joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420294
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x3d2b8af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4202cf
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4202e8
lea eax, [ebp - 0x10]
mov edx, dword [0x3d4854c]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x4202fb
lea eax, [ebp - 0x10]
mov edx, dword [0x3d4854c]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x420307
adc edx, 0
mov edx, dword [edx*4 + 0x3d47378]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x420481
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420474
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420474
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420412
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420412
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420412
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420412
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420474
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420474
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420474
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420474
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420499
inc ebx
cmp ebx, 0x19
jne 0x4202c1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3d2b8b6
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x1002e6c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1002e6cf
pop dword [ebp - 8]
mov eax, 0x90ae4095
sub eax, 0x80ab59c6
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xbbb14c78
sub dword [ebp - 0x18], 0x6d5f072d
mov dword [ebp - 0x14], 0x86815a8d
sub dword [ebp - 0x14], 0x544e0e48
mov dword [ebp - 0x10], 0xef911b41
add dword [ebp - 0x10], 0x5cbb28ed
mov dword [ebp - 0xc], 0x1b35270b
sub dword [ebp - 0xc], 0x1b35270b
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x9359201f
add dword [ebp - 0x18], 0xe1194937
mov dword [ebp - 0x14], 0x6f466459
add dword [ebp - 0x14], 0xd225fd1c
mov dword [ebp - 0x10], 0x11d187a6
add dword [ebp - 0x10], 0x519de4c6
mov dword [ebp - 0xc], 0xd33ef7fc
add dword [ebp - 0xc], 0x2cc10804
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x3fd865f2
sub eax, 0x2fd4c592
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x37725
push 0
call eax
mov ecx, 0x7cb13a68
sub ecx, 0x7cb0f915
xor esi, esi
add esi, eax
mov edi, 0xa7fb54fc
sub edi, 0x97f45efc
add edi, dword [ebp - 8]
mov ebx, 0xee3f6b29
sub ebx, 0xa8910b0
xor dword [ebp - 4], 0xcc8dbf76
mov edx, dword [edi]
sub edx, ebx
add dword [ebp - 4], 0x889c5bf6
mov dword [esi], edx
add esi, 0xe3098da3
sub esi, 0xe3098d9f
add edi, 0xe5e26441
add edi, 0x1a1d9bc3
loop 0x1002e7ee
add eax, 0x4158af4a
sub eax, 0x4157b72b
xor ebx, ebx
add ebx, eax
add eax, 0x17892e75
sub eax, 0x17892e70
mov ecx, 0xfb587315
add ecx, 0x14a78ceb
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x10007159
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x10007168
pop dword [ebp - 0x10]
mov eax, 0x10007168
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x2303cb94
sub dword [ebp - 0x20], 0xd4b18649
mov dword [ebp - 0x1c], 0xbe86a5ee
add dword [ebp - 0x1c], 0x73aca657
mov dword [ebp - 0x18], 0x291a1163
add dword [ebp - 0x18], 0x233232cb
mov dword [ebp - 0x14], 0x1ba9c98
add dword [ebp - 0x14], 0xfe456368
lea eax, [ebp - 0x20]
push eax
mov eax, 0xbb4fbe27
add eax, 0x54b05309
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x94ef5953
add dword [ebp - 0x20], 0xdf831003
mov dword [ebp - 0x1c], 0xa5a76c35
sub dword [ebp - 0x1c], 0x643b0ac0
mov dword [ebp - 0x18], 0xf1ddc027
sub dword [ebp - 0x18], 0x8e6e53bb
mov dword [ebp - 0x14], 0xbb20d03e
