joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10034533
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x10034555
mov eax, 0xfffffffd
jmp 0x10034635
mov ebx, dword [0x1005a415]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x10034603
mov ebx, dword [0x1005a415]
add ebx, 4
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 6
jne 0x100345a4
mov ebx, dword [0x1005a415]
add ebx, 8
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
cmp dword [ebx], 2
jne 0x100345a4
mov eax, 1
jmp 0x100345a9
mov eax, 0
test eax, eax
je 0x100345d5
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x100345be
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x1005a415]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x1003462b
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x10034635
mov esp, ebp
pop ebp
ret 4

Function at 0x1003483c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x100348ef
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x10034e5a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push pe_nt_image_headers32
push 1
mov ebx, 0x184
call fcn.100401b0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10034e9f
push ebx
call fcn.1003e902
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0xff
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
nop
nop
cmp dword [ebp - 8], esp
je 0x10034ed4
push 0x36
push 0x405ffd5
push 6
call fcn.1003e90e
add esp, 0xc
push 0x10058dc8
push dword [ebp - 4]
mov ecx, 2
call fcn.10004748
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x10034ef4
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10034f05
push ebx
call fcn.1003e902
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x1003526e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.1003483c
test eax, eax
je 0x100352b1
xor eax, eax
xchg dword [ebp + 8], eax
cmp eax, 0xffff
jle 0x100352b1
cmp word [eax], 0x5a4d
jne 0x100352b1
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x100352b1
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.1003490e
mov eax, dword [ebp + 8]
jmp 0x100352ca
mov esp, ebp
pop ebp
ret 4
Function at 0x1003f670
Capabilities:
Query environment variable

Disassembly:
push ebp
push esi
push edi
push 0x104
call fcn.1003ee00
mov ebp, dword [esp + 0x18]
add esp, 4
mov edi, eax
push 0x104
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, 0x104
jbe 0x1003f6c7
push ebx
push edi
call fcn.1003ef10
push esi
mov ebx, esi
call fcn.1003ee00
add esp, 8
mov edi, eax
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, ebx
ja 0x1003f69e
mov eax, edi
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x100401f0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x10040259
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.1003ee50
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x10042e70
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x10042e8e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x10042e83
pop esi
ret

Function at 0x100430a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x10043132
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x10043124
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x1004311c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x100430e5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x10043140
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret
Function at 0x10043160
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.10045ed0
mov edi, dword [esp + 0x38]
xor ebp, ebp
push edi
mov ebx, eax
mov dword [esp + 0x18], ebp
call dword [0x1005aa74]
add esp, 8
test ebx, ebx
je 0x100432a4
test eax, eax
je 0x100432a4
inc eax
push eax
call fcn.10049182
mov ebp, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.10049650
mov edi, eax
add esp, 0xc
test edi, edi
je 0x100431d2
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10043291
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call fcn.10049182
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x1004325a
cmp eax, 0xea
jne 0x1004327d
push esi
call fcn.10049190
mov ecx, dword [esp + 0x18]
push ecx
call fcn.10049182
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x10043225
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x10043268
cmp eax, 2
jne 0x1004327d
push esi
call dword [0x1005aa74]
push eax
push esi
call fcn.100454d0
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
call fcn.10049190
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.10049190
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x100432cd
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x100432d9
mov esi, dword [esp + 0x40]
test esi, esi
je 0x100432d9
push esi
call dword [0x1005aa74]
push eax
push esi
call fcn.100454d0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x10043603
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x84]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x44], 1
je case.0x100435d1.2
mov ecx, dword [esp + 0x7c]
lea eax, [ecx - 1]
cmp eax, 5
ja case.0x100435d1.2
jmp dword [eax*4 + 0x1004365c]
mov word [esp + 0x48], di
jmp 0x1004360a
mov word [esp + 0x48], 2
jmp 0x1004360a
mov word [esp + 0x48], 3
jmp 0x1004360a
mov word [esp + 0x48], 4
jmp 0x1004360a
mov word [esp + 0x48], 7
jmp 0x1004360a
mov word [esp + 0x48], 5
lea edx, [esp + 8]
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x18]
push edx
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
cmp esi, edi
je 0x10043654
cmp dword [esp + 0x70], edi
je 0x10043640
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x54
ret
Function at 0x100438d0
Capabilities:
Delete directory

