joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f600
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov dword [esp + 8], 0x33343566
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov eax, 0xf046ba29
mov edx, 0xd6
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax + 0xfb945df]
mov edi, esi
not edi
or edi, edx
mov ecx, edi
or ecx, 2
mov ebx, edi
xor ebx, 0xfffffffd
and ebx, ecx
inc ecx
imul ebx, ecx
mov ecx, edi
not ecx
and ecx, 2
and edi, 0xfffffffd
inc edi
imul edi, ecx
add edi, ebx
add esi, eax
add esi, edi
mov dword [esp + 4], esi
mov ecx, dword [esp + 4]
add cl, 0xe1
mov byte [esp + eax + 0xfb945df], cl
inc eax
dec edx
cmp eax, 0xf046ba36
jne 0x43f640
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [ebp + 8], 0
sete cl
jmp dword [ecx*4 + 0x44bf8c]

Function at 0x43f840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [ebp + 8]
movzx eax, word [eax]
mov dword [esp + 0x18], eax
mov dword [esp + 8], 0x3b38e3f9
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov word [esp + 0x14], 0
xor ecx, ecx
mov eax, 0xffffffff
nop
nop
nop
nop
mov dword [esp], eax
mov dword [esp + 4], ecx
movzx esi, byte [esp + ecx + 8]
mov eax, dword [esp]
and eax, 0x23004046
mov ecx, dword [esp + 4]
and ecx, 0x48400c11
or ecx, eax
mov edx, ecx
xor edx, 0x23004046
mov eax, dword [esp]
and eax, 2
mov ebx, edx
xor ecx, 0x23004044
add ecx, edx
and edx, 0x6b404c55
imul eax, edx
and ebx, 2
sub ecx, edx
imul ecx, ebx
mov edx, ecx
and edx, eax
xor ecx, eax
mov eax, dword [esp]
and eax, 0x6b404c57
mov edi, dword [esp + 4]
and edi, 8
or edi, eax
xor edi, 0x880ede58
mov eax, dword [esp]
and eax, 0xe3400007
add eax, eax
sub eax, edi
add eax, ecx
lea ecx, [eax + edx*2]
mov edi, 0x77f121a7
sub edi, ecx
lea edx, [eax + edx*2]
add edx, 0x880ede58
mov eax, edx
and eax, 0x65947485
mov ecx, edi
and ecx, 0x9a6b8b7a
or ecx, eax
mov dword [esp + 0x1c], esi
mov ebx, esi
not ebx
lea eax, [esi + esi]
not eax
add eax, esi
or eax, ebx
mov esi, eax
and esi, 0x659474ff
xor esi, ecx
xor esi, 0x7a
or eax, edx
not eax
or eax, esi
or ebx, edi
and edi, 0x2a
and edx, 0xd5
or edx, edi
xor edx, 0xd5
or ebx, edx
add ebx, dword [esp + 0x1c]
mov ecx, 0xfffffffe
sub ecx, ebx
and ecx, eax
not ecx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x30]
add al, 0x9f
mov byte [esp + ecx + 8], al
mov eax, dword [esp]
inc ecx
dec eax
cmp ecx, 0xe
jne case.default.0x43f98f
xor ecx, ecx
mov eax, dword [esp + 0x18]
cmp dword [esp + 8], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x44c01c]
Function at 0x440480
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4404a0
mov edi, eax
sar edi, 1
cmp edi, 0xfffffffb
jge 0x4404bb
mov eax, 0xffffffff
jmp 0x4404be
add eax, 0xa
push eax
call fcn.00408d90
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov dword [esp + 4], eax
add eax, 8
movzx ecx, word [esi]
test cx, cx
je 0x440501
add esi, 2
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x4404f0
mov word [eax], 0
lea eax, [edi*2 + 8]
mov word [esp + 0x14], ax
lea eax, [edi*2 + 0xa]
mov word [esp + 0x16], ax
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x34], 0x18
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x40
lea eax, [esp + 0x14]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x20], 0x92919097
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov eax, 0x900a7fc2
mov dword [esp + 8], 0x900a7fc3
mov edx, 0x6ff5803c
mov dword [esp], edx
movzx ecx, byte [esp + eax + 0x6ff5805e]
mov edi, ecx
lea edx, [ecx + ecx]
not edx
add edx, ecx
mov dword [esp + 0x10], edx
not ecx
mov dword [esp + 0xc], eax
mov esi, ecx
and esi, 0x401000e3
and edi, 0x1c
or edi, esi
mov esi, edi
xor esi, 0xbfefff1c
xor edi, 0xe3
or edi, ecx
lea ecx, [esi + edi]
add esi, edi
inc esi
lea ebx, [eax + 1]
mov edi, ebx
and edi, 0x1846
mov edx, dword [esp]
and edx, 0x60818019
or edx, edi
xor edx, 0xf08be799
and edx, ebx
mov edi, esi
and edi, edx
xor edx, esi
not edx
add ecx, edx
inc ecx
sub ecx, edi
mov edx, dword [esp]
shr edx, 1
and edx, 1
mov esi, ebx
and esi, 0x100a7fdd
imul esi, edx
mov eax, dword [esp + 8]
mov edx, eax
shr edx, 1
and edx, 1
mov edi, ebx
or edi, 2
imul edi, edx
add esi, esi
lea edx, [esi + edi*2]
mov edi, dword [esp + 0xc]
mov esi, edi
sub esi, edx
and esi, dword [esp + 0x10]
mov edx, ecx
and edx, esi
add esi, ecx
add edx, edx
sub esi, edx
mov edx, dword [esp]
and esi, ecx
mov dword [esp + 0x1c], esi
mov ecx, dword [esp + 0x1c]
add cl, 0xab
mov byte [esp + edi + 0x6ff5805e], cl
inc eax
mov dword [esp + 8], eax
dec edx
mov eax, ebx
cmp ebx, 0x900a7fce
jne 0x440580
mov esi, dword [esp + 0x20]
mov eax, dword [0x44d514]
test eax, eax
je 0x4406bd
xor ecx, ecx
mov edx, dword [0x44d518]
nop
nop
nop
cmp dword [edx + ecx*8], 0xbc8a835b
je 0x440680
inc ecx
cmp eax, ecx
jne 0x440670
jmp 0x4406bd
mov eax, dword [edx + ecx*8 + 4]
cmp eax, esi
je 0x4406bd
lea ecx, [esp + 0x20]
lea edx, [esp + 0x34]
push 0
push 0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x20]
push 0
push ecx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xb
push dword [0x44d51c]
push eax
call fcn.0043d9a0
add esp, 0x38
mov esi, eax
push dword [esp + 4]
call fcn.00408da0
add esp, 4
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4406e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x440700
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x44071b
mov eax, 0xffffffff
jmp 0x44071e
add eax, 0xa
push eax
call fcn.00408d90
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov dword [esp + 4], eax
add eax, 8
movzx edx, word [edi]
test dx, dx
je 0x440761
add edi, 2
nop
mov word [eax], dx
add eax, 2
movzx edx, word [edi]
add edi, 2
test dx, dx
jne 0x440750
mov word [eax], 0
and esi, 2
mov eax, esi
xor eax, 2
mov edx, ecx
and edx, 0xfffd
imul edx, eax
or ecx, 2
imul ecx, esi
lea eax, [ecx + edx]
mov word [esp + 0x14], ax
lea eax, [ecx + edx]
add eax, 2
mov word [esp + 0x16], ax
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x34], 0x18
mov dword [esp + 0x38], 0
mov dword [esp + 0x40], 0x40
lea eax, [esp + 0x14]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x20], 0x92919097
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov eax, 0x900a7fc2
mov dword [esp + 8], 0x900a7fc3
mov edx, 0x6ff5803c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp], edx
movzx ecx, byte [esp + eax + 0x6ff5805e]
mov edi, ecx
lea edx, [ecx + ecx]
not edx
add edx, ecx
mov dword [esp + 0x10], edx
not ecx
mov dword [esp + 0xc], eax
mov esi, ecx
and esi, 0x401000e3
and edi, 0x1c
or edi, esi
mov esi, edi
xor esi, 0xbfefff1c
xor edi, 0xe3
or edi, ecx
lea ecx, [esi + edi]
add esi, edi
inc esi
lea ebx, [eax + 1]
mov edi, ebx
and edi, 0x1846
mov edx, dword [esp]
and edx, 0x60818019
or edx, edi
xor edx, 0xf08be799
and edx, ebx
mov edi, esi
and edi, edx
xor edx, esi
not edx
add ecx, edx
inc ecx
sub ecx, edi
mov edx, dword [esp]
shr edx, 1
and edx, 1
mov esi, ebx
and esi, 0x100a7fdd
imul esi, edx
mov eax, dword [esp + 8]
mov edx, eax
shr edx, 1
and edx, 1
mov edi, ebx
or edi, 2
imul edi, edx
add esi, esi
lea edx, [esi + edi*2]
mov edi, dword [esp + 0xc]
mov esi, edi
sub esi, edx
and esi, dword [esp + 0x10]
mov edx, ecx
and edx, esi
add esi, ecx
add edx, edx
sub esi, edx
mov edx, dword [esp]
and esi, ecx
mov dword [esp + 0x1c], esi
mov ecx, dword [esp + 0x1c]
add cl, 0xab
mov byte [esp + edi + 0x6ff5805e], cl
inc eax
mov dword [esp + 8], eax
dec edx
mov eax, ebx
cmp ebx, 0x900a7fce
jne 0x440800
mov esi, dword [esp + 0x20]
mov eax, dword [0x44d514]
test eax, eax
je 0x440931
xor ecx, ecx
mov edx, dword [0x44d518]
nop
nop
nop
cmp dword [edx + ecx*8], 0xcd669f2f
je 0x440900
inc ecx
cmp eax, ecx
jne 0x4408f0
jmp 0x440931
mov eax, dword [edx + ecx*8 + 4]
cmp eax, esi
je 0x440931
lea ecx, [esp + 0x20]
