joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4505d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x456360
mov eax, dword fs:[0]
push eax
sub esp, 0x40c
mov eax, dword [0x465b18]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
cmp ebx, edx
je 0x45079d
mov edi, 0x5c
jmp 0x450620
mov eax, dword [ebx]
mov esi, dword [eax*4 + 0x46a4f8]
lea ecx, [eax*4 + 0x46a4f8]
mov dword [ebp - 0x414], ecx
test esi, esi
je 0x450648
cmp esi, 0xffffffff
je 0x450792
jmp 0x45078e
mov esi, dword [eax*4 + 0x45dca8]
cmp byte [0x46a4f0], 0
mov dword [ebp - 4], 0
je 0x45067d
push 0x800
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ecx, dword [ebp - 0x414]
mov esi, eax
mov edx, dword [ebp + 0xc]
jmp 0x45076a
test esi, esi
je 0x450768
cmp word [esi], 0
je 0x450768
push 0x200
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x45075f
cmp eax, 0x200
jae 0x45075f
mov word [ebp + eax*2 - 0x410], di
inc eax
cmp eax, 0x200
jae 0x45075f
movzx ecx, word [esi]
test cx, cx
je 0x4506f0
mov edx, ecx
mov word [ebp + eax*2 - 0x410], dx
inc eax
cmp eax, 0x200
jae 0x45075f
movzx ecx, word [esi + 2]
add esi, 2
mov edx, ecx
test cx, cx
jne 0x4506d2
add eax, eax
cmp eax, 0x400
jae 0x4507bf
mov edi, dword [0x465b18]
xor ecx, ecx
mov word [ebp + eax - 0x410], cx
mov ecx, edi
xor edi, dword [0x46a4f4]
and ecx, 0x1f
ror edi, cl
test edi, edi
je 0x450729
lea eax, [ebp - 0x418]
push eax
push 0
call edi
push 8
push 0
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test edi, edi
je 0x45074f
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x418]
call edi
mov ecx, dword [ebp - 0x414]
mov edi, 0x5c
mov edx, dword [ebp + 0xc]
jmp 0x45076a
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x414]
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test esi, esi
jne 0x45077c
or eax, 0xffffffff
xchg dword [ecx], eax
jmp 0x450792
mov eax, esi
xchg dword [ecx], eax
test eax, eax
je 0x45078b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [ebp + 0xc]
test esi, esi
jne 0x4507bb
add ebx, 4
cmp ebx, edx
jne 0x450620
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00454150
mov esp, ebp
pop ebp
ret
mov eax, esi
jmp 0x45079f
call fcn.00427f20
int3
Function at 0x4506fd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x456360
mov eax, dword fs:[0]
push eax
sub esp, 0x40c
mov eax, dword [0x465b18]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
cmp ebx, edx
je 0x45079d
mov edi, 0x5c
jmp 0x450620
mov eax, dword [ebx]
mov esi, dword [eax*4 + 0x46a4f8]
lea ecx, [eax*4 + 0x46a4f8]
mov dword [ebp - 0x414], ecx
test esi, esi
je 0x450648
cmp esi, 0xffffffff
je 0x450792
jmp 0x45078e
mov esi, dword [eax*4 + 0x45dca8]
cmp byte [0x46a4f0], 0
mov dword [ebp - 4], 0
je 0x45067d
push 0x800
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ecx, dword [ebp - 0x414]
mov esi, eax
mov edx, dword [ebp + 0xc]
jmp 0x45076a
test esi, esi
je 0x450768
cmp word [esi], 0
je 0x450768
push 0x200
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x45075f
cmp eax, 0x200
jae 0x45075f
mov word [ebp + eax*2 - 0x410], di
inc eax
cmp eax, 0x200
jae 0x45075f
movzx ecx, word [esi]
test cx, cx
je 0x4506f0
mov edx, ecx
mov word [ebp + eax*2 - 0x410], dx
inc eax
cmp eax, 0x200
jae 0x45075f
movzx ecx, word [esi + 2]
add esi, 2
mov edx, ecx
test cx, cx
jne 0x4506d2
add eax, eax
cmp eax, 0x400
jae 0x4507bf
mov edi, dword [0x465b18]
xor ecx, ecx
mov word [ebp + eax - 0x410], cx
mov ecx, edi
xor edi, dword [0x46a4f4]
and ecx, 0x1f
ror edi, cl
test edi, edi
je 0x450729
lea eax, [ebp - 0x418]
push eax
push 0
call edi
push 8
push 0
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test edi, edi
je 0x45074f
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x418]
call edi
mov ecx, dword [ebp - 0x414]
mov edi, 0x5c
mov edx, dword [ebp + 0xc]
jmp 0x45076a
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x414]
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test esi, esi
jne 0x45077c
or eax, 0xffffffff
xchg dword [ecx], eax
jmp 0x450792
mov eax, esi
xchg dword [ecx], eax
test eax, eax
je 0x45078b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [ebp + 0xc]
test esi, esi
jne 0x4507bb
add ebx, 4
cmp ebx, edx
jne 0x450620
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00454150
mov esp, ebp
pop ebp
ret
mov eax, esi
jmp 0x45079f
call fcn.00427f20
int3
Function at 0x40decb
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a538]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408cc1
mov dword [ebp - 0x14], eax
cmp dword [0x81531c], esi
jne 0x40dfbe
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40df4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40e09e
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40e09e
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e09e
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x81531c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x815320], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x815324], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x81532c], eax
test eax, eax
je 0x40dfbb
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x815328], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40dfe3
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40dfd6
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40dff8
push 4
pop eax
jmp 0x40e0a0
cmp dword [ebp - 0x14], esi
je 0x40dff8
push dword [0x81531c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40dfdd
mov eax, dword [0x815328]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40e056
cmp dword [0x81532c], edi
je 0x40e056
push eax
call ebx
push dword [0x81532c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40e056
test eax, eax
je 0x40e056
call ecx
test eax, eax
je 0x40e04b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40e04b
test byte [ebp - 8], 1
jne 0x40e056
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40e086
mov eax, dword [0x815320]
cmp eax, edi
je 0x40e083
push eax
call ebx
test eax, eax
je 0x40e083
call eax
mov esi, eax
test esi, esi
je 0x40e083
mov eax, dword [0x815324]
cmp eax, edi
je 0x40e083
push eax
call ebx
test eax, eax
je 0x40e083
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x81531c]
call ebx
test eax, eax
je 0x40e09e
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40e0a0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404283
mov esp, ebp
pop ebp
ret
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rsrc
mov ebx, 0x40c7d0
nop
mov ecx, 0x6ee64863
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x39df346b
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x401c66
pop dword [ebp - 0x4c]
mov eax, 0x44bb77db
sub eax, 0x447b5b75
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x8995ba07
sub dword [ebp - 0x5c], 0x3b4374bc
mov dword [ebp - 0x58], 0x14b2014d
add dword [ebp - 0x58], 0x1d814af8
mov dword [ebp - 0x54], 0x99de622b
add dword [ebp - 0x54], 0xb26de203
mov dword [ebp - 0x50], 0x8b604a4b
sub dword [ebp - 0x50], 0x8b604a4b
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x40d99476
add eax, 0xbf669bde
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xd9279993
sub dword [ebp - 0x5c], 0x64b5303d
mov dword [ebp - 0x58], 0x48026a84
sub dword [ebp - 0x58], 0x696090f
mov dword [ebp - 0x54], 0xb86d1ffa
sub dword [ebp - 0x54], 0x54fdb38e
mov dword [ebp - 0x50], 0x8391aed1
add dword [ebp - 0x50], 0x7c6e512f
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x37892
push 0
call eax
mov ecx, 0x4c38
mov esi, eax
mov edi, 0x1a08e215
sub edi, 0x19c87215
add edi, dword [ebp - 0x4c]
mov edx, 0xeaf09e4c
add dword [ebp - 0x48], 0xb0d3e92d
mov ebx, dword [edi]
sub dword [ebp - 0x18], 0x60b1b9c7
add ebx, edx
xor dword [ebp - 8], ecx
mov dword [esi], ebx
sub dword [ebp - 0x14], ecx
add esi, 0x1ae4093b
sub esi, 0x1ae40937
add edi, 0x4adfd718
sub edi, 0x4adfd714
loop 0x401d77
add eax, 0xc1343047
sub eax, 0xc1330c94
xor ebx, ebx
add ebx, eax
add eax, 0x923f96a2
sub eax, 0x923f969d
mov ecx, 0x3999dcf1
sub ecx, 0x3959dcf1
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x10001de8
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [edx + 0x48]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x10001e01
push dword [esp + 8]
push dword [esp + 8]
push edx
call ecx
add esp, 0xc
ret
push dword [eax + 0x38]
push dword [esp + 0xc]
push 1
push dword [esp + 0x10]
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
ret

Function at 0x10005305
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x10005333
push esi
call fcn.10009b3e
cmp dword [esi + 0x40], 0
pop ecx
je 0x1000532c
xor eax, eax
mov dword [esi + 0x14], 0xcf
inc eax
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x100053a3
mov eax, dword [esi + 0x1b4]
cmp dword [eax + 0x10], 0
je 0x10005395
mov eax, dword [esi + 8]
test eax, eax
je 0x10005354
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x1b4]
push esi
call dword [eax]
pop ecx
test eax, eax
je 0x10005391
cmp eax, 2
je 0x10005395
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10005349
cmp eax, 3
je 0x10005378
cmp eax, 1
jne 0x10005349
inc dword [ecx + 4]
mov ecx, dword [ecx + 4]
mov eax, dword [esi + 8]
cmp ecx, dword [eax + 8]
jl 0x10005349
mov ecx, dword [esi + 0x140]
add dword [eax + 8], ecx
jmp 0x10005349
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
mov dword [esi + 0x98], eax
jmp 0x100053c1
cmp eax, 0xcc
je 0x100053c1
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
mov eax, dword [esi]
mov ecx, dword [esi + 0x14]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
pop ecx
call fcn.100051d0
pop esi
ret

Function at 0x1001c020
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
sub eax, dword [esi + 0x289c]
push 1
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x292c], eax
call edi
sub eax, dword [esi + 0x28a0]
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x2930], eax
mov eax, dword [esi + 0x2d50]
test eax, eax
je 0x1001c08f
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x28a0]
push dword [esi + 0x289c]
push dword [esi + 0x2930]
push dword [esi + 0x292c]
push dword [esi + 0x2d50]
call dword [sym.imp.USER32.dll_MoveWindow]
push esi
call fcn.1001c540
pop ecx
pop edi
pop esi
ret
Function at 0x1001c540
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1001c54f
pop dword [ebp - 0x10]
mov eax, 0x1001c54f
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xd526008a
add dword [ebp - 0x20], 0x792c44c1
mov dword [ebp - 0x1c], 0xba7a75cb
add dword [ebp - 0x1c], 0x77b8d67a
mov dword [ebp - 0x18], 0x7995b723
sub dword [ebp - 0x18], 0x2d4972f5
mov dword [ebp - 0x14], 0x443df28f
add dword [ebp - 0x14], 0xbbc20d71
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xa83dc958
add dword [ebp - 0x20], 0xcc349ffe
mov dword [ebp - 0x1c], 0x4b9ef442
add dword [ebp - 0x1c], 0xf5cd6d33
mov dword [ebp - 0x18], 0xe7942fa5
sub dword [ebp - 0x18], 0x8424c339
mov dword [ebp - 0x14], 0x79d50f59
sub dword [ebp - 0x14], 0x79d50f59
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x5a79d5d2
add eax, 0xb5881a72
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3a371
push 0
call eax
mov ecx, 0x4d12
mov edi, eax
mov ebx, 0x5b4de3c3
sub ebx, 0x4b4af1c3
add ebx, dword [ebp - 0x10]
mov esi, 0xa3a43eb4
add dword [ebp - 4], 0xa0ce5fe8
mov edx, dword [ebx]
sub dword [ebp - 0xc], eax
sub edx, esi
xor dword [ebp - 4], ebx
mov dword [edi], edx
sub dword [ebp - 8], 0x24174860
add edi, 0x49e188e8
add edi, 0xb61e771c
add ebx, 0xb90de7aa
add ebx, 0x46f2185a
loop 0x1001c65b
add eax, 0xebed27b4
sub eax, 0xebec0099
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xe3d53a98
add ecx, 0x2c2ac568
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x1001e4ea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10029008]
jne 0x1001e4f4
repz ret
jmp fcn.1001ea43

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x408ecc
mov ecx, 0x697257c0
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..text
mov ebx, 0x42e1d0
nop
mov ecx, 0x3cb85d7a
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x2e047561
Capabilities:
Encode data using xor

Disassembly:
movsd dword es:[edi], dword [esi]
and eax, 0x60165f44
pushal
and byte [ebx], bh
mov eax, dword [0xe51c06ab]
movsd dword es:[edi], dword [esi]
sub dword [edi + ebp*2], 6
sbb dword [ebx - 0x3febfba7], esp
test ch, al
push ds
inc esp
mov edi, 0x9c18178c
stosb byte es:[edi], al
add byte [edx], ch
mov eax, dword [0x6abd1ee8]
sub eax, dword [esi]
cmp edx, dword [ebx + 0x10018a6]
mov al, byte [0xa5febf93]
add dword [eax - 0x5a01406d], esp
pop edi
add dh, al
test al, 0x3c
loop 0x2e0474cf
test dword [edi - 0x20], edi
mov dword [ebx - 0x38c5d88], esp
xor ebx, ecx
adc eax, 0xf4ffef5d
pop esi
fcmovnb st(0), st(1)
fcom qword [bp + 0x1ccb]
dec edi
dec ebx
invalid
hlt
mov esi, 0x2fa98b7
sub dword [esi], eax
shl dword [ebx - 0x76d98277], 0x6a
sbb eax, 0xd62c6b1a
test al, 0xb3
movsb byte es:[edi], byte [esi]
or al, 0x4e
jne 0x2e047500
cwde
adc al, 0xaf
sbb dl, ch
add al, 0xf3
mov ecx, dword [ecx]
lodsd eax, dword [esi]
insd dword es:[edi], dx
mov ebx, 0x953456f3
cmp ah, bl
inc ebp
cdq
jg 0x2e04757d
arpl word [eax], ax
cmp byte [edx + edx], dl
inc esi
push 0x74a2101a
cmp byte [ecx], ch
pop ss
and al, 0x92
out dx, eax
lodsb al, byte [esi]
or al, 0x41
sbb byte [ebp + 1], 0x33
mov bl, 0x34
mov edx, 0x92d4cacd
jg 0x2e04753c
loop 0x2e0475ef
xor dword [edi + ecx*4 + 0x41], 0x90626f56
sbb dword [edi + 0x22770c33], esi
insd dword es:[edi], dx
cmpsd dword [esi], dword es:[edi]
add dword [eax + ebx], ecx
push ss
dec byte [esi]
xor byte [0x81e828c3], 0x23
jnp 0x2e0475c6
or dword [edi - 0x74], 0x77
stc
pop ebp
fldcw word [eax - 0x49]
sbb al, 0xe7
invalid
add dword [eax - 0x3f1ee61b], 0x6bee0f2
jmp 0x7af3583f

Function at 0x2e04cae9
Capabilities:
Encode data using xor

Disassembly:
add byte [eax - 0x22e0243b], bl
sar dword [ebx], 0x1f
ffree st(1)
cmp edi, dword [edi - 0x4a6a7a48]
mov edx, 0x718282dd
xchg ebx, eax
cmp al, 0x36
and al, 2
mov bl, 0x5d
movsb byte es:[edi], byte [esi]
and ch, byte [eax + 0x3536fc]
jae 0x2e04cb47
xor eax, 0x31387300
sbb edi, edx
xor dword [ecx], ebx
xlatb
or dword [ecx], eax
adc bl, byte [ecx]
loop 0x2e04cb0b
cmp eax, 0x771c21ff
push es
movsd dword es:[edi], dword [esi]
stosb byte es:[edi], al
inc esi
mov ecx, 0x666619c6
mov dh, 0x7b
shl dword [edx - 0x2d15a574], 0x4b
stc
jle 0x2e04cb7b
insb byte es:[edi], dx
arpl word [ebx], bx
sub eax, dword [esi + ecx*4]
sub edi, ebx
lahf
int 0x1b
and byte [0x330f1a1c], cl
in eax, 0x4c
lcall 0xe7, 0x376323ae
and esp, dword [ebx + 0x37]
out 0, eax
outsd dx, dword [esi]
ficomp word [eax]
jnp 0x2e04cb93
inc ebx
mov cl, 0xf
ret 0xdbf1
invalid
sub edi, ecx
xchg edi, eax
retf 0x1fc4
Function at 0x401000
Capabilities:
Initialize winsock library
Terminate process

Disassembly:
sub esp, 0x1e0
lea eax, [esp + 0x50]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp dword [esp + 0x1e4], 5
je 0x401034
push str.Usage:port_10.110.51.221_3301_127.0.0.1_3389_n
call fcn.00401c40
add esp, 4
push 0
call fcn.00401b6b
push esi
mov esi, dword [esp + 0x1ec]
push edi
push 0x28
mov ecx, dword [esi + 4]
lea edx, [esp + 0xc]
push ecx
push edx
call fcn.00401a40
mov eax, dword [esi + 8]
push eax
call fcn.00401a31
mov ecx, dword [esi + 0xc]
push 0x28
lea edx, [esp + 0x44]
push ecx
push edx
mov edi, eax
call fcn.00401a40
mov eax, dword [esi + 0x10]
push eax
call fcn.00401a31
lea ecx, [esp + 0x50]
push eax
push ecx
lea edx, [esp + 0x30]
push edi
push edx
call fcn.004010b0
add esp, 0x30
push 0x989680
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.Hello_World__n
call fcn.00401c40
add esp, 4
xor eax, eax
pop edi
pop esi
add esp, 0x1e0
ret
Function at 0x4010b0
Capabilities:
Create thread
Get socket status
Receive data
Receive data on socket
Send data
Send data on socket
Terminate thread

Disassembly:
mov eax, 0x5110
call fcn.00401e40
push ebx
push ebp
mov ebp, dword [esp + 0x5128]
push esi
push edi
call fcn.004012a0
mov esi, eax
test esi, esi
je 0x401294
call fcn.004012a0
mov ebx, eax
test ebx, ebx
je 0x401294
mov edi, dword [esp + 0x5128]
mov eax, dword [esp + 0x5124]
push edi
push eax
push str.___Make_a_Connection_to__s:_d...._r_n
call fcn.00401c40
push 0x407310
call fcn.00401c71
mov ecx, dword [esp + 0x5134]
push edi
push ecx
push esi
call fcn.004018f0
add esp, 0x1c
test eax, eax
jne 0x40112b
push esi
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
call esi
push ebx
call esi
jmp 0x4010c5
mov ecx, 0x1400
xor eax, eax
lea edi, [esp + 0x120]
rep stosd dword es:[edi], eax
lea edi, [esi + 1]
push 0
push 0
lea edx, [esp + 0x24]
push 0
push edx
push edi
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x40116f
cmp dword [0x407c20], 0x2714
jne 0x4011a4
jmp 0x40113e
lea eax, [esp + 0x1c]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x401188
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40113e
push 0
lea ecx, [esp + 0x124]
push 0x5000
push ecx
push esi
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
jg 0x4011b6
push str.____There_is_a_error...Create_a_new_connection._r_n
call fcn.00401c40
add esp, 4
jmp 0x4010c5
push str.___Connect_OK__r_n
call fcn.00401c40
mov edx, dword [esp + 0x5130]
push ebp
push edx
push str.___Make_a_Connection_to__s:_d...._r_n
call fcn.00401c40
push 0x407310
call fcn.00401c71
mov eax, dword [esp + 0x5140]
push ebp
push eax
push ebx
call fcn.004018f0
add esp, 0x20
test eax, eax
jne 0x401203
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x4011b6
push 0
lea ecx, [esp + 0x124]
push edi
push ecx
push ebx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x401229
push str.____Send_failed._r_n
call fcn.00401c40
add esp, 4
jmp 0x4011b6
mov ecx, 0x1400
xor eax, eax
lea edi, [esp + 0x120]
push str.___All_Connect_OK__r_n
rep stosd dword es:[edi], eax
call fcn.00401c40
add esp, 4
lea edx, [esp + 0x18]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], esi
push edx
push 0
push eax
push 0x4012c0
push 0
push 0
mov dword [esp + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40128a
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.___CreateThread_OK__r_n_n
call fcn.00401c40
add esp, 4
jmp 0x4010c5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5110
ret

Function at 0x4012a0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
test eax, eax
jge 0x4012bf
push str.____Create_socket_error._r_n
call fcn.00401c40
add esp, 4
xor eax, eax
ret