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x100438dd
xor eax, eax
pop esi
ret
push esi
call dword [0x1005aa74]
add esp, 4
test eax, eax
jne 0x100438ed
pop esi
ret
cmp eax, 1
jne 0x100438fb
cmp byte [esi], 0x5c
jne 0x100438fb
xor eax, eax
pop esi
ret
push esi
call fcn.10043680
add esp, 4
test eax, eax
je 0x1004390f
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop esi
ret

Function at 0x10043af0
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x208
test eax, eax
push ebx
push esi
push edi
jne 0x10043b1b
lea eax, [esp + 0xc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x10043b43
mov byte [esp + 0xc], al
jmp 0x10043b43
mov edi, dword [esp + 0x21c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
call dword [0x1005aa74]
mov cl, byte [esp + eax + 0xf]
lea eax, [esp + eax + 0x10]
add esp, 4
cmp cl, 0x5c
je 0x10043b61
mov byte [eax], 0x5c
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
call edi
lea edx, [esp + 0xc]
push eax
push edx
lea eax, [esp + 0x118]
push 0x1005a794
push eax
call esi
add esp, 0x10
lea ecx, [esp + 0x110]
push ecx
call ebx
test eax, eax
jne 0x10043b73
lea edx, [esp + 0x110]
push edx
call dword [0x1005aa74]
inc eax
push eax
call fcn.1003ee50
mov edx, eax
lea edi, [esp + 0x118]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x208
ret
Function at 0x10044c10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x10044c31
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x10044c8b
inc edi
cmp edi, esi
jl 0x10044c25
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x10044cc0
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x10044c7a
cmp byte [eax], bl
je 0x10044c95
cmp byte [eax + 1], bl
je 0x10044c9e
cmp byte [eax + 2], bl
je 0x10044ca8
cmp byte [eax + 3], bl
je 0x10044cb4
add eax, 4
cmp eax, edi
jb 0x10044c51
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4

Function at 0x10047340
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
sub esp, 0x10
push esi
push 6
push 1
push 2
call sub.WS2_32.dll_socket
mov ecx, dword [esp + 0x1c]
mov esi, eax
xor eax, eax
push ecx
mov dword [esp + 8], eax
mov word [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
call sub.WS2_32.dll_inet_addr
mov edx, dword [esp + 0x20]
mov dword [esp + 8], eax
push edx
call sub.WS2_32.dll_htons
mov word [esp + 6], ax
lea eax, [esp + 4]
push 0x10
push eax
push esi
call sub.WS2_32.dll_connect
test eax, eax
jne 0x1004739f
mov eax, esi
pop esi
add esp, 0x10
ret
push esi
call sub.WS2_32.dll_closesocket
xor eax, eax
pop esi
add esp, 0x10
ret
Function at 0x10047500
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1ac
lea eax, [esp + 0x1c]
push ebx
push esi
push edi
push eax
push 1
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x10047623
mov ebx, dword [esp + 0x1c0]
test ebx, ebx
jl 0x10047623
cmp ebx, 0xffff
jg 0x10047623
mov edi, dword [esp + 0x1c4]
push edi
call fcn.10048690
add esp, 4
cmp eax, 1
jne 0x10047570
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x10047586
lea ecx, [esp + 0x14]
push ecx
push edi
call fcn.10048880
add esp, 8
test eax, eax
je 0x10047623
mov esi, dword [esp + 0x1bc]
xor edx, edx
lea ecx, [esp + 0x14]
push ebx
lea eax, [esi + 0x34]
push ecx
push esi
mov dword [eax], edx
mov byte [eax + 4], dl
call fcn.10047340
add esp, 0xc
mov dword [esi + 0xc], eax
test eax, eax
je 0x10047623
push eax
call fcn.10047880
push esi
lea edx, [esp + 0x18]
push 0x100473b0
push edx
mov dword [esi + 0x10], 0
call fcn.100488d0
mov eax, dword [esp + 0x20]
add esp, 0x10
mov dword [esi + 0x14], eax
mov eax, dword [esi + 4]
test eax, eax
jne 0x1004760c
push esi
lea ecx, [esp + 0x10]
push 0x10047420
push ecx
call fcn.100488d0
mov edx, dword [esp + 0x18]
push esi
lea eax, [esp + 0x1c]
push 0x10047490
push eax
mov dword [esi + 0x18], edx
call fcn.100488d0
mov ecx, dword [esp + 0x24]
add esp, 0x18
mov dword [esi + 0x1c], ecx
call fcn.10047270
mov dword [esi + 8], eax
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x1ac
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x1ac
ret