lea edx, [esp + 0x34]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ecx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 6
push dword [0x44d51c]
push eax
call fcn.0043d9a0
add esp, 0x24
mov esi, eax
push dword [esp + 4]
call fcn.00408da0
add esp, 4
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440bc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov dword [esp + 0x10], 0x92919097
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov eax, 0x900a7fc2
mov dword [esp + 4], 0x900a7fc3
mov edx, 0x6ff5803c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp], edx
movzx edi, byte [esp + eax + 0x6ff5804e]
mov ebx, edi
lea ecx, [edi + edi]
not ecx
add ecx, edi
mov dword [esp + 0xc], ecx
not edi
mov dword [esp + 8], eax
mov ecx, edi
and ecx, 0x401000e3
and ebx, 0x1c
or ebx, ecx
mov ecx, ebx
xor ecx, 0xbfefff1c
xor ebx, 0xe3
or ebx, edi
lea edi, [ecx + ebx]
add ecx, ebx
inc ecx
lea esi, [eax + 1]
mov ebx, esi
and ebx, 0x1846
mov edx, dword [esp]
and edx, 0x60818019
or edx, ebx
xor edx, 0xf08be799
and edx, esi
mov ebx, ecx
and ebx, edx
xor edx, ecx
not edx
add edi, edx
inc edi
sub edi, ebx
mov edx, dword [esp]
shr edx, 1
and edx, 1
mov ecx, esi
and ecx, 0x100a7fdd
imul ecx, edx
mov eax, dword [esp + 4]
mov edx, eax
shr edx, 1
and edx, 1
mov ebx, esi
or ebx, 2
imul ebx, edx
add ecx, ecx
lea edx, [ecx + ebx*2]
mov ebx, dword [esp + 8]
mov ecx, ebx
sub ecx, edx
and ecx, dword [esp + 0xc]
mov edx, edi
and edx, ecx
add ecx, edi
add edx, edx
sub ecx, edx
mov edx, dword [esp]
and ecx, edi
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x2c]
add cl, 0xab
mov byte [esp + ebx + 0x6ff5804e], cl
inc eax
mov dword [esp + 4], eax
dec edx
mov eax, esi
cmp esi, 0x900a7fce
jne 0x440c00
mov eax, dword [esp + 0x10]
mov ecx, dword [0x44d514]
test ecx, ecx
je 0x440d2a
xor edx, edx
mov esi, dword [0x44d518]
nop
nop
cmp dword [esi + edx*8], 0xd75bc899
je 0x440d00
inc edx
cmp ecx, edx
jne 0x440cf0
jmp 0x440d2a
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x440d2a
lea eax, [esp + 0x10]
lea edx, [esp + 0x2c]
push 5
push 0x18
push eax
push edx
push dword [ebp + 8]
push 5
push dword [0x44d51c]
push ecx
call fcn.0043d9a0
add esp, 0x20
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x440d37
mov ecx, dword [esp + 0x18]
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x440d46
cmp byte [esp + 0x25], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x441360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 8]
mov edx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0x441380
sar edx, 1
mov esi, edx
and esi, 0xfffd
mov edi, edx
and edi, 2
or edx, 2
imul edx, edi
xor edi, 2
imul edi, esi
lea esi, [edi + edx]
mov word [esp + 0xc], si
add edx, edi
add edx, 2
mov word [esp + 0xe], dx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x2c], 0x18
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], 0x40
lea eax, [esp + 0xc]
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x18], 0x92919097
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov eax, 0x900a7fc2
mov dword [esp + 4], 0x900a7fc3
mov edi, 0x6ff5803c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp], edi
movzx esi, byte [esp + eax + 0x6ff58056]
mov ebx, esi
lea edx, [esi + esi]
not edx
add edx, esi
not esi
mov dword [esp + 8], eax
mov ecx, esi
and ecx, 0x401000e3
and ebx, 0x1c
or ebx, ecx
mov ecx, ebx
xor ecx, 0xbfefff1c
xor ebx, 0xe3
or ebx, esi
lea esi, [ecx + ebx]
add ecx, ebx
inc ecx
inc eax
mov ebx, eax
and ebx, 0x1846
mov edi, dword [esp]
and edi, 0x60818019
or edi, ebx
xor edi, 0xf08be799
and edi, eax
mov ebx, ecx
and ebx, edi
xor edi, ecx
not edi
add esi, edi
inc esi
sub esi, ebx
mov edi, dword [esp]
shr edi, 1
and edi, 1
mov ecx, eax
and ecx, 0x100a7fdd
imul ecx, edi
mov edi, dword [esp + 4]
shr edi, 1
and edi, 1
mov ebx, eax
or ebx, 2
imul ebx, edi
add ecx, ecx
lea edi, [ecx + ebx*2]
mov ebx, dword [esp + 8]
mov ecx, ebx
sub ecx, edi
mov edi, dword [esp]
and ecx, edx
mov edx, esi
and edx, ecx
add ecx, esi
add edx, edx
sub ecx, edx
and ecx, esi
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
add cl, 0xab
mov byte [esp + ebx + 0x6ff58056], cl
inc dword [esp + 4]
dec edi
mov ecx, eax
cmp eax, 0x900a7fce
jne 0x441420
mov eax, dword [esp + 0x18]
mov ecx, dword [0x44d514]
test ecx, ecx
je 0x441547
xor edx, edx
mov esi, dword [0x44d518]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x55708665
je 0x441520
inc edx
cmp ecx, edx
jne 0x441510
jmp 0x441547
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x441547
lea eax, [esp + 0x2c]
push dword [ebp + 0x14]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 4
push dword [0x44d51c]
push ecx
call fcn.0043d9a0
add esp, 0x1c
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x407ef8
nop
mov ecx, 0x59552301
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x238567be
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401d50
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x432613
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x11c
mov eax, dword [0x43c2d0]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push str.7A23EC47_F9C9_4b1a_A812_489C7A8C8927
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401db2
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x401e9a
call fcn.00407410
test eax, eax
je 0x401e8e
mov dword [ebp - 4], 0
mov byte [ebp - 0x128], 0
push 0x103
push 0
lea ecx, [ebp - 0x127]
push ecx
call fcn.00422700
add esp, 0xc
lea ecx, [ebp - 0x15]
call fcn.00402ad0
mov byte [ebp - 4], 1
push 0x104
lea edx, [ebp - 0x128]
push edx
lea ecx, [ebp - 0x15]
call fcn.00411a90
push str.Windows_7
lea eax, [ebp - 0x128]
push eax
call fcn.00402fb0
add esp, 8
test eax, eax
setne cl
mov byte [ebp - 0x129], cl
movzx edx, byte [ebp - 0x129]
test edx, edx
jne 0x401e34
call fcn.0041b450
jmp 0x401e39
call fcn.0041b9f0
lea ecx, [ebp - 0x12a]
call fcn.00402ad0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x12a]
call fcn.00404af0
call fcn.00401be0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12a]
call fcn.00419690
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x15]
call fcn.00419690
jmp 0x401e82
mov dword [ebp - 4], 0xffffffff
call fcn.00407480
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0041d486
mov esp, ebp
pop ebp
ret 0x10

Function at 0x403070
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 8
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0x403050
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x404a40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5010
call fcn.00427380
mov eax, dword [0x43c2d0]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x5000
lea eax, [ebp - 0x5010]
push eax
call fcn.0041de18
add esp, 0x10
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x5010]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041d486
mov esp, ebp
pop ebp
ret
Function at 0x404c80
Capabilities:
Enumerate process modules
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x43c2d0]
xor eax, ebp
mov dword [ebp - 0x2c], eax
push str.Enter_SetWindowsAPIHook_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x404cad
xor eax, eax
jmp 0x404d97
mov ecx, dword [ebp + 8]
cmp dword [ecx + 4], 0
jne 0x404cbd
xor eax, eax
jmp 0x404d97
mov edx, dword [ebp + 8]
cmp dword [edx + 8], 0
jne 0x404ccd
xor eax, eax
jmp 0x404d97
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0
jne 0x404d82
mov dword [ebp - 0x258], 0x224
push 0x220
push 0
lea ecx, [ebp - 0x254]
push ecx
call fcn.00422700
add esp, 0xc
push 0x1c
lea edx, [ebp - 0x28]
push edx
push fcn.00404b90
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
push 0
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x258]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.dll_Module32First
