joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8c99b0
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], eax
push dword [esp + 4]
xchg esi, edi
pop ecx
mov word [esp + 2], sp
jmp 0x8c98f8
pop dword [esp]
xchg dword [esp], ebx
mov byte [esp + 1], ah
mov bx, 0xfd4d
mov dword [esp], ebp
mov edi, 0x2d0a6060
jmp 0x8c9877
lea esi, [eax - 0x99]
mov word [esp], bx
mov dx, word [esp + 2]
btr ecx, esp
jmp 0x8c98d2
pop si
mov ebp, ecx
bsf bp, si
xchg byte [esp + 2], al
rdtsc
lea esp, [esp + 1]
jmp 0x8c98a5
mov edi, dword [esp]
lea ebp, [ecx + edx]
call 0x8c98de
xlatb
xor dl, ch
mov dl, 0xec
sub edi, eax
push dword [esp + 2]
jmp 0x8c992e
lea ebp, [ecx + edx]
mov bl, bh
btc ecx, edi
xchg si, bx
mov edi, 0x61b47b0a
add ebx, ebp
jmp 0x8c98be
btr edx, edx
mov dx, 0xb2bb
mov eax, dword [esp + 0xf]
xchg edx, ebx
lea eax, [ebx*4]
push edx
jmp 0x8c9942
mov cx, bx
pushal
push dword [esp + 0x14]
push dword [esp + 9]
mov si, word [esp + 0x12]
popal
jmp 0x8c990c
lea esp, [esp + 0xd]
cld
add esp, 3
xchg byte [esp + 2], cl
mov dword [esp], ebp
mov di, dx
jmp 0x8c9992
xchg dword [esp + 2], ecx
mov bh, byte [esp + 3]
cpuid
rdtsc
push word [esp + 3]
xchg byte [esp + 3], cl
jmp 0x8c988d
lea esi, [eax + 0x21]
pop eax
setge ah
mov cl, ch
rdtsc
add esp, 0
call fcn.008c99e4
push 0xe8197ee8
add eax, dword [ebp - reloc.WINMM.dll_PlaySoundW]
fiadd word [ebx + 0x4c8b00c4]
and al, 3
mov cl, ch
mov ebx, esi
add esp, 0
mov ecx, dword [esp + 3]
clc
pop cx
jmp 0x8c9977
lea ecx, [esp + ebp]
mov word [esp + 2], di
mov dword [esp + 1], ebp
jmp 0x8c995d

Function at 0x8ca196
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
and edx, ecx
inc si
mov ebp, 0xc185bde2
xchg dword [esp], edx
jmp 0x8ca16a
mov edx, eax
pushal
xchg dword [esp + 0x13], ebx
sub esp, 0x16
xchg ebp, eax
popal
jmp 0x8ca17d
setae ch
call fcn.008ca1ff
salc
push esi
les esp, [ebx - 0x34bb4aa2]
pop ebx
int 0x23
out dx, al
stc
fdivr dword [ebx]
adc ch, cl
invalid
sbb bh, bh
invalid

Function at 0x8ca2dc
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 4]
bswap ebp
mov eax, dword [esp + 0x15]
shr ah, 1
xchg byte [esp + 4], cl
rdtsc
jmp 0x8ca24a
xchg word [esp + 1], cx
mov bx, word [esp + 8]
pop dword [esp + 0x12]
mov byte [esp + 0x17], ch
mov word [esp + 8], bx
pop ax
jmp 0x8ca264
xchg cx, si
xchg byte [esp + 0x1a], cl
lea ebx, [esi - 0x1d]
sub ebx, eax
pop si
jmp 0x8ca287
clc
mov eax, dword [esp + 0xf]
mov eax, 0xecc45794
popal
push edx
jmp 0x8ca2c5

Function at 0x8ca4f1
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0xe
xchg word [esp + 4], di
push word [esp + 5]
mov bh, byte [esp + 5]
bswap ebp
jmp 0x8ca4ab
Function at 0x8ca81b
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
rdtsc
xchg ebx, edx
mov ebx, esi
setbe dh
mov cx, di
jmp 0x8ca782
add esp, 3
push esp
push dword [esp + 3]
pop dword [esp]
xchg dword [esp], esi
jmp 0x8ca728
cmc
lea ecx, [edx*4]
xchg dword [esp], eax
sub ax, 0x280
rdtsc
jmp 0x8ca73e
push word [esp + 1]
sub esp, 0
neg ebp
mov bl, 0x28
xchg byte [esp + 2], cl
bswap esi
jmp 0x8ca755
xchg edx, ebx
cpuid
mov dh, byte [esp]
lea esp, [esp]
not cx
mov edi, dword [esp]
jmp 0x8ca7e2
btr esi, esp
xchg word [esp], dx
bswap edx
inc edx
lea ebx, [esi - 0x65]
lea esp, [esp + 1]
jmp 0x8ca76e
mov si, di
lea esp, [esp + 1]
xchg cx, ax
xchg word [esp], bp
stc
lea eax, [edx + ebx]
jmp 0x8ca79a
lea ebp, [esp + esi]
mov dx, sp
btr eax, esp
neg ax
lea ecx, [esp + ebp]
jmp 0x8ca84d
add al, dh
mov cx, di
lea ecx, [ebx*4]
xchg dh, al
add esp, 0
mov ax, word [esp]
call fcn.008ca7ca
pop word [esp]
mov dx, word [esp + 1]
not bh
clc
mov ecx, 0x8d66ebe6
not bh
jmp 0x8ca7cc
mov esi, 0x8eee938a
mov dx, di
mov cx, 0x83e1
jmp 0x8ca7b6
xchg bp, di
lea ebp, [ebp*4]
mov ecx, 0xcd121cdc
xchg byte [esp], al
bswap edx
lea ebx, [esp + eax]
jmp 0x8ca91e
lea edi, reloc.WINMM.dll_PlaySoundW
rdtsc
inc al
rdtsc
xor edx, esi
mov bl, 8
jmp 0x8ca829
btc ebp, ebx
xchg byte [esp + 0x18], al
bswap eax
pop dword [esp]
setnp bh
jmp 0x8ca8b8
xchg edx, eax
lea ecx, [ebp - 0x97]
lea ebx, [esp + ecx]
rdtsc
pop word [esp + 0x18]
neg ch
jmp 0x8ca88a
mov word [esp + 0x16], sp
mov bx, sp
bswap esi
mov ebx, 0x9519395c
xchg cx, bx
mov byte [esp + 0x15], bh
jmp 0x8ca8f8
mov dword [esp + 0x1f], eax
mov di, word [esp + 5]
xchg dword [esp + 0xa], ebp
ror bh, 3
mov eax, ebp
inc bl
jmp 0x8ca8a2
pop word [esp]
lea esp, [esp + 5]
mov ax, dx
add esp, 0x17
push word [esp]
lea edx, [ecx*4]
jmp 0x8ca9c5
bswap edx
push esp
mov ebx, dword [esp + 4]
cmc
pushal
inc dl
jmp 0x8ca8e2
rcl bp, cl
mov byte [esp + 0x17], bh
and eax, ecx
pop dword [esp + 3]
mov bl, 0x60
mov word [esp + 0x10], di
jmp 0x8ca978
cpuid
xchg bp, di
xchg ah, bl
mov word [esp + 0xc], di
sub esp, 0x1e
bswap ebp
jmp 0x8ca92b
mov al, ah
mov bx, word [esp + 0x13]
mov dh, byte [esp + 0x19]
setae ah
lea esp, [esp + 0x20]
jmp 0x8ca98d
btc esi, ebx
xchg ah, bl
mov ebx, ecx
mov bp, word [esp + 0x1d]
neg bh
xchg word [esp + 1], bp
jmp 0x8ca960
lea eax, [edi*4]
push dword [esp + 0xe]
lea esp, [esp + 0x11]
bswap ebp
mov dx, word [esp]
bswap edx
jmp 0x8caa0f
sub esp, 0xe
pop word [esp + 6]
stc
push esp
sub edi, eax
lea ebx, [ebp + 0x3f]
jmp 0x8ca94d
mov bx, di
cld
bsr di, cx
mov dh, byte [esp + 4]
lea ebp, [edx + edx]
clc
jmp 0x8ca9ac
lea esp, [esp + 0x24]
popal
sub esp, 0x14
push word [esp + 0xd]
lea esp, [esp + 0x13]
jmp 0x8caa6e
pop word [esp + 1]
sub esp, 0x1c
mov word [esp], dx
shr eax, 0x17
mov word [esp + 0xc], dx
mov ax, sp
jmp 0x8ca9d7
btc eax, ebx
cpuid
sub esp, 8
xchg bh, cl
neg edx
lea ebx, [ecx - 0xd3]
jmp 0x8ca9ef
lea esp, [esp + 4]
call fcn.008caa23
sub esp, 0x1a
push dword [esp + 0xb]
lea esp, [esp + 1]
lea esp, [esp + 0x20]
popfd
jmp 0x8caa4e
Function at 0x8cabee
Capabilities:
Access peb ldr_data

Disassembly:
lea esp, [esp + 2]
mov dword [esp + 0x8c], edi
lea esp, [esp + 0x8c]
jmp 0x8cac71
mov dword [esp + 5], ebp
push dword [esp + 4]
mov word [esp + 0x22], dx
jmp 0x8cabcf
mov dword [esp + 0x10], eax
call fcn.008cac58
push ebx
pushal
lea ecx, [ecx + 0x1b]
mov ebx, dword [esp]
jmp 0x8cabfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x8cac27

Function at 0x8cac31
Capabilities:
Parse pe header

Disassembly:
push eax
jmp 0x8c602e
call fcn.008c6033
movzx ebx, word [eax + 0x3c]
jmp 0x8caca6
mov eax, dword [esp + 4]
call 0x8cac3b
cdq
lea esp, [esp + 0xc]
xor ax, ax
cmp word [eax], 0x5a4d
jmp 0x8cac7f
je 0x8ca0f7
sub eax, 0x10000
jmp 0x8cac42
add ebx, eax
cmp word [ebx], 0x4550
push eax
inc ebp
je 0x8c52b8
jne 0x8cac85
inc ebx
rcl byte [esi + 0x31], 0xc0
sub bh, bh
jge 0x8cacab
je 0x8cac47
outsb dx, byte [esi]
iretd

Function at 0x8cac3b
Capabilities:
Parse pe header

Disassembly:
push eax
jmp 0x8c602e
call fcn.008c6033
movzx ebx, word [eax + 0x3c]
jmp 0x8caca6
mov eax, dword [esp + 4]
call 0x8cac3b
cdq
lea esp, [esp + 0xc]
xor ax, ax
cmp word [eax], 0x5a4d
jmp 0x8cac7f
je 0x8ca0f7
sub eax, 0x10000
jmp 0x8cac42
add ebx, eax
cmp word [ebx], 0x4550
push eax
inc ebp
je 0x8c52b8
jne 0x8cac85
inc ebx
rcl byte [esi + 0x31], 0xc0
sub bh, bh
jge 0x8cacab
je 0x8cac47
outsb dx, byte [esi]
iretd
Function at 0x1000c550
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10040fcc
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x100590e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x28], 0
je 0x1000c593
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov al, byte [ebp + 8]
lea ecx, [esi + 0xc]
mov byte [esi + 0x2b], al
mov byte [esi + 0x28], 1
mov byte [esi + 0x29], 0
mov byte [esi + 0x2a], 0
mov eax, dword [esi + 0xc]
call dword [eax]
cmp dword [esi + 8], 0
je 0x1000c5b8
mov bl, byte [esi + 0x28]
jmp 0x1000c5ea
lea eax, [esi + 4]
xor ecx, ecx
push eax
mov al, byte [esi + 0x2b]
mov edx, 8
test al, al
cmovne ecx, edx
push ecx
push esi
push 0x1000c7d0
push 0
push 0
call fcn.1003037a
add esp, 0x18
mov dword [esi + 8], eax
test eax, eax
jne 0x1000c610
mov byte [esi + 0x28], al
xor bl, bl
mov edx, dword [esi + 0xc]
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 1
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0xc]
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 2
call dword [eax + 4]
mov al, byte [esi + 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10019050
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100590e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0x444], 0
je 0x10019084
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001ff0d
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x44c], eax
test edi, edi
je 0x100190a3
push 0x3ff
lea eax, [esi + 0x28]
push edi
push eax
call fcn.10030530
add esp, 0xc
push dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
push eax
push edi
mov dword [esi + 0x24], eax
call fcn.10018dc0
add esp, 0xc
mov dword [esi + 0x448], eax
cmp eax, 0xffffffff
jne 0x100190d5
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001ff0d
mov esp, ebp
pop ebp
ret 0x10
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0x28]
mov byte [esi + 0x444], 1
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x28], 0x10
push eax
push dword [esi + 0x448]
call dword [sym.imp.WS2_32.dll_getsockname]
push dword [ebp - 0x20]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
test eax, eax
mov edx, str._NULL_
cmovne edx, eax
cmp byte [edx], 0
jne 0x1001911c
xor ecx, ecx
jmp 0x1001912a
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10019121
sub ecx, edi
push ecx
push edx
lea ecx, [esi + 4]
call fcn.100033f0
push 1
push 0x1004467c
lea ecx, [esi + 4]
call fcn.10001650
push dword [ebp - 0x22]
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
push eax
lea eax, [ebp - 0x14]
push 0x10045da4
push eax
call fcn.10007bc0
add esp, 0xc
cmp byte [ebp - 0x14], 0
jne 0x1001916b
xor ecx, ecx
jmp 0x1001917a
lea ecx, [ebp - 0x14]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10019171
sub ecx, edx
push ecx
lea eax, [ebp - 0x14]
push eax
lea ecx, [esi + 4]
call fcn.10001650
mov ecx, esi
call fcn.10018950
mov ecx, dword [ebp - 4]
pop edi
mov byte [esi + 0x444], al
xor ecx, ebp
pop esi
call fcn.1001ff0d
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100194b0
Capabilities:
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x1001940b
push eax
call edi
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x10019427
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push ebx
lea ebx, [esi + 8]
xorps xmm0, xmm0
mov eax, 2
movups xmmword [ebx], xmm0
push str.127.0.0.1
mov word [ebx], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x10
push ebx
push dword [esi + 4]
mov dword [esi + 0xc], eax
xor eax, eax
mov word [esi + 0xa], ax
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x10019476
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x10
push eax
push ebx
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1001948b
push dword [esi + 4]
call edi
pop ebx
pop edi
mov dword [esi + 4], 0xffffffff
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 0x8004667e
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
neg eax
pop ebx
sbb eax, eax
pop edi
inc eax
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ecx + 4], 0xffffffff
je 0x100193f0
mov al, 1
ret
Function at 0x1001a010
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004253f
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x100590e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov al, byte [ebp + 0xc]
mov byte [edi + 0xd4], al
mov eax, dword [ebp + 8]
mov dword [edi + 0x124], eax
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x130]
mov byte [edi + 0xd5], 0
push eax
push dword [edi + 0x124]
mov dword [ebp - 0x134], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
lea ecx, [ebp - 0xb0]
call fcn.100071f0
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], 0
call fcn.100071f0
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x130]
push eax
call fcn.10007550
add esp, 8
mov dword [ebp - 0x134], 0x80
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x130]
push eax
push dword [edi + 0x124]
call dword [sym.imp.WS2_32.dll_getpeername]
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x130]
push eax
call fcn.10007550
add esp, 8
lea eax, [ebp - 0x60]
lea ecx, [ebp - 0xb0]
push eax
call fcn.10007700
mov ebx, eax
lea esi, [edi + 0xe8]
cmp esi, ebx
je 0x1001a13b
mov eax, dword [esi + 0x14]
cmp eax, 0x10
jb 0x1001a116
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.10001780
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x1001a12e
mov eax, dword [esi]
jmp 0x1001a130
mov eax, esi
push ebx
mov ecx, esi
mov byte [eax], 0
call fcn.10002230
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 4], 1
cmp eax, 0x10
jb 0x1001a154
inc eax
lea ecx, [ebp - 0x60]
push eax
push dword [ebp - 0x60]
call fcn.10001780
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x48]
call fcn.10007700
mov ebx, eax
lea esi, [edi + 0x100]
cmp esi, ebx
je 0x1001a1a4
mov eax, dword [esi + 0x14]
cmp eax, 0x10
jb 0x1001a17f
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.10001780
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x1001a197
mov eax, dword [esi]
jmp 0x1001a199
mov eax, esi
push ebx
mov ecx, esi
mov byte [eax], 0
call fcn.10002230
mov eax, dword [ebp - 0x64]
mov byte [ebp - 4], 1
cmp eax, 0x10
jb 0x1001a1bd
inc eax
lea ecx, [ebp - 0x78]
push eax
push dword [ebp - 0x78]
call fcn.10001780
lea eax, [edi + 0x12c]
push eax
lea ecx, [ebp - 0xb0]
call fcn.10007690
lea eax, [edi + 0x13c]
push eax
lea ecx, [ebp - 0x48]
call fcn.10007690
mov eax, dword [ebp - 0x34]
cmp eax, 0x10
jb 0x1001a1f3
inc eax
lea ecx, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
call fcn.10001780
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x48], 0
cmp eax, 0x10
jb 0x1001a223
inc eax
lea ecx, [ebp - 0xb0]
push eax
push dword [ebp - 0xb0]
call fcn.10001780
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001ff0d
mov esp, ebp
pop ebp
ret 8
Function at 0x1001a330
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10042580
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x100590e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
test eax, eax
jne 0x1001a377
mov byte [esi + 0x11c], al
mov eax, dword [esi]
push 1
call dword [eax + 0x78]
jmp 0x1001a4c1
cmp eax, 1
jne 0x1001a38f
mov eax, dword [esi]
push 1
mov byte [esi + 0x11d], 0
call dword [eax + 0x7c]
jmp 0x1001a4c1
cmp eax, 4
jne 0x1001a4c1
lea eax, [ebp - 0x134]
mov dword [ebp - 0x134], 0x80
push eax
lea eax, [ebp - 0x130]
push eax
push dword [esi + 0x124]
call dword [sym.imp.WS2_32.dll_getsockname]
lea ecx, [ebp - 0x80]
call fcn.100071f0
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], 0
call fcn.100071f0
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x130]
push eax
call fcn.10007550
add esp, 8
mov dword [ebp - 0x134], 0x80
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x130]
push eax
push dword [esi + 0x124]
call dword [sym.imp.WS2_32.dll_getpeername]
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x130]
push eax
call fcn.10007550
add esp, 8
lea eax, [ebp - 0x98]
lea ecx, [ebp - 0x80]
push eax
call fcn.10007700
push eax
lea ecx, [esi + 0xe8]
call fcn.100067e0
lea ecx, [ebp - 0x98]
call fcn.100067a0
lea eax, [ebp - 0xb0]
push eax
lea ecx, [ebp - 0x48]
call fcn.10007700
push eax
lea ecx, [esi + 0x100]
call fcn.100067e0
lea ecx, [ebp - 0xb0]
call fcn.100067a0
lea eax, [esi + 0x12c]
push eax
lea ecx, [ebp - 0x80]
call fcn.10007690
lea eax, [esi + 0x13c]
push eax
lea ecx, [ebp - 0x48]
call fcn.10007690
mov eax, dword [esi]
mov ecx, esi
mov byte [esi + 0xd4], 1
call dword [eax + 0x48]
test eax, eax
je 0x1001a4b1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x48]
push 0
push 0
push 0
mov edx, dword [eax]
mov ecx, eax
push esi
call dword [edx]
lea ecx, [ebp - 0x48]
call fcn.100067a0
lea ecx, [ebp - 0x80]
call fcn.100067a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001ff0d
mov esp, ebp
pop ebp
ret 4
Function at 0x1001d6f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 0xc]
test ecx, ecx
je 0x1001d700
pop ebp
jmp fcn.1001d630
pop ebp
ret 8

Function at 0x1001dd50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x1001dd65
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1001dda6
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x1001dda2
nop word [eax + eax]
cmp esi, edx
jae 0x1001dda6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x1001dd90
cmp esi, edx
jb 0x1001ddab
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x44b903d0
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x6ed02c8e
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x407e30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407f09
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407e68
mov eax, dword [ebp - 4]
call fcn.00407220
jmp 0x407e70
mov eax, dword [ebp - 4]
call fcn.00407c1c
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407ebc
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407ea6
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.00407220
jmp 0x407eb8
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407c1c
inc ebx
dec esi
jne 0x407e80
push 1
push dword [ebp - 4]
push 0x407f20
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f84
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407f10
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x4015c9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
cmp edi, ebx
jne 0x4015e2
push 0x80004005
call fcn.00401150
mov esi, dword [ebp + 8]
push edi
push esi
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp + 0x10], ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp esi, ebx
je 0x401631
mov ecx, dword [edi]
cmp ecx, ebx
jbe 0x40162f
cmp dword [ebp + 0x10], ebx
jbe 0x40162c
cmp dword [ebp + 0x10], 2
jbe 0x401638
cmp dword [ebp + 0x10], 7
jne 0x40162c
cmp ecx, 1
jb 0x40162c
lea edx, [ecx + esi]
cmp byte [edx - 1], bl
jne 0x40162c
cmp ecx, 1
jbe 0x401631
cmp byte [edx - 2], bl
je 0x401631
push 0xd
pop eax
mov byte [esi], bl
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
cmp byte [ecx + esi - 1], bl
jmp 0x40162a

Function at 0x40169a
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x4016e8
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x4016f9
push 0xd
pop eax
jmp 0x401723
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x4016fc
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x401dfc
Capabilities:
Get file version info

Disassembly:
push 0x960
push 0x40fcd8
call fcn.0040b3d0
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov byte [ebp - 0x81c], 0
push ecx
push eax
push 0x40d730
lea eax, [ebp - 0x81c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x95c]
push eax
lea eax, [ebp - 0x81c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x401ef7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x96c]
push eax
lea eax, [ebp - 0x81c]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
je 0x401ef7
push edi
call sub.MSVCR100.dll_void____cdecl_operator_new___unsigned_int_
pop ecx
mov esi, eax
mov dword [ebp - 0x960], esi
test esi, esi
je 0x401ef7
and dword [ebp - 4], 0
push esi
push edi
push 0
lea eax, [ebp - 0x81c]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x401eeb
and dword [ebp - 0x964], 0
lea eax, [ebp - 0x964]
push eax
lea eax, [ebp - 0x968]
push eax
push str.StringFileInfo040904e4ProductVersion
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x401eeb
push ebx
push dword [ebp - 0x968]
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x401eeb
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x41228c
call sub.MSVCR100.dll__local_unwind4
add esp, 0xc
xor eax, eax
inc eax
jmp 0x401ef9
mov dword [ebp - 4], 0xfffffffe
call fcn.00401f05
xor eax, eax
call fcn.0040b418
ret