dword [edi + 0xdc], 0
mov dword [edi + 0xd8], 0
mov dword [edi + 0xd0], 0
mov dword [edi + 0xcc], 0
mov dword [edi + 0xc8], 0
mov dword [edi + 0xc4], 0
mov dword [edi + 0xfc], 0x3f800000
mov dword [edi + 0xe8], 0x3f800000
mov dword [edi + 0xd4], 0x3f800000
mov dword [edi + 0xc0], 0x3f800000
mov ecx, dword [0x790918]
call fcn.0051a030
mov dword [edi + 0x130], eax
mov eax, edi
mov dword [edi + 0x128], 0
mov dword [edi + 0x12c], 0
mov word [edi + 0x1f0], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x6490f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [ecx + 0x18]
push esi
mov esi, dword [esp + 0x18]
push edi
mov ebx, dword [ebp]
xor edi, edi
mov edx, dword [ebp + 4]
add ebx, dword [eax]
add edx, dword [eax + 4]
mov eax, dword [ecx + 8]
test eax, eax
je 0x64913a
mov esi, eax
movzx ecx, dl
xor ebx, edx
and ecx, 0x1f
rol ebx, cl
add ebx, dword [ebp + edi*8 + 8]
movzx ecx, bl
xor edx, ebx
and ecx, 0x1f
rol edx, cl
add edx, dword [ebp + edi*8 + 0xc]
inc edi
cmp edi, esi
jb 0x649115
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x64915d
mov eax, dword [ecx]
xor eax, ebx
mov dword [esi], eax
lea eax, [ecx + 4]
test eax, eax
je 0x64915f
mov eax, dword [eax]
pop edi
xor eax, edx
mov dword [esi + 4], eax
pop esi
pop ebp
pop ebx
ret 0xc
mov dword [esi], ebx
pop edi
mov dword [esi + 4], edx
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x323401bf
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x76b607a
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x40df33
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edi, eax
xor eax, eax
test edi, edi
je 0x40dfbb
jmp loc.005f7a08
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x40dffd
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x41e2e8]
jmp loc.005e9a98

Function at 0x40e755
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor eax, eax
test esi, esi
je 0x40e7c0
mov ecx, dword [ebp + 0xc]
push ebx
push edi
mov edi, dword [ebp + 8]
push 0x41
pop ebx
push 0x5a
pop edx
sub edi, ecx
mov dword [ebp + 0x10], edx
jmp 0x40e77a
push 0x5a
pop edx
movzx eax, word [edi + ecx]
cmp ax, bx
jb 0x40e790
cmp ax, dx
ja 0x40e790
add eax, 0x20
movzx edx, ax
jmp 0x40e792
mov edx, eax
movzx eax, word [ecx]
cmp ax, bx
jb 0x40e7a6
cmp ax, word [ebp + 0x10]
ja 0x40e7a6
add eax, 0x20
movzx eax, ax
add ecx, 2
dec esi
je 0x40e7b6
test dx, dx
je 0x40e7b6
cmp dx, ax
je 0x40e777
jmp 0x5f6cc0
pop esi
pop ebp
ret

Function at 0x40ea60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x40ea74
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x40ea8f
jmp loc.005f9240
pop ebp
ret
Function at 0x411d85
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040e08f
mov dword [ebp - 0x14], eax
cmp dword [0x41e2b0], esi
jne 0x411e78
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x411e05
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x411f58
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x411f58
push 0x41a68c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x411f58
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x41e2b0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x41e2b4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x41e2b8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41e2c0], eax
test eax, eax
je 0x411e75
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41e2bc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x411e9d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x411e90
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x411eb2
push 4
pop eax
jmp 0x411f5a
cmp dword [ebp - 0x14], esi
je 0x411eb2
push dword [0x41e2b0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x411e97
mov eax, dword [0x41e2bc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x411f10
cmp dword [0x41e2c0], edi
je 0x411f10
push eax
call ebx
push dword [0x41e2c0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x411f10
test eax, eax
je 0x411f10
call ecx
test eax, eax
je 0x411f05
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x411f05
test byte [ebp - 8], 1
jne 0x411f10
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x411f40
mov eax, dword [0x41e2b4]
cmp eax, edi
je 0x411f3d
push eax
call ebx
test eax, eax
je 0x411f3d
call eax
jmp 0x5f4740
mov edi, dword [ebp + 0x10]
push dword [0x41e2b0]
call ebx
test eax, eax
je 0x411f58
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x411f5a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407940
mov esp, ebp
pop ebp
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x1b074b01
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x4dcb25f8
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x40d35c
Capabilities:
Initialize iwebbrowser2

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.004b3a5c
test al, al
je 0x40d3c6
mov esi, dword [sym.imp.ole32.dll_CoCreateInstance]
lea eax, [ebp + 8]
push eax
mov ebx, 0x68a478
push ebx
push 4
push 0
mov edi, 0x68a4b8
push edi
call esi
test eax, eax
jns 0x40d3a7
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp + 8]
push eax
push ebx
push 4
push 0
push edi
call esi
test eax, eax
js 0x40d3b0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0040d61a
jmp 0x40d3dd
push dword [ebp + 0x1c]
mov ecx, dword [ebp + 0xc]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0040d3e5
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18

Function at 0x40d61a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x960
push edi
lea eax, [ebp - 8]
push eax
push 0xf01ff
mov edi, 0x80004005
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40d6ec
push esi
lea eax, [ebp - 4]
push eax
push 1
xor esi, esi
push esi
push esi
push 0x2000000
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x40d6eb
push 0x1000
push dword [ebp - 4]
call fcn.004b4559
pop ecx
pop ecx
test eax, eax
je 0x40d6eb
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x104
lea eax, [ebp - 0x160]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push dword [ebp + 0x18]
lea eax, [ebp - 0x960]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x90
push dword [ebp + 8]
push str.__surl:_s__sflg:_d__sht:_d__swd:_d__smn:_d__sslp:_d
push eax
call fcn.004baa18
add esp, 0x20
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x960]
push eax
lea eax, [ebp - 0x160]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
je 0x40d6eb
xor edi, edi
pop esi
mov eax, edi
pop edi
leave
ret 0x14
Function at 0x40dc8c
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, pe_nt_image_headers32
lea ebx, [ebp - 8]
mov eax, esi
lea edi, [ebp - 0x10c]
call fcn.0040d718
pop ecx
mov ecx, dword [ebp - 8]
mov al, byte [ebp + ecx - 0x10d]
cmp al, 0x3a
je 0x40dccf
cmp al, 0x5c
je 0x40dccf
mov byte [ebp + ecx - 0x10c], 0x5c
inc ecx
mov dword [ebp - 8], ecx
mov eax, esi
sub eax, ecx
push 0x6e4d5c
lea edi, [ebp + ecx - 0x10c]
lea ebx, [ebp - 8]
call fcn.0040d718
pop ecx
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
jne 0x40dd0f
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40ddf3
cmp byte [ebp - 0x220], 0x2e
jne 0x40dd3b
cmp byte [ebp - 0x21f], 0
je 0x40ddd0
cmp byte [ebp - 0x21f], 0x2e
jne 0x40dd3b
cmp byte [ebp - 0x21e], 0
je 0x40ddd0
push dword [ebp + 8]
lea ebx, [ebp - 8]
mov eax, esi
lea edi, [ebp - 0x10c]
call fcn.0040d718
pop ecx
mov ecx, dword [ebp - 8]
mov al, byte [ebp + ecx - 0x10d]
cmp al, 0x3a
je 0x40dd6d
cmp al, 0x5c
je 0x40dd6d
mov byte [ebp + ecx - 0x10c], 0x5c
inc ecx
mov dword [ebp - 8], ecx
lea edx, [ebp - 0x220]
mov eax, esi
sub eax, ecx
push edx
lea edi, [ebp + ecx - 0x10c]
lea ebx, [ebp - 8]
call fcn.0040d718
test byte [ebp - 0x24c], 0x10
pop ecx
lea eax, [ebp - 0x10c]
je 0x40ddb6
push 1
push 0x6e4d5c
push eax
call fcn.0040dc8c
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x40ddbd
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40ddd0
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.004b7311
pop ecx
pop ecx
lea eax, [ebp - 0x24c]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40dd0f
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40e0d3
Capabilities:
Hash data with md5