Function at 0x10047880
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push 0x8004667e
push ecx
mov dword [esp + 0xc], 1
call sub.WS2_32.dll_ioctlsocket
xor edx, edx
test eax, eax
setge dl
mov eax, edx
pop ecx
ret
Function at 0x10048880
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push eax
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x1004888f
ret
mov ecx, dword [eax + 0xc]
push esi
push edi
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
call sub.WS2_32.dll_inet_ntoa
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x10]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret

Function at 0x100488d0
Capabilities:
Create thread

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push 0
push ecx
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 4]
xor edx, edx
test eax, eax
setne dl
mov dword [ecx], eax
mov eax, edx
ret

Function at 0x10048900
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x10048919
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret
Function at 0x401e70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4a337c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [edx + 0x14], 0x10
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
jb 0x401e90
mov edx, dword [edx]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x401ee5
cmp dword [esi + 0x14], 0x10
mov eax, dword [esi + 0x10]
jb 0x401ec0
mov esi, dword [esi]
cmp dword [edi + 0x14], 0x10
jb 0x401ec8
mov edi, dword [edi]
push eax
push esi
push 1
push 0
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xc]
test eax, eax
je 0x401ef7
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045aab3
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0045aab3
mov esp, ebp
pop ebp
ret
Function at 0x405430
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47fad8
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x4a337c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x40546a
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4055f0
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xb7
je 0x4055f0
call ebx
cmp eax, 3
jne 0x4055ec
cmp dword [esi + 0x14], 0x10
mov edi, esi
jb 0x4054a3
mov edi, dword [esi]
mov edx, dword [esi + 0x10]
test edx, edx
je 0x40551a
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.0045c6b0
add esp, 0xc
mov ecx, 0x49f088
mov edx, 2
nop word [eax + eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ebp + eax - 0x128], 1
sub edx, 1
jne 0x4054d0
mov edx, dword [esi + 0x10]
or ecx, 0xffffffff
lea eax, [edx - 1]
cmp eax, ecx
cmovb ecx, eax
movzx eax, byte [ecx + edi]
add ecx, edi
mov al, byte [ebp + eax - 0x128]
test al, al
jne 0x405516
cmp ecx, edi
je 0x40551a
movzx eax, byte [ecx - 1]
dec ecx
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x405502
sub ecx, edi
jmp 0x40551d
or ecx, 0xffffffff
cmp ecx, 0xffffffff
je 0x4055ec
cmp edx, ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov eax, esi
cmovb ecx, edx
mov byte [ebp - 0x28], 0
cmp dword [esi + 0x14], 0x10
jb 0x405547
mov eax, dword [esi]
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.004042e0
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.00405430
test al, al
je 0x4055bc
cmp dword [esi + 0x14], 0x10
jb 0x40556c
mov esi, dword [esi]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x405586
call ebx
cmp eax, 0xb7
je 0x405586
xor bl, bl
jmp 0x405588
mov bl, 1
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x4055b8
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4055ae
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40560e
push edx
push ecx
call fcn.0045aaf9
add esp, 8
mov al, bl
jmp 0x4055f2
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x4055ec
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4055e2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40560e
push edx
push ecx
call fcn.0045aaf9
add esp, 8
xor al, al
jmp 0x4055f2
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045aab3
mov esp, ebp
