joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43fea6
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
and dword [ebp - 0x10], ebx
and dword [eax], ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push edx
push ecx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x440001
push esi
push edi
mov edi, dword [ebp - 8]
test edi, edi
je 0x43ffec
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x43fef4
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43fee8
sub ecx, edx
inc ecx
jmp 0x43fef6
xor ecx, ecx
cmp dword [edi + 4], 2
mov dword [ebp - 0xc], ecx
jne 0x43ff03
push 0x10
jmp 0x43ff0f
cmp dword [edi + 4], 0x17
jne 0x43ffb7
push 0x1c
cmp dword [edi + 0x18], 0
pop eax
mov dword [ebp - 4], eax
je 0x43ffb7
cmp dword [edi + 0x10], 0
jbe 0x43ffb7
cmp dword [edi + 0x10], eax
jb 0x43ffb7
mov esi, dword [0x46f048]
add ecx, 0x20
add eax, ecx
mov ecx, esi
push eax
call dword [0x4553fc]
call esi
mov esi, eax
pop ecx
test esi, esi
je 0x43ffe3
mov ecx, dword [edi]
mov dword [esi], ecx
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 8]
mov dword [esi + 8], ecx
mov eax, dword [edi + 0xc]
mov ecx, dword [ebp - 4]
and dword [esi + 0x14], 0
and dword [esi + 0x1c], 0
mov dword [esi + 0xc], eax
lea eax, [esi + 0x20]
push ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x18], eax
push dword [edi + 0x18]
push eax
call fcn.00452780
mov edx, dword [ebp - 0xc]
add esp, 0xc
test edx, edx
je 0x43ffa5
mov eax, dword [esi + 0x18]
add eax, dword [ebp - 4]
push edx
mov dword [esi + 0x14], eax
push dword [edi + 0x14]
push eax
call fcn.00452780
add esp, 0xc
mov eax, dword [ebp - 0x10]
test ebx, ebx
cmove ebx, esi
test eax, eax
je 0x43ffb4
mov dword [eax + 0x1c], esi
mov dword [ebp - 0x10], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x43fede
mov esi, dword [ebp - 0x14]
cmp dword [ebp - 8], 0
je 0x43ffd4
push dword [ebp - 8]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test esi, esi
je 0x43ffe8
mov ecx, ebx
call fcn.0043fe82
xor ebx, ebx
jmp 0x43fff8
push 8
pop esi
jmp 0x43ffc5
test ebx, ebx
jne 0x43fff8
mov esi, 0x2af9
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0xc]
pop edi
mov dword [eax], ebx
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x44023e
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x46f008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x18]
mov esi, ecx
push eax
push esi
push 2
mov edi, edx
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x440276
push edi
push esi
lea edx, [ebp - 0x18]
push 2
pop ecx
call fcn.0044014e
pop ecx
pop ecx
jmp 0x440292
lea eax, [ebp - 0x14]
push eax
push esi
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x440290
push edi
push esi
lea edx, [ebp - 0x14]
push 0x17
jmp 0x44026c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00450ca6
leave
ret
Function at 0x446591
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
push edi
push esi
push eax
push dword [ebp + 8]
mov edi, edx
mov dword [ebp - 8], eax
mov ebx, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], esi
call fcn.004520c0
add esp, 0xc
lea eax, [ebp - 8]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x446659
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x800c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x446639
push 0
push edi
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x446639
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x446639
cmp esi, dword [ebp - 0xc]
jb 0x446639
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [ebp - 4], 0
je 0x446648
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 8], 0
je 0x446659
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44699f
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration
Start tcp server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x46f008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
push 6
inc eax
mov dword [ebp - 0x28], 0x10
push eax
push 2
mov dword [ebp - 0x34], eax
pop eax
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
or ebx, 0xffffffff
cmp esi, ebx
je 0x446b63
push 2