Disassembly:
xor ecx, ecx
mov byte [eax + 0x68], cl
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x40fbd7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [edi + 0x24]
push esi
mov esi, dword [edi + 0x34]
sub esi, dword [edi + 0x6c]
mov eax, dword [edi + 0x64]
mov ecx, dword [edi + 0x24]
lea ecx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, ecx
jb 0x40fc5e
mov eax, dword [edi + 0x30]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.004bd990
mov eax, dword [edi + 0x44]
mov ecx, dword [edi + 0x3c]
sub dword [edi + 0x68], ebx
sub dword [edi + 0x64], ebx
add esp, 0xc
sub dword [edi + 0x54], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
sub eax, 2
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x40fc1f
mov eax, dword [edi + 0x38]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
sub eax, 2
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x40fc42
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x40fcb6
mov ecx, dword [edi + 0x6c]
add ecx, dword [edi + 0x64]
push esi
add ecx, dword [edi + 0x30]
mov esi, eax
push ecx
call fcn.0040f925
add dword [edi + 0x6c], eax
mov esi, dword [edi + 0x6c]
pop ecx
pop ecx
cmp esi, 3
jb 0x40fca2
mov edx, dword [edi + 0x64]
add edx, dword [edi + 0x30]
mov ecx, dword [edi + 0x50]
movzx eax, byte [edx]
mov dword [edi + 0x40], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [edi + 0x4c]
mov dword [edi + 0x40], eax
cmp esi, 0x106
jae 0x40fcb6
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x40fbe0
pop esi
pop ebx
leave
ret

Function at 0x411cc0
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x41fd40
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + eax]
mov ebx, 0x1505
cmp esi, edi
jae 0x41fd6e
movzx eax, byte [esi]
push eax
call fcn.00421c00
mov edx, ebx
shl edx, 5
movsx ecx, al
add ebx, edx
inc esi
add esp, 4
xor ebx, ecx
cmp esi, edi
jb 0x41fd51
pop edi
pop esi
movzx eax, bl
pop ebx
ret

Function at 0x422fe0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_recv]
cmp eax, 0xffffffff
jne 0x423012
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
ret
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor eax, eax
ret

Function at 0x423090
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
xor edi, edi
cmp dword [esi + 0x610], edi
je 0x4230d9
push 1
push esi
call fcn.00426710
mov eax, dword [esi + 0x5a4]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esi + 0x610]
push edx
push eax
push esi
call ecx
push 0
push esi
mov edi, eax
call fcn.00426710
add esp, 0x24
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [esp + 0x10]
test eax, eax
js 0x423119
cmp eax, 2
jg 0x423119
mov edx, dword [esi + 0x5a0]
push edx
push 1
lea eax, [eax + eax*2 + 0x674ac8]
push 2
push eax
call fcn.004be791
mov ecx, dword [esi + 0x5a0]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
push ecx
push 1
push edx
push eax
call fcn.004be791
add esp, 0x20
mov eax, edi
pop edi
pop esi
ret
Function at 0x423120
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x808
mov eax, dword [0x6f33d4]
xor eax, esp
mov dword [esp + 0x804], eax
push esi
mov esi, dword [esp + 0x810]
test esi, esi
je 0x423253
test dword [esi + 0xa9c], 0x40000000
je 0x423253
mov ecx, dword [esp + 0x814]
push edi
lea eax, [esp + 0x81c]
push eax
push ecx
lea edx, [esp + 0x10]
push 0x801
push edx
call fcn.0042b890
add esp, 0x10
cmp eax, 0x801
jb 0x4231c8
mov edx, dword [esp + 0x818]
mov eax, edx
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x423190
sub eax, edi
cmp byte [eax + edx - 1], 0xa
jne 0x4231b1
push str...._n
push 5
lea eax, [esp + 0x80c]
push eax
jmp 0x4231c0
push 0x674ae0
push 4
lea ecx, [esp + 0x80d]
push ecx
call fcn.0042b8f0
add esp, 0xc
lea eax, [esp + 8]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4231d0
sub eax, edx
cmp dword [esi + 0x610], 0
mov edi, eax
je 0x423226
push 1
push esi
call fcn.00426710
mov edx, dword [esi + 0x5a4]
mov ecx, dword [esi + 0x610]
push edx
push edi
lea eax, [esp + 0x18]
push eax
push 0
push esi
call ecx
push 0
push esi
call fcn.00426710
add esp, 0x24
pop edi
pop esi
mov ecx, dword [esp + 0x804]
xor ecx, esp
call fcn.004bec6d
add esp, 0x808
ret
mov edx, dword [esi + 0x5a0]
push edx
push 1
push 2
push 0x674ac8
call fcn.004be791
mov eax, dword [esi + 0x5a0]
push eax
push 1
lea ecx, [esp + 0x20]
push edi
push ecx
call fcn.004be791
add esp, 0x20
pop edi
mov ecx, dword [esp + 0x808]
pop esi
xor ecx, esp
call fcn.004bec6d
add esp, 0x808
ret

