joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40153b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esp
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [esp + 0x2c], 1
je 0x401554
movzx esi, word [esp + 0x30]
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x4044e0], eax
mov dword [ebp - 0x4c], 0x30
call fcn.0040152b
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x44], 0x40120e
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], str.Trick
mov dword [ebp - 0x20], eax
call fcn.0040151e
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
test eax, eax
je 0x401626
mov eax, 0x80000000
push edi
push dword [ebp - 0x38]
push edi
push edi
push eax
push eax
push eax
push eax
push 0x80
push str.Qindom
push str.Trick
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push eax
mov dword [0x4044e8], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4044e8]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x401626
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x40160a
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x8e123c
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8e1242
pop ebp
sub ebp, 6
sub ebp, 0x4e123c
jmp 0x8e12a0
and eax, ebp
pop es
add dword [eax], eax
pop ss
add byte [edi], al
add byte [edx], dh
add byte [ebx], dl
add byte [edi + 0x67], cl
adc byte [edx + esi*4], bh
movsd dword es:[edi], dword [esi]
inc esi
pop ebp
loopne 0x8e1278
sbb byte [eax], ch
jg 0x8e1298
in al, dx
jbe 0x8e1242
leave
mov al, 0x7a
or eax, dword [ecx]
add byte [eax], al
add byte [edx + 0x6b], dh
sub ah, byte [edx + 0x200f4e81]
fist dword [ebp + 0x6a56d85a]
mov ebx, dword [esi + 0x486ebe51]
fisub word [edx]
mov ebp, 0x77e2a302
mov byte [esi - 0x10], bh
shl dword [edi - 0x17], 1
add al, 0
add byte [eax], al
push ss
ja 0x8e125b
mov dword [0x7e8877e2], eax
invalid
jmp 0x8e12a9
dec ebx
mov eax, 0x4e123c
add eax, ebp
add eax, 0x93
mov ecx, 0x622
mov edx, 0x7f3dbd44
xor byte [eax], dl
inc eax
dec ecx
jne 0x8e12c0
jmp 0x8e12d3
add al, 0x2c
inc esp
push esp
inc esp
inc esp
sub al, 0x44
mov byte [eax + 0x44], ch
ja 0x8e1265
adc al, 0xbb
sar dword [eax + 0x15], 1
add byte [esp + edx - 0x31], al
mov edi, ecx
int 0x78
inc esp
inc esp
inc esp
lds eax, [ebp + 0x444444bc]
inc edi
mov esp, edi
inc edx
inc esp
inc esp
inc esp
invalid
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp int.00401219
Function at 0x402bff
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402c93
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402c50
cmp dword [ebp + 0x10], ebx
jne 0x402c87
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402bff
test eax, eax
jne 0x402c62
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402c37
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.00406558
cmp eax, ebx
je 0x402c9a
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402c93
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402c90
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402c90
jmp 0x402c93

Function at 0x4030e7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x403112
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
call fcn.004031ef
cmp eax, esi
jl 0x4031e9
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00405dd6
test eax, eax
je 0x4031d9
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.004031ef
mov ebx, eax
cmp ebx, esi
jl 0x4031e7
cmp dword [ebp + 0x10], esi
jne 0x4031b5
cmp dword [ebp + 8], esi
jle 0x4031e7
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x403177
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00405dd6
test eax, eax
je 0x4031d9
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00405e05
test eax, eax
je 0x4031b1
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x403166
jmp 0x4031e7
push 0xfffffffffffffffe
jmp 0x4031db
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x4031c0
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4031de
push 0xfffffffffffffffd
pop eax
jmp 0x4031e9
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10

Function at 0x4058c3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.00403c1a
push ebx
mov es, word [ebx - 0x72f3957c]
test dword [eax + edi*8 - 1], esp
call dword [eax - 0x18]
push eax
jecxz 0x4058d8
invalid
call [ecx + 0x50]
mov eax, dword [ebp - 0x550]
lea eax, [ebp + eax - 0x654]
push eax
call fcn.00403b8b
add esp, 0xc
lea eax, [ebp - 0x654]
mov dword [ebp - 0x3a0], eax
jmp 0x405b92
Function at 0x40601f
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x406042
push dword [esp + 8]
push dword [esp + 8]
call fcn.00405ead
pop ecx
pop ecx
inc dword [0x42a2d0]
ret 8

