joyce8/EMBER2024-capa huggingface dataset:
Function at 0x525378
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x525381
mov eax, dword [ebp - 4]
add esp, 0xfffffebc
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004050b8
xor eax, eax
push ebp
push 0x52545c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x55d520]
mov byte [eax], 0
mov dword [ebx], 0xffffffff
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x154]
call fcn.00403004
mov edx, 1
lea eax, [ebp - 0x154]
call fcn.004034b4
call fcn.00402ad0
test eax, eax
jne 0x525439
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x10145]
mov ecx, 0xfff1
lea eax, [ebp - 0x154]
call fcn.00403160
mov dx, word [ebp - 8]
test dx, dx
jbe 0x525433
lea eax, [ebp - 0x10145]
xor ecx, ecx
mov cl, byte [eax]
mov esi, dword [ebx]
and esi, 0xff
xor ecx, esi
mov ecx, dword [ecx*4 + 0x55c3d4]
mov esi, dword [ebx]
shr esi, 8
xor ecx, esi
mov dword [ebx], ecx
inc eax
dec dx
jne 0x52540f
cmp dword [ebp - 8], 0
jne 0x5253e6
lea eax, [ebp - 0x154]
call fcn.00403180
not dword [ebx]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x525463
lea eax, [ebp - 4]
call fcn.00404c08
ret

Function at 0x526ddc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004050b8
xor eax, eax
push ebp
push 0x526e9d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x526e7b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
xor ecx, ecx
mov edx, 0x1e
call fcn.00403370
lea eax, [ebp - 0x122]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00403370
lea eax, [ebp - 0x122]
mov edx, dword [ebp - 4]
call fcn.0040a7d0
xor eax, eax
mov dword [ebp - 0x22], eax
lea eax, [ebp - 0x122]
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x1e], 3
mov word [ebp - 0x12], 0x40
or word [ebp - 0x12], 0x10
or word [ebp - 0x12], 4
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x526e87
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x526ea4
lea eax, [ebp - 4]
call fcn.00404c08
ret

