joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003a4a1
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x10266034
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x102663c0
jl 0x1003a4af
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10266664
jl 0x1003a4ef
mov ecx, dword [0x102673b0]
xor ecx, dword [0x10266034]
and ecx, edi
xor ecx, dword [0x102673b0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x10266030], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10266664]
mov dword [0x102669f0], eax
pop esi
ret
Function at 0x1003ccb5
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x10061fbb
call fcn.10060508
sub esp, 0x24
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x1003ccff
mov dword [edx], 0
cmp dword [edx], 3
jge 0x1003ccee
mov esi, dword [ebp + 0x1c]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 1
inc dword [edx]
cmp dword [edx], 3
jl 0x1003ccdc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x14], 0x3bb8
cmp dword [ebp - 0x14], 0x3d29
jle 0x1003cd65
xor esi, esi
xor edi, edi
mov eax, edi
lea ecx, [ebp - 0x30]
and eax, esi
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003cd2c
mov eax, dword [eax]
push eax
call fcn.100483dc
pop ecx
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.10004d74
inc edi
cmp edi, 0x4ac
jl 0x1003cd13
inc esi
cmp esi, 0x72e7
jl 0x1003cd11
push 0xdb2
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp dword [ebp - 0x14], 0x3b5d
jge 0x1003cd79
push str.gsxb_aowwubr_mxbqzjjdv_evhjxmt_nbtuygxzg_pzpdvjgkn_jniwe
call fcn.100483dc
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], 0x631a
cmp dword [ebp - 0x18], 0x665a
jle 0x1003cddc
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov eax, ebx
cdq
idiv ecx
mov ecx, edi
mov eax, esi
sub ecx, edx
shl eax, cl
mov ecx, 0x1007c858
cdq
push edx
push eax
call fcn.10004668
mov ecx, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x15f5
jl 0x1003cd98
inc ebx
cmp ebx, 0x1860
jl 0x1003cd93
inc edi
cmp edi, 0x424d
jl 0x1003cd91
inc esi
cmp esi, 0x15ec
jl 0x1003cd8f
push ecx
push dword [ebp + 0x20]
mov ecx, dword [ebp + 0xc]
call fcn.100414bf
mov edx, dword [ebp + 0x14]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x18], 0x5f99
mov dword [edx], eax
jge 0x1003ccee
mov edx, str.tzns_rpyvd_kaizo_bpphjbtm_dfquynfg_djsqditjz
mov ecx, 0x1007c858
call fcn.10006b3c
jmp 0x1003ccee
Function at 0x1004006e
Capabilities:
Delete registry key

Disassembly:
mov eax, 0x10062205
call fcn.10060508
sub esp, 0x60
push ebx
push esi
mov dword [ebp - 0x1c], 0xfab
mov ebx, ecx
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x1c], 0x1207
mov dword [ebp - 0x24], ebx
jle 0x100400f5
mov edi, esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x14], 0x35cb
mov ebx, esi
mov eax, edi
lea ecx, [ebp - 0x3c]
or eax, ebx
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100400c2
mov eax, dword [eax]
push eax
call fcn.100483dc
pop ecx
push esi
push 1
lea ecx, [ebp - 0x3c]
call fcn.10004d74
inc ebx
cmp ebx, 0x48fb
jl 0x100400a9
dec edi
dec dword [ebp - 0x14]
jne 0x100400a7
mov edi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x2a28
jl 0x1004009d
mov ebx, dword [ebp - 0x24]
cmp dword [ebp - 0x1c], 0xd46
jge 0x10040109
push str.nysn_tgev_wfuazz_haxwqm_bfatpnh_myyiwjn
call fcn.100483dc
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x18], 0
je 0x1004012f
push ecx
push ecx
mov ecx, dword [ebp + 0x10]
push ebx
call fcn.1003c91c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x14], 0x694a
cmp dword [ebp - 0x14], 0x6a90
jle 0x10040164
mov edi, esi
mov ebx, edi
mov esi, 0x6c5
mov eax, ebx
mov ecx, 0x1007c858
cdq
push edx
push eax
call fcn.10004668
dec ebx
dec esi
jne 0x10040148
inc edi
cmp edi, 0x510f
jl 0x10040141
mov dword [ebp - 0x18], 0x78b3
cmp dword [ebp - 0x18], 0x7be4
jle 0x100401cb
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edi, esi
mov dword [ebp - 0x1c], esi
mov ebx, edi
mov edi, 0x3b55
mov eax, ebx
lea ecx, [ebp - 0x54]
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1004019f
mov eax, dword [eax]
push eax
call fcn.100483dc
pop ecx
push esi
push 1
lea ecx, [ebp - 0x54]
call fcn.10004d74
dec ebx
dec edi
jne 0x10040188
mov edi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x3811
jl 0x10040181
push esi
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 8]
mov eax, dword [eax]
inc eax
push eax
push esi
lea eax, [ebp - 0x6c]
push eax
call fcn.100415c9
mov ecx, dword [ebp + 8]
push eax
call fcn.10007acd
push esi
push 1
lea ecx, [ebp - 0x6c]
call fcn.10004e40
cmp dword [ebp - 0x18], 0x75f8
jge 0x10040207
push str.ltcbdd_zooumf_dwm
call fcn.100483dc
pop ecx
mov dword [ebp - 4], 4
cmp dword [ebp - 0x14], 0x668f
jge 0x1004011e
mov edx, str.fbzocbcgj_qwkcm_ukwfzw_lszvgq_fcvwben_tqrtbyo_nmfqchk_vqttnse_uonwi
mov ecx, 0x1007c858
call fcn.10006b3c
jmp 0x1004011e
Function at 0x10042021
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006234f
call fcn.10060508
sub esp, 0x20
push ebx
xor ebx, ebx
mov dword [ebp - 0x28], ecx
inc ebx
push esi
mov byte [ebp - 0x14], bl
mov dword [ebp - 0x20], 0x14f0
cmp dword [ebp - 0x20], 0x1898
push edi
mov dword [ebp - 0x10], esp
jle 0x1004209d
xor edi, edi
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], 0x4b40
mov eax, esi
mov ecx, 0x1007c858
and eax, ebx
xor eax, edi
cdq
push edx
push eax
call fcn.10004668
dec esi
dec dword [ebp - 0x18]
jne 0x10042060
mov esi, dword [ebp - 0x1c]
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x581b
jl 0x10042056
inc ebx
cmp ebx, 0x3e5b
jl 0x10042051
inc edi
cmp edi, 0x3de8
jl 0x1004204f
xor ebx, ebx
inc ebx
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x1215
jge 0x100420d8
mov edx, str.rty_nehklrfj_awtr_viai_gqkfnjqbb
mov ecx, 0x1007c858
call fcn.10006b3c
jmp 0x100420d8
mov esi, dword [ebp + 0x2c]
mov ecx, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x28]
mov eax, dword [esi]
cmp eax, dword [ecx]
jge 0x100420f4
mov eax, dword [esi]
mov dword [edi], eax
cmp dword [edi], 0
jne 0x100420f4
xor eax, eax
jmp 0x100420f6
mov eax, ebx
cmp dword [ecx], 0
je 0x10042100
cmp dword [esi], 0
jne 0x10042102
xor ebx, ebx
lea ecx, [ebx + eax]
xor edx, edx
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
cmp ecx, eax
mov eax, dword [esi]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [esi]
jg 0x10042120
mov eax, dword [esi]
mov ecx, dword [edi]
xor edx, edx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp ecx, eax
mov eax, dword [ebp + 0x24]
setge dl
xor ecx, ecx
test edx, edx
mov eax, dword [eax]
sete cl
mov dword [eax], edx
mov eax, dword [ebp + 0x20]
mov dword [eax], ecx
cmp dword [eax], 0
je 0x10042148
mov eax, dword [edi]
mov eax, dword [esi]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax]
mov eax, dword [edi]
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], 0
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100421c5
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10062369
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
mov dword [esp + 4], 0xbf5c
lea ecx, [esp + 0x4c]
push ebx
mov dword [esp + 0xc], 0xffffffff
xor ebx, ebx
mov dword [esp + 0x1c], ebx
xor eax, eax
inc eax
mov dword [esp + 0x24], 0x8bc698dc
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], 0xe6337258
mov dword [esp + 8], eax
push 2
call fcn.10004892
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x2c], 0x7c5c6a81
push 4
mov dword [esp + 0x1c], 0xe68f
pop edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x40], 0x32b8
mov dword [esp + 0x14], ebx
jmp 0x1004225d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x54]
mov dword [eax + ecx*4], 0x7b187b35
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1004224a
cmp dword [esp + 0xc], ebx
jne 0x10042305
mov eax, dword [esp + 0x18]
dec dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x54]
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
neg eax
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add eax, dword [esp + 0x20]
je 0x100422c7
cmp dword [esp + 0x10], ebx
jne 0x100422c7
mov ecx, ebx
jmp 0x100422ca
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x24]
inc eax
add eax, ecx
mov ecx, 0xd2300b63
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x28], 1
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0xc]
cmp ecx, eax
sbb eax, eax
inc eax
add eax, dword [esp + 0x10]
jne 0x10042305
mov edx, ebx
jmp 0x10042308
xor edx, edx
inc edx
mov eax, dword [esp + 0x2c]
xor ecx, ecx
sub edx, eax
mov eax, dword [esp + 0xc]
cmp eax, edx
mov eax, dword [esp + 0x1c]
setg cl
xor edx, edx
cmp ecx, eax
setge dl
add edx, dword [esp + 0x30]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x10], edx
mov dword [esp + 8], ebx
jmp 0x100423ca
mov dword [esp + 0x34], edi
lea ecx, [esp + 0x48]
mov dword [esp + 0x38], 0xb1b2b150
push 2
call fcn.10004892
push 0x7f63
lea eax, [esp + 0x48]
mov byte [esp + 0x70], 1
push eax
push 1
lea eax, [esp + 0x54]
mov dword [esp + 0x48], 0x7bf6b3da
push eax
push ecx
push 0x3aad
push ecx
push 0x5231
call fcn.1004216b
add esp, 0x10
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x48]
push eax
push ecx
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x68]
push eax
push ecx
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x78]
call fcn.10042021
add esp, 0x38
mov byte [esp + 0x6c], bl
lea ecx, [esp + 0x48]
call fcn.100048f4
inc dword [esp + 8]
cmp dword [esp + 8], 0xc
jle 0x1004233a
lea ecx, [esp + 0x54]
call fcn.100048f4
mov ecx, dword [esp + 0x64]
pop edi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002c8f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x100083e8
call fcn.100080a0
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.10003717
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 1
je 0x10002cbb
push edi
call esi
cmp eax, 0xffffffff
jne 0x10002cfd
test ebx, ebx
je 0x10002cfa
lea ecx, [ebp - 0x18]
call fcn.10001b28
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.10003820
test al, al
push dword [ebp - 0x18]
je 0x10002cf4
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.1000217b
pop ecx
mov eax, esi
jmp 0x10002cfd
call fcn.1000217b
pop ecx
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x1000319f
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100031c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x100031c5
xor al, al
jmp 0x100031e5
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.100080f0
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x10005803
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
call fcn.10004c21
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
jne 0x10005825
call fcn.10004bd6
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.10004c11
mov edx, ds
sbb bh, dl
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.10004c21
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10004bd6
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.10004c11
arpl word [edx], cx
xor dword [ebp + 0x68], edi
add al, 1
add byte [eax], al
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x10005905
cmp dword [ebp - 0x398], 0
je 0x10005acf
cmp dword [ebp + 0xc], 1
je 0x10005acf
cmp dword [ebp + 0xc], 8
jne 0x10005a97
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
invalid
test dword [ebx - 7], edx
Function at 0x1000580f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
call fcn.10004c21
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
jne 0x10005825
call fcn.10004bd6
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.10004c11
mov edx, ds
sbb bh, dl
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.10004c21
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10004bd6
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.10004c11
arpl word [edx], cx
xor dword [ebp + 0x68], edi
add al, 1
add byte [eax], al
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x10005905
cmp dword [ebp - 0x398], 0
je 0x10005acf
cmp dword [ebp + 0xc], 1
je 0x10005acf
cmp dword [ebp + 0xc], 8
jne 0x10005a97
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
invalid
test dword [ebx - 7], edx
Function at 0x10007a5f
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x10008b90
call fcn.100080a0
sub esp, 0x28
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
cmp si, ax
jne 0x10007b3d
mov ecx, eax
xor edi, edi
shr ax, 0xa
and ecx, 0x3ff
mov esi, eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
movzx ecx, cx
lea edx, [ebp - 0x1c]
mov dword [ebp - 4], edi
call fcn.10007b6b
lea ecx, [ebp - 0x34]
call fcn.100078de
mov byte [ebp - 4], 1
mov dword [ebp - 0x10], edi
movzx ebx, si
mov eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
not eax
and eax, ebx
cmp eax, dword [ebp - 0x18]
jae 0x10007b1f
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ecx + eax*4]
cmp dword [esi + 4], edi
je 0x10007b1f
lea eax, [ebp - 0x34]
lea ecx, [ebp - 0x28]
push eax
call fcn.10001bfb
push dword [esi]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.10001e74
lea ecx, [ebp - 0x28]
push str..txt
call fcn.10001e74
mov edx, dword [ebp - 0x28]
mov ecx, 0x1000c0e0
call fcn.100078d2
test al, al
jne 0x10007b4c
push dword [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.1000217b
pop ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jb 0x10007abf
push dword [ebp - 0x34]
call fcn.1000217b
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.10007c73
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
push dword [esi]
mov ecx, 0x1000c100
call fcn.10001d23
push dword [ebp - 0x28]
call fcn.1000217b
push dword [ebp - 0x34]
call fcn.1000217b
pop ecx
jmp 0x10007b30

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401590
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6c4
mov eax, dword [0x413014]
xor eax, esp
mov dword [esp + 0x6c0], eax
push ebx
push esi
mov ebx, ecx
push edi
mov dword [esp + 0x14], ebx
call dword [sym.imp.mfc140.dll_Ordinal_7961]
push 0xc
call dword [sym.imp.mfc140.dll_Ordinal_1507]
add esp, 4
test eax, eax
je 0x4015d4
mov ecx, eax
call dword [sym.imp.mfc140.dll_Ordinal_952]
mov esi, eax
jmp 0x4015d6
xor esi, esi
call dword [sym.imp.mfc140.dll_Ordinal_7282]
push eax
call dword [sym.imp.mfc140.dll_Ordinal_13378]
push 0x40dc50
mov ecx, ebx
call dword [sym.imp.mfc140.dll_Ordinal_13830]
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc140.dll_Ordinal_316]
push 0x104
lea eax, [esp + 0x5c4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x5c0]
push eax
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc140.dll_Ordinal_1529]
push 0x12
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc140.dll_Ordinal_12863]
push 0x40dc70
push dword [eax]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call dword [sym.imp.mfc140.dll_Ordinal_1044]
test bl, bl
je 0x401685
lea eax, [esp + 0xc]
push 0x40dc84
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
add esp, 8
lea ecx, [esp + 0xc]
push 0
push 0
call dword [sym.imp.mfc140.dll_Ordinal_1661]
push eax
call dword [sym.imp.mfc140.dll_Ordinal_2298]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
xor edi, edi
call dword [sym.imp.mfc140.dll_Ordinal_2241]
mov eax, dword [eax + 0x10]
push eax
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov ecx, 1
cmove edi, ecx
test ebx, ebx
je 0x4016ba
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test edi, edi
je 0x4016d5
push 0
push 0
push 0x40dcb0
call dword [sym.imp.mfc140.dll_Ordinal_2298]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00401fa0
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
mov dword [eax + 0x20], ecx
call dword [sym.imp.mfc140.dll_Ordinal_4084]
test esi, esi
je 0x4016fd
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
lea ecx, [esp + 0x18]
call fcn.00401730
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov ecx, dword [esp + 0x6cc]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040b2ce
mov esp, ebp
pop ebp
ret
Function at 0x4018d0
Capabilities:
Print debug messages
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x824
mov eax, dword [0x413014]
xor eax, esp
mov dword [esp + 0x820], eax
push ebx
push esi
mov esi, dword [0x414714]
lea ecx, [esp + 8]
push edi
push 0x40d967
call dword [sym.imp.mfc140.dll_Ordinal_310]
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add esp, 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], edx
xorps xmm0, xmm0
mov dword [esp + 0x24], 0
lea ecx, [esp + 0x1c]
movsd qword [esp + 0x1c], xmm0
push eax
call fcn.00409af0
push 0x800
lea eax, [esp + 0x2c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x28]
push 0
push 0x800
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401a91
sub esp, 8
lea eax, [esp + 0x18]
lea ecx, [esp + 0x24]
push eax
call fcn.00409910
push ebx
push dword [eax]
lea eax, [esp + 0x14]
push str.__s_RecvData_HDZB__4d_Bytes_:
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
add esp, 0x10
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, dword [0x413700]
mov eax, 0x800
cmp ebx, eax
cmovg ebx, eax
xor ecx, ecx
cmp edi, eax
cmovg edi, ecx
lea esi, [edi + ebx]
cmp esi, eax
jl 0x4019fc
sub eax, edi
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [edi + 0x413710]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [esi - 0x800]
push eax
lea eax, [esp + 0x82c]
sub eax, edi
push eax
push 0x413710
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 0xfffff800
jmp 0x401a11
push ebx
lea eax, [esp + 0x2c]
push eax
lea eax, [edi + 0x413710]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [0x413700], esi
cmp esi, 0x800
jae 0x401ab2
mov ecx, 0x413710
mov byte [esi + 0x413710], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401a32
sub ecx, edx
cmp ecx, esi
cmovb esi, ecx
mov ecx, dword [0x413704]
mov eax, esi
mov dword [0x413700], esi
sub eax, ecx
push eax
push esi
push ecx
lea eax, [esp + 0x18]
push str.RecvData:_d_d_d_r_n
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
add esp, 0x14
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x820]
xor ecx, esp
call fcn.0040b2ce
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov ecx, dword [esp + 0x82c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040b2ce
mov esp, ebp
pop ebp
ret
call fcn.0040b402
int3