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x404d6e
mov eax, dword [ebp - 0x23c]
cmp eax, dword [ebp - 4]
je 0x404d59
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x23c]
mov dword [ecx + 0x10], edx
mov eax, dword [ebp + 8]
push eax
call fcn.00404b90
add esp, 4
lea ecx, [ebp - 0x258]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.dll_Module32Next
mov dword [ebp - 0xc], eax
jmp 0x404d30
push str.Exit_SetWindowsAPIHook_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
jmp 0x404d97
mov eax, dword [ebp + 8]
push eax
call fcn.00404b90
add esp, 4
mov eax, 1
jmp 0x404d97
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.0041d486
mov esp, ebp
pop ebp
ret

Function at 0x407410
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x43c2d0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x43e9dc], 0
jne 0x40746c
lea eax, [ebp - 0x198]
push eax
push 0x202
call sub.WSOCK32.dll_WSAStartup
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
jne 0x407458
mov dword [0x43e9dc], 1
jmp 0x40746c
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
test ecx, ecx
jne 0x40742c
mov eax, dword [0x43e9dc]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d486
mov esp, ebp
pop ebp
ret
Function at 0x407490
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x10], 0
jne 0x4074a3
mov al, 1
jmp 0x407550
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 0
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.WSOCK32.dll_send
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x4074fe
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x10]
jae 0x4074fc
push 2
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4074b8
jmp 0x407535
cmp dword [ebp - 0x10], 0
jge 0x407535
cmp dword [ebp - 0xc], 5
jae 0x407535
cmp dword [ebp - 8], 5
jae 0x407535
cmp dword [ebp - 0xc], 0
jne 0x40751f
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x4074b8
cmp dword [ebp + 0x14], 0
je 0x407543
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp eax, dword [ebp + 0x10]
sete cl
mov al, cl
mov esp, ebp
pop ebp
ret
Function at 0x407640
Capabilities:
Connect socket
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004075e0
add esp, 0xc
cmp dword [ebp + 0x14], 0
jle 0x4077ac
mov dword [ebp - 4], 1
lea eax, [ebp - 4]
push eax
push 0x8004667e
mov ecx, dword [ebp + 8]
push ecx
call sub.WSOCK32.dll_ioctlsocket
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4077ac
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.WSOCK32.dll_connect
mov dword [ebp - 8], eax
mov dword [ebp - 0x114], 0
cmp dword [ebp - 8], 0xffffffff
jne 0x4076bc
call sub.WSOCK32.dll_WSAGetLastError
mov dword [ebp - 0x114], eax
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0x8004667e
mov eax, dword [ebp + 8]
push eax
call sub.WSOCK32.dll_ioctlsocket
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4076f2
cmp dword [ebp - 0x114], 0x2733
je 0x4076f2
or eax, 0xffffffff
jmp 0x4077bd
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x228], 0
cmp dword [ebp - 0x110], 0x40
jae 0x40772e
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp + 8]
mov dword [ebp + ecx*4 - 0x10c], edx
mov eax, dword [ebp - 0x110]
add eax, 1
mov dword [ebp - 0x110], eax
xor ecx, ecx
jne 0x407706
cmp dword [ebp - 0x228], 0x40
jae 0x40775a
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp + 8]
mov dword [ebp + edx*4 - 0x224], eax
mov ecx, dword [ebp - 0x228]
add ecx, 1
mov dword [ebp - 0x228], ecx
xor edx, edx
jne 0x407732
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], 0
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0x110]
push eax
push 0
push 0
call sub.WSOCK32.dll_select
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x4077a7
xor eax, eax
jmp 0x4077bd
or eax, 0xffffffff
jmp 0x4077bd
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.WSOCK32.dll_connect
mov esp, ebp
pop ebp
ret