Function at 0x527b94
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x527bac
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x527ba5
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.00403370
xor edx, edx
mov eax, 0x55cb34
mov bl, byte [eax]
mov ecx, ebx
and cl, 7
and ecx, 0xff
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
xor ecx, ecx
mov cl, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x527c16
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp - 8]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x527bca
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x527e54
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x527e6d
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x527e66
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x527e7f
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x527e78
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.00527a48
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x527e99
mov al, byte [ebp - 0xa]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
mov dl, byte [ebp - 9]
xor ecx, ecx
mov cl, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
shl edx, 2
mov al, byte [ebp - 8]
xor ecx, ecx
mov cl, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
mov al, byte [ebp - 7]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
mov al, byte [ebp - 6]
and al, 0xf
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
mov dl, byte [esi]
call fcn.00527b58
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x527f1e
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x527f3b
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.00527ad8
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x527f64
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x527f7c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x527f95
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x527f8e
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x527fa9
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.00527940
test bl, bl
jne 0x52807c
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x56028c
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x527fe0
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x527ff4
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.00527e54
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov bl, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x528026
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x527fd5
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x528049
mov eax, 4
mov edx, dword [ebp + 0xc]
mov cl, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x52805a
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x52806e
jmp 0x528137
cmp bl, 1
jne 0x528137
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x5602e6
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x52809c
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x5280b0
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.00527e54
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
mov cl, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x5280e2
sub ebx, 6
inc dword [ebp - 8]
jne 0x528091
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
mov cl, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x528109
mov eax, 4
mov ebx, dword [ebp + 0xc]
mov dl, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x52811a
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov cl, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x52812e
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.005279c4
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x529b04
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x529b55
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x529b3c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x529b2c
jmp 0x529b55
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x529b3d
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5377c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x537a08
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x53781f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5602fc]
cmp dword [eax + 0x38], 0
ja 0x537815
mov eax, dword [ebp - 4]
mov edx, 0x537a20
call fcn.00404c5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5379ea
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x537829
xor ecx, ecx
push ebp
push 0x5379d6
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov ebx, 0x80
mov esi, 0x560304
call fcn.00402c80
mov eax, 0xff
call fcn.00403390
mov byte [esi], al
inc esi
dec ebx
jne 0x537841
xor ebx, ebx
mov esi, 0x560304
mov eax, ebx
and eax, 0x8000000f
jns 0x53786b
dec eax
or eax, 0xfffffff0
inc eax
test eax, eax
jne 0x537889
push dword [ebp - 8]
push 0x537a2c
push 0x537a38
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404f88
push dword [ebp - 8]
lea ecx, [ebp - 0x20]
xor eax, eax
mov al, byte [esi]
mov edx, 2
call fcn.00409d7c
push dword [ebp - 0x20]
push 0x537a44
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404f88
inc ebx
inc esi
cmp ebx, 0x80
jne 0x53785d
mov byte [ebp - 0x1c], 0x50
mov byte [ebp - 0x1b], 0x53
xor esi, esi
mov eax, esi
shl eax, 4
mov byte [ebp - 0x1a], al
mov dl, byte [ebp - 0x1c]
xor dl, byte [ebp - 0x1b]
xor dl, al
mov byte [ebp - 9], dl
mov ebx, 4
lea eax, [ebp - 0x19]
mov edx, esi
shl edx, 4
add edx, ebx
mov dl, byte [edx + 0x560300]
mov byte [eax], dl
xor byte [ebp - 9], dl
inc ebx
inc eax
cmp ebx, 0x14
jne 0x5378e1
mov ebx, 0x15
mov eax, 0x560384
mov byte [eax], 0
inc eax
dec ebx
jne 0x537904
xor eax, eax
mov dword [0x56039c], eax
lea edx, [ebp - 0x1c]
mov cx, 0x14
mov eax, dword [0x5602fc]
call fcn.004f6e0c
mov eax, dword [0x55d3b8]
mov eax, dword [eax]
call fcn.0047c944
mov ebx, 0x64
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x55d3b8]
mov eax, dword [eax]
call fcn.0047c944
cmp dword [0x56039c], 0
jne 0x537953
dec ebx
jne 0x537934
cmp dword [0x56039c], 0
jne 0x537973
mov eax, dword [ebp - 4]
mov edx, 0x537a50
call fcn.00404c5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5379ea
cmp byte [0x560384], 0x4f
jne 0x537985
cmp byte [0x560385], 0x4b
je 0x5379b5
mov al, byte [0x560384]
cmp al, 0x45
jne 0x5379a0
cmp al, 0x45
jne 0x5379a0
mov edx, dword [ebp - 4]
mov eax, esi
neg eax
call fcn.00409c68
jmp 0x5379ab
mov edx, dword [ebp - 4]
imul eax, esi, 0xfffffff5
call fcn.00409c68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5379ea
inc esi
cmp esi, 8
jne 0x5378c6
mov eax, dword [ebp - 4]
mov edx, 0x537a5c
call fcn.00404c5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5379ea
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x537a0f
lea eax, [ebp - 0x20]
call fcn.00404c08
lea eax, [ebp - 8]
call fcn.00404c08
ret
Function at 0x537d58
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor ecx, ecx
push ebp
push 0x537e89
push dword fs:[ecx]
mov dword fs:[ecx], esp
xor eax, eax
mov dword [ebp - 8], eax
mov byte [ebp - 0xc], 0x50
mov byte [ebp - 0xb], 0x52
mov al, byte [ebp - 8]
mov byte [ebp - 0xa], al
mov dl, byte [ebp - 0xc]
xor dl, byte [ebp - 0xb]
xor dl, al
mov byte [ebp - 9], dl
xor eax, eax
mov dword [0x56039c], eax
lea edx, [ebp - 0xc]
mov cx, 4
mov eax, dword [0x5602fc]
call fcn.004f6e0c
mov ebx, 0x64
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x55d3b8]
mov eax, dword [eax]
call fcn.0047c944
cmp dword [0x56039c], 0
jg 0x537dcc
dec ebx
jne 0x537dad
cmp dword [0x56039c], 0
jne 0x537def
jmp 0x537e72
mov ebx, 0x13
mov eax, 0x560384
lea edx, [ebp - 0x1f]
mov cl, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x537dfc
xor eax, eax
mov ebx, 0x12
lea edx, [ebp - 0x1f]
xor ecx, ecx
mov cl, byte [edx]
xor eax, ecx
inc edx
dec ebx
jne 0x537e0f
cmp byte [ebp - 0x1f], 0x50
jne 0x537e4c
cmp byte [ebp - 0x1e], 0x4c
jne 0x537e4c
xor edx, edx
mov dl, byte [ebp - 0xd]
cmp eax, edx
jne 0x537e4c
xor ebx, ebx
lea eax, [ebp - 0x1d]
mov dl, byte [eax]
mov ecx, dword [ebp - 8]
shl ecx, 4
add ecx, ebx
mov byte [ecx + 0x560304], dl
inc ebx
inc eax
cmp ebx, 0x10
jne 0x537e33
jmp 0x537e65
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, eax
neg eax
call fcn.00409c68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x537e9d
inc dword [ebp - 8]
cmp dword [ebp - 8], 8
jne 0x537d77
mov eax, dword [ebp - 4]
mov edx, 0x537eb8
call fcn.00404c5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x537e9d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53dc54
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x53dd06
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xfe
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x107]
push eax
call sub.kernel32.dll_GetComputerNameA
lea eax, [ebp - 8]
lea edx, [ebp - 0x107]
mov ecx, 0xff
call fcn.00404e78
lea edx, [ebp - 0x110]
mov eax, dword [ebp - 8]
call fcn.004099fc
mov eax, dword [ebp - 0x110]
lea edx, [ebp - 0x10c]
call fcn.0040978c
mov edx, dword [ebp - 0x10c]
lea eax, [ebp - 8]
call fcn.00404ca0
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00404c5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53dd0d
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.00404c2c
lea eax, [ebp - 8]
call fcn.00404c08
ret