Function at 0x40604b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
lea eax, [ebp + 0x18]
push edi
push eax
mov eax, dword [ebp + 0x18]
xor edi, edi
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov word [esi], di
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4060bf
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x800
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4060ac
cmp dword [ebp + 0x14], 1
je 0x4060af
cmp dword [ebp + 0x14], 2
je 0x4060af
mov word [esi], di
push dword [ebp + 0x18]
mov word [esi + 0x7fe], di
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
ret 0x14
Function at 0x10001070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x3c
mov al, 0x45
push ebx
mov byte [esp + 0x21], al
mov byte [esp + 0x24], al
mov al, 0x73
push ebp
mov byte [esp + 0x3c], al
mov byte [esp + 0x3d], al
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [esp + 0x38]
push edi
lea ecx, [esp + 0x2c]
mov bl, 0x65
push eax
push ecx
mov byte [esp + 0x34], 0x4b
mov byte [esp + 0x36], 0x52
mov byte [esp + 0x37], 0x4e
mov byte [esp + 0x39], 0x4c
mov byte [esp + 0x3a], 0x33
mov byte [esp + 0x3b], 0x32
mov byte [esp + 0x3c], 0x2e
mov byte [esp + 0x3d], 0x64
mov byte [esp + 0x3e], 0x6c
mov byte [esp + 0x3f], 0x6c
mov byte [esp + 0x40], 0
mov byte [esp + 0x44], 0x47
mov byte [esp + 0x45], bl
mov byte [esp + 0x46], 0x74
mov byte [esp + 0x47], 0x50
mov byte [esp + 0x48], 0x72
mov byte [esp + 0x49], 0x6f
mov byte [esp + 0x4a], 0x63
mov byte [esp + 0x4b], bl
mov byte [esp + 0x4e], 0x48
mov byte [esp + 0x4f], bl
mov byte [esp + 0x50], 0x61
mov byte [esp + 0x51], 0x70
mov byte [esp + 0x52], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov ebp, eax
lea edx, [esp + 0x20]
lea eax, [esp + 0x2c]
push edx
push eax
mov byte [esp + 0x28], 0x48
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], 0x61
mov byte [esp + 0x2b], 0x70
mov byte [esp + 0x2c], 0x52
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], 0x41
mov byte [esp + 0x2f], 0x6c
mov byte [esp + 0x30], 0x6c
mov byte [esp + 0x31], 0x6f
mov byte [esp + 0x32], 0x63
mov byte [esp + 0x33], 0
call esi
push eax
call edi
lea ecx, [esp + 0x14]
lea edx, [esp + 0x2c]
push ecx
push edx
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], 0x48
mov byte [esp + 0x1d], bl
mov byte [esp + 0x1e], 0x61
mov byte [esp + 0x1f], 0x70
mov byte [esp + 0x20], 0x41
mov byte [esp + 0x21], 0x6c
mov byte [esp + 0x22], 0x6c
mov byte [esp + 0x23], 0x6f
mov byte [esp + 0x24], 0x63
mov byte [esp + 0x25], 0
call esi
push eax
call edi
mov esi, eax
mov eax, dword [esp + 0x50]
test eax, eax
je 0x100011cd
mov ecx, dword [esp + 0x54]
push ecx
push eax
push 0
call ebp
push eax
call dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
mov edx, dword [esp + 0x54]
push edx
push 0
call ebp
push eax
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
Function at 0x100011f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov al, 0x45
push ebx
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov al, 0x6c
push ebp
mov byte [esp + 0x1e], al
mov byte [esp + 0x1f], al
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [esp + 0xc]
push edi
lea ecx, [esp + 0x1c]
mov bl, 0x65
push eax
push ecx
mov byte [esp + 0x24], 0x4b
mov byte [esp + 0x26], 0x52
mov byte [esp + 0x27], 0x4e
mov byte [esp + 0x29], 0x4c
mov byte [esp + 0x2a], 0x33
mov byte [esp + 0x2b], 0x32
mov byte [esp + 0x2c], 0x2e
mov byte [esp + 0x2d], 0x64
mov byte [esp + 0x30], 0
mov byte [esp + 0x18], 0x48
mov byte [esp + 0x19], bl
mov byte [esp + 0x1a], 0x61
mov byte [esp + 0x1b], 0x70
mov byte [esp + 0x1c], 0x46
mov byte [esp + 0x1d], 0x72
mov byte [esp + 0x1e], bl
mov byte [esp + 0x1f], bl
mov byte [esp + 0x20], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov ebp, eax
mov al, 0x73
mov byte [esp + 0x34], al
mov byte [esp + 0x35], al
lea edx, [esp + 0x2c]
lea eax, [esp + 0x1c]
push edx
push eax
mov byte [esp + 0x34], 0x47
mov byte [esp + 0x35], bl
mov byte [esp + 0x36], 0x74
mov byte [esp + 0x37], 0x50
mov byte [esp + 0x38], 0x72
mov byte [esp + 0x39], 0x6f
mov byte [esp + 0x3a], 0x63
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3e], 0x48
mov byte [esp + 0x3f], bl
mov byte [esp + 0x40], 0x61
mov byte [esp + 0x41], 0x70
mov byte [esp + 0x42], 0
call esi
push eax
call edi
mov ecx, dword [esp + 0x40]
push ecx
push 0
call eax
push eax
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x10001580
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections

Disassembly:
sub esp, 0x28
mov eax, dword [esp + 0x34]
push ebp
push edi
xor ecx, ecx
mov edi, dword [eax + 4]
mov eax, dword [eax]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov cx, word [eax + 0x14]
cmp word [eax + 6], 0
lea ebp, [ecx + eax + 0x18]
jbe 0x100016de
push ebx
push esi
add ebp, 0x10
mov bl, 0x6c
jmp 0x100015bc
mov edi, dword [esp + 0x14]
lea edx, [esp + 0x18]
lea eax, [esp + 0x28]
push edx
push eax
mov byte [esp + 0x30], 0x4b
mov byte [esp + 0x31], 0x45
mov byte [esp + 0x32], 0x52
mov byte [esp + 0x33], 0x4e
mov byte [esp + 0x34], 0x45
mov byte [esp + 0x35], 0x4c
mov byte [esp + 0x36], 0x33
mov byte [esp + 0x37], 0x32
mov byte [esp + 0x38], 0x2e
mov byte [esp + 0x39], 0x64
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], 0
mov byte [esp + 0x20], 0x56
mov byte [esp + 0x21], 0x69
mov byte [esp + 0x22], 0x72
mov byte [esp + 0x23], 0x74
mov byte [esp + 0x24], 0x75
mov byte [esp + 0x25], 0x61
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], 0x41
mov byte [esp + 0x28], bl
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], 0x6f
mov byte [esp + 0x2b], 0x63
mov byte [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [ebp], 0
jne 0x1000168a
mov ecx, dword [esp + 0x40]
mov esi, dword [ecx + 0x38]
test esi, esi
jle 0x100016bc
mov edx, dword [ebp - 4]
push 4
push 0x1000
add edx, edi
push esi
push edx
call eax
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebp - 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x100016bc
mov edx, dword [ebp - 4]
mov ecx, dword [ebp]
push 4
push 0x1000
add edx, edi
push ecx
push edx
call eax
mov ecx, dword [ebp]
mov esi, dword [ebp + 4]
mov edi, dword [esp + 0x3c]
mov edx, ecx
add esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 8], eax
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x10]
inc eax
add ebp, 0x28
mov edx, dword [ecx]
xor ecx, ecx
mov dword [esp + 0x10], eax
mov cx, word [edx + 6]
cmp eax, ecx
jl 0x100015b8
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x28
ret
Function at 0x100016f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x4c]
mov al, 0x45
mov byte [esp + 0x29], al
mov byte [esp + 0x2c], al
mov eax, dword [edi]
xor ecx, ecx
mov byte [esp + 0x28], 0x4b
mov byte [esp + 0x2a], 0x52
mov byte [esp + 0x2b], 0x4e
mov byte [esp + 0x2d], 0x4c
mov byte [esp + 0x2e], 0x33
mov byte [esp + 0x2f], 0x32
mov byte [esp + 0x30], 0x2e
mov byte [esp + 0x31], 0x64
mov byte [esp + 0x32], 0x6c
mov byte [esp + 0x33], 0x6c
mov byte [esp + 0x34], 0
mov cx, word [eax + 0x14]
lea edx, [esp + 0x1c]
mov bl, 0x74
lea esi, [ecx + eax + 0x18]
lea eax, [esp + 0x28]
push edx
push eax
mov byte [esp + 0x24], 0x56
mov byte [esp + 0x25], 0x69
mov byte [esp + 0x26], 0x72
mov byte [esp + 0x27], bl
mov byte [esp + 0x28], 0x75
mov byte [esp + 0x29], 0x61
mov byte [esp + 0x2a], 0x6c
mov byte [esp + 0x2b], 0x46
mov byte [esp + 0x2c], 0x72
mov byte [esp + 0x2d], 0x65
mov byte [esp + 0x2e], 0x65
mov byte [esp + 0x2f], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, dword [edi]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
cmp word [ebp + 6], 0
jbe 0x100018b0
add esi, 0x24
mov eax, dword [esi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov edi, eax
and ecx, 1
and edx, 1
shr edi, 0x1f
test eax, 0x2000000
je 0x100017ec
mov ecx, dword [esi - 0x14]
mov edx, dword [esi - 0x1c]
push 0x4000
push ecx
push edx
call dword [esp + 0x20]
jmp 0x10001890
lea ecx, [edx + ecx*2]
test eax, 0x4000000
lea edx, [edi + ecx*2]
mov edi, dword [edx*4 + 0x1002d030]
je 0x10001806
or edi, 0x200
mov ecx, dword [esi - 0x14]
test ecx, ecx
jne 0x1000181f
test al, 0x40
je 0x10001816
mov ecx, dword [ebp + 0x20]
jmp 0x1000181d
test al, 0x80
je 0x10001890
mov ecx, dword [ebp + 0x24]
test ecx, ecx
jbe 0x10001890
lea eax, [esp + 0x38]
lea ecx, [esp + 0x28]
push eax
push ecx
mov byte [esp + 0x40], 0x56
mov byte [esp + 0x41], 0x69
mov byte [esp + 0x42], 0x72
mov byte [esp + 0x43], bl
mov byte [esp + 0x44], 0x75
mov byte [esp + 0x45], 0x61
mov byte [esp + 0x46], 0x6c
mov byte [esp + 0x47], 0x50
mov byte [esp + 0x48], 0x72
mov byte [esp + 0x49], 0x6f
mov byte [esp + 0x4a], bl
mov byte [esp + 0x4b], 0x65
mov byte [esp + 0x4c], 0x63
mov byte [esp + 0x4d], bl
mov byte [esp + 0x4e], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esi - 0x14]
lea edx, [esp + 0x18]
push edx
mov edx, dword [esi - 0x1c]
push edi
push ecx
push edx
call eax
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x10]
xor edx, edx
inc eax
mov ebp, dword [ecx]
add esi, 0x28
mov dword [esp + 0x10], eax
mov dx, word [ebp + 6]
cmp eax, edx
jl 0x100017b8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
Function at 0x10001da0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, 0x5ab
and eax, 0xff
push esi
cdq
idiv ecx
mov esi, dword [esp + 0xc]
add dl, 0x3d
test esi, esi
jbe 0x10001dcd
mov eax, dword [esp + 8]
mov cl, byte [eax]
xor cl, dl
add cl, dl
mov byte [eax], cl
inc eax
dec esi
jne 0x10001dc1
pop esi
ret

Function at 0x10001dd0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push 0x400
push 0x26000
push 0x10007030
call fcn.10001da0
push 0x10007030
call fcn.100012f0
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x10001e15
mov eax, dword [esp + 0x10]
push eax
push ebx
call fcn.10001af0
add esp, 8
test eax, eax
jne 0x10001e19
push ebx
call fcn.10001b80
add esp, 4
pop edi
pop esi
pop ebx
ret
sub esp, 0x2a8
mov ecx, 0xaa
mov esi, str.___________
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call eax
push ebx
call fcn.10001b80
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x404887
Capabilities:
Query environment variable

Disassembly:
push 0x4c
mov eax, 0x5af3a7
call fcn.00580ed4
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
mov edi, ecx
push edi
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], ebx
call fcn.004081bb
mov dword [ebp - 4], 1
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push edi
call ebx
mov esi, dword [ebp - 0x30]
mov edi, eax
inc edi
inc edi
call fcn.00408184
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
mov dword [ebp - 0x38], 1
neg ecx
or ecx, eax
push ecx
call fcn.005726e9
pop ecx
push edi
push eax
push dword [ebp - 0x3c]
mov dword [ebp - 0x34], eax
call ebx
test eax, eax
je 0x404922
push edi
push dword [ebp - 0x34]
lea esi, [ebp - 0x58]
call fcn.00408197
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x30]
push 0xffffffffffffffff
push 0
call fcn.00409936
mov byte [ebp - 4], 1
push 0
push 1
call fcn.00409c0f
push dword [ebp - 0x34]
call fcn.0057458b
pop ecx
mov byte [ebp - 4], 0
push 0
push 1
lea esi, [ebp - 0x2c]
call fcn.00409c0f
mov eax, dword [ebp - 0x30]
call fcn.00580f57
ret
Function at 0x4063a8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x6b06f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push 0x114
mov dword [ebp - 0x124], eax
xor ebx, ebx
lea eax, [ebp - 0x120]
push ebx
push eax
call fcn.005783f0
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40643e
cmp dword [ebp - 0x11c], 6
jb 0x406430
push ebx
push ebx
push ebx
push 3
push 6
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
cmp eax, ebx
jge 0x40641d
cmp eax, 0x80010119
jne 0x40643e
push 0x670fe8
push dword [ebp - 0x124]
call fcn.0040570a
pop ecx
jmp 0x40643b
push dword [ebp - 0x124]
call fcn.0040523d
mov bl, al
pop ecx
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0057372c
leave
ret
Function at 0x410af8
Capabilities:
Reference sql statements

Disassembly:
push 0x40
mov eax, 0x5b21b9
call fcn.00580e9e
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
push str.SELECT__FROM_logs_WHERE_flags____ORDER_BY_cfired_DESC_LIMIT___
lea eax, [ebp - 0x1c]
push eax
call fcn.00484810
mov byte [ebp - 4], 1
push dword [ebp + 0x10]
push 1
lea eax, [ebp - 0x1c]
call fcn.004846f0
push dword [ebp + 0x14]
push 2
lea eax, [ebp - 0x1c]
call fcn.004846f0
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004844a0
mov byte [ebp - 4], 2
cmp byte [ebp - 0x28], bl
jne 0x410bea
lea eax, [ebp - 0x4c]
push eax
call fcn.0040ffb5
mov byte [ebp - 4], 3
xor esi, esi
lea edi, [ebp - 0x30]
call fcn.00483f80
mov dword [ebp - 0x4c], eax
inc esi
call fcn.00484040
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00408606
push 2
pop esi
call fcn.00483f80
mov dword [ebp - 0x44], eax
push 3
pop esi
call fcn.00484040
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00408606
push 4
pop esi
call fcn.00484040
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00408606
push 5
pop esi
call fcn.00483f80
mov dword [ebp - 0x38], eax
push 6
pop esi
call fcn.00483f80
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [ebp + 0xc]
call fcn.004139be
mov eax, edi
push eax
call fcn.004840c0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x4c]
push eax
call fcn.00410aba
jmp 0x410b4c
mov byte [ebp - 4], 1
lea esi, [ebp - 0x30]
call fcn.00483f30
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c]
call fcn.00484270
or dword [ebp - 4], 0xffffffff
call fcn.00580f43
ret 0x10

Function at 0x41117b
Capabilities:
Reference sql statements

Disassembly:
push 0x34
mov eax, 0x5b20e8
call fcn.00580e9e
and dword [ebp - 4], 0
push str.SELECT_id__value_FROM_reports_WHERE_type__
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
call fcn.00484810
mov byte [ebp - 4], 1
push dword [ebp + 0xc]
push 1
lea eax, [ebp - 0x24]
call fcn.004846f0
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004844a0
mov byte [ebp - 4], 2
cmp byte [ebp - 0x38], 0
jne 0x41121d
xor esi, esi
inc esi
lea edi, [ebp - 0x40]
call fcn.00484040
mov ebx, eax
test ebx, ebx
je 0x411212
xor esi, esi
call fcn.00483f80
mov esi, eax
mov dword [ebp - 0x2c], ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
call fcn.00408561
mov byte [ebp - 4], 3
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 4
lea eax, [ebp - 0x1c]
push eax
mov edi, dword [ebp + 0x10]
call fcn.00413b10
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1c]
push eax
call fcn.0042c57d
lea eax, [ebp - 0x40]
push eax
call fcn.004840c0
jmp 0x4111c1
mov byte [ebp - 4], 1
lea esi, [ebp - 0x40]
call fcn.00483f30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.00484270
or dword [ebp - 4], 0xffffffff
call fcn.00580f43
ret 0xc