pop eax
xorps xmm0, xmm0
mov word [ebp - 0x14], ax
push 0x7f000001
movlpd qword [ebp - 0xc], xmm0
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0x10], eax
xor eax, eax
push 4
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x34]
push eax
push 4
push 0xffff
push esi
mov dword [edi + 4], ebx
mov dword [edi], ebx
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, ebx
je 0x446b4b
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, ebx
je 0x446b4b
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, ebx
je 0x446b4b
cmp dword [ebp - 0x28], 0x10
jl 0x446b4b
push 1
push esi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, ebx
je 0x446b4b
push 0
push 1
push 2
pop eax
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi], eax
cmp eax, ebx
je 0x446b4b
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, ebx
je 0x446b4b
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 1
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
js 0x446b4b
xor edx, edx
mov dword [ebp - 0x30], esi
push 0
push 0x2710
inc edx
mov dword [ebp - 0x2c], 0x300
lea ecx, [ebp - 0x30]
call fcn.0042f35e
pop ecx
pop ecx
push 0
push 0
push esi
call dword [sym.imp.WS2_32.dll_accept]
mov dword [edi + 4], eax
cmp eax, ebx
je 0x446b4b
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, ebx
je 0x446b4b
push 0x10
pop eax
cmp dword [ebp - 0x28], eax
jl 0x446b4b
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_getpeername]
cmp eax, ebx
je 0x446b4b
cmp dword [ebp - 0x28], 0x10
jl 0x446b4b
mov ax, word [ebp - 0x14]
cmp ax, word [ebp - 0x24]
jne 0x446b4b
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x20]
jne 0x446b4b
mov ax, word [ebp - 0x12]
cmp ax, word [ebp - 0x22]
jne 0x446b4b
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x446b65
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
push dword [edi]
call dword [sym.imp.WS2_32.dll_closesocket]
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00450ca6
leave
ret
Function at 0x44c6e0
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
xor edi, edi
push edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x44c703
push 0x1b
pop eax
jmp 0x44c727
lea eax, [esi + 4]
push eax
push edi
push edi
push 0x8003
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x44c725
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x44c6fe
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x44f820
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 0x18
xor edi, edi
push edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x44f851
lea eax, [esi + 4]
push eax
push edi
push edi
push 0x800c
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop edi
xor eax, eax
pop esi
pop ebp
ret

Function at 0x44f8f5
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov esi, dword [edi + 0xc]
mov eax, dword [edi + 0x14]
lea eax, [eax + esi*2]
mov esi, dword [0x46f048]
add eax, 0xc
mov ecx, esi
push eax
call dword [0x4553fc]
call esi
mov ebx, eax
pop ecx
test ebx, ebx
je 0x44fa58
lea ecx, [ebx + 0xc]
mov dword [ebx], edi
mov dword [ebx + 4], ecx
mov eax, dword [edi + 0xc]
add eax, ecx
mov dword [ebx + 8], eax
mov eax, dword [ebp + 8]
cmp eax, dword [edi + 0x10]
jbe 0x44f990
mov esi, dword [edi]
push ecx
mov ecx, esi
call dword [0x4553fc]
call esi
mov eax, dword [ebp - 8]
mov esi, dword [edi + 4]
pop ecx
push dword [ebp + 8]
mov ecx, esi
push eax
push dword [ebx + 4]
call dword [0x4553fc]
call esi
mov eax, dword [ebx + 8]
add esp, 0xc
add eax, dword [edi + 0xc]
mov esi, dword [edi + 8]
mov ecx, esi
mov dword [ebp - 8], eax
push dword [ebx + 4]
push eax
call dword [0x4553fc]
call esi
mov eax, dword [edi + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebx + 4]
mov dword [ebp + 8], eax
mov esi, dword [edi]
push ecx
mov ecx, esi
call dword [0x4553fc]
call esi
mov esi, dword [edi]
pop ecx
push dword [ebx + 8]
mov ecx, esi
call dword [0x4553fc]
call esi
pop ecx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x44fa51
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 8]
mov esi, dword [edi + 4]
mov ecx, esi
push 1
mov al, byte [eax]
xor al, 0x36
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push eax
push dword [ebx + 4]
call dword [0x4553fc]
call esi
mov ecx, dword [ebp - 8]
add esp, 0xc
mov esi, dword [edi + 4]
mov al, byte [ecx]
xor al, 0x5c
inc ecx
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push 1
push eax
push dword [ebx + 8]
mov dword [ebp - 8], ecx
mov ecx, esi
call dword [0x4553fc]
call esi
add esp, 0xc
sub dword [ebp + 8], 1
jne 0x44f9c1
mov eax, dword [ebp - 0xc]
jmp 0x44fa51
mov esi, dword [edi + 4]
mov ecx, esi
push 1
push 0x46c912
push dword [ebx + 4]
call dword [0x4553fc]
call esi
mov esi, dword [edi + 4]
add esp, 0xc
mov ecx, esi
push 1
push 0x46c911
push dword [ebx + 8]
call dword [0x4553fc]
call esi
mov eax, dword [ebp - 0xc]
add esp, 0xc
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [edi + 0x10]
jb 0x44fa16
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x476227
Capabilities:
Encode data using xor

Disassembly:
enter 0, 0
pushal
mov ebx, accept
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov edi, esi
imul eax, edx, 0x10dcd
add eax, 0x116c5
xor edx, edx
div ebx
lodsd eax, dword [esi]
xor eax, edx
stosd dword es:[edi], eax
loop 0x47623c
popal
leave
ret 0xc
Function at 0x40672b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40673a
pop dword [ebp - 0x14]
mov eax, 0x40673a
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x60a14c00
sub dword [ebp - 0x24], 0x124f06b5
mov dword [ebp - 0x20], 0x757aa79b
sub dword [ebp - 0x20], 0x43475b56
mov dword [ebp - 0x1c], 0x68b6967f
add dword [ebp - 0x1c], 0xe395adaf
mov dword [ebp - 0x18], 0x14f03713
sub dword [ebp - 0x18], 0x14f03713
lea eax, [ebp - 0x24]
push eax
mov eax, 0x388954de
sub eax, 0x3848d3da
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x10e2d2
sub dword [ebp - 0x24], 0x8b9e797c
mov dword [ebp - 0x20], 0x71b6116f
sub dword [ebp - 0x20], 0x3049affa
mov dword [ebp - 0x1c], 0xc0e1e413
add dword [ebp - 0x1c], 0xa28d8859
mov dword [ebp - 0x18], 0xf8b72f8f
add dword [ebp - 0x18], 0x748d071
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3a615
push 0
call eax
mov ecx, 0x34c05307
sub ecx, 0x34bfff92
mov esi, eax
mov edx, 0x3585fcf8
sub edx, 0x353f18f8
add edx, dword [ebp - 0x14]
mov edi, 0xbc944242
add edi, 0xe3b62e12
mov ebx, dword [edx]
mov dword [ebp - 4], 0x7abfa39a
xor ebx, edi
add dword [ebp - 0x10], esi
mov dword [esi], ebx
add dword [ebp - 0x10], 0x1c4108cf
add esi, 0x60ae3aef
sub esi, 0x60ae3aeb
add edx, 4
loop 0x406852
add eax, 0x140a7
xor ebx, ebx
add ebx, eax
add eax, 0x56712fc5
add eax, 0xa98ed040
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x4748c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4b000]
push edi
jmp 0x4748da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4748e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4748d0
mov eax, 1
add ebx, ebx
jne 0x4748f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x474904
jne 0x474923
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x474923
dec eax
add ebx, ebx
jne 0x474910
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4748e8
add ebx, ebx
jne 0x47491f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x474975
xor ecx, ecx
sub eax, 3
jb 0x47493b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4749aa
sar eax, 1
mov ebp, eax
jmp 0x474946
add ebx, ebx
jne 0x474946
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x474914
inc ecx
add ebx, ebx
jne 0x474954
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x474914
add ebx, ebx
jne 0x474961
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x474956
jne 0x474972
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x474956
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x474994
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x474986
jmp 0x4748d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x474994
add edi, ecx
jmp 0x4748d6
pop esi
mov edi, esi
mov ecx, 0x1ccf
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4749b2
cmp byte [edi], 0xa
jne 0x4749b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4749b7
lea edi, [esi + 0x6f000]
mov eax, dword [edi]
or eax, eax
je 0x474a26
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7a2ec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7a3b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4749e4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7a3b8]
or eax, eax
je 0x474a20
mov dword [ebx], eax
add ebx, 4
jmp 0x474a01
call dword [esi + 0x7a3c8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x474a57
cmp al, 0xef
ja 0x474a4a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x474a2c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x474a39
mov ebp, dword [esi + 0x7a3bc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x474a8b
sub esp, 0xffffff80
jmp 0x42a9b5
Function at 0x401830
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
push esi
and esp, 0xfffffff8
sub esp, 0x90
lea eax, str.gpmgpmgpm.dll
mov word [esp + 0x88], 0x2690
mov dword [esp + 0x7c], 0x23529ee1
mov ecx, esp
mov dword [ecx], str.gpmgpmgpm.dll
mov ecx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esp + 0x60], eax
call ecx
sub esp, 4
mov ecx, 1
cmp eax, 0
mov dword [esp + 0x5c], ecx
je 0x401977
jmp 0x40196b
xor eax, eax
mov ecx, 1
lea edx, [esp + 0x64]
lea esi, str._estapp
mov edi, 0x18
lea ebx, [esp + 0x64]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x50]
imul eax, ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x48], eax
mov eax, ecx
mov dword [esp + 0x44], edx
mul ecx
mov ecx, dword [esp + 0x48]
add edx, ecx
add edx, ecx
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], edx
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 8], 0x18
mov dword [esp + 0x40], edi
call fcn.00405210
mov si, word [esp + 0x88]
add si, 0xd9e8
mov word [esp + 0x64], 0x74
mov word [esp + 0x72], 0x2e
mov word [esp + 0x74], 0x65
mov word [esp + 0x76], si
mov word [esp + 0x78], 0x65
mov eax, esp
mov ecx, dword [esp + 0x44]
mov dword [eax], ecx
mov dword [eax + 8], 1
mov dword [eax + 4], 0
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
call eax
sub esp, 0xc
mov ecx, 1
cmp eax, 0
mov dword [esp + 0x3c], ecx
je 0x401a50
jmp 0x401a80
mov eax, dword [esp + 0x5c]
lea esp, [ebp - 0xc]
pop esi
pop ebx
pop edi
pop ebp
ret
mov eax, 1
mov ecx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp byte [ecx], 0x6a
mov dword [esp + 0x5c], eax
je 0x40196b
jmp 0x401885
mov eax, dword [esp + 0x38]
mov ecx, 0xafb
lea edx, str.o2VCHgyMFUOJs_ZKG
mov esi, 0x318
mov edi, 0x88
mov ebx, esp
mov dword [ebx + 0xc], 0x88
mov dword [ebx + 8], 0x318
mov dword [ebx + 4], str.o2VCHgyMFUOJs_ZKG
mov dword [ebx], 0xafb
mov ebx, dword [sym.imp.KERNEL32.dll_LCIDToLocaleName]
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], edi
call ebx
sub esp, 0x10
mov ecx, dword [sym.imp.USER32.dll_GetFocus]
mov dword [esp + 0x20], eax
call ecx
xor ecx, ecx
mov edx, esp
mov dword [edx + 0xc], 0
mov dword [edx + 8], 0
mov dword [edx + 4], 0
mov dword [edx], 0
mov edx, dword [sym.imp.ADVAPI32.dll_RegSaveKeyExA]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
call edx
sub esp, 0x10
xor ecx, ecx
mov edx, dword [esp + 0x34]
add edx, 1
cmp edx, 0x3ff
mov dword [esp + 0x14], eax
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], ecx
je 0x401a80
jmp 0x401990
xor eax, eax
mov dword [esp + 0x38], eax
jmp 0x401990
mov eax, dword [esp + 0x7c]
xor eax, 0x23529ee1
mov dword [esp + 0x10], eax
call fcn.00403fd0
xor ecx, ecx
mov dx, word [esp + 0x8a]
mov word [esp + 0x8a], dx
mov esi, dword [esp + 0x10]
cmp eax, esi
mov dword [esp + 0x3c], ecx
je 0x401a45
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x5c], eax
jmp 0x40196b
Function at 0x4049a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x70
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [esp + 0x60], 0x1ff59c5b
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], ecx
mov dword [esp + 0x44], edx
mov dword [esp + 0x40], esi
jmp 0x404b54
mov eax, dword [esp + 0x64]
and eax, dword [esp + 0x64]
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x4c]
cmp eax, 0
je 0x404b4c
jmp 0x4049f9
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x38], eax
jmp 0x404a35
xor eax, eax
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x54]
mov esi, 0x73ea3b37
mov dword [esp + 0x34], eax
mov eax, ecx
mov dword [esp + 0x30], edx
mul esi
mov ecx, dword [esp + 0x30]
imul ecx, ecx, 0x73ea3b37
add edx, ecx
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], edx
mov eax, dword [esp + 0x34]
mov dword [esp + 0x2c], eax
jmp 0x404aff
mov eax, dword [esp + 0x38]
mov ecx, eax
and ecx, 0x1f
mov dx, word [esp + 0x6a]
or dx, 0xde44
movzx ecx, byte [ecx + 0x4060e7]
mov word [esp + 0x6a], dx
mov esi, dword [esp + 0x60]
mov edi, dword [esp + 0x48]
movzx ebx, byte [edi + eax]
mov byte [esp + 0x5f], 0
mov edi, dword [esp + 0x50]
mov edx, dword [esp + 0x54]
xor edi, 0x758ebfbb
mov dword [esp + 0x28], eax
mov eax, esp
mov dword [eax], 0x4060e7
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ebx
call fcn.004043c0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
sub ecx, edx
add ecx, eax
mov al, cl
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x50], ecx
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x28]
mov byte [ecx + edx], al
mov al, byte [esp + 0x5f]
add al, 0xca
mov byte [esp + 0x5f], al
mov esi, dword [esp + 0x1c]
lea esi, [edx + esi - 0x1ff59c3b]
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov word [esp + 0x6a], 0x27c7
mov edi, dword [esp + 0x4c]
cmp esi, edi
mov dword [esp + 0x38], esi
jb 0x404a35
jmp 0x404b7b
mov eax, dword [esp + 0x2c]
lea ecx, [0x4060e7]
mov edx, dword [esp + 0x44]
movzx esi, byte [edx + eax]
mov dword [esp], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], esi
call fcn.004043c0
mov ecx, dword [esp + 0x60]
add ecx, 0xe00a63a6
mov edx, dword [esp + 0xc]
sub edx, eax
mov bl, dl
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x10]
mov byte [eax + edx], bl
add edx, ecx
mov ecx, dword [esp + 0x4c]
cmp edx, ecx
mov dword [esp + 0x2c], edx
jne 0x404aff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x64]
mov edx, dword [eax*4 + 0x406108]
mov dword [esp + 0x64], ecx
mov ecx, dword [esp + 0x4c]
cmp edx, ecx
mov dword [esp + 8], eax
mov dword [esp + 0x3c], edx
jb 0x4049ef
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x60]
mov dl, byte [esp + 0x5f]
xor ecx, 0x1ff59c5a
xor eax, 0x1ff59c7b
add dl, 0xd9
mov byte [esp + 0x5f], dl
mov esi, dword [esp + 8]
add esi, ecx
cmp esi, eax
mov dword [esp + 0x40], esi
je 0x4049d4
jmp 0x404b54
Function at 0x1002dc20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1002dc2f
pop dword [ebp - 0x28]
mov eax, 0x1002dc2f
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x40b91175
add dword [ebp - 0x38], 0xd9933d6
mov dword [ebp - 0x34], 0x18617818
add dword [ebp - 0x34], 0x19d1d42d
mov dword [ebp - 0x30], 0x1ba422bb
sub dword [ebp - 0x30], 0xcf57de8d
mov dword [ebp - 0x2c], 0xc6730f78
sub dword [ebp - 0x2c], 0xc6730f78
lea eax, [ebp - 0x38]
push eax
mov eax, 0x80bd725e
add eax, 0x8f46fe6a
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x94c4e4cd
add dword [ebp - 0x38], 0xdfad8489
mov dword [ebp - 0x34], 0x983b39e2
add dword [ebp - 0x34], 0xa9312793
mov dword [ebp - 0x30], 0xb54dcf5c
add dword [ebp - 0x30], 0xae219d10
mov dword [ebp - 0x2c], 0xe1b5d1de
sub dword [ebp - 0x2c], 0xe1b5d1de
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x232547a3
sub eax, 0x1320d6bf
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x439ba
push 0
call eax
mov ecx, 0x298042bc
add ecx, 0xd68009fc
xor ebx, ebx
add ebx, eax
mov edi, 0x1dd092c6
add edi, 0xf2359d3a
add edi, dword [ebp - 0x28]
mov edx, 0x774a0dc7
mov dword [ebp - 4], 0xb2801ebe
mov esi, dword [edi]
xor dword [ebp - 0x1c], 0x157b109e
sub esi, edx
sub dword [ebp - 0x20], esi
mov dword [ebx], esi
add dword [ebp - 4], ecx
add ebx, 0xdf3339b0
add ebx, 0x20ccc654
add edi, 0x4e6318e1
add edi, 0xb19ce723
loop 0x1002dd48
add eax, 0x7abfaa81
sub eax, 0x7abe84ce
mov ebx, eax
add eax, 0x924517ed
add eax, 0x6dbae818
mov ecx, 0x15582ebf
sub ecx, 0x5582ebf
add ecx, dword [ebp - 0x28]
call ebx
leave
ret