pop ebp
ret
call fcn.004603b9
int3
Function at 0x40fab0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
je 0x40fb4f
push edi
call fcn.00421cf0
add esp, 4
test al, al
jne 0x40fb4f
push ebx
push ebp
push esi
mov esi, edi
xor ebx, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x40fad8
sub esi, ecx
push esi
push 0x2e
push edi
call fcn.0042d150
add esp, 0xc
test eax, eax
je 0x40fb0c
sub eax, edi
push eax
push 0x2e
push edi
call fcn.0042d150
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x40fb0e
inc ebx
mov ecx, edi
sub ecx, ebx
add esi, ecx
test ebx, ebx
cmovne edi, ebx
xor ecx, ecx
xor ebp, ebp
mov ebx, 0x1505
lea eax, [edi + esi]
cmp edi, eax
cmova esi, ecx
test esi, esi
je 0x40fb47
mov al, byte [edi]
push eax
call fcn.0041e330
movsx ecx, al
lea edi, [edi + 1]
mov eax, ebx
inc ebp
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp ebp, esi
jb 0x40fb26
pop esi
pop ebp
movzx eax, bl
pop ebx
pop edi
ret
xor eax, eax
pop edi
ret
Function at 0x4145f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x24]
mov eax, 0x180
mov edx, 0x140
push ebp
push esi
cmp dword [ebx], 0x4a3054
mov ecx, dword [ebx + 8]
cmovne eax, edx
mov dword [esp + 0x20], ecx
add eax, dword [ebx + 0xc]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x3c]
push edi
test eax, eax
je 0x414627
mov byte [eax], 0
mov ebp, dword [esp + 0x34]
mov esi, dword [ebp + 0x8d8]
test esi, esi
je 0x4147e4
push dword [ecx + 8]
mov edi, dword [esi + 0x14]
call dword [0x4a300c]
add esp, 4
mov dword [esp + 0x34], eax
test eax, eax
je 0x414680
mov eax, dword [ebx + 0xc]
cmp byte [eax + 0x1c9], 0
je 0x414692
push dword [eax + 0x64]
call dword [0x4a300c]
mov ecx, eax
add esp, 4
mov dword [esp + 0x10], ecx
test ecx, ecx
jne 0x41468d
mov edi, dword [esp + 0x34]
push edi
call dword [0x4a3004]
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 0x1b
pop ebx
add esp, 0x1c
ret
mov eax, dword [ebx + 0xc]
jmp 0x41469a
mov dword [esp + 0x10], 0
cmp byte [eax + 0x1ca], 0
je 0x4146af
mov ecx, dword [eax + 0x444]
mov dword [esp + 0x14], ecx
jmp 0x4146b7
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [ebp + 0x78]
test eax, eax
je 0x4146cd
test byte [eax + 4], 0x10
je 0x4146cd
lea edx, [eax + 0x78]
mov dword [esp + 0x30], edx
jmp 0x4146d7
lea eax, [ebp + 0x8dc]
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0x4a4]
mov ecx, 1
cmp eax, ecx
jbe 0x41472b
mov eax, dword [ebp + 0x8d8]
add eax, 0x74
nop
cmp dword [eax - 8], 0
mov edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], eax
je 0x414725
mov edi, dword [eax]
inc ecx
mov esi, dword [esp + 0x18]
add eax, 0x60
add esi, 0xffffffec
cmp edi, edx
cmovge esi, dword [esp + 0x20]
cmp edi, edx
cmovge edi, edx
cmp ecx, dword [ebp + 0x4a4]
jb 0x4146f0
mov eax, dword [ebp + 0x4a4]
cmp ecx, eax
jne 0x41473a
push esi
call fcn.004150b0
add esp, 4
jmp 0x414746
lea esi, [ecx + ecx*2]
shl esi, 5
add esi, dword [ebp + 0x8d8]
mov eax, dword [esp + 0x38]
push dword [esi]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x40]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x34]
mov eax, dword [eax]
mov dword [esi + 0x14], eax
call dword [0x4a3004]
push dword [esi + 4]
call dword [0x4a3004]
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x3c]
mov ebp, dword [esp + 0x18]
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x2c]
mov dword [esi], edi
mov dword [esi + 4], ebp
mov eax, dword [eax + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [ebx + 0xc]
lea ebx, [esi + 0x20]
push ebx
push dword [esp + 0x34]
mov eax, dword [eax + 0x1e0]
mov eax, dword [eax]
mov dword [esi + 8], eax
call fcn.00413e20
add esp, 0x10
test al, al
jne 0x4147d9
push ebx
call fcn.004140b0
push edi
mov dword [esi + 0xc], 0
call dword [0x4a3004]
push ebp
call dword [0x4a3004]
add esp, 0xc
mov eax, 0x1b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov eax, dword [esp + 0x40]
test eax, eax
je 0x4147e4
mov byte [eax], 1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret