joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7175cb
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub ch, ah
mov ch, 0x50
mov ecx, dword [esp + 1]
push dword [esp + 4]
pop ax
xchg ah, ch
jmp 0x71751d
pop ax
xchg cx, ax
xchg cl, ch
shl dx, cl
mov dx, 0x3e01
push esp
jmp 0x7174d0
push word [esp + 3]
push word [esp + 5]
bsf ax, si
pushal
mov dl, 0x54
sub ax, 0xb658
jmp 0x7175a3
bsf dx, si
xchg word [esp + 3], dx
xchg byte [esp], ch
mov dl, 0x34
mov cx, 0x45d9
jmp 0x717501
btc eax, edi
mov dx, 0x5eeb
mov al, ah
xchg ecx, eax
lea esp, [esp + 2]
lea eax, [esi*4]
jmp 0x7174f1
setne ch
push word [esp + 0x1c]
rol cl, 3
bswap ecx
mov word [esp + 0x1c], sp
mov eax, 0xa92aaf80
jmp 0x71758b
xchg edx, ecx
pop eax
mov ecx, dword [esp + 0x10]
mov ch, byte [esp + 0x10]
mov byte [esp + 0x1d], dh
mov word [esp + 0x20], dx
jmp 0x717550
lea edx, [esp + edx]
xchg edx, eax
mov ax, bx
lea edx, [ebx*4]
sete ch
jmp 0x7175d6
lea ecx, [esp + esi]
lea ecx, [eax - 0x49]
pop ecx
shl cx, cl
lea ecx, [ebp - 0x8f]
mov word [esp + 0x19], dx
jmp 0x717575
btc eax, ebx
mov cx, ax
jmp 0x717539
dec ax
mov word [esp + 0x1c], di
mov cx, word [esp + 0x1f]
xchg dh, al
xchg cl, ch
jmp 0x717691
mov dx, 0xdf0b
mov ax, 0xf7b3
push dword [esp + 4]
bt ecx, edx
mov ax, sp
jmp 0x717679
mov ecx, ebx
sub esp, 0xe
lea edx, [eax - 0xe1]
mov dx, 0x5717
rdtsc
jmp 0x71761a
setg ah
sub esp, 0x10
bsf dx, ax
pushal
lea esp, [esp + 0x59]
setno ch
jmp 0x717632
xchg word [esp + 0xf], cx
push word [esp + 5]
mov dl, 0xfc
pop word [esp + 1]
jmp 0x7176be
mov eax, dword [esp + 0x11]
dec cx
rcl ecx, 3
xchg dh, al
mov edx, dword [esp + 7]
jmp 0x717660
neg ecx
lea eax, [esi + edi]
clc
push dword [esp + 4]
btr ecx, edx
neg ax
jmp 0x71764c
mov byte [esp + 5], bh
xchg dx, cx
xchg dword [esp + 4], eax
mov ecx, 0x631b8bf4
add esp, 5
xchg cx, ax
jmp 0x71771b
mov cx, 0xf543
mov ch, bh
xchg edx, eax
not ecx
lea esp, [esp + 9]
mov ecx, dword [esp + 3]
jmp 0x7176a3
inc al
mov eax, dword [esp + 1]
call fcn.007176d1
lea esp, [esp + 9]
mov byte [esp + 1], dh
lea eax, [ebp - 0x3fe23261]
xchg word [esp], ax
xchg dx, ax
add esp, 2
jmp 0x717798
push esp
rdtsc
stc
rdtsc
mov eax, dword [esp + 5]
xchg edx, eax
jmp 0x7176ea
push dword [esp + 8]
mov ax, di
mov byte [esp + 0xd], bh
mov dh, byte [esp + 0xf]
setle ah
xchg byte [esp], cl
jmp 0x7177a7
add esp, 9
ror dh, 7
push dword [esp + 4]
mov byte [esp + 0xc], ah
mov word [esp + 4], di
jmp 0x717729
mov edx, 0xd02e329e
lea edx, [ecx - 0x46d496ad]
sub esp, 0x12
mov eax, 0xe29a72dc
xchg dword [esp + 2], eax
mov al, 0xbe
jmp 0x717751
mov eax, esi
rdtsc
mov ch, 0xb0
push esp
mov cx, 0xb719
xchg cl, ch
jmp 0x71776b
setae dh
add esp, 7
pop dx
mov byte [esp + 5], dh
push word [esp + 4]
neg ch
jmp 0x717c12
push dword [esp + 4]
mov cl, byte [esp + 4]
push dword [esp + 8]
mov byte [esp + 1], bh
call fcn.007177e3
movsd dword es:[edi], dword [esi]
sub edi, dword [ebx - 0x3235d222]
dec esp
ret 0x54a5
push dword [esp + 0x17]
lea edx, [ebx + ebp]
mov edx, esi
xchg dh, al
add esp, 0x22
btr edx, esp
jmp 0x717801
neg eax
mov al, 0xb6
not eax
pop eax
xchg cx, ax
sub esp, 0x18
jmp 0x717826
clc
setge cl
mov dl, dh
xchg ah, ch
mov word [esp + 0xc], di
rdtsc
jmp 0x7179bb
Function at 0x7176d1
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr cx, cx
btr ecx, esp
mov cx, 0xb51b
mov ax, sp
jmp 0x7176f5

Function at 0x7178a0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 8]
rdtsc
setl ch
xchg byte [esp + 7], al
rdtsc
pop cx
jmp 0x717886
rdtsc
pop dword [esp + 6]
mov cx, 0x4315
add esp, 5
xor edx, esi
jmp 0x717839
mov ax, 0x72eb
mov dx, bp
clc
xchg edx, eax
mov ax, word [esp + 4]
and dx, 0x2e30
jmp 0x717858
push dword [esp + 2]
rdtsc
mov byte [esp + 1], bh
sub dx, 0x344e
jmp 0x717961
inc ecx
jmp 0x717870
lea edx, [ebp - 0x65c477b1]
mov cx, 0x673d
call 0x7178ee

Function at 0x717e65
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg cl, ch
sub esp, 0xa
rdtsc
mov cl, ch
push dword [esp + 0xc]
setbe ah
jmp 0x717e8b
lea ecx, [eax + edx]
mov al, ah
jmp 0x717e4f
pop word [esp + 0x2f]
not cl
mov ch, bh
mov dl, 0xb4
mov al, ah
mov byte [esp + 0x29], bh
jmp 0x717f65
mov al, ah
mov ecx, dword [esp]
shl dx, cl
mov ch, 0x40
xchg edx, ecx
mov ax, word [esp]
jmp 0x717f7b
mov cx, di
mov dx, word [esp]
shr ecx, 0x1b
mov dx, 0xbdef
mov edx, 0xb0502e9a
jmp 0x717ec8
xchg dh, al
xchg cx, ax
mov dx, word [esp]
lea eax, [edx + esi]
xchg edx, eax
mov edx, dword [esp]
jmp 0x717ef2
lea esp, [esp + 0x42]
and cl, bh
mov edx, dword [esp]
xchg dh, al
mov eax, 0x2c1a7f4a
lea ecx, [edi + ebp]
jmp 0x717f0c
pop cx
mov cl, ch
lea eax, [ecx*4]
cmp edx, ecx
xchg dword [esp + 0xa], eax
push dword [esp + 0x18]
jmp 0x717f23
lea esp, [esp + 0x15]
pushal
mov dx, bp
xchg ah, ch
mov ch, byte [esp + 0x25]
lea eax, [eax + 0x1394e9f9]
jmp 0x717f3c
bt eax, edx
rdtsc
lea edx, [ecx - 0x6cf07d5d]
mov ecx, edx
jmp 0x71828f
mov word [esp + 0x14], di
mov ch, 0x10
rdtsc
call 0x718025
lea eax, [ebp - 0x2000581]
push esp
mov dword [esp], esi
mov word [esp], bx
sub esp, 0x1a
lea edx, [esp + esi]
jmp 0x718188

Function at 0x7183a7
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov word [esp + 4], sp
mov word [esp], sp
mov dword [esp + 0x80], edi
jmp 0x7183ad
push dword [esp + 2]
jmp 0x718390
lea esp, [esp + 0x80]
jmp 0x7183f5
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x7183d8

Function at 0x402daa
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x40a58c], 0
push esi
jne 0x402de1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x402dbb
mov dword [ecx*4 + 0x40a588], eax
inc ecx
cmp ecx, 0x100
jl 0x402db6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x402e12
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x40a588]
xor eax, esi
inc ecx
dec edx
jne 0x402df4
pop edi
not eax
pop esi
ret 0xc
Function at 0x401d80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + 8]
neg ecx
sbb ecx, ecx
and ecx, 0xfffffffe
add ecx, 2
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x401e22
mov dword [ebp - 0xc], 0
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx + 0xc]
jae 0x401e22
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 0x18], edx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp + 0x14]
push ecx
call fcn.00401ce0
add esp, 8
mov edx, dword [eax]
mov dword [ebp - 0x14], edx
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401e15
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x14]
jae 0x401e17
jmp 0x401e22
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0xc], edx
jmp 0x401dc5
mov esp, ebp
pop ebp
ret
Function at 0x402e50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x403c01
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x38]
mov ebp, dword [esp + 0x3c]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x44]
mov dword [esi], eax
mov eax, dword [esp + 0x40]
mov dword [esi + 0x14], ecx
mov cl, byte [esp + 0x50]
cmp cl, bl
mov dword [esi + 8], edx
mov edx, dword [esp + 0x48]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x4c]
mov byte [esp + 0x28], 1
mov dword [esi + 0xc], ebp
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], cl
mov dword [esi + 0x30], ebx
jne 0x402f67
xor edi, edi
cmp eax, ebx
mov dword [esp + 0x50], edi
jbe 0x402eff
lea ecx, [edx + 0xc]
mov edx, eax
jmp 0x402ee0
mov eax, dword [ecx]
cmp eax, edi
jbe 0x402ee8
mov edi, eax
add ecx, 0x10
dec edx
jne 0x402ee0
cmp edi, 0x100000
mov dword [esp + 0x50], edi
mov eax, 0x4064d8
ja 0x402f03
lea eax, [esp + 0x50]
mov eax, dword [eax]
mov dword [esi + 0x28], eax
add eax, 0xa
push eax
call fcn.00403563
mov edi, eax
mov eax, dword [esi + 0x24]
add esp, 4
cmp eax, edi
je 0x402f29
push eax
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [esi + 0x24], edi
push ebx
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
mov eax, dword [esi + 0x24]
add esp, 4
cmp eax, ebx
jne 0x402f67
lea edx, [esp + 0x50]
push edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x54], str.bad_allocation
call dword [sym.imp.MSVCR71.dll_public:_void___thiscall_exception::constructor_char_const__const_const__]
push 0x406bb0
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x4064dc
call sub.MSVCR71.dll__CxxThrowException
mov ecx, ebp
imul ecx, ecx, 0x44
add ecx, 4
push ecx
call fcn.00403563
add esp, 4
mov dword [esp + 0x50], eax
cmp eax, ebx
mov byte [esp + 0x28], 2
je 0x402f9f
push 0x402210
push 0x4021d0
push ebp
lea edi, [eax + 4]
push 0x44
push edi
mov dword [eax], ebp
call fcn.00403698
jmp 0x402fa1
xor edi, edi
mov eax, dword [esi + 0x2c]
cmp eax, edi
mov byte [esp + 0x28], 1
je 0x402fd1
cmp eax, ebx
je 0x402fce
mov edx, dword [eax - 4]
lea ebp, [eax - 4]
push 0x402210
push edx
push 0x44
push eax
call fcn.00403638
push ebp
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
add esp, 4
mov dword [esi + 0x2c], edi
cmp dword [esi + 0x2c], ebx
jne 0x403004
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x54], str.bad_allocation
call dword [sym.imp.MSVCR71.dll_public:_void___thiscall_exception::constructor_char_const__const_const__]
push 0x406bb0
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x1c], 0x4064dc
call sub.MSVCR71.dll__CxxThrowException
mov ecx, esi
call fcn.00402b70
mov ecx, dword [esp + 0x20]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x24
Function at 0x403700
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x406748
call fcn.00403914
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x403740
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x403740
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x403758
cmp eax, 0x20b
je 0x403745
mov dword [ebp - 0x1c], ebx
jmp 0x40376c
cmp dword [ecx + 0x84], 0xe
jbe 0x403740
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x403766
cmp dword [ecx + 0x74], 0xe
jbe 0x403740
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x408420], 0xffffffff
or dword [0x408424], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x408418]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x408414]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x40841c], eax
call fcn.004039aa
call fcn.00403a4a
cmp dword [0x4083d8], ebx
jne 0x4037cc
push fcn.00403a4a
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.00403a38
push 0x40800c
push 0x408008
call sub.MSVCR71.dll__initterm
push 0x4039ee
call fcn.00403998
mov eax, dword [0x408410]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x40840c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jge 0x403820
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x408004
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x40389e
cmp al, bl
je 0x40384a
cmp dword [ebp - 0x20], ebx
jne 0x40389e
mov al, byte [esi]
cmp al, bl
je 0x40385a
cmp al, 0x20
ja 0x40385a
inc esi
mov dword [ebp - 0x24], esi
jmp 0x40384a
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x58], 1
je 0x403876
movzx eax, word [ebp - 0x54]
jmp 0x403879
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.00401520
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], ebx
jne 0x403896
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x4038f3
cmp al, 0x22
jne 0x4038ad
xor ecx, ecx
cmp dword [ebp - 0x20], ebx
sete cl
mov dword [ebp - 0x20], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR71.dll__ismbblead]
pop ecx
test eax, eax
je 0x4038c0
inc esi
mov dword [ebp - 0x24], esi
inc esi
jmp 0x403838
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0040394f
ret
Function at 0x40651e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x406559
push 6
call fcn.00414284
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00415890
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4065bc
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00415620
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4065e0
push 6
call fcn.00414284
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00415890
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x406643
push 0x80000301
push 0
push 2
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00415620
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x406667
push 6
call fcn.00414284
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.00415890
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4066ca
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.00415620
add esp, 0x1c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x4066d2
mov esp, ebp
pop ebp
ret
Function at 0x40abcc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40ac12
push 6
call fcn.00414284
add esp, 4
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fadd qword [0x442d9d]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
call fcn.0040158c
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.00415850
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40ac65
push ebx
call fcn.0041427e
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
push dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40ac9e
push 6
call fcn.00414284
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x40acba
push eax
mov ebx, eax
call fcn.00401a25
inc eax
push eax
call fcn.00414278
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x40acbf
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40acd0
push ebx
call fcn.0041427e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x415480
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x4154e9
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.004143b0
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x415580
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x415612
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x415604
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x4155fc
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x4155c5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x416c30
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x416c68
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x418630
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x418696
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x418696
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x418677
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x419350
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.004194a0
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x419370
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WSOCK32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x419351
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.004194a0
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x419370
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WSOCK32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x4193a0
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
push edi
mov dword [esp + 8], eax
mov edi, ecx
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
push ecx
mov dword [esp + 0x18], eax
mov word [esp + 0xc], 2
call sub.WSOCK32.dll_htons
mov esi, dword [esp + 0x1c]
mov word [esp + 0xa], ax
push esi
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4193f7
push esi
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x41940d
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
lea edx, [esp + 8]
push 0x10
push edx
mov ecx, edi
call fcn.00419430
pop edi
pop esi
add esp, 0x10
ret 8
push 0x2726
call sub.WSOCK32.dll_WSASetLastError
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8

Function at 0x419430
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [ecx]
push edx
push eax
call sub.WSOCK32.dll_connect
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 8

Function at 0x4194c0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WSOCK32.dll_select
cmp eax, 0xffffffff
jne 0x419509
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4