joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a830
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.10009ca0
test eax, eax
je 0x1000a873
lea ecx, [ebp - 0x14]
mov word [ebp - 0xf], 0x6957
push ecx
push eax
mov dword [ebp - 0x14], 0x6e697242
mov dword [ebp - 0xd], 0x776f646e
mov dword [ebp - 7], 0x706f54
mov byte [ebp - 0x10], 0x67
mov word [ebp - 9], 0x6f54
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push esi
push 0x104
lea eax, [ebp - 0x130]
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x10], esi
call fcn.1000e200
add esp, 0xc
mov dword [ebp - 5], 0x73255c45
lea ecx, [ebp - 0x28]
mov dword [ebp - 0xa], 0x41575446
mov word [ebp - 0xc], 0x4f53
mov byte [ebp - 1], 0
mov byte [ebp - 6], 0x52
call fcn.1000b7e0
cmp dword [eax + 0x14], 0x10
jb 0x1000a951
mov eax, dword [eax]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x130]
push 0x104
push eax
call fcn.1000b6e0
mov edx, dword [ebp - 0x14]
add esp, 0x14
cmp edx, 0x10
jb 0x1000a99c
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000a992
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000a9b1
push edx
push ecx
call fcn.1000c04b
add esp, 8
lea eax, [ebp - 0x130]
mov ecx, esi
push eax
call fcn.1000b880
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.1001f347
int3

Function at 0x1000ae60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [0x1006e56c], 0
jne 0x1000ae87
call fcn.1000a100
mov edx, 0x100
mov ecx, 0x1006e570
call fcn.1000a730
mov dword [0x1006e56c], 1
jmp fcn.1000a790

Function at 0x1002aee3
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002a78f

Function at 0x1002aeee
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002a9ca

Function at 0x1003584e
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003568c

Function at 0x1003ba10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.10009ca0
test eax, eax
je 0x1003ba4e
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xf], 0x69577465
push ecx
push eax
mov dword [ebp - 8], 0x736f5077
mov word [ebp - 0xb], 0x646e
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 4], 0
mov byte [ebp - 9], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1003baa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.10009ca0
test eax, eax
je 0x1003baef
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x11], 0x65726f46
push ecx
push eax
mov dword [ebp - 5], 0x776f646e
mov dword [ebp - 0xa], 0x57646e75
mov word [ebp - 0x14], 0x6553
mov word [ebp - 0xd], 0x7267
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 1], 0
mov byte [ebp - 6], 0x69
mov byte [ebp - 0xb], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1003bb40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.10009ca0
test eax, eax
je 0x1003bb81
lea ecx, [ebp - 0x10]
mov dword [ebp - 5], 0x776f646e
push ecx
push eax
mov dword [ebp - 0xb], 0x65766974
mov dword [ebp - 0x10], 0x41746553
mov word [ebp - 7], 0x6957
mov byte [ebp - 1], 0
mov byte [ebp - 0xc], 0x63
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1003bd10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0xc]
sub esp, 0x118
cmp eax, 1
jne 0x1003bdc4
push ecx
lea edx, [esp + 0x14]
call fcn.10009fc0
add esp, 4
mov dword [esp + 6], 0x75732074
lea eax, [esp]
mov dword [esp + 0xc], 0x74726f
mov dword [esp + 1], 0x6174736e
mov word [esp + 0xa], 0x7070
push eax
lea eax, [esp + 0x14]
mov byte [esp + 4], 0x69
push eax
mov byte [esp + 0xd], 0x6e
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1003bdf0
mov edx, sym.drvhlp.dll_yw70aa
mov ecx, 0x1006e560
call fcn.1003c080
test eax, eax
je 0x1003bdf0
mov edx, sym.drvhlp.dll_yhkmjw
mov ecx, 0x1006e524
call fcn.1003c080
test eax, eax
je 0x1003bdf0
mov edx, sym.drvhlp.dll_di84ga
mov ecx, 0x1006e54c
call fcn.1003c080
test eax, eax
je 0x1003bdf0
mov edx, sym.drvhlp.dll_hf3wp8
mov ecx, 0x1006e544
call fcn.1003c080
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
test eax, eax
jne 0x1003bdf0
mov ecx, 0x1006e560
call fcn.1003c250
mov ecx, 0x1006e524
call fcn.1003c250
mov ecx, 0x1006e54c
call fcn.1003c250
mov ecx, 0x1006e544
call fcn.1003c250
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4011c7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffeff8
push ebp
mov ebp, esp
pop ebp
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 4], eax
inc eax
jne 0x4011f5
leave
ret 8
push 0
lea eax, [ebp - 8]
push eax
push 0x1000
lea eax, [ebp - 0x1008]
push eax
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
or eax, eax
jne 0x401221
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
sub eax, eax
leave
ret 8
push dword [ebp - 8]
lea eax, [ebp - 0x1008]
push eax
push dword [ebp + 0xc]
call fcn.00401150
cmp dword [ebp - 8], 0
jne 0x4011f5
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, 1
leave
ret 8

