joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403e2f
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x424070]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x403ed2
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.0040dec5
pop ecx
pop ecx
test eax, eax
je 0x403ebb
test ebx, ebx
je 0x403eaf
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.0040dec5
pop ecx
pop ecx
test eax, eax
jle 0x403ebb
push ebx
call fcn.00403a18
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.004039f7
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x403e7c
xor edi, edi
cmp ebx, edi
jne 0x403ed6
xor eax, eax
jmp 0x403f42
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x403f05
call fcn.00403a18
pop ecx
cmp dword [ebp - 0x70], edi
je 0x403ed2
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x403ed2
call fcn.00403a18
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x403ef5
cmp dword [ebp - 0x70], edi
je 0x403f38
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.004039f7
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004098e8
add ebp, 0x9c
leave
ret
Function at 0x408f37
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x422550
call fcn.0040dcb0
xor esi, esi
cmp dword [0x4274a8], esi
jne 0x408df7
push esi
push esi
push 1
push esi
call dword [sym.imp.kernel32.dll_HeapSetInformation]
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x408e0a
mov dword [ebp - 0x1c], esi
jmp 0x408e40
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x408e05
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x408e05
cmp dword [eax + 0x400074], 0xe
jbe 0x408e05
xor ecx, ecx
cmp dword [eax + 0x4000e8], esi
setne cl
mov dword [ebp - 0x1c], ecx
call fcn.0040f80c
test eax, eax
jne 0x408e51
push 0x1c
call fcn.0040dec5
pop ecx
call fcn.0040d831
test eax, eax
jne 0x408e62
push 0x10
call fcn.0040dec5
pop ecx
call fcn.0040dae6
mov dword [ebp - 4], esi
call fcn.0040dec5
test eax, eax
jns 0x408e7b
push 0x1b
call fcn.0040dec5
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x4274a4], eax
call fcn.0040dec5
mov dword [0x42565c], eax
call fcn.0040dec5
test eax, eax
jns 0x408ea1
push 8
call fcn.0040dec5
pop ecx
call fcn.0040f1ff
test eax, eax
jns 0x408eb2
push 9
call fcn.0040dec5
pop ecx
push 1
call fcn.0040dec5
pop ecx
cmp eax, esi
je 0x408ec5
push eax
call fcn.0040dec5
pop ecx
mov eax, dword [0x425634]
mov dword [0x425638], eax
push eax
push dword [0x42562c]
push dword [0x425628]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], esi
jne 0x408ef2
push eax
call fcn.0040dec5
call fcn.00408bb3
jmp 0x408f27
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.0040dcf5
ret
call fcn.0040dec5
jmp 0x408dd6

Function at 0x4098e8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424070]
jne 0x4098f2
repz ret
jmp fcn.004114ed
Function at 0x40dec5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x40ded4
pop dword [ebp - 0x38]
mov eax, 0x40ded4
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xa8aa43e
sub dword [ebp - 0x48], 0xbc385ef3
mov dword [ebp - 0x44], 0x17ef7f50
sub dword [ebp - 0x44], 0xe5bc330b
mov dword [ebp - 0x40], 0xea43aa59
sub dword [ebp - 0x40], 0x9df7662b
mov dword [ebp - 0x3c], 0x8a0041ff
add dword [ebp - 0x3c], 0x75ffbe01
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xc20cdb1d
add dword [ebp - 0x48], 0xb2658e39
mov dword [ebp - 0x44], 0xd81f1e60
add dword [ebp - 0x44], 0x694d4315
mov dword [ebp - 0x40], 0x47b8adc0
add dword [ebp - 0x40], 0x1bb6beac
mov dword [ebp - 0x3c], 0x13d0d7ec
add dword [ebp - 0x3c], 0xec2f2814
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x5e9d5776
add eax, 0xa1a468d6
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3fc22
push 0
call eax
mov ecx, 0xfa274872
sub ecx, 0xfa26ef93
xor edi, edi
add edi, eax
mov edx, 0x3f9ab322
sub edx, 0x3f578922
add edx, dword [ebp - 0x38]
mov esi, 0x196cfa0a
xor dword [ebp - 0x14], 0x534d715
mov ebx, dword [edx]
add dword [ebp - 4], edx
sub ebx, esi
mov dword [ebp - 0x24], 0xb082edca
mov dword [edi], ebx
sub dword [ebp - 0x20], 0x68eefd4a
add edi, 0x93b4f724
sub edi, 0x93b4f720
add edx, 0x38cb5c01
sub edx, 0x38cb5bfd
loop 0x40dfe8
add eax, 0x89cb8407
add eax, 0x7635d248
xor ebx, ebx
add ebx, eax
add eax, 0x322e241
add eax, 0xfcdd1dc4
mov ecx, 0x3bdc1b36
sub ecx, 0x3b9c1b36
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x6d9b1180
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_TcAddClassMap___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.traffic.dll
mov dword [ebp - 0x40], str.TcAddClassMap
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6d9b11e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_TcAddFilter___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.traffic.dll
mov dword [ebp - 0x40], str.TcAddFilter
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6d9b1240
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_TcAddFlow___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.traffic.dll
mov dword [ebp - 0x40], str.TcAddFlow
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6d9b12a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_TcCloseInterface___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.traffic.dll
mov dword [ebp - 0x40], str.TcCloseInterface
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6d9b1300
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_TcDeleteFilter___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.traffic.dll
mov dword [ebp - 0x40], str.TcDeleteFilter
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6d9b1360
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_TcDeleteFlow___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.traffic.dll
mov dword [ebp - 0x40], str.TcDeleteFlow
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x6d9b13c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_TcEnumerateFlows___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.traffic.dll
mov dword [ebp - 0x40], str.TcEnumerateFlows
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6d9b1420
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_TcEnumerateInterfaces___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.traffic.dll
mov dword [ebp - 0x40], str.TcEnumerateInterfaces
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6d9b1480
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_TcGetFlowNameA___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.traffic.dll
mov dword [ebp - 0x40], str.TcGetFlowNameA
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6d9b14e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_TcGetFlowNameW___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.traffic.dll
mov dword [ebp - 0x40], str.TcGetFlowNameW
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6d9b1540
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_TcModifyFlow___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.traffic.dll
mov dword [ebp - 0x40], str.TcModifyFlow
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6d9b15a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_TcOpenInterfaceA___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.traffic.dll
mov dword [ebp - 0x40], str.TcOpenInterfaceA
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x6d9b1600
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_TcOpenInterfaceW___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.traffic.dll
mov dword [ebp - 0x40], str.TcOpenInterfaceW
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6d9b1660
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_TcQueryFlowA___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.traffic.dll
mov dword [ebp - 0x40], str.TcQueryFlowA
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6d9b16c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_TcQueryFlowW___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.traffic.dll
mov dword [ebp - 0x40], str.TcQueryFlowW
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6d9b1720
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_TcQueryInterface___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.traffic.dll
mov dword [ebp - 0x40], str.TcQueryInterface
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6d9b1780
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_TcSetFlowA___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.traffic.dll
mov dword [ebp - 0x40], str.TcSetFlowA
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4

Function at 0x6d9b17e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_TcSetFlowW___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.traffic.dll
mov dword [ebp - 0x40], str.TcSetFlowW
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x6d9b1840
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ebp - 0x50]
sub esp, 0x5c
mov dword [esp], str.WARNING:_calling_stub_TcSetInterface___n
call sym._DbgPrint
xor eax, eax
mov ecx, 0x12
mov dword [ebp - 0x58], 0x80000100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 1
mov dword [esp], eax
mov dword [ebp - 0x44], str.traffic.dll
mov dword [ebp - 0x40], str.TcSetInterface
mov dword [ebp - 0x48], 2
call sym._RtlRaiseException_4
Function at 0x6d9b3530
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea esi, [ebp + 0xc]
sub esp, 0x10
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], 0x6d9b65ec
call sym._fwrite
mov eax, dword [ebp + 8]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.msvcrt.dll_vfprintf]
call sym._abort
lea esi, [esi]
Function at 0x406fa0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
xchg edi, eax
in al, dx
and al, 0x53
push esi
mov esi, dword [ebp - 0x11]
inc ecx
fstp xword [ebx]
push edi
mov dword [ebp - 0xc], esi
jne 0x406fba
mov esi, str.0.0.0.0
mov al, byte [esi]
cmp al, 0x30
jl 0x40707d
cmp al, 0x71
salc
invalid
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebx]
or al, 0x39
sbb dword [edi], ecx
test byte [ecx], cl
add byte [eax], al
add byte [ecx - 0x347403a3], cl
sbb al, 0x53
cmp byte [edx], bh
imul edx, dword [eax - 0x74000026], 0xfffffff8
xor eax, eax
mov esi, edi
aad 0xe
daa
add byte [eax], al
mov al, 0xab
dec ebp
pop ss
sbb al, 0x8b
dec ebp
or al, 0x8b
jge 0x40703e
mov dword [esi], eax
mov edx, dword [ecx + 0xc]
mov eax, dword [edi + edx]
mov edx, dword [ebp + 0x6f]
push edx
push 2
mov ecx, dword [eax]
sbb al, 0x89
dec esi
sub al, 0xe8
jne 0x407056
call fcn.00406dd0
add esp, 0x78
test esi, ebp
jne 0x4070a5
invalid
mov eax, dword [ebp + 0x37]
test eax, eax
je 0x4070e4
inc ecx
mov eax, dword [ebp + 0x1c]
add eax, 0xffe7dde8
invalid
fucom st(7)
inc edi
sub eax, 0x4d8b0446
or byte [ecx + esi], ch
jmp 0x4070ae
push esi
call dword [sym.imp.WSOCK32.dll_gethostbyname]
cmp ecx, dword [ecx]
mov dword [ebp + 0xc], eax
jne 0x407010
mov esi, dword [sym.imp.WSOCK32.dll_WSAGetLastError]
call esi
test eax, eax
je 0x4070c6
call esi
pop edi
pop esi
add eax, 0xafc80
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 4]
mov dword [esi + 4], edx
mov dword [ebx + 0x5d], esi
mov eax, dword [ebp + 0xc]
add edi, 0xffffff8f
mov ebx, esi
mov dword [ebp - 4], edi
dec eax
or al, 0x83
cmp al, 0xf
add byte [edi], cl
test dword [ebx + 0x6e], ebx
invalid
pop edi
pop esi
lahf
jp 0x407126
mov esp, dword [edi + 0x5d]
ret
push ebx
push esi
xor edx, edi
mov eax, dword [ecx]
mov esi, dword [ecx]
loope 0x40706f
jg 0x4070dc
mov byte [ebp + 0x10], al
push edi
mov dword [ebp + 0x1a], esi
or byte [eax], al
add byte [ebp - 4], dh
test al, al
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], esi
jmp 0x407173
add eax, dword [ebp - 0x6b7af040]
or al, byte [eax]
test dword [ebx + 0x78b044f], ecx
mov dword [edx], esi
xchg ebp, eax
mov esi, dword [ebx + 0x45984010]
hlt
invalid

Function at 0x407ef0
Capabilities:
Encode data using xor

Disassembly:
cmp ecx, dword [ebx + 0x14ec90ec]
cmp dword [ebp + 0x10], 0x4f
jl 0x407f03
invalid
frstor dword [eax - 0x7a]
fsubr qword [ebp + 0x40c288]
mov ecx, dword [ebp + 0x18]
push ebx
push ebp
pop ebp
and byte [esi + 0x33], dl
not byte [edi - 0x32]
into
loopne 0x407f90
or esp, edi
mov dword [ebp - 0xa], ecx
les eax, [0xe7afb7b]
fld qword [ebp + 8]
out 0xe0, al
jbe 0x407f36
or bh, al
add ebp, esp
add bl, ah
mov byte [ebx + 0x558b0c4d], cl
or byte [ebp + 0x5150ec45], cl
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push ecx
push edx
inc dword [ecx]
mov cl, 0xc1
inc eax
add ch, bl
pop ebp
or ch, bl
inc ebp
pop edx
fcomp qword [0x40c230]
jg 0x407f17
xor dl, al
inc eax
add byte [edi - 0x3c], bh
or al, 0xdf
loopne 0x407f4d
les esp, [ebp + 0x738d727b]
push eax
cmp esi, ebx
hlt
Function at 0x409c80
Capabilities:
Encode data using xor

Disassembly:
mov dword [edi + 0x30], eax
mov eax, dword [edi - 0x11]
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
xor ebx, dword [0x7d8b5756]
push 0xffffffffffffff89
inc ebp
in al, dx
mov dword [ebp - 0x59], eax
mov eax, edi
xor ebx, ebx
and eax, 0x295c0000
mov ebx, ebp
loopne 0x409c2a
adc esp, esp
mov dword [eax + ebp*8 - 0x31], ebx
xchg edi, eax
cld
je 0x409cf8
cmp dword [0x410684], ebx
jne 0x409c3b
push 0x41ef84
push ebx
push ebx
push ebx
push ebx
invalid
mov esi, dword [ebp - 0x4f]
xor al, bh
add byte [eax], al
adc byte [eax], al
je 0x409d72
div dword [ecx + 4]
add byte [eax], al
add dword [eax], eax
je 0x409d72
mov eax, dword [0x410648]
mov edx, dword [esi + 0x10]
adc dword [0x1eec45c7], ebp
add byte [eax], al
add byte [ecx + 0x1d37f055], cl
push ebx
push str.GetEffectiveRightsFromAclW
push 1
call 0x7d40a940
add esp, 0xc
cmp eax, ebx
mov dword [0xa41061e], eax
je 0x409dc6
lea ecx, [ebp + 0xc]
lea esi, [ebx + 0x4df551e0]
adc byte [edx + 0x51], dl
call eax
imul eax, ebx, 0x75
and dword [ebx + 0x86add55], ecx
mov edx, dword [ebp - 0x23]
push 8
invalid
pushfd
invalid
push 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x409d51

Function at 0x40a720
Capabilities:
Encode data using xor

Disassembly:
outsb dx, byte [esi]
mov ebp, esp
mov eax, dword [0x3d0859]
push esi
test dword [edx], edx
push edi
jne 0x40a91b
push 0x4107f8
invalid
mov ebp, eax
or byte [edi - 0x77], bl
in al, 0x8b
xor eax, 0x4108dc
xor eax, eax
cmp edi, esi
add dword [edi], ecx
popfd
ror byte [eax + 0x5e], 0x25
dec esi
add byte [eax], al
pop ebp
ret
Function at 0x43b64a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x43b3c1
sub edi, 0x6a72c22c
add edi, 0x730e04be
and edx, edi
call fcn.0043b690
add edx, edi
add edi, 0x758ecf79
push 0xbb2e8bf6
pop edi
xor dword [ecx], eax
sub edi, edi
mov edx, 0xea62781
add ecx, 1
sub edx, 0x11785695
sub edi, edi
cmp ecx, esi
jne fcn.0043b64a
sub edi, edi
ret
Function at 0x10011140
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x10043a41
call fcn.1001f59e
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
push 2
push ebx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x100111a1
call fcn.1000e50a
mov esi, eax
jmp 0x10011279
push dword [ebp - 0x41c]
push esi
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x100111bf
call fcn.1000e50a
jmp 0x10011270
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x100111b5
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x41c], esi
cmp eax, esi
jae 0x100111f2
mov esi, 0x8007000e
jmp 0x10011272
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.100264e3
mov dword [ebp - 4], 1
jmp 0x10011226
cmp dword [ebp - 0x418], 0
je 0x100111e8
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x420]
push ebx
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x100111b5
mov eax, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor edx, edx
mov word [eax + ecx*2], dx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.100264e3
mov esi, eax
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10011292
lea ecx, [ebp - 0x418]
call fcn.10011348
mov eax, esi
call fcn.1001f5f7
ret 0x10