Function at 0x423270
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x108
mov eax, dword [0x6f33d4]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
mov esi, dword [esp + 0x110]
test dword [esi + 0xa9c], 0x40000000
jne 0x4232a5
cmp dword [esi + 0x5a8], 0
je 0x423397
mov ecx, dword [esp + 0x114]
lea eax, [esp + 0x118]
push eax
push ecx
lea edx, [esp + 0xc]
push pe_nt_image_headers32
push edx
call fcn.0042b890
lea eax, [esp + 0x14]
add esp, 0x10
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4232d0
sub eax, edx
mov edx, dword [esi + 0x5a8]
push edi
mov edi, eax
test edx, edx
je 0x423304
test byte [esi + 0xfa4], 8
jne 0x423304
lea ecx, [esp + 8]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x4232f3
or dword [esi + 0xfa4], 8
test dword [esi + 0xa9c], 0x40000000
je 0x423396
mov byte [esp + edi + 8], 0xa
inc edi
cmp dword [esi + 0x610], 0
mov byte [esp + edi + 8], 0
je 0x42336a
push 1
push esi
call fcn.00426710
mov eax, dword [esi + 0x5a4]
mov edx, dword [esi + 0x610]
push eax
push edi
lea ecx, [esp + 0x18]
push ecx
push 0
push esi
call edx
push 0
push esi
call fcn.00426710
add esp, 0x24
pop edi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004bec6d
add esp, 0x108
ret
mov eax, dword [esi + 0x5a0]
push eax
push 1
push 2
push 0x674ac8
call fcn.004be791
mov ecx, dword [esi + 0x5a0]
push ecx
push 1
lea edx, [esp + 0x20]
push edi
push edx
call fcn.004be791
add esp, 0x20
pop edi
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.004bec6d
add esp, 0x108
ret
Function at 0x4237b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [ebx + 0x2c8]
push ebp
mov ebp, dword [ebx + eax*4 + 0x1b8]
push esi
lea esi, [eax + 0x1e]
shl esi, 4
add esi, ebx
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [ecx + 0x40], 3
je 0x42384f
cmp dword [ebx + eax*4 + 0x1d0], 0x4234c0
jne 0x42384f
cmp dword [esi], 0
je 0x4237ea
test edi, edi
je 0x42384f
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
call fcn.00423bf0
add esp, 0x14
cmp eax, 0xffffffff
je 0x42384f
test al, 1
je 0x42384f
cmp dword [esi], 0
jne 0x423831
mov edx, dword [ebx]
mov eax, dword [edx + 0x8f4]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x6f0020]
mov edi, dword [esi + 4]
xor ecx, ecx
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
cmp eax, ecx
je 0x42384c
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebp
call dword [sym.imp.WSOCK32.dll_recv]
test eax, eax
jle 0x42384f
add dword [esi + 8], eax
pop edi
pop esi
pop ebp
ret
mov dword [esi + 4], ecx
pop edi
pop esi
pop ebp
ret

Function at 0x423860
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x84
mov eax, dword [0x6f33d4]
xor eax, esp
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0x8c]
push ebx
mov ebx, dword [esp + 0x8c]
push ebp
mov ebp, dword [ebx + eax*4 + 0x1b8]
push esi
mov esi, dword [esp + 0xa4]
push edi
mov edi, dword [esp + 0xa0]
call fcn.004237b0
mov eax, dword [esp + 0xa4]
push 0
push eax
push edi
push ebp
call dword [sym.imp.WSOCK32.dll_send]
mov edi, eax
mov dword [esi], 0
cmp edi, 0xffffffff
jne 0x42390a
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov ebp, eax
cmp ebp, 0x2733
jne 0x4238d9
xor eax, eax
mov dword [esi], 0x51
jmp 0x42390a
push 0x80
lea ecx, [esp + 0x14]
push ecx
push ebp
call fcn.00417630
mov edx, dword [ebx]
push eax
push str.Send_failure:__s
push edx
call fcn.00423270
mov eax, dword [ebx]
mov dword [eax + 0xcbc], ebp
add esp, 0x18
mov dword [esi], 0x37
mov eax, edi
mov ecx, dword [esp + 0x90]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004bec6d
add esp, 0x84
ret