joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5bd705
Capabilities:
Encode data using xor

Disassembly:
push word [esp + 1]
and al, 1
jo 0x5bd746
jno 0x5bd730
xlatb
push ebp
lds ebp, [edi + ebx*2 + 0x54c647ec]
xor ecx, esi
jle 0x5bd70e
jnp 0x5bd708
invalid
mov dword [esp], ebp
pop word [esp + 1]
mov dword [esp], ecx
jmp 0x5bd771
mov dword [esp], ebp
pop word [esp + 1]
mov dword [esp], ecx
mov dword [esp + 0x18], ebp
call 0x5bd75b
mov word [ebp - 0x72fcdb9c], cs
and al, 1
mov dword [esp + 0x14], esi
push edx
push eax
jmp 0x5bd78d
mov dword [esp + 0x18], ebp
jmp 0x5bd755
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
pushfd
jmp fcn.005bd251

Function at 0x5c196d
Capabilities:
Encode data using xor

Disassembly:
push 0xf05acbd4
jmp 0x5c192b
cpuid
neg ebp
jmp 0x5c1993
mov dword [esp + 0x40], edi
lea esp, [esp + 0x40]
pushfd
jmp 0x5c1213
mov edx, esi
sub esp, 0x15
lea esp, [esp + 1]
jmp 0x5c19b2
mov word [esp + 0x1f], bx
pop word [esp + 0x18]
lea esp, [esp + 2]
jmp 0x5c1941
lea esp, [esp + 1]
jmp 0x5c19b2
jno 0x5c194f
mov edx, esi
sub esp, 0x15
jmp 0x5c197d
xchg al, dh
sbb al, dh
jmp 0x5c19fc
mov cl, 0x21
inc eax
mov bl, 4
xor byte [ebx], dh
sub al, byte [ebp - 0x75]
jl 0x5c19d9
mov edi, dword [esp + 0x40]
inc eax
lea eax, [edi + 0xa8f8]
neg esi
jae 0x5c199c
jb 0x5c19ca
std
jbe 0x5c19a9
cmp dword [esi - 0x34], 0xffffffe7
push cs
xchg al, dh
sbb al, dh
jmp 0x5c19fc
invalid
lea esi, [esp + 0x14]
mov ch, byte [esp]
lea ecx, [ecx + ebp]
mov dx, 0x7aa2
pushal
jmp 0x5c1a3a
mov ah, cl
cpuid
sub esp, 0x8c
mov ebp, esp
mov eax, esi
clc
jmp 0x5c1aba
jp 0x5c1a24
mov ah, cl
cpuid
jmp fcn.005c1a28

Function at 0x5e09ec
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x5e0a10
pop word [esp]
bsf bp, bp
lea esp, [esp + 2]
jmp 0x5e095e
mov ebp, 0xff00
jmp 0x5e0a49
mov edi, dword [edi*4 + 0x5b8bdc]
cmc
stc
pushfd
jmp 0x5e0948
mov dword [edi], eax
neg eax
xor ax, 0x358e
mov eax, dword [esp]
jmp 0x5e09af
lea edi, [ecx + 0x10]
pushal
sub esp, 0x1d
lea esp, [esp + 1]
xor ebx, eax
jmp 0x5e0987
mov eax, dword [ecx + 8]
sub esp, 6
sub esp, 0xa
call 0x5e09be
inc esp
xor eax, ebx
jmp 0x5e0a06
lea esp, [esp + 4]
xor eax, dword [ecx]
lea edi, [esi*4]
lea edi, [ebx*4]
cmc
jmp 0x5e09a0
push esi
mov esi, ecx
lea esi, [esi + 0x1c]
jmp 0x5e0a26
mov dword [ecx + 0x14], ebx
mov dword [ecx + 0x18], eax
xor edx, eax
jmp 0x5e09ec
mov eax, edi
jmp 0x5e0b1e
mov dword [esi], edx
pop esi
mov ebx, 0x5ba3e0
lea esp, [esp + 0x50]
jmp 0x5ada0d
and edi, ebp
xor eax, edi
bsr di, bx
jmp 0x5e09d5
lea esp, [esp + 1]
lea esp, [esp + 0x18]
popal
sub esp, 0x11
lea esp, [esp + 9]
jmp 0x5e0ab0
bswap edi
pushal
mov dword [esp], edx
sub esp, 0x1b
pop word [esp]
jmp 0x5e0a53
cmp edi, eax
shr ecx, 8
mov edi, 0x4b1a962c
mov edi, dword [esp]
mov edi, dword [esp]
jmp 0x5e0a69
push edx
jmp 0x5e0aef
and ecx, esi
sub esp, 3
push word [esp + 1]
lea esp, [esp + 1]
jmp 0x5e0a9a
pop edx
shr edi, 0x10
cmc
call fcn.005e0ac0
xor byte [ecx + 0x74b34021], dh
xor dh, byte [edx + 0x3b24720]
xor ebp, dword [edx]
inc ebp
mov edx, ecx
lea edx, [edx*4]
lea edx, [edx + 0x5b8bdc]
mov ecx, dword [edx]
jmp 0x5e0ad6
mov edx, dword [eax + 0xc]
cmc
mov di, cx
mov ecx, edx
jmp 0x5e0a88
Function at 0x5e0ac0
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 2
lea esp, [esp + 2]
jmp 0x5e0b02
and edi, esi
mov edi, dword [edi*4 + 0x5b8bdc]
push edx
jmp 0x5e0b2c
lea esp, [esp + 0x10]
and ecx, 0xff0000
jmp 0x5e0b74
xor ecx, edi
lea edi, [edx - 0x77]
jmp 0x5e0c07
and edi, 0xff000000
pushfd
push dword [esp + 3]
jmp 0x5e0b5e
mov edi, edx
call fcn.005e0bb6
stc
lea esp, [esp + 1]
xor edx, ecx
lea ecx, [edx*4]
mov ecx, dword [esp]
jmp 0x5e0c59
xor ecx, edx
mov edx, 0x3b9eb366
rcl dx, 8
jmp 0x5e0c7c
mov dword [eax + 0x14], edx
cmc
bts cx, bx
mov ecx, dword [eax + 8]
jmp 0x5e0c43
mov dword [eax + 0x18], ecx
mov dh, ah
call fcn.005e0c66
mov ebp, eax
jmp 0x5e0ced
jne 0x5ada0d
mov al, byte [esp]
jmp 0x5e0ccf
clc
mov dword [eax + 0x1c], edx
lea esp, [esp + 0x24]
cmp ebx, 0x5ba404
jmp 0x5e0ca9
push 0xa
mov eax, dword [esp]
mov bp, 0xfd46
pushal
jmp 0x5e0d2b
add ebp, 0xc
mov edx, dword [ebp]
pop ebp
xor edx, ecx
jmp 0x5e0cbf
mov esi, dword [esp]
mov bl, 0xfa
call fcn.005e0cf8
inc eax
fdiv qword [edx + 0x15]
in al, 0x52
mov dh, 0x29
mov ecx, 0xe8ec2bd8
dec edx
fdivr dword [edi + 0x5e6bcd4a]
pop esi
lea esp, [esp + 0x20]
pop edi
mov bh, byte [esp]
mov bx, 0x716d
jmp 0x5e0d0e

Function at 0x5e0bf1
Capabilities:
Encrypt data using aes

Disassembly:
movzx edi, byte [edi*4 + 0x5b8bdc]
jmp 0x5e1078
sub esp, 0x15
lea esp, [esp + 1]
mov edx, dword [eax + 4]
sub esp, 0x17
lea esp, [esp + 0xa]
jmp 0x5e0c0e
xchg dh, dl
lea edx, [eax + esi]
mov dword [edi], ecx
inc dh
not dh
jmp 0x5e0c30
lea esp, [esp + 4]
xor ecx, dword [eax]
mov dh, dl
lea edx, [esp + 0xf8]
add ebx, 4
jmp 0x5e0c9c
mov dl, byte [esp]
lea edi, [eax + 0x10]
pushfd
lea edx, [ecx*4]
jmp 0x5e0d80
xor ecx, edx
bsr edi, ecx
mov dh, cl
lea esp, [esp + 0x30]
xor ecx, dword [ebx]
jmp 0x5e0dc6
xor ecx, edi
and edx, ebp
mov edi, 0x4360a0d
jmp 0x5e0f2e
Function at 0x63afbe
Capabilities:
Authenticate hmac

Disassembly:
pop edi
mov bx, 0x283e
jmp 0x63ad92
call dword [eax + 0x98]
mov ah, bl
jmp 0x63a9bf
lea esp, [esp + 8]
push edi
jmp 0x63a977
jmp 0x63a98d
mov eax, ebx
jmp 0x5b4e92
pop ebx
mov esp, ebp
call 0x63ad7c
popal
jmp 0x63ae18
push ecx
jmp 0x63aed5
mov dx, 0x7f1c
bswap ecx
jmp 0x63ae9a
rcl dx, 2
mov dx, 0x7f1c
bswap ecx
pushal
mov word [esp + 0x18], bx
call fcn.0063ae62
mov dl, ch
jmp 0x63aee3
add bx, ax
js 0x63ae90
rcl dx, 2
jmp 0x63ae44
ror cx, 0
sub esp, 0x13
jnp 0x63aefd
xchg dword [esp + 8], edx
lea edx, [ecx + edx]
jmp 0x63af36
xchg dword [esp + 8], edx
call fcn.0063b024
mov esi, 0x8d11148d
and al, 3
jmp 0x63af5a
lea esp, [esp + 3]
jmp 0x63af5a
lea esp, [esp + 0x10]
dec cx
mov dx, 0x248f
mov edx, 0x4292c8d
mov dx, bp
jmp 0x63afa2
mov word [esp], si
lea esp, [esp + 2]
jmp 0x63afb5
sub esp, 2
jge 0x63af7f
mov word [esp], si
lea esp, [esp + 2]
call int.0063af89
push esi
neg cx
call 0x63afbe
shr ebx, 0x71
lea esp, [esp + 2]
jmp 0x63b072
lea esp, [esp + 4]
inc cx
btc edx, ecx
jo 0x63b17b
jno 0x63b0aa
inc edi
out dx, al
stc
fdivr dword [ebx]
jo 0x63afc0
lea esp, [esp + 2]
jmp 0x63b072
inc edx
inc dx
and edx, 0xc629ac55
jmp 0x63b184
inc edx
inc dx
and edx, 0xc629ac55
call fcn.0063b0ed
inc ecx
mov ch, byte [esp]
mov cx, 0xddfe
mov dx, 0xc56e
inc bx
bswap ecx
jmp 0x63c097
jg 0x63b2df
xchg byte [esp + 0xa], cl
sub esp, 0x19
call fcn.0063b204
clc
lea edx, [edx - 0x28]
mov cl, 0xa1
bsf cx, cx
bswap ecx
jmp 0x63b232
push dword [esp + 0x20]
ret 0x24
lea esp, [esp + 0x38]
sub bx, 0x16e6
setbe cl
xchg ecx, edx
bsf cx, di
jmp 0x63b24d
setne ch
lea ecx, [ebp + 0xcd4]
xchg dword [esp + 0x20], edx
lea edx, [esp + 0xb3]
mov ch, byte [esp]
xchg cl, dh
jmp 0x63b213
js 0x63b279
mov cl, byte [esp]
or dh, 0xa
jmp 0x63b27f
not bx
rcl cx, 1
jmp 0x63b2a4
shl ecx, 0xb
bswap ecx
jmp 0x63b281
mov cl, byte [esp]
or dh, 0xa
jmp 0x63b257
ror bx, 0
mov ch, byte [esp]
cmc
jg 0x63b2c3
jle 0x63b2ad
mov bh, dl
bswap ebx
dec edx
jnp 0x63b427
jp fcn.005cd6c9
rcl dword [eax - 0x2d]
dec edx
in eax, 0x14
jo 0x63b263
shl ecx, 0xb
bswap ecx
jmp 0x63b281
xchg cl, ch
bswap ecx
jmp 0x63b2c7
xchg cl, ch
bswap ecx
mov word [esi], bx
bswap edx
jmp 0x63b28d
xchg byte [esp + 0xa], cl
sub esp, 0x19
push word [esp + 0x13]
xchg dword [esp + 3], edx
mov cx, word [esp + 9]
lea esp, [esp + 3]
jmp 0x63b21a
jmp fcn.005cd6c9
rcr edx, 2
jmp 0x63bb83
mov cl, byte [esp]
shl ecx, cl
xchg ecx, edx
jmp 0x63b59a
mov cl, byte [esp]
shl ecx, cl
xchg ecx, edx
rcr edx, 2
ror bx, 0
bswap edx
pushal
bsr dx, sp
jmp 0x63b1c1
mov cx, word [esp]
setge cl
mov ecx, edx
neg edx
je 0x63bb79
jne 0x63b859
mov cx, sp
jmp 0x63c119
xchg dl, ch
mov dx, 0x1876
not ax
call fcn.0063c0ed

Function at 0x63b024
Capabilities:
Authenticate hmac

Disassembly:
mov edx, 0x803b021
mov edx, 0xe1ba3673
not dx
lea ecx, [ecx + 1]
setg dh
call fcn.0063af7a
bt dx, dx
btc dx, sp
lea esp, [esp + 2]
lea edi, [edi + 1]
jmp 0x63b00b
mov edx, ebp
bsf edx, esp
mov dl, al
mov dx, word [esp]
xchg dword [esp], edi
jmp 0x63b05e
clc
shr dx, cl
xchg dword [esp], ecx
mov dl, bh
bswap edx
jmp 0x63afd7
mov edx, 0x6db4fab9
mov dx, bp
bts dx, dx
mov dx, si
call fcn.0063b047
Function at 0x6a17e2
Capabilities:
Parse pe header

Disassembly:
mov byte [esp + 1], ah
mov word [esp + 1], bx
mov dword [esp + 0x20], ebp
jmp 0x6a181b
pushal
pop word [esp + 3]
lea esp, [esp + 2]
mov dword [esp + 0x38], esi
pushfd
pop word [esp]
jmp 0x6a1805

Function at 0x6a17f8
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.0069ec78
push eax
jmp 0x69ec73
call 0x6a0049
jmp 0x6a1862
movzx ebx, word [eax + 0x3c]
jmp 0x6a184c
lea esp, [esp + 2]
mov dword [esp + 0x20], esp
call fcn.006a17e2
lea esp, [esp + 2]
mov dword [esp + 0x34], edi
lea esp, [esp + 0x34]
jmp 0x6a18e9
add ebx, eax
jmp 0x6a18aa
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
je 0x6a004e
sub eax, 0x10000
jmp 0x6a1866
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x6a0044
je 0x69f6e5
jne 0x6a1871
in eax, 0x62
invalid
cmp word [ebx], 0x4550
jmp 0x6a1890
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x6a1885
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43f004]
jne 0x401010
repz ret
jmp fcn.0040160c

Function at 0x4076e5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404bff
and dword [ebp - 4], 0
cmp dword [0x441c9c], 0
mov ebx, eax
jne 0x407796
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407847
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407847
push eax
call fcn.00404b8d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x441c9c], eax
call esi
push eax
call fcn.00404b8d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x441ca0], eax
call esi
push eax
call fcn.00404b8d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x441ca4], eax
call esi
push eax
call fcn.00404b8d
pop ecx
mov dword [0x441cac], eax
test eax, eax
je 0x407796
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404b8d
pop ecx
mov dword [0x441ca8], eax
mov eax, dword [0x441ca8]
cmp eax, ebx
je 0x4077ee
cmp dword [0x441cac], ebx
je 0x4077ee
push eax
call fcn.00404c08
push dword [0x441cac]
mov esi, eax
call fcn.00404c08
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4077ee
test edi, edi
je 0x4077ee
call esi
test eax, eax
je 0x4077e5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4077e5
test byte [ebp - 0xc], 1
jne 0x4077ee
or dword [ebp + 0x10], 0x200000
jmp 0x407827
mov eax, dword [0x441ca0]
cmp eax, ebx
je 0x407827
push eax
call fcn.00404c08
pop ecx
test eax, eax
je 0x407827
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407827
mov eax, dword [0x441ca4]
cmp eax, ebx
je 0x407827
push eax
call fcn.00404c08
pop ecx
test eax, eax
je 0x407827
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x441c9c]
call fcn.00404c08
pop ecx
test eax, eax
je 0x407847
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407849
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x409a80
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x43f004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x23593b4], 0x930
jne 0x409aaa
push str.yukepimutade_yumuni_kudefesoroxodimijig_vamibihepayihidarizinuk
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
cmp dword [0x23593b4], 0x114e
mov eax, dword [ebp + 8]
mov dword [0x23591f8], eax
jne 0x409add
push 0
lea ecx, [ebp - 0x804]
push ecx
push 0
call sub.KERNEL32.dll_VerLanguageNameW
lea edx, [ebp - 0x820]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401006
mov esp, ebp
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x469e25
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
test esi, esi
jle 0x469e51
push ebx
mov ebx, dword [ebp + 8]
movzx eax, byte [ebx]
mov ecx, edi
shl ecx, 3
movzx edx, byte [eax + 0x49b3b0]
xor edx, ecx
xor edi, edx
inc ebx
dec esi
test esi, esi
jg 0x469e37
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x474817
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
test ebx, ebx
jg 0x47483b
jl 0x474832
test esi, esi
jne 0x47483b
xor eax, eax
xor edx, edx
jmp 0x47492e
cmp dword [edi + 0x38], 0
je 0x474850
push ebx
push esi
push dword [ebp + 8]
call fcn.0040fc90
jmp 0x47492e
mov eax, dword [edi + 0x1c]
mov ecx, esi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], esi
mov ecx, dword [eax]
test ecx, ecx
je 0x4748a4
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x4748a4
cmp eax, esi
jb 0x474876
mov eax, esi
mov dword [ebp - 4], esi
push eax
push ecx
push dword [ebp + 8]
call fcn.00477d80
mov edx, dword [ebp - 4]
mov ecx, esi
mov eax, dword [ebp + 8]
sub ecx, edx
add eax, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
add esp, 0xc
mov eax, dword [edi + 0x2c]
mov dword [ebp - 0xc], ecx
sub dword [eax], edx
mov eax, dword [edi + 0x1c]
add dword [eax], edx
jmp 0x4748aa
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [edi + 0x4c], 0
je 0x474922
mov ecx, edi
call fcn.00474149
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
cmp eax, 0xfff
jbe 0x4748fe
mov ecx, dword [ebp - 4]
push dword [edi + 0x4c]
push 0xfff
push 1
push ecx
call fcn.0047f3d5
mov ecx, dword [ebp - 4]
add esp, 0x10
mov edx, dword [ebp - 8]
add ecx, eax
sub edx, eax
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
cmp eax, 0xfff
jne 0x4748fa
cmp edx, eax
ja 0x4748c7
jmp 0x474901
sub esi, edx
jmp 0x474927
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, eax
test eax, eax
je 0x474925
push dword [edi + 0x4c]
push edx
push 1
push dword [ebp - 4]
call fcn.0047f3d5
mov ecx, dword [ebp - 0xc]
add esp, 0x10
sub ecx, eax
jmp 0x474925
mov ecx, dword [ebp - 0xc]
sub esi, ecx
sbb ebx, 0
mov eax, esi
mov edx, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x475f7d
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x4b8b60
call fcn.00477240
push 1
call fcn.00476a27
pop ecx
test al, al
je 0x475f67
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.004769f5
mov byte [ebp - 0x24], al
mov eax, dword [0x4bde6c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x475f67
test eax, eax
jne 0x475e8b
mov dword [0x4bde6c], ecx
push 0x49930c
push 0x4992e8
call fcn.0048340b
pop ecx
pop ecx
test eax, eax
je 0x475e6e
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x475f57
push 0x4992e4
push 0x4992b0
call fcn.004833c6
pop ecx
pop ecx
mov dword [0x4bde6c], 2
jmp 0x475e90
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00476b7b
pop ecx
call fcn.00476fd0
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x475ec1
push esi
call fcn.00476ae7
pop ecx
test al, al
je 0x475ec1
mov esi, dword [esi]
push edi
push 2
push edi
mov ecx, esi
call dword [0x4992ac]
call esi
call fcn.00476fd6
mov esi, eax
cmp dword [esi], edi
je 0x475edf
push esi
call fcn.00476ae7
pop ecx
test al, al
je 0x475edf
push dword [esi]
call fcn.004836af
pop ecx
call fcn.004770f6
movzx esi, ax
call fcn.00483373
push esi
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.0047712c
test al, al
je 0x475f6e
test bl, bl
jne 0x475f0d
call fcn.0048368a
push edi
push 1
call fcn.00476b98
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x475f57
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push 7
call fcn.00476fdc
push esi
call fcn.004836d5
push dword [ebp - 0x20]
call fcn.00483699
int3
call fcn.00552000
jmp 0x475e01

Function at 0x48851e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00488394
Function at 0x401339
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x114
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0x1c]
sub eax, 3
je 0x4013f9
dec eax
mov ecx, dword [ebp - 0x18]
je 0x401399
dec eax
je 0x401377
dec eax
jne 0x4013a7
push str.Windows_Vista
jmp 0x4013fe
mov eax, ecx
sub eax, 0
je 0x401392
dec eax
je 0x40138b
dec eax
jne 0x4013a7
push str.Windows_2003
jmp 0x4013fe
push str.Windows_XP
jmp 0x4013fe
push str.Windows_2000
jmp 0x4013fe
test ecx, ecx
je 0x4013e7
cmp ecx, 0xa
je 0x4013e0
cmp ecx, 0x5a
je 0x4013d9
cmp dword [ebp - 0x10], 2
mov eax, 0x41649c
je 0x4013b7
mov eax, 0x416498
push ecx
push dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0xa0]
push str.Win_s__d._d
push eax
call fcn.0040e9fe
add esp, 0x14
lea eax, [ebp - 0xa0]
push eax
jmp 0x4013fe
push str.Windows_Me
jmp 0x4013fe
push str.Windows_98
jmp 0x4013fe
cmp dword [ebp - 0x10], 2
mov eax, str.Windows_NT_4.0
je 0x4013d6
mov eax, str.Windows_95
jmp 0x4013d6
push str.WindowsNT_3.51
mov ecx, dword [ebp + 0x7c]
call fcn.004012ea
mov ecx, dword [ebp + 0x7c]
push 0x416444
call fcn.004012ea
mov ecx, dword [ebp + 0x7c]
lea eax, [ebp - 0xc]
push eax
call fcn.004012ea
add ebp, 0x74
leave
ret
Function at 0x4023ce
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
push ebx
mov ebx, ecx
jne 0x4023e4
xor eax, eax
jmp 0x40246b
mov eax, dword [ebp + 0x14]
push esi
push dword [ebp + 0x10]
mov esi, dword [sym.imp.WS2_32.dll_htons]
mov dword [ebp - 0xc], eax
mov dword [0x41f140], eax
mov eax, dword [ebp + 0xc]
mov word [ebp - 0x10], 2
mov dword [0x41f13c], eax
call esi
push dword [ebp + 0x18]
mov word [0x41f144], ax
call esi
and word [0x41f13a], 0
push 0x14
mov esi, 0x41f130
push esi
mov ecx, ebx
mov word [0x41f146], ax
mov byte [0x41f151], 2
call fcn.004022ea
and word [0x41f154], 0
push 0x1c
push esi
mov ecx, ebx
mov word [0x41f13a], ax
call fcn.00402339
push 0x10
mov word [0x41f154], ax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x30
push esi
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_sendto]
pop esi
pop ebx
leave
ret 0x14

Function at 0x402470
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
push ebx
mov ebx, ecx
jne 0x402483
xor eax, eax
jmp 0x4024f3
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
and word [0x41f16a], 0
push esi
push 0x14
mov dword [0x41f16c], ecx
mov esi, 0x41f160
push esi
mov ecx, ebx
mov word [ebp - 0x10], 2
mov dword [ebp - 0xc], eax
mov dword [0x41f170], eax
mov byte [0x41f174], 8
call fcn.004022ea
and word [0x41f176], 0
push 0x28
push 0x41f174
mov ecx, ebx
mov word [0x41f16a], ax
call fcn.004022ea
push 0x10
mov word [0x41f176], ax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x3c
push esi
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_sendto]
pop esi
pop ebx
leave
ret 0x14

Function at 0x4024f8
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push edi
push 8
mov esi, ecx
call fcn.0040ec9c
pop ecx
mov ecx, dword [esp + 0xc]
lea edi, [esi + 4]
push edi
push 4
push eax
push 0x40bef8
push 0
push 0
mov dword [eax], esi
mov dword [eax + 4], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xfffffffffffffff1
push eax
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [edi]
pop edi
pop esi
ret 4

Function at 0x402d6a
Capabilities:
Create thread

Disassembly:
push esi
push edi
push 8
mov esi, ecx
call fcn.0040ec9c
pop ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
xor ecx, ecx
lea edi, [esi + 4]
push edi
push ecx
push eax
push 0x40bef8
push ecx
push ecx
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
mov eax, dword [edi]
pop edi
pop esi
ret 4
Function at 0x403f59
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x114]
push eax
push 0x104
push str.windev_peers.ini
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40400e
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push 7
push 0x40000000
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x403fbb
xor al, al
jmp 0x404010
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0xc]
push eax
lea esi, [ebx + 0x41f330]
push dword [esi]
call fcn.0040e93e
pop ecx
push eax
push dword [esi]
push dword [ebp - 8]
call edi
push 0
lea eax, [ebp - 0xc]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
mov byte [ebp - 4], 0xd
mov byte [ebp - 3], 0xa
call edi
add ebx, 4
cmp ebx, 0x430
jb 0x403fc3
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
leave
ret

Function at 0x404851
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 8
mov esi, ecx
call fcn.0040ec9c
pop ecx
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
lea ecx, [ebp - 4]
push ecx
xor ecx, ecx
push ecx
push eax
push 0x4044c8
push ecx
push ecx
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop esi
leave
ret 4

Function at 0x40488c
Capabilities:
Create thread

Disassembly:
push esi
push edi
push 8
mov esi, ecx
call fcn.0040ec9c
pop ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
xor ecx, ecx
lea edi, [esi + 4]
push edi
push ecx
push eax
push 0x4044c8
push ecx
push ecx
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
mov eax, dword [edi]
pop edi
pop esi
ret 4