Function at 0x53dd14
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004050b8
mov eax, dword [ebp - 0xc]
call fcn.004050b8
xor eax, eax
push ebp
push 0x53ddb4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, 0x53ddcc
call fcn.00404ed0
mov eax, dword [ebp - 0xc]
call fcn.00404ec8
mov esi, eax
inc esi
mov edx, esi
dec edx
test edx, edx
jl 0x53dd7b
inc edx
xor ecx, ecx
lea eax, [ebp - 0x10c]
mov ebx, dword [ebp - 0xc]
mov bl, byte [ebx + ecx]
mov byte [eax], bl
inc ecx
inc eax
dec edx
jne 0x53dd6e
push esi
lea eax, [ebp - 0x10c]
push eax
push 7
push 0
mov eax, dword [ebp - 8]
call fcn.004050c8
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53ddbb
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404c2c
ret

Function at 0x53df44
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1d8], ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x53e011
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1d4]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, edi
call fcn.00404c08
push 0x40
lea eax, [ebp - 0x44]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x44]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x53dff8
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x53dfe8
test ebx, ebx
jne 0x53dfb9
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, edi
call fcn.0040a940
jmp 0x53dfe7
push dword [edi]
push 0x53e028
mov eax, dword [esi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
lea edx, [ebp - 0x1d8]
call fcn.0040a940
push dword [ebp - 0x1d8]
mov eax, edi
mov edx, 3
call fcn.00404f88
inc ebx
cmp dword [esi + ebx*4], 0
jne 0x53dfa2
mov eax, dword [ebp - 4]
mov dword [eax], ebx
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53e018
lea eax, [ebp - 0x1d8]
call fcn.00404c08
ret
Function at 0x53f364
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
push ecx
push esp
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov cl, 1
mov edx, 0x53f39c
mov eax, dword [esp]
call fcn.0053f2cc
mov ebx, eax
mov eax, dword [esp]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
pop edx
pop ebx
ret

Function at 0x54c1d8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
mov esi, 0x5603ec
xor eax, eax
push ebp
push 0x54c2d8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x54c2e8
mov eax, dword [0x55e668]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, dword [ebx + 0x3ec]
call fcn.00432d10
push 0x54c2f0
mov eax, dword [0x55e668]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, dword [ebx + 0x3f0]
call fcn.00432d10
mov eax, esi
mov edx, 0x58
call fcn.004083a0
mov dword [esi], 0x58
mov eax, ebx
call fcn.004633f4
mov dword [esi + 4], eax
mov dword [esi + 8], 0x1b
mov dword [esi + 0xc], 7
mov dword [esi + 0x10], 0x465
test edi, edi
jne 0x54c276
mov eax, dword [ebx + 0x3ec]
call fcn.00432a40
mov dword [esi + 0x14], eax
jmp 0x54c284
mov eax, dword [ebx + 0x3f0]
call fcn.00432a40
mov dword [esi + 0x14], eax
push dword [ebx + 0x55c]
push 0x54c300
mov eax, dword [0x55cdec]
push dword [eax]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404f88
mov eax, dword [ebp - 4]
call fcn.004050c8
mov edx, eax
lea eax, [esi + 0x18]
mov ecx, 0x40
call fcn.0040a79c
push esi
push 0
call sub.shell32.dll_Shell_NotifyIconA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54c2df
lea eax, [ebp - 4]
call fcn.00404c08
ret

Function at 0x54cbb0
Capabilities:
Find taskbar
Hide graphical window
Hide the windows taskbar

Disassembly:
add esp, 0xffffffcc
mov edx, 0x54cbd8
mov eax, esp
call fcn.0040a774
push 0
lea eax, [esp + 4]
push eax
call sub.user32.dll_FindWindowA
push 9
push eax
call sub.user32.dll_ShowWindow
add esp, 0x34
ret

Function at 0x5552d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor eax, eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x55538d
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
push 0xff
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 4]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00404e78
lea eax, [ebp - 0x108]
mov ecx, 0x5553a4
mov edx, dword [ebp - 4]
call fcn.00404f14
mov eax, dword [ebp - 0x108]
call fcn.0040a2b8
test al, al
jne 0x555343
xor ebx, ebx
lea eax, [ebp - 0x10c]
mov ecx, 0x5553bc
mov edx, dword [ebp - 4]
call fcn.00404f14
mov eax, dword [ebp - 0x10c]
call fcn.0040a2b8
test al, al
jne 0x555367
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x555394
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.00404c2c
lea eax, [ebp - 4]
call fcn.00404c08
ret
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
mov esi, 0x1c89345c
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x19d07241
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401515
Capabilities:
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push str.JDK_ALTERNATE_VM
or ebx, 0xffffffff
call dword [sym.imp.MSVCRT.dll_getenv]
mov esi, eax
mov eax, dword [ebp + 8]
mov edi, dword [eax]
mov dword [ebp - 0x14], edi
lea eax, [edi*4 + 4]
push eax
call fcn.00401c90
pop ecx
mov dword [ebp - 0x10], eax
pop ecx
mov ecx, dword [ebp + 0xc]
push 1
pop edx
mov ecx, dword [ecx]
cmp edi, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov ecx, dword [ecx]
mov dword [eax], ecx
jle 0x40160a
lea ecx, [eax + 4]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ecx]
mov edi, dword [ecx + edx*4]
cmp byte [edi], 0x2d
je 0x401586
mov ecx, dword [ebp - 4]
inc dword [ebp - 8]
add dword [ebp - 4], 4
mov dword [ecx], edi
jmp 0x4015f8
push edi
call fcn.004028d0
test eax, eax
pop ecx
jl 0x4015a7
mov ecx, dword [0x406384]
mov ebx, eax
lea eax, [eax + eax*2]
mov esi, dword [ecx + eax*4]
mov eax, dword [ebp + 8]
inc esi
dec dword [eax]
jmp 0x4015f5
push 0xa
push str._XXaltjvm
push edi
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
je 0x4015d1
push 0xc
push str._J_XXaltjvm
push edi
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x4015e9
xor eax, eax
cmp byte [edi + 1], 0x58
setne al
dec eax
and al, 0xfe
add eax, 0xc
add eax, edi
or ebx, 0xffffffff
mov esi, eax
jmp 0x4015f5
mov eax, dword [ebp - 4]
inc dword [ebp - 8]
add dword [ebp - 4], 4
mov dword [eax], edi
mov eax, dword [ebp - 0x10]
inc dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x14]
jl 0x401568
push 1
pop edx
mov ecx, dword [ebp - 8]
mov edi, dword [ebp + 0xc]
and dword [eax + ecx*4], 0
mov dword [edi], eax
mov eax, dword [ebp + 8]
test esi, esi
mov dword [eax], ecx
jne 0x40162c
mov eax, dword [0x406384]
mov eax, dword [eax]
inc eax
jmp 0x4016da
test ebx, ebx
jl 0x4016d8
mov eax, dword [0x406384]
lea ecx, [ebx + ebx*2]
cmp dword [eax + ecx*4 + 4], edx
jne 0x40166a
lea ecx, [ebx + ebx*2]
push dword [eax + ecx*4 + 8]
call fcn.004028d0
test eax, eax
pop ecx
jl 0x401690
mov ebx, eax
lea ecx, [eax + eax*2]
mov eax, dword [0x406384]
mov esi, dword [eax + ecx*4]
lea ecx, [eax + ecx*4]
inc esi
cmp dword [ecx + 4], 1
je 0x401642
lea ecx, [ebx + ebx*2]
mov ecx, dword [eax + ecx*4 + 4]
dec ecx
dec ecx
je 0x4016b4
dec ecx
jne 0x4016d8
push 1
push esi
push str.Error:__s_VM_not_supported
call fcn.00402f20
add esp, 0xc
push 1
call dword [sym.imp.MSVCRT.dll_exit]
mov ecx, dword [0x406384]
lea eax, [ebx + ebx*2]
push 1
push dword [ecx + eax*4 + 8]
push str.Error:_Unable_to_resolve_VM_alias__s
call fcn.00402f20
add esp, 0xc
push 1
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [eax]
inc eax
push eax
mov eax, dword [sym.imp.MSVCRT.dll__iob]
push esi
add eax, 0x40
push str.Warning:__s_VM_not_supported___s_VM_will_be_used_n
push eax
call dword [sym.imp.MSVCRT.dll_fprintf]
mov eax, dword [0x406384]
add esp, 0x10
mov esi, dword [eax]
inc esi
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret