joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ae85b
Capabilities:
Encode data using xor

Disassembly:
lea ecx, [eax]
pop ebx
cmp esp, 0xbcb9010
adc bh, al
push esi
mov eax, dword [esi - 0x73]
dec ebp
cld
mov esp, dword [ebp - 4]
add byte [eax], al
push es
push ecx
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ecx + ebp*2 - 1]
nop
pushfd
mov ecx, dword [esp + 0x10]
xor eax, eax
push ss
push dword [ebp + 0x10]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ecx + ebp*2 - 1]
nop
mov al, byte [0xfe244c8b]
frndint
push ebp
mov edi, esp
pop esi
leave
nop
dec esi
add al, 0xb8
aam 0xb
add byte [ebp + 0x9d3fce8], al
push esi
sub esp, 0x54
and dword [ebp - 0x10], 0xffffff8b
adc eax, 0x56658914
push edi
cmp ebx, 0x8b575511
jl 0x100ae8be
sti
adc dword [ebp + 0x57], edx
mov edi, dword [ecx + edi*8 + 0x75]
sbb bh, bh
jne 0x100ae8da
jne 0x100ae8df
push dword [ebp + 0x10]
mov eax, dword [edi]
push dword [ebp + 0xc]
fisttp qword [ebx + 0xf8b0686]
test byte [ebp + 1], dl
add byte [ecx + ebp*8], ah
sbb eax, 0x83500000
sti
dec esi
jmp 0x600ae8fc
cmp ebx, 0x4e
jne 0x100ae90c
push ebp
int3
cld
jne 0x100ae91f
cmp ebx, 6
jne 0x100ae924
push esi
je 0x100ae91a
mov eax, dword [eax + 0x1c]
dec esp
push dword [ebp + 0xc]
push edi
or al, 0x79
xlatb
or cl, byte [ebx + 0x7520fb83]
sbb byte [ebx + 0x10e8c1c6], cl
cmp ebx, 0x20
jne 0x100ae941
and byte [ebp + 0x18], dh
mov eax, esi
shr eax, 0x10
push eax
movsx eax, si
push eax
push edi
or al, 0xda
xlatb
or cl, byte [ebx - 0x7af074fa]
mov ebx, 0x8b585203
pop es
pop eax
mov eax, dword [edi]
call 0x385b5484
jne 0x100ae926
mov eax, dword [eax]
mov esp, ebp
mov ebx, eax
mov eax, 0x7503f8ff
and ebx, eax
and ecx, eax
push 7
xor ebx, ecx
call fcn.10008924
jne 0x100ae940
mov ecx, dword [ebp + 0xc3b5b04]
add byte [ebp - 0x72eff05f], cl
sbb al, 0
lea esp, [ecx + 0xd100f]
in al, dx
jne 0x100ae9a7
cmp eax, dword [ebx + 8]
jne 0x100ae9a7
mov ebx, dword [ebx + 4]
push 7
mov dword [ebp + 0x10], ebx
call fcn.10008994
add dword [eax], eax
into
mov dword [edx - 0x7ea90000], ebx
jge 0x100ae9a0
add al, al
or al, 0x10
inc byte [edx - 0x73173153]
jmp 0x1491b132
call 0xd796d331
xchg byte [ebx + eax], al
add byte [ecx + 0x8438900], cl
add eax, dword [eax]
mov dword [eax], eax
mov dword [ebx + 8], eax
je 0x100aea24
jmp 0x100ae9b8
mov edx, 0x100cc000
cmp ecx, edx
jae 0x100ae9d7
invalid
inc esp
and al, 0x10
push 0
add dword [eax], eax
add al, ch
call 0x11b3d1fc
add byte [edx - 0x77], ch
inc ebp
adc byte [esp + ebp + 0x68], dh
add edi, dword [eax]
add bh, bh
mov ecx, dword [eax + 0x10]
add al, 0x55
mov dword [ecx], edi
adc dword [eax + 0x18], esi
push esi
call 0x106aa4e0
add dword [eax], eax
add eax, 0x18
push 0x100cc000
call 0xb8f301f8
add dword [eax], eax
push 0xffffffffffffff89
inc ebp
adc byte [ebp - 0x2a], dh
push ebp
int3
and dword [ebx + 4], 0
push 7
call fcn.10008994
add al, al
mov ecx, dword [ecx + 0x5b00000d]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x90c9
Function at 0x1000718b
Capabilities:
Encode data using xor

Disassembly:
xlatb
cmp edi, dword [edi]
sub dword [esi], ecx
or eax, 0x250e2b5b
pop edi
sub al, 0xe
sub eax, 0x25795a63
pop esp
pop eax
sar byte [eax - 0x7c], 0xd6
xchg edx, eax
mov al, 0x3d
cld
add eax, 0x884954ae
xor edx, dword [ecx - 0x28]
not edx
xchg ecx, eax
fdiv st(7)
sal bl, cl
xchg ecx, eax
mov ebx, 0x435a62b1
and al, 0x5c
sub al, 0xd9
add edx, dword [edx - 0x5a]
or byte [eax - 0x39], dh
loope 0x10002a71
push es
cmpsb byte [esi], byte es:[edi]
mov ebp, 0xd552ae6a
or byte [eax - 0x38], dh
fnstenv [ebp - 0x25dbc190]
push es
cmpsb byte [esi], byte es:[edi]
mov ebp, 0xd5529994
push es
scasb al, byte es:[edi]
push esp
pop esi
enter 0xffffffffffffc7bc, 0xffffffffffffffe1
pop es
jo 0x10002a82
or al, 0xda
add byte [esi + 0x52ae46bd], ah
aad 8
cmpsb byte [esi], byte es:[edi]
invalid
sub eax, 1
clc
jae 0x100071a6
push esi
movsd dword es:[edi], dword [esi]
push ss
adc ebx, ebp
xor eax, dword [ebp + 0x41]
xchg edi, eax
dec ebp
retf 0x9a23
sub edx, 0xfffffffc
jmp 0x1000703f
dec dword [ecx]
jmp 0x100071bc
stc
sbb ebx, 0xfffffff7
jmp 0x10007073
je 0x1000729a
clc
jae 0x1000724f
dec esi
adc eax, 0x24cfec00
push esi
wait
jmp 0x6a34705d
push dword [ebx]
pop edx
jmp 0x1000726b
call fcn.100072cc
jmp 0x1000729a
sub dword [edx], 0x82d552b0
jmp 0x1000705f
sub ebx, 0xfffffffc
jmp 0x100070be
push dword [ebx + 4]
pop eax
jmp 0x10007108
pop ebx
jmp 0x10007208
jne 0x10007108
jae 0x10007092
clc
andps xmm5, xmmword [edi + 0x20ced4cd]
sbb cl, byte [esi + 0xf]
test esp, edi
invalid
jne 0x100070be
jmp 0x100070f5
test dword [ebx], 0xffffffff
jmp 0x100070a7
add ebx, 0xffffffb7
jmp 0x100071cd
jmp 0x10002a5f
mov ecx, ebx
jmp 0x10007138
add edx, ebx
stc
jb 0x1000715c
jbe 0x10007280
cmp byte [di + 0x33], bh
outsd dx, dword [esi]
xlatb
mov ecx, 0x43ff1372
inc ebx
psrlq mm0, qword [eax + 0x3a]
aaa
jo 0x100072ef
or edi, dword [ecx]
push ecx
dec edi
out dx, eax
cmc
cli
mov ch, 0x90
retf
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
jmp 0x10007225
inc ebx
and al, 0x61
fadd dword [ebp + 3]
mov dword [0x53046b25], eax
aad 0x82
xor edx, dword [edi]
invalid
Function at 0x801712
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov si, word [esp + 4]
xchg dword [esp], edi
xchg si, ax
setnp dh
mov si, 0x4e23
jmp 0x801749
push dword [esp + 0x17]
mov dl, dh
setnp ah
popal
sub esp, 0xc
jmp 0x8016f9
clc
neg dh
push word [esp + 3]
lea esp, [esp + 7]
bsr bx, cx
pop ecx
jmp 0x80184c
mov dword [esp + 5], esi
lea esp, [esp + 0xe]
mov cl, ch
sub esp, 0xe
xchg ecx, ebx
mov ebp, dword [esp + 0xd]
jmp 0x801721
bswap ecx
and cl, bh
not edi
inc bl
mov dx, word [esp + 4]
xchg byte [esp + 0xe], al
jmp 0x801778
xchg bx, di
setns ch
shr ebx, 0xf
mov word [esp + 0xa], dx
sub esp, 4
inc ebp
jmp 0x80178f
xchg si, bp
neg edx
mov bx, sp
mov bx, 0x91e9
bswap ecx
mov di, word [esp + 0xe]
jmp 0x8017b0
not ecx
mov ebx, 0xd35ffb9c
lea edx, [eax + edi]
btc ebx, ebx
sub esp, 0xc
setbe dh
jmp 0x801833

Function at 0x8019b5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dh, byte [esp + 2]
lea ebp, [esp + ebx]
push esp
mov bx, 0x5d51
mov dword [esp], ecx
mov dx, 0x4907
jmp 0x8019be
add esp, 1
mov ecx, dword [esp + 3]
setle ah
xchg byte [esp], cl
inc bx
xchg edx, ecx
jmp 0x801a2d
push word [esp + 1]
mov edx, 0x36d579b0
pop dx
mov byte [esp + 1], bh
jmp 0x801972
rcr ch, 5
stc
btr ecx, esp
jmp 0x80199e
inc ebx
add esp, 0
bswap esi
rdtsc
mov dh, byte [esp + 5]
mov bp, dx
jmp 0x801987
push word [esp + 7]
push esp
clc
inc edx
mov dx, word [esp + 2]
mov ecx, 0x631eb196
jmp 0x8019ec
mov edx, ebp
xchg bh, cl
pop si
push dword [esp]
shl dx, cl
rdtsc
jmp 0x801a12
Function at 0x801da7
Capabilities:
Execute anti-debugging instructions

Disassembly:
btc edi, ebx
push edx
mov ebp, 0x225f0eda
mov si, 0x3b89
sub esp, 2
mov di, word [esp + 0x14]
jmp 0x801dd0
jmp 0x801d88
xor dl, ch
mov dl, 0xd4
lea esp, [esp + 5]
cpuid
mov ebp, dword [esp]
lea esp, [esp + 1]
jmp 0x801de9
pop word [esp + 0x11]
mov bp, word [esp + 0x18]
xchg byte [esp + 1], al
xchg bh, cl
lea esp, [esp + 0x1b]
xchg cx, bp
jmp 0x801da9
add esp, 0
mov dl, dh
cld
cld
xchg cx, bp
mov cx, word [esp]
jmp 0x801e1f

Function at 0x802223
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ecx
rdtsc
mov edi, eax
btc edx, edi
jmp 0x80220a

Function at 0x806e88
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 0x1b], esi
lea esp, [esp + 2]
mov dword [esp + 0xc8], edi
lea esp, [esp + 0xc8]
jmp 0x806f65
Function at 0x401753
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebp - 0x4f]
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
push eax
add ecx, 0x40
push 0x2bd274
push ecx
sub dl, byte [sym.imp.MSVCRT.dll_fprintf]
mov eax, dword [0x954102ac]
sbb dword [eax + 0xc], 0xffffff85
push edi
je 0x4017ed
push eax
push str.Total_of__d_requests_completed_n
invalid
mov edx, dword [0x411800]
aam 0xdd
cwde
aam 0x40
add bh, bh
salc
mov eax, dword [0x410278]
add esp, 8
test eax, eax
je 0x40181c
mov eax, dword [0x416b46]
push eax
sub eax, 0x413c40
push 0x40d4ea
call esi
add esp, 0xc
adc al, 7
dec esi
add byte [ebp - 0x2b7f4740], al
mov eax, 0x40d480
jne 0x40182f
mov eax, 0x8440457c
push eax
add dword [eax - 0xffbf2c], esp
salc
mov ecx, dword [0x3040c053]
add ecx, 0x20
push ecx
call dword [sym.imp.WSOCK32.dll_ioctlsocket]
add esp, 0xc
mov edx, dword [0x40ee18]
daa
xor eax, sym.imp.MSVCRT.dll_calloc
push 0x30de0860
push edx
invalid

Function at 0x401e40
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
or al, 0xec
js 0x401e9d
popal
jne 0x401e56
push esi
sbb ah, byte [eax + ecx*4]
push 0x78
push eax
push esi
call 0x5b86e0
mov ecx, dword [ebp + 8]
invalid
add byte [ebx + 0x15c6084d], cl
fld st(0)
inc eax
add byte [eax - 0x7e], dl
add edx, 0x40
push 0x40d4d1
push edx
call esi
add cl, 0x40
add byte [ecx - 0x3cbefd54], ah
add esp, 0x14
test eax, eax
je 0x401e8c
push eax
push str.Total_of__d_requests_completed_n
call dword [0x40ff64]
add esp, 0x5d
push esi
imul edx, dword [0x40c1c5], 0x9090905e
nop
nop
nop
iretd
nop
nop
nop

Function at 0x404a60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor al, dh
push ss
loop 0x404a74
test byte [ebp - 0x6fffffff], dh
dec ebp
ret 0x33e
Function at 0x40abf0
Capabilities:
Encode data using xor

Disassembly:
enter 0xfffffffffffff855, 0xffffffffffffffd6
dec ebp
adc al, 0x83
cmp dword [eax], eax
pop edi
mov esp, 0x3308758b
rcl byte [ecx + 6], 0x46
test al, al
mov dword [eax - 0x8e68717], esp
sub ebx, edx
mov edx, dword [ecx]
dec edx
mov dword [ecx], edx
mov ecx, dword [ebp + 0x10]
mov word [ecx], ax
push 0x4d7602c1
adc cl, ch
enter 1, 0
mov ecx, eax
and ecx, 0x9c00c0
xor byte [ebp + 0x5d8545c0], 0
fadd dword [eax]
cdq
mov edi, 0x90a3
mov ecx, eax
mov dword [ebp - 9], edx
and ecx, edi
xor ebx, ebx
mov esi, 1
xor edx, edx
cmp ecx, edi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], eax
xchg esp, eax
xor al, 0x3b
sal dword [ebp - 0x17], cl
les eax, [ebx - 0x75]
sar dword [ecx - 0x68ff23ff], cl
dec ecx
fiadd dword [edi]
das
add byte [ebx], cl
clc
or ebx, edx
inc esi
cmp esi, 3
mov dword [ebp - 4], esi
sbb ecx, dword [eax - 0x75]
inc ebp
in al, dx
mov ecx, dword [ebp + 0x5c]
and eax, edi
ja 0x40aa18
xchg edi, eax
invalid
inc ebp
adc byte [ebx - 0x33], al
fadd dword [ecx + 0x3ffe6]
daa
mov word [eax], cx
lodsd eax, dword [esi]
pop bx
fxch st(6)
add byte [eax], cl
add byte [esi - 0x77], ah
dec ebx
and edi, 0xfffffff5
mov dword [ebp - 0x12], eax
mov edi, dword [ebp + 0xc]
jge 0x40abca
mov eax, dword [edi]
sbb eax, 0xf84589c0
jne 0x40a9c0
invalid
call [edi + 0x5e]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xcd4e
push ebp
mov ebp, esp
sub esp, 8
mov ebx, dword [ecx + 0xc]
push ebx
push esi
xor byte [eax - 0x760093c6], bl
jge 0x40abff
dec dword [ecx + 0xe0bfc7d]
or ecx, dword [esi]
pop edi
ja 0x40abc9
fisttp word [ebx + 0x10c25de5]
sbb dword [eax], eax
jge 0x40ab9b
mov eax, dword [ebp + 0x14]
dec ebp
cmp byte [esi], ah
je 0x40ac05
jo 0x40ac92
or byte [ebx], dh
leave
ror byte [esi], cl
add esi, 2
cmp ecx, 0x1943
mov dword [ebp - 0xc], esi
pop esp
push ss
je 0x40abbc
cmp cl, byte [ebx - 0x2776b1d0]
mov eax, dword [ebp + 0x10]
mov byte [eax], cl
inc eax
add byte [ebp + 0x10], 0xe9
or cl, dl
add byte [eax], al
mov eax, ecx
and eax, 0xfc00
or eax, 0xd166dc00
inc dword [edi + 0x11c]
cmp eax, 0xd800
jne 0x40aca6
cmp edi, 2
jb 0x40ad67
mov ax, word [esi]
invalid
add bl, byte [ecx - 0x523f575]
xor dword [esi + ebp*8 + 0x55], 0x17890001
or byte [ecx + 0x7eb00a6], dl
mov eax, ecx
cdq
mov ebx, eax
sar dl, 0x8b
ret
pop edi
pop esi
mov eax, 0x11678
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x423b47
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x423b75
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x423b93
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00423ab1
jmp 0x423b93
mov eax, dword [esi + 0x14]
test eax, eax
je 0x423b93
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00423ab1
test edi, edi
mov eax, edi
jne 0x423b7d
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x438c24]
test ecx, ecx
je 0x423c46
jmp 0x423b46
ret 8

Function at 0x461f20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x455015
lea edi, [esi - 0x54015]
push edi
or ebp, 0xffffffff
jmp 0x461f42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x461f49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x461f38
mov eax, 1
add ebx, ebx
jne 0x461f5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x461f50
jne 0x461f6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f50
xor ecx, ecx
sub eax, 3
jb 0x461f80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x461ff2
mov ebp, eax
add ebx, ebx
jne 0x461f8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x461f98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x461fbc
inc ecx
add ebx, ebx
jne 0x461fa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x461f9d
jne 0x461fb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x461fdc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x461fcd
jmp 0x461f3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x461fdc
add edi, ecx
jmp 0x461f3e
pop esi
mov edi, esi
mov ecx, 0x32d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x461ffa
cmp byte [edi], 0
jne 0x461ffa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x461fff
lea edi, [esi + 0x5f000]
mov eax, dword [edi]
or eax, eax
je 0x46206e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x621f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x62254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x46202c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x62258]
or eax, eax
je 0x462068
mov dword [ebx], eax
add ebx, 4
jmp 0x462049
call dword [esi + 0x6225c]
popal
jmp 0x4095a4
Function at 0x401880
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
mov ecx, dword [esp + 4]
push 0xffffffffffffffff
push 0x403928
push eax
mov eax, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0x10
and ecx, 0xffff
push esi
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x401942
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40192c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
lea ecx, [esp + 8]
mov esi, eax
call sub.MFC42.DLL_CFile::CFile
mov edx, dword [esp + 0x30]
push 0
push 0x1001
push edx
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0
call sub.MFC42.DLL_CFile::Open
test eax, eax
je 0x40191b
push edi
push esi
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CFile::Write
lea ecx, [esp + 8]
call sub.MFC42.DLL_CFile::Close
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call fcn.00403484
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
mov ecx, dword [esp + 0x14]
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x402620
Capabilities:
Persist via windows service
Set registry value
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x403a2b
push eax
mov dword fs:[0], esp
sub esp, 0x214
push ebx
push ebp
mov ebp, ecx
push esi
push edi
push 0
lea ecx, [ebp + 0x60]
call sub.MFC42.DLL_CString::GetBuffer
push 1
mov ebx, eax
push str.SYSTEMCurrentControlSetServicesWinSock2C360CenterHook
push 0x80000002
lea eax, [esp + 0x12c]
push 0x104
push eax
push str.PathName
lea ecx, [esp + 0x34]
call fcn.004030b0
test eax, eax
je 0x402682
mov esi, 0xfffffcde
jmp 0x402725
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x20]
call fcn.00402c60
test eax, eax
je 0x4026b8
mov esi, eax
jmp 0x402725
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
push 0xf003f
push eax
push eax
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2C360CenterHook
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x402711
push esi
push ebx
push 1
push eax
mov eax, dword [esp + 0x24]
push str.PathName
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x402718
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0xfffffcdc
jmp 0x402725
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
cmp esi, 0xfffffcde
mov dword [esp + 0x22c], 0
je 0x402753
test esi, esi
je 0x40274c
push 0x40646c
jmp 0x402758
push 0x406434
jmp 0x402758
push 0x4063f0
lea ecx, [esp + 0x14]
call fcn.00403352
push 0x4063d0
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator
push 0x4063c4
push 0x40a
mov ecx, ebp
call sub.MFC42.DLL_CWnd::SetDlgItemTextA
mov eax, dword [esp + 0x10]
push 4
push 0
push eax
mov ecx, ebp
call sub.MFC42.DLL_CWnd::MessageBoxA
pop edi
pop esi
pop ebp
cmp eax, 6
pop ebx
jne 0x4027a1
push 0
call dword [sym.imp.MSVCRT.dll_exit]
lea ecx, [esp]
mov dword [esp + 0x21c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x214]
mov dword fs:[0], ecx
add esp, 0x220
ret
Function at 0x402a60
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 8]
push ebx
push ebp
push esi
mov eax, dword [edx + 4]
mov edx, dword [edx]
push edi
mov dword [esp + 0x10], ecx
lea edi, [ecx + 0x64]
mov ebx, 0xc
mov esi, dword [edi + 4]
mov ecx, 0x20
sub eax, esi
mov esi, edx
and esi, 0x1f
mov ebp, eax
sub ecx, esi
sub edi, 8
shl ebp, cl
mov ecx, esi
mov esi, dword [edi + 8]
shr eax, cl
mov ecx, 0x20
or ebp, eax
xor ebp, edx
sub edx, esi
mov eax, ebp
mov ebp, edx
mov esi, eax
and esi, 0x1f
sub ecx, esi
shl ebp, cl
mov ecx, esi
shr edx, cl
or ebp, edx
xor ebp, eax
dec ebx
mov edx, ebp
jne 0x402a7a
mov esi, dword [esp + 0x10]
pop edi
mov ecx, dword [esi + 8]
sub eax, ecx
mov ecx, dword [esp + 0x18]
mov dword [ecx + 4], eax
mov eax, dword [esi + 4]
sub edx, eax
pop esi
pop ebp
mov dword [ecx], edx
pop ebx
pop ecx
ret 8

Function at 0x402ae0
Capabilities:
Encrypt data using rc6

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov ebx, ecx
xor edx, edx
push edi
mov edi, dword [esp + 0x28]
mov dword [esp + 0x10], ebx
mov eax, 0xf
mov dword [esp + 0x20], edx
mov ecx, eax
shr ecx, 2
mov ebp, dword [esp + ecx*4 + 0x14]
lea esi, [esp + ecx*4 + 0x14]
xor ecx, ecx
mov cl, byte [eax + edi]
shl ebp, 8
add ecx, ebp
dec eax
cmp eax, 0xffffffff
mov dword [esi], ecx
jne 0x402afc
lea eax, [ebx + 4]
mov ecx, 0x19
mov dword [eax], 0xb7e15163
mov esi, dword [eax]
add eax, 4
sub esi, 0x61c88647
dec ecx
mov dword [eax], esi
jne 0x402b29
xor ebp, ebp
xor esi, esi
xor edi, edi
mov dword [esp + 0x28], 0x4e
jmp 0x402b4d
mov ebx, dword [esp + 0x10]
mov ecx, dword [ebx + edx*4 + 4]
lea eax, [edx + 1]
lea edx, [esi + edi]
add edx, ecx
mov ecx, edx
shr ecx, 0x1d
shl edx, 3
or ecx, edx
mov dword [ebx + eax*4], ecx
mov edi, ecx
mov ecx, dword [esp + ebp*4 + 0x14]
add ecx, esi
lea ebx, [esi + edi]
and ebx, 0x1f
lea esi, [ecx + edi]
mov ecx, 0x20
sub ecx, ebx
mov edx, esi
shr edx, cl
mov ecx, ebx
shl esi, cl
mov ecx, 0x1a
or edx, esi
mov dword [esp + ebp*4 + 0x14], edx
mov esi, edx
xor edx, edx
div ecx
mov eax, dword [esp + 0x28]
inc ebp
and ebp, 3
dec eax
mov dword [esp + 0x28], eax
jne 0x402b49
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x402c60
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404900
push 0x40358e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
push ebx
push esi
push edi
mov dword [ebp - 0x12c], ecx
xor edi, edi
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push edi
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402cc7
mov eax, 0xfffffcdd
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], edi
mov dword [ebp - 0x128], edi
mov dword [ebp - 0x124], edi
mov ebx, dword [ebp + 8]
push 0x104
lea ecx, [ebp - 0x120]
push ecx
push edi
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x402d43
push ebx
lea eax, [ebp - 0x120]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x12c]
call fcn.00402d70
mov esi, eax
mov dword [ebp - 0x124], esi
test esi, esi
je 0x402d3a
push 0xffffffffffffffff
lea edx, [ebp - 0x10]
push edx
call sub.MSVCRT.dll__local_unwind2
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
inc edi
mov dword [ebp - 0x128], edi
jmp 0x402cd9
mov dword [ebp - 4], 0xffffffff
call fcn.00402d64
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4030b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404920
push 0x40358e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 0x1c]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40314d
mov dword [ebp - 4], eax
lea eax, [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x20]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403141
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp + 0x1c]
jne 0x403141
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
call sub.MSVCRT.dll__local_unwind2
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov dword [ebp - 4], 0xffffffff
call fcn.00403162
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18

Function at 0x403170
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404930
push 0x40358e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x40322b
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40322b
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x4031d0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea edx, [ebp - 0x1c]
push edx
push 0xf003f
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40322b
mov dword [ebp - 4], eax
push esi
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x40321f
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
push ecx
call sub.MSVCRT.dll__local_unwind2
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebp - 4], 0xffffffff
call fcn.00403240
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x417a8c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x417a92
ret