add dword [ebp - 0x14], 0x44df2fc2
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3f4b1
push 0
call eax
mov ecx, 0x8c2fb80f
add ecx, 0x73d092ec
mov edx, eax
mov esi, 0x85926d2f
add esi, 0x8a708ad1
add esi, dword [ebp - 0x10]
mov ebx, 0xc14541fa
mov dword [ebp - 8], 0x26a018b
mov edi, dword [esi]
mov dword [ebp - 8], 0xc911d033
xor edi, ebx
mov dword [edx], edi
xor dword [ebp - 0xc], 0x50bfcebd
add edx, 4
add esi, 4
loop 0x1000727a
add eax, 0xa1179242
add eax, 0x5ee98c7d
xor ebx, ebx
add ebx, eax
add eax, 0x940e60d5
add eax, 0x6bf19f30
mov ecx, 0x6de9ab75
sub ecx, 0x5de9ab75
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x100269ee
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100060ec]
jne 0x10027054
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x1002bda8], eax
mov dword [0x1002bda4], ecx
mov dword [0x1002bda0], edx
mov dword [0x1002bd9c], ebx
mov dword [0x1002bd98], esi
mov dword [0x1002bd94], edi
mov word [0x1002bdc0], ss
mov word [0x1002bdb4], cs
mov word [0x1002bd90], ds
mov word [0x1002bd8c], es
mov word [0x1002bd88], fs
mov word [0x1002bd84], gs
pushfd
pop dword [0x1002bdb8]
mov eax, dword [ebp]
mov dword [0x1002bdac], eax
mov eax, dword [ebp + 4]
mov dword [0x1002bdb0], eax
lea eax, [ebp + 8]
mov dword [0x1002bdbc], eax
mov eax, dword [ebp - 0x320]
mov dword [0x1002bcf8], 0x10001
mov eax, dword [0x1002bdb0]
mov dword [0x1002bcac], eax
mov dword [0x1002bca0], 0xc0000409
mov dword [0x1002bca4], 1
mov eax, dword [0x100060ec]
mov dword [ebp - 0x328], eax
mov eax, dword [0x1002baac]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x1002bcf0], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x100060fc
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x1002bcf0], 0
jne 0x10027140
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x411d62
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x417678], 0
push ebx
push esi
mov esi, 0x417680
jne 0x411d8e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x417698], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x417678], 1
push dword [0x417698]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x411e2b
push 0x14
push 8
push dword [0x417008]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x411e55
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x41767c]
test eax, eax
je 0x411dd0
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x41767c], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x411e5a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x417698]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x417008]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x411e55
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x29801a89
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x298601b4]
jne 0x29801a93
repz ret
jmp fcn.2983e792

Function at 0x298050c5
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x2983eb59
call fcn.29801f91
mov ebx, dword [ebp + 8]
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x298050e5
xor eax, eax
call fcn.298029c6
ret 4
call dword [sym.imp.MSVCP100.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
test eax, eax
je 0x29805113
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x24]
mov edi, dword [eax]
add edi, dword [ecx]
mov ecx, esi
call dword [sym.imp.MSVCP100.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
cmp eax, edi
jae 0x29805113
mov ecx, esi
call dword [sym.imp.MSVCP100.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
mov eax, ebx
jmp 0x298050dd
xor edi, edi
cmp dword [esi + 0x54], edi
jne 0x2980511f
or eax, 0xffffffff
jmp 0x298050dd
mov ecx, esi
call fcn.29803ec2
cmp dword [esi + 0x44], edi
jne 0x2980513c
push dword [esi + 0x54]
push ebx
call fcn.2983656f
pop ecx
pop ecx
test al, al
je 0x2980511a
jmp 0x2980510f
push edi
push 8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0x30], bl
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x2c], 0
call fcn.2983656f
mov dword [ebp - 4], edi
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x298051f1
lea eax, [ebp - 0x2c]
mov ecx, eax
add eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x34]
push edx
push eax
push ecx
mov ecx, dword [esi + 0x44]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2f]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [esi + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::out_int___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x2980520f
cmp eax, 1
jg 0x298051f9
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x298051a4
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x34]
sub edi, eax
je 0x298051cb
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x298051b7
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x2980520f
lea eax, [ebp - 0x30]
mov byte [esi + 0x49], 1
cmp dword [ebp - 0x38], eax
jne 0x29805229
test edi, edi
jne 0x2980515b
cmp dword [ebp - 0x1c], 0x20
jae 0x2980520f
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.2983656f
jmp 0x2980515b
mov ecx, dword [ebp - 0x2c]
jmp 0x2980516d
cmp eax, 3
jne 0x2980520f
push dword [esi + 0x54]
push dword [ebp - 0x30]
call fcn.2983656f
pop ecx
pop ecx
test al, al
jne 0x29805229
or esi, 0xffffffff
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.2983656f
mov eax, esi
jmp 0x298050dd
mov esi, ebx
jmp 0x29805212
Function at 0x2980522d
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x2983fd5f
call fcn.29801f91
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x44], edi
je 0x29805323
cmp byte [esi + 0x49], 0
je 0x29805323
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x29805263
xor al, al
jmp 0x29805325
push edi
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x2c], 0
call fcn.2983656f
mov dword [ebp - 4], edi
lea ebx, [esi + 0x4c]
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x298052c5
lea eax, [ebp - 0x2c]
mov ecx, eax
add eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push eax
push ecx
mov ecx, dword [esi + 0x44]
push ebx
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x298052ca
dec eax
je 0x298052ce
dec eax
dec eax
je 0x2980531f
xor bl, bl
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.2983656f
mov al, bl
jmp 0x29805325
mov ecx, dword [ebp - 0x2c]
jmp 0x29805290
mov byte [esi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x298052da
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x29805301
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x298052ed
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x298052af
cmp byte [esi + 0x49], 0
je 0x2980531f
test edi, edi
jne 0x29805282
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.2983656f
jmp 0x29805282
mov bl, 1
jmp 0x298052b1
mov al, 1
call fcn.298029c6
ret
Function at 0x2982092f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x29840d8f
call fcn.2983e23c
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
cmp esi, ebx
je 0x298209dd
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x41c]
push eax
call fcn.2983656f
add esp, 0xc
test eax, eax
js 0x298209dd
mov edi, dword [ebp - 0x41c]
cmp edi, 0x400
jg 0x298209c3
push edi
call fcn.2981d496
pop ecx
test al, al
je 0x298209c3
mov eax, edi
call fcn.2983e480
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x298209cf
push edi
lea ecx, [ebp - 0x428]
call fcn.2983656f
push 3
push edi
push esi
push eax
call fcn.2983656f
cmp eax, ebx
jne 0x29820a1a
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x298209f6
lea ecx, [ebp - 0x418]
call fcn.2981cb8c
mov esi, 0x8007000e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.2981cb0e
mov eax, esi
lea esp, [ebp - 0x440]
call fcn.2983e275
ret 0x10
push 2
push ebx
push eax
call fcn.2981d73e
mov edi, eax
mov dword [ebp - 0x41c], edi
cmp edi, ebx
jne 0x29820a3b
call fcn.2981c3ab
mov esi, eax
jmp 0x29820b05
push dword [ebp - 0x420]
push dword [ebp - 0x424]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x29820a5e
call fcn.2981c3ab
jmp 0x29820af7
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
cmp eax, ebx
je 0x29820a54
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x424], esi
cmp eax, esi
jae 0x29820a8e
mov esi, 0x8007000e
jmp 0x29820af9
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.2983656f
mov dword [ebp - 4], 1
jmp 0x29820abc
cmp dword [ebp - 0x418], ebx
je 0x29820a87
push esi
push dword [ebp - 0x420]
push esi
push dword [ebp - 0x418]
call fcn.2983656f
mov eax, dword [ebp - 0x418]
add esp, 0x10
push dword [ebp + 0x14]
mov byte [eax + esi], bl
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.2983656f
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x298209fb
lea ecx, [ebp - 0x418]
call fcn.2981cb8c
jmp 0x298209fb
Function at 0x2983656f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x2983657e
pop dword [ebp - 0x10]
mov eax, 0x659ca3d2
add eax, 0xc3e6c1ac
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x28b9d53c
sub dword [ebp - 0x20], 0xda678ff1
mov dword [ebp - 0x1c], 0x628d621
sub dword [ebp - 0x1c], 0xd3f589dc
mov dword [ebp - 0x18], 0x5897fb64
add dword [ebp - 0x18], 0xf3b448ca
mov dword [ebp - 0x14], 0xa38808cc
sub dword [ebp - 0x14], 0xa38808cc
lea eax, [ebp - 0x20]
push eax
mov eax, 0x58bcffa0
add eax, 0xd0c74158
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x15569060
sub dword [ebp - 0x20], 0xa0e4270a
mov dword [ebp - 0x1c], 0x2a2948f
sub dword [ebp - 0x1c], 0xc136331a
mov dword [ebp - 0x18], 0xd2617f33
add dword [ebp - 0x18], 0x910ded39
mov dword [ebp - 0x14], 0x1f748468
add dword [ebp - 0x14], 0xe08b7b98
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x46428
push 0
call eax
mov ecx, 0x5b2874c7
add ecx, 0xa4d7dae1
xor edx, edx
add edx, eax
mov edi, 0xfc31b985
sub edi, 0xd2a9f985
add edi, dword [ebp - 0x10]
mov esi, 0x87b4d28a
add esi, 0x4fa72e4f
sub dword [ebp - 0xc], eax
mov ebx, dword [edi]
xor dword [ebp - 0xc], 0x950dddb0
add ebx, esi
sub dword [ebp - 8], 0x76fb963d
mov dword [edx], ebx
sub dword [ebp - 8], 0x48fad135
add edx, 0x529073b1
sub edx, 0x529073ad
add edi, 4
loop 0x2983669d
add eax, 0xfee0ebc9
add eax, 0x12045aa
xor ebx, ebx
add ebx, eax
add eax, 0x8200757c
add eax, 0x7dff8a89
mov ecx, 0x8760acdd
sub ecx, 0x5de0acdd
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x100259e1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x100259f0
pop dword [ebp - 0x10]
mov eax, 0x669c2ec8
add eax, 0xa9662b28
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x1e8f5757
add dword [ebp - 0x20], 0x2fc2edf4
mov dword [ebp - 0x1c], 0x84003ed4
sub dword [ebp - 0x1c], 0x51ccf28f
mov dword [ebp - 0x18], 0xc31bdac7
sub dword [ebp - 0x18], 0x76cf9699
mov dword [ebp - 0x14], 0xfac98c67
sub dword [ebp - 0x14], 0xfac98c67
lea eax, [ebp - 0x20]
push eax
mov eax, 0xf551e8c6
add eax, 0x1ab16852
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x9915a6f5
add dword [ebp - 0x20], 0xdb5cc261
mov dword [ebp - 0x1c], 0x64d9db5d
sub dword [ebp - 0x1c], 0x236d79e8
mov dword [ebp - 0x18], 0x6dd84a02
add dword [ebp - 0x18], 0xf597226a
mov dword [ebp - 0x14], 0xb55b2fc1
add dword [ebp - 0x14], 0x4aa4d03f
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x40ad1
push 0
call eax
mov ecx, 0xdac253a4
add ecx, 0x253e0a95
mov edx, eax
mov ebx, 0x8338bb0e
sub ebx, 0x7330370e
add ebx, dword [ebp - 0x10]
mov esi, 0x84c5fa0a
add dword [ebp - 8], edi
mov edi, dword [ebx]
mov dword [ebp - 4], 0xa3744018
sub edi, esi
mov dword [edx], edi
xor dword [ebp - 0xc], esi
add edx, 0xe518fa74
add edx, 0x1ae70590
add ebx, 4
loop 0x10025b07
add eax, 0xcf1ce166
add eax, 0x30e48a51
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x25bad9e1
add ecx, 0xea45261f
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x401321
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
lea ebp, [esp - 0xfb8]
mov eax, 0x1038
call fcn.004105e0
mov eax, dword [0x43cddc]
xor eax, ebp
mov dword [ebp + 0xfb4], eax
push edi
mov edi, dword [ebp + 0xfc0]
lea eax, [ebp - 0x7c]
push eax
call fcn.0041d84c
pop ecx
mov dword [ebp - 0x78], eax
cmp eax, 0xffffffff
jne 0x401366
push 5
call fcn.00409a61
pop ecx
jmp 0x401452
push esi
call fcn.004082d1
push eax
push 0x5c
call fcn.00408c45
push eax
push 0x4360e8
mov esi, 0x400
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.00408299
push dword [ebp - 0x7c]
lea eax, [ebp + 0x7ac]
push 0x4360f8
push esi
push eax
call fcn.00408299
and dword [ebp - 0x64], 0
lea eax, [ebp + 0x7ac]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
mov dword [ebp - 0x74], str.JavaWSSplashScreen
mov dword [ebp - 0x70], 0x436128
mov dword [ebp - 0x68], edi
call fcn.0041d84c
add esp, 0x34
test eax, eax
jne 0x401449
mov word [ebp - 0x64], ax
lea edi, [ebp - 0x62]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x80], 0x10
call dword [sym.imp.WSOCK32.dll_accept]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401401
push 6
jmp 0x40144b
push 0
push 6
lea eax, [ebp + 0xfac]
push eax
push esi
call dword [sym.imp.WSOCK32.dll_recv]
cmp eax, 6
je 0x40141c
push 7
jmp 0x40144b
lea eax, [ebp + 0xfac]
push eax
call fcn.0041d84c
pop ecx
mov dword [0x4360e0], eax
test eax, eax
jg 0x401436
push 8
jmp 0x40144b
push esi
call fcn.00408098
push dword [ebp - 0x78]
call fcn.00408098
pop ecx
xor eax, eax
jmp 0x401450
push 0
call fcn.00409a61
pop ecx
pop esi
mov ecx, dword [ebp + 0xfb4]
xor ecx, ebp
pop edi
call fcn.0040ffe6
add ebp, 0xfb8
leave
ret
Function at 0x406f15
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1198]
mov eax, 0x1218
call fcn.004105e0
mov eax, dword [0x43cddc]
xor eax, ebp
mov dword [ebp + 0x1194], eax
push edi
push 0x437f38
push 0x437f68
push 0xffffffffffffffff
lea eax, [ebp - 0x74]
push 0x1000
push eax
call fcn.0041d84c
add esp, 0x18
lea eax, [ebp - 0x78]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x74]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x406f77
xor eax, eax
jmp 0x406ffb
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0xf8c]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push str.Path
push dword [ebp - 0x78]
mov dword [ebp - 0x80], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x78]
test eax, eax
je 0x406fac
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x406f70
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x7c], 1
jne 0x406f70
mov eax, dword [esi + 4]
test eax, eax
je 0x406fc6
push eax
call fcn.0041d84c
pop ecx
push edi
call fcn.0041d84c
lea ecx, [esi + 8]
push ecx
push eax
mov dword [esi + 4], eax
call fcn.00406c53
mov eax, dword [esi]
add esp, 0xc
test eax, eax
je 0x406fe9
push eax
call fcn.0041d84c
pop ecx
lea eax, [ebp + 0xf8c]
push eax
call fcn.0041d84c
mov dword [esi], eax
xor eax, eax
pop ecx
inc eax
mov ecx, dword [ebp + 0x1194]
xor ecx, ebp
call fcn.0040ffe6
add ebp, 0x1198
leave
ret