Function at 0x4013aa
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
mov esi, dword [ebp + 0xc]
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call sub.kernel32.dll_WriteFile
or eax, eax
je 0x4013d0
cmp dword [ebp - 4], 0
jne 0x4013d7
sub eax, eax
pop esi
leave
ret 0xc
mov eax, dword [ebp - 4]
add esi, eax
sub dword [ebp + 0x10], eax
jne 0x4013b4
mov eax, 1
pop esi
leave
ret 0xc

Function at 0x4018af
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
push dword [ebp + 8]
pop ebx
mov al, byte [ebx]
mov byte [ebp - 3], al
mov al, byte [ebx + 1]
mov byte [ebp - 4], al
mov edi, ebx
inc edi
inc edi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 0x10]
jecxz 0x40191a
inc byte [ebp - 3]
movzx eax, byte [ebp - 3]
movzx edx, byte [eax + edi]
mov byte [ebp - 1], dl
add byte [ebp - 4], dl
movzx eax, byte [ebp - 4]
mov dl, byte [eax + edi]
mov byte [ebp - 2], dl
movzx eax, byte [ebp - 3]
mov byte [eax + edi], dl
movzx eax, byte [ebp - 4]
mov dl, byte [ebp - 1]
mov byte [eax + edi], dl
mov dl, byte [ebp - 1]
add dl, byte [ebp - 2]
mov dl, byte [edx + edi]
mov eax, dword [ebp - 8]
xor byte [eax + esi], dl
inc dword [ebp - 8]
loop 0x4018da
mov al, byte [ebp - 3]
mov byte [ebx], al
mov al, byte [ebp - 4]
mov byte [ebx + 1], al
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x401b92
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push edi
mov eax, dword [ebp + 0x14]
or eax, eax
je 0x401ba6
mov dword [eax], 0
sub edi, edi
cmp dword [ebp + 0x18], 1
jne 0x401bb5
mov edx, 0x200
jmp 0x401bc4
cmp dword [ebp + 0x18], 2
jne 0x401bc2
mov edx, 0x100
jmp 0x401bc4
sub edx, edx
or edx, 0x20019
lea eax, [ebp - 4]
push eax
push edx
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne 0x401c4f
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
or eax, eax
jne 0x401c47
cmp dword [ebp - 8], 0
je 0x401c47
cmp dword [ebp - 0xc], 1
jne 0x401c0d
cmp dword [ebp - 8], 1
je 0x401c47
mov eax, dword [ebp - 8]
inc eax
push eax
call fcn.004017d4
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
or eax, eax
je 0x401c3b
push edi
call fcn.004017bd
sub edi, edi
jmp 0x401c47
mov eax, dword [ebp + 0x14]
or eax, eax
je 0x401c47
push dword [ebp - 8]
pop dword [eax]
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
mov eax, edi
or eax, eax
jne 0x401c71
cmp dword [ebp + 0x18], 2
jae 0x401c71
mov eax, dword [ebp + 0x18]
inc eax
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401b92
pop edi
leave
ret 0x14

Function at 0x401ccb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov eax, dword [ebp + 8]
not eax
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
or ecx, ecx
je 0x401cf6
mov edx, eax
shr edx, 8
xor al, byte [edi]
and eax, 0xff
mov eax, dword [eax*4 + 0x4187f0]
xor eax, edx
inc edi
loop 0x401cde
not eax
pop edi
leave
ret 0xc

Function at 0x401e83
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
or eax, eax
je 0x401e92
cmp byte [eax], 0
jne 0x401e9b
mov eax, 0
leave
ret 4
push dword [ebp + 8]
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x401eb5
test eax, 0x10
setne al
movzx eax, al
jmp 0x401eba
mov eax, 0
leave
ret 4

Function at 0x401ebe
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0
push 0
push dword [ebp + 8]
call sub.kernel32.dll_ExpandEnvironmentStringsA
or eax, eax
je 0x401efe
push eax
push eax
call fcn.004017d4
mov dword [ebp - 4], eax
pop eax
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call sub.kernel32.dll_ExpandEnvironmentStringsA
or eax, eax
jne 0x401efb
push dword [ebp - 4]
call fcn.004017bd
sub eax, eax
jmp 0x401efe
mov eax, dword [ebp - 4]
leave
ret 4
Function at 0x401f02
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push 0x10
push ebx
call fcn.004017eb
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
mov dword [ebx], eax
inc eax
je 0x401f89
push 0
push eax
call sub.kernel32.dll_GetFileSize
mov dword [ebx + 0xc], eax
push 0
push 0
push 0
push 2
push 0
push dword [ebx]
call sub.kernel32.dll_CreateFileMappingA
or eax, eax
je 0x401f7c
mov dword [ebx + 4], eax
push 0
push 0
push 0
push 4
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebx + 8], eax
or eax, eax
jne 0x401f89
push dword [ebx + 4]
call sub.kernel32.dll_CloseHandle
push dword [ebx]
call sub.kernel32.dll_CloseHandle
mov dword [ebx], 0xffffffff
jmp 0x401f89
push dword [ebx]
call sub.kernel32.dll_CloseHandle
mov dword [ebx], 0xffffffff
sub eax, eax
cmp dword [ebx + 8], eax
setne al
pop ebx
leave
ret 8
Function at 0x4025e2
Capabilities:
Create directory
Delete file
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
sub ebx, ebx
lea eax, [ebp - 4]
push eax
push str.SoftwareWinRAR
push dword [0x414838]
call sub.advapi32.dll_RegCreateKeyA
or eax, eax
jne 0x402628
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 3
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegSetValueExA
or eax, eax
jne 0x402620
inc ebx
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
or ebx, ebx
jne 0x4026f5
lea eax, [ebp - 0x10d]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
or eax, eax
je 0x4026f5
cmp eax, 0x104
ja 0x4026f5
push 0
lea eax, [ebp - 0x10d]
push eax
call sub.kernel32.dll_CreateDirectoryA
lea eax, [ebp - 0x10d]
push eax
call fcn.004024ae
or eax, eax
jne 0x40268e
push 0x414814
lea eax, [ebp - 0x10d]
push eax
call fcn.00401cfd
push dword [ebp + 8]
push eax
call fcn.00401d51
jmp 0x40269d
push dword [ebp + 8]
lea eax, [ebp - 0x10d]
push eax
call fcn.00401cfd
mov dword [ebp - 0x114], eax
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
push dword [ebp - 0x114]
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 8], eax
inc eax
je 0x4026db
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 8]
call fcn.004013aa
mov ebx, eax
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
or ebx, ebx
jne 0x4026ea
push dword [ebp - 0x114]
call sub.kernel32.dll_DeleteFileA
push dword [ebp - 0x114]
call fcn.004017bd
mov eax, ebx
pop ebx
leave
ret 0xc

Function at 0x4026fc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.SoftwareWinRAR
push dword [0x414838]
call fcn.00401c76
or eax, eax
jne 0x4027fe
sub ebx, ebx
lea eax, [ebp - 0x111]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
or eax, eax
je 0x4027fc
cmp eax, 0x104
ja 0x4027fc
lea eax, [ebp - 4]
push eax
call fcn.00401000
lea eax, [ebp - 0x111]
push eax
call fcn.004024ae
or eax, eax
jne 0x40277f
push 0x414814
lea eax, [ebp - 0x111]
push eax
call fcn.00401cfd
push dword [ebp + 8]
push eax
call fcn.00401d51
jmp 0x40278e
push dword [ebp + 8]
lea eax, [ebp - 0x111]
push eax
call fcn.00401cfd
push eax
push dword [ebp - 4]
push eax
call fcn.004011c7
or eax, eax
je 0x4027ef
push dword [ebp - 4]
call fcn.00401064
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4027ef
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call sub.ole32.dll_GetHGlobalFromStream
test eax, eax
js 0x4027ef
push dword [ebp - 0xc]
call sub.kernel32.dll_GlobalLock
or eax, eax
je 0x4027ef
push eax
push dword [ebp - 8]
call fcn.004017d4
mov ebx, eax
pop eax
push dword [ebp - 8]
push ebx
push eax
call fcn.0040180b
push dword [ebp - 0xc]
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [ebp + 0xc]
push dword [ebp - 8]
pop dword [eax]
call fcn.004017bd
push dword [ebp - 4]
call fcn.00401017
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x402bd8
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
push ebx
push ebp
mov ebp, esp
pop ebp
cmp dword [0x414aba], 0
je 0x402c0a
cmp dword [0x414abe], 0
je 0x402c0a
cmp dword [0x414af6], 0
je 0x402c0a
cmp dword [0x414afa], 0
jne 0x402c0f
sub eax, eax
pop ebx
leave
ret
sub ebx, ebx
call dword [0x414aba]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x134], 0x128
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
je 0x402d54
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x134]
push eax
push dword [ebp - 0x138]
call sub.kernel32.dll_Process32First
or eax, eax
je 0x402d49
push str.explorer.exe
lea eax, [ebp - 0x110]
push eax
call sub.shlwapi.dll_StrStrIA
or eax, eax
je 0x402d32
mov dword [ebp - 0x13c], 0
lea eax, [ebp - 0x13c]
push eax
push dword [ebp - 0x12c]
call dword [0x414abe]
mov edx, dword [ebp - 0x13c]
or eax, eax
je 0x402d32
cmp edx, dword [ebp - 0xc]
jne 0x402d32
push dword [ebp - 0x12c]
push 0
push 0x2000000
call sub.kernel32.dll_OpenProcess
or eax, eax
je 0x402d32
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x201eb
push dword [ebp - 8]
call dword [0x414af6]
or eax, eax
je 0x402d2a
push dword [ebp - 4]
call dword [0x414afa]
or eax, eax
je 0x402d18
inc ebx
mov dword [ebp - 0x140], 0
lea eax, [ebp - 0x140]
push eax
push 0xf003f
call sub.advapi32.dll_RegOpenCurrentUser
or eax, eax
jne 0x402d14
cmp dword [ebp - 0x140], 0
je 0x402d14
push dword [ebp - 0x140]
pop dword [0x414838]
jmp 0x402d49
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
jmp 0x402d32
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
lea eax, [ebp - 0x134]
push eax
push dword [ebp - 0x138]
call sub.kernel32.dll_Process32Next
jmp 0x402c4e
push dword [ebp - 0x138]
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop ebx
leave
ret

Function at 0x402d59
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push eax
push ebx
push ecx
push edx
push edi
push esi
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 0x80]
lea edx, [eax*8]
mov ebx, eax
mov ecx, eax
shr eax, 6
mov dword [ebp - 0x14], eax
mov edi, dword [ebp + 8]
add edi, ecx
mov byte [edi], pe_nt_image_headers32
and ebx, 0x3f
sub edi, ebx
cmp ebx, 0x38
jb 0x402d9f
add edi, ebx
mov eax, 0x40
sub eax, ebx
add edi, eax
inc dword [ebp - 0x14]
mov dword [edi + 0x38], edx
lea esi, [ebp - 0x10]
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
push dword [ebp - 0x14]
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00402de4
cld
mov ecx, 4
mov edi, dword [ebp + 0x10]
rep movsd dword es:[edi], dword [esi]
pop esi
pop edi
pop edx
pop ecx
pop ebx
pop eax
leave
ret 0xc
Function at 0x4033f7
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push edi
push esi
push ebx
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
pop dword [ebp - 8]
mov dword [0x418bf0], 0x67452301
mov dword [0x418bf4], 0xefcdab89
mov dword [0x418bf8], 0x98badcfe
mov dword [0x418bfc], 0x10325476
mov dword [0x418c00], 0xc3d2e1f0
jmp 0x40345d
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
push 0x40
push 0x418c04
push eax
call fcn.0040180b
add dword [ebp - 4], 0x40
call fcn.00403529
sub dword [ebp - 8], 0x40
jae 0x403441
mov ebx, dword [ebp - 8]
add ebx, 0x40
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
push ebx
push 0x418c04
push eax
call fcn.0040180b
add dword [ebp - 4], ebx
mov byte [ebx + 0x418c04], 0x80
sub ebx, 0x37
jbe 0x4034a5
sub ebx, 8
je 0x403499
and byte [ebx + 0x418c44], 0
inc ebx
js 0x40348f
call fcn.00403529
mov ebx, 0xffffffc8
jmp 0x4034a7
je 0x4034b1
and byte [ebx + 0x418c3c], 0
inc ebx
js 0x4034a7
mov eax, dword [ebp + 0xc]
mov ecx, 8
xor edx, edx
mul ecx
bswap eax
bswap edx
mov dword [0x418c40], eax
mov dword [0x418c3c], edx
call fcn.00403529
mov eax, dword [0x418bf0]
mov edx, dword [0x418bf4]
mov ecx, dword [0x418bf8]
bswap eax
bswap edx
bswap ecx
mov dword [0x418bf0], eax
mov dword [0x418bf4], edx
mov dword [0x418bf8], ecx
mov eax, dword [0x418bfc]
mov edx, dword [0x418c00]
bswap eax
bswap edx
mov dword [0x418bfc], eax
mov dword [0x418c00], edx
push 0x14
push dword [ebp + 0x10]
push 0x418bf0
call fcn.0040180b
pop ebx
pop esi
pop edi
leave
ret 0xc
Function at 0x403529
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov ecx, 0xfffffff8
mov eax, dword [ecx*8 + 0x418c44]
mov edx, dword [ecx*8 + 0x418c48]
bswap eax
bswap edx
mov dword [ecx*8 + 0x418c44], eax
mov dword [ecx*8 + 0x418c48], edx
inc ecx
jne 0x403534
mov ecx, 0xffffffc0
mov eax, dword [ecx*4 + 0x418d38]
mov edx, dword [ecx*4 + 0x418d24]
xor eax, dword [ecx*4 + 0x418d0c]
xor edx, dword [ecx*4 + 0x418d04]
xor eax, edx
rol eax, 1
mov dword [ecx*4 + 0x418d44], eax
inc ecx
jne 0x40355c
mov ebx, dword [0x418bf0]
mov esi, dword [0x418bf4]
mov edi, dword [0x418bf8]
push dword [0x418bfc]
pop dword [ebp - 4]
push dword [0x418c00]
pop dword [ebp - 8]
mov ecx, 0xffffffec
mov edx, esi
mov eax, edi
not edx
and eax, esi
and edx, dword [ebp - 4]
or eax, edx
add eax, dword [ecx*4 + 0x418c54]
add eax, dword [ebp - 8]
add eax, 0x5a827999
push dword [ebp - 4]
pop dword [ebp - 8]
mov dword [ebp - 4], edi
rol esi, 0x1e
mov edi, esi
mov esi, ebx
rol ebx, 5
add ebx, eax
inc ecx
jne 0x4035af
mov ecx, 0xffffffec
mov eax, esi
mov edx, edi
xor eax, dword [ebp - 4]
xor eax, edx
add eax, dword [ecx*4 + 0x418ca4]
add eax, dword [ebp - 8]
add eax, 0x6ed9eba1
push dword [ebp - 4]
pop dword [ebp - 8]
mov dword [ebp - 4], edi
rol esi, 0x1e
mov edi, esi
mov esi, ebx
rol ebx, 5
add ebx, eax
inc ecx
jne 0x4035e8
mov ecx, 0xffffffec
mov eax, edi
mov edx, dword [ebp - 4]
or eax, dword [ebp - 4]
and edx, edi
and eax, esi
or eax, edx
add eax, dword [ecx*4 + 0x418cf4]
add eax, dword [ebp - 8]
add eax, 0x8f1bbcdc
push dword [ebp - 4]
pop dword [ebp - 8]
mov dword [ebp - 4], edi
rol esi, 0x1e
mov edi, esi
mov esi, ebx
rol ebx, 5
add ebx, eax
inc ecx
jne 0x40361d
mov ecx, 0xffffffec
mov eax, esi
mov edx, edi
xor eax, dword [ebp - 4]
xor eax, edx
add eax, dword [ecx*4 + 0x418d44]
add eax, dword [ebp - 8]
add eax, 0xca62c1d6
push dword [ebp - 4]
pop dword [ebp - 8]
mov dword [ebp - 4], edi
rol esi, 0x1e
mov edi, esi
mov esi, ebx
rol ebx, 5
add ebx, eax
inc ecx
jne 0x403657
add dword [0x418bf0], ebx
add dword [0x418bf4], esi
add dword [0x418bf8], edi
mov eax, dword [ebp - 4]
add dword [0x418bfc], eax
mov eax, dword [ebp - 8]
add dword [0x418c00], eax
leave
ret

Function at 0x4036ad
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call sub.wsock32.dll_inet_addr
cmp eax, 0xffffffff
jne 0x4036e3
push dword [ebp + 8]
call sub.wsock32.dll_gethostbyname
or eax, eax
jne 0x4036d0
mov eax, 0xffffffff
jmp 0x4036e3
mov eax, dword [eax + 0xc]
nop
or eax, eax
jne 0x4036df
mov eax, 0xffffffff
jmp 0x4036e3
mov eax, dword [eax]
mov eax, dword [eax]
leave
ret 4
Function at 0x4036e7
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
push 6
push 1
push 2
call sub.wsock32.dll_socket
cmp eax, 0xffffffff
jne 0x403702
jmp 0x403764
mov ebx, eax
push 0x10
lea eax, [ebp - 0x10]
push eax
call fcn.004017eb
mov word [ebp - 0x10], 2
mov ecx, dword [ebp + 0x10]
xchg ch, cl
mov word [ebp - 0xe], cx
cmp dword [ebp + 0xc], 0
je 0x403729
mov eax, dword [ebp + 0xc]
jmp 0x403748
cmp dword [ebp + 0xc], 0
jne 0x403739
cmp dword [ebp + 8], 0
jne 0x403739
jmp 0x40375c
push dword [ebp + 8]
call fcn.004036ad
cmp eax, 0xffffffff
jne 0x403748
jmp 0x40375c
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x10]
push eax
push ebx
call sub.wsock32.dll_connect
cmp eax, 0xffffffff
jne 0x403764
push ebx
call sub.wsock32.dll_closesocket
xor ebx, ebx
mov eax, ebx
pop ebx
leave
ret 0xc

Function at 0x40376b
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
cmp dword [ebp + 0x10], 0
jne 0x403781
mov eax, 1
pop edi
pop ebx
leave
ret 0xc
mov edi, dword [ebp + 0xc]
mov ebx, 0
push 0
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call sub.wsock32.dll_send
test eax, eax
jle 0x4037af
add edi, eax
sub dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], 0
jne 0x4037ad
mov ebx, 1
jmp 0x4037af
jmp 0x403789
mov eax, ebx
pop edi
pop ebx
leave
ret 0xc

Function at 0x4037b7
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push dword [ebp + 0xc]
pop dword [ebp - 0x10c]
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 1
lea eax, [ebp - 0x100]
push dword [ebp + 8]
pop dword [eax]
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
lea eax, [ebp - 0x104]
push eax
push 0
call sub.wsock32.dll_select
cmp eax, 0xffffffff
je 0x40380a
or eax, eax
jne 0x40380e
xor eax, eax
jmp 0x403813
mov eax, 1
leave
ret 8

Function at 0x403817
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebx
sub ebx, ebx
push 0x5a
push dword [ebp + 8]
call fcn.004037b7
or eax, eax
je 0x403882
push 0x5a
push dword [ebp + 8]
call fcn.004037b7
or eax, eax
jne 0x40383e
jmp 0x403882
push 0
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp + 8]
call sub.wsock32.dll_recv
test eax, eax
jle 0x403882
mov eax, dword [ebp + 0x14]
cmp byte [ebp - 1], al
jne 0x40385c
mov bl, 1
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
push 0
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp + 0xc]
call dword [edx + 0x10]
push dword [ebp + 0xc]
call fcn.00401064
cmp eax, dword [ebp + 0x10]
jb 0x40387e
jmp 0x403882
test ebx, ebx
je 0x40382e
mov eax, ebx
pop ebx
leave
ret 0x14