joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b060
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x42b077
add esp, 0xfffffff0
call fcn.00402ec8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00410024
mov dl, 1
mov eax, dword [0x40a564]
call fcn.00402c64
mov dword [ebx + 0x70], eax
mov dl, 1
mov eax, dword [0x40a564]
call fcn.00402c64
mov dword [ebx + 0x88], eax
xor eax, eax
mov dword [ebx + 0x44], eax
xor eax, eax
mov dword [ebx + 0x64], eax
mov dword [ebx + 0x40], 0x80000018
mov dword [ebx + 0x58], 0x1f4
mov dword [ebx + 0x5c], 0x32
mov dword [ebx + 0x60], 0x9c4
mov byte [ebx + 0x68], 0
mov byte [ebx + 0x7d], 1
mov dl, 1
mov eax, dword [0x4119d0]
call fcn.00418aa0
mov esi, eax
mov dword [ebx + 0x78], esi
push 0x42b1d0
mov eax, dword [0x451bc4]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00418e40
mov eax, dword [ebx + 0x78]
mov dword [eax + 8], ebx
mov dword [eax + 4], 0x42c850
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x451bc4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.00408a68
test eax, eax
je 0x42b158
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00406d58
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.00408a90
test eax, eax
je 0x42b16c
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x6c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.0040398c
mov eax, dword [0x451b18]
cmp byte [eax], 0
jne 0x42b19d
mov eax, ebx
call fcn.0042b2b4
mov byte [ebx + 0x3d], 1
mov byte [ebx + 0x3e], 1
mov byte [ebx + 0x3f], 1
mov byte [ebx + 0x7e], 1
xor eax, eax
mov dword [ebx + 0x80], eax
cmp byte [ebp - 1], 0
je 0x42b1c5
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42b508
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4526f4]
cmp dword [eax + 0x24], 0
je 0x42b598
cmp dword [ebx + 0x74], 0
jne 0x42b595
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x42b49c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x70]
cmp dword [eax + 8], 0
je 0x42b595
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x42b564
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x70]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x42b595
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x70]
call fcn.0040b7c8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x42b570
inc dword [ebx + 0x74]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x42be80
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x84], 0
je 0x42beb5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403844
jmp 0x42bebf
mov eax, esi
mov edx, dword [ebx + 0x6c]
call fcn.004037f8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x42cad4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x64]
test esi, esi
je 0x42cb0c
mov eax, esi
call fcn.00420168
test al, al
je 0x42cb0c
mov eax, dword [ebx + 0x64]
call fcn.0041ff8c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x42cb0c
push 0
mov eax, dword [ebx + 0x64]
call fcn.0041ff8c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x435d50
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x435ed5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.004037f8
mov eax, dword [ebp - 0x10]
call fcn.00435abc
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x435da3
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00403c20
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004361f4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x435e93
xor eax, eax
push ebp
push 0x435e8c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00435c28
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.00435ee4
test al, al
je 0x435e6a
mov ecx, dword [ebp - 0x34]
add ecx, 1
jno 0x435df8
call fcn.00402bd4
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00403844
mov ebx, dword [ebp - 0x38]
sub ebx, 1
jno 0x435e0f
call fcn.00402bd4
test ebx, ebx
jl 0x435e6a
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x34]
add eax, 1
jno 0x435e23
call fcn.00402bd4
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00403ba0
push eax
push esi
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x435e66
mov eax, dword [ebp - 0x14]
call fcn.00403ba0
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00403914
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.00435d50
inc esi
dec ebx
jne 0x435e16
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435e93
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00435c28
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.00403ba0
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.00435c14
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435edc
lea eax, [ebp - 0x3c]
call fcn.00403760
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403784
ret

Function at 0x435ee4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.004029c8
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
pop esi
pop ebx
ret
Function at 0x435f28
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x435ffb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.00435ee4
test al, al
je 0x435fdd
mov ecx, dword [ebp - 0x1c]
add ecx, 1
jno 0x435f6f
call fcn.00402bd4
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00403844
mov ebx, dword [ebp - 0x20]
sub ebx, 1
jno 0x435f86
call fcn.00402bd4
test ebx, ebx
jl 0x435fdd
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
add eax, 1
jno 0x435f9a
call fcn.00402bd4
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403ba0
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumValueA
mov eax, dword [ebp - 0xc]
call fcn.00403ba0
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00403914
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc esi
dec ebx
jne 0x435f8d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x436002
lea eax, [ebp - 0x2c]
call fcn.00403760
lea eax, [ebp - 0xc]
call fcn.00403760
ret

Function at 0x4360a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x436131
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebp + 8]
call fcn.00435ad8
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00403ba0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x43611b
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x451c4c]
call fcn.00404764
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x4359a0]
call fcn.0040801c
call fcn.0040323c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x436138
lea eax, [ebp - 0x10]
call fcn.00403760
ret
Function at 0x436144
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4361df
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00403ba0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4361b9
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x451d40]
call fcn.00404764
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x4359a0]
call fcn.0040801c
call fcn.0040323c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00435b08
mov edx, dword [ebp + 8]
mov byte [edx], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4361e6
lea eax, [ebp - 0x10]
call fcn.00403760
ret

Function at 0x443de0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x443ea3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x34]
call fcn.00403ba0
push eax
call sub.ws2_32.dll_inet_addr
mov esi, eax
mov dword [ebx + 0x40], esi
inc esi
je 0x443e1a
lea eax, [ebx + 0x38]
mov edx, dword [ebx + 0x34]
call fcn.004037b4
jmp 0x443e6e
mov eax, dword [ebx + 0x34]
call fcn.00403ba0
push eax
call sub.ws2_32.dll_gethostbyname
mov esi, eax
test esi, esi
jne 0x443e5a
call sub.kernel32.dll_GetLastError_1
mov dword [ebx + 0x70], eax
cmp word [ebx + 0x5a], 0
je 0x443e8d
lea eax, [ebp - 4]
mov ecx, dword [ebx + 0x34]
mov edx, 0x443eb8
call fcn.00403a28
mov ecx, dword [ebp - 4]
mov edx, ebx
mov eax, dword [ebx + 0x5c]
call dword [ebx + 0x58]
jmp 0x443e8d
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebx + 0x40], eax
lea eax, [ebx + 0x38]
mov edx, dword [esi]
call fcn.00403914
push dword [ebx + 0x40]
call sub.ws2_32.dll_inet_ntoa
lea edx, [ebp - 4]
call fcn.00406f08
mov edx, dword [ebp - 4]
lea eax, [ebx + 0x3c]
call fcn.004037b4
mov byte [ebx + 0x74], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443eaa
lea eax, [ebp - 4]
call fcn.00403760
ret
Function at 0x44a034
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
test dl, dl
je 0x44a04e
add esp, 0xfffffff0
call fcn.00402ec8
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44a1cb
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x44a1ab
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 1
lea edx, [ebp - 0xc]
mov eax, dword [0x452ac0]
call fcn.00406a60
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
add eax, 0x30
call fcn.004037b4
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
mov dl, 1
mov eax, dword [0x42e080]
call fcn.00434f1c
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], ebx
mov byte [ebx + 0x4b8], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00406a90
mov edx, dword [ebp - 4]
mov ebx, dword [edx + 0x28]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebx + 0x4f4], eax
mov dword [ebx + 0x4f0], 0x449d38
mov eax, dword [ebp - 4]
mov dword [ebx + 0x4dc], eax
mov dword [ebx + 0x4d8], 0x449a3c
mov ecx, ebx
mov dl, 1
mov eax, dword [0x43c248]
call fcn.0043c800
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x2c], esi
imul edx, dword [0x452ac8], 4
jno 0x44a111
call fcn.00402bd4
bound edx, qword [0x44a1ec]
mov eax, esi
call fcn.0043c990
mov eax, dword [ebp - 4]
push eax
push 0x4499d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
call fcn.0043c9a0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
xor edx, edx
call fcn.0043c980
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0xc]
mov edx, 0x452b08
call fcn.00403980
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.00430adc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov dword [eax + 0x34], 0x10
add dword [0x451af8], 1
jno 0x44a186
call fcn.00402bd4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
mov dl, 1
call fcn.0043c980
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov edx, dword [eax]
call dword [edx + 0x84]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44a1b5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a1d2
lea eax, [ebp - 0xc]
call fcn.00403760
ret
Function at 0x401330
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7f4
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x79c], 4
mov dword [ebp - 0x784], 0x80000000
mov dword [ebp - 0x798], 0x20019
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x72c], eax
pushal
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x12d
mov dword [ebp - 0x28], 0x14
mov dword [ebp - 0x7f4], str.FFFTWAREFFasses
mov dword [ebp - 0x7a4], str.yysid0afaced1_e828_11d1_9187_b532f1e9575dinprocserver32
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x12c
mov dword [ebp - 0x28], 0x13
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x200
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x4014b3
call entry0
mov ecx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [0x40d0c8], ecx
mov edx, dword [ebp - 0x7f4]
mov byte [edx], 0x53
mov eax, dword [ebp - 0x7f4]
mov byte [eax + 1], 0x4f
mov ecx, dword [ebp - 0x7f4]
mov byte [ecx + 2], 0x46
mov edx, dword [ebp - 0x7f4]
mov byte [edx + 9], 0x43
mov eax, dword [ebp - 0x7f4]
mov byte [eax + 0xa], 0x6c
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x7f4]
push edx
push 0x80000002
call dword [0x40d0c8]
test eax, eax
je 0x401511
xor eax, eax
jmp 0x4017b3
mov eax, dword [ebp - 0x7a4]
mov byte [eax], 0x63
mov ecx, dword [ebp - 0x7a4]
mov byte [ecx + 1], 0x6c
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x7a4]
push eax
push 0x80000000
call dword [0x40d0c8]
test eax, eax
je 0x401545
xor eax, eax
jmp 0x4017b3
push 1
mov ecx, dword [0x40d0c4]
push ecx
call fcn.00401ac0
add esp, 8
mov dword [0x40d0d4], eax
mov edx, dword [0x40d0d4]
push edx
jmp section..htext
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x25815b05
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x25815b14
pop dword [ebp - 0x10]
mov eax, 0x6a50d470
sub eax, 0x44cf795c
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xd54b24ea
sub dword [ebp - 0x20], 0x86f8df9f
mov dword [ebp - 0x1c], 0x352102fd
add dword [ebp - 0x1c], 0xfd124948
mov dword [ebp - 0x18], 0x8ea74985
add dword [ebp - 0x18], 0xbda4faa9
mov dword [ebp - 0x14], 0x77e08de
add dword [ebp - 0x14], 0xf881f722
lea eax, [ebp - 0x20]
push eax
mov eax, 0x661a71fa
add eax, 0xbf675e4a
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xf14977bc
add dword [ebp - 0x20], 0x8328f19a
mov dword [ebp - 0x1c], 0xd3558410
add dword [ebp - 0x1c], 0x6e16dd65
mov dword [ebp - 0x18], 0x89b95578
sub dword [ebp - 0x18], 0x2649e90c
mov dword [ebp - 0x14], 0x3567e5ce
add dword [ebp - 0x14], 0xca981a32
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x7d3730a3
sub eax, 0x57b56023
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3d695
push 0
call eax
mov ecx, 0x86d573eb
add ecx, 0x792ad78e
xor edx, edx
add edx, eax
mov ebx, 0x75900bec
sub ebx, 0x500d75ec
add ebx, dword [ebp - 0x10]
mov esi, 0x2bcd4906
xor dword [ebp - 8], 0x4b2f9bb3
mov edi, dword [ebx]
mov dword [ebp - 0xc], 0x35de4c47
sub edi, esi
sub dword [ebp - 4], eax
mov dword [edx], edi
sub dword [ebp - 0xc], 0x77358a19
add edx, 0xb26bfbaf
add edx, 0x4d940455
add ebx, 0xd25e9219
add ebx, 0x2da16deb
loop 0x25815c32
add eax, 0x25e165e6
sub eax, 0x25e0452f
xor ebx, ebx
add ebx, eax
add eax, 0x712039a9
sub eax, 0x712039a4
mov ecx, 0x25800000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x3addb236
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
lea eax, [eax + 0xc]
mov edx, eax
cmp edx, eax
je 0x3addb290
push eax
push 0x3add9d9a
call fcn.3addb2ce
push 7
push 0x3ade70bc
push dword [eax + 0x30]
call fcn.3addb627
cmp eax, 0
jne 0x3addb26a
inc eax
jmp 0x3addb292
push 0x3add9db2
call fcn.3addb2ce
push 7
push 0x3ade70bc
push dword [eax + 0x30]
call fcn.3addb627
cmp eax, 0
jne 0x3addb28b
inc eax
jmp 0x3addb292
pop eax
mov eax, dword [eax]
jmp 0x3addb244
xor eax, eax
ret

Function at 0x3addb2a8
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
mov eax, dword fs:[0x30]
mov al, byte [eax + 0x68]
and al, 0x70
cmp al, 0x70
sete al
movzx eax, al
ret

Function at 0x3addb2bc
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
test al, al
setne al
movzx eax, al
ret

Function at 0x3addb2ce
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
lea edi, [0x3ade70bc]
mov esi, dword [ebp + 8]
lodsw ax, word [esi]
xor ax, 0xdc
stosw word es:[edi], ax
cmp ax, 0
jne 0x3addb2dc
pop edi
pop esi
leave
ret 4

Function at 0x3addb2f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
lea edi, [0x3ade70bc]
mov esi, dword [ebp + 8]
lodsb al, byte [esi]
xor al, 0xdc
stosb byte es:[edi], al
cmp al, 0
jne 0x3addb2fe
pop edi
pop esi
leave
ret 4

Function at 0x3addb532
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + ebx + 0x78]
add eax, ebx
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x20]
mov edi, dword [edx + ebx]
test edi, edi
je 0x3addb583
add edi, ebx
xchg esi, eax
push ecx
xor eax, eax
lea ecx, [eax - 1]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg esi, eax
mov esi, dword [ebp + 0xc]
repe cmpsb byte [esi], byte es:[edi]
pop ecx
jne 0x3addb583
sub ecx, dword [eax + 0x18]
neg ecx
mov edx, dword [eax + 0x24]
add edx, ebx
movzx edx, word [edx + ecx*2]
mov eax, dword [eax + 0x1c]
add eax, ebx
mov eax, dword [eax + edx*4]
add eax, ebx
jmp 0x3addb58a
add edx, 4
loop 0x3addb54a
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x3addb591
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push esi
push edi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
lea ebp, [eax + 0xc]
mov eax, dword [ebp]
mov esi, dword [eax + 0x30]
movzx ecx, word [eax + 0x2e]
mov edi, dword [esp + 0x10]
mov dx, word [esi]
cmp dx, word [edi]
je 0x3addb5dd
cmp dx, 0x41
jb 0x3addb5c2
cmp dx, 0x5a
jbe 0x3addb5c8
cmp dx, 0x61
jb 0x3addb5d4
cmp dx, 0x7a
ja 0x3addb5d4
xor dx, 0x20
jmp 0x3addb5d6
jmp 0x3addb5f0
cmp dx, word [edi]
je 0x3addb5dd
jmp 0x3addb5f0
add edi, 2
add esi, 2
sub ecx, 2
cmp ecx, 0
jne 0x3addb5ae
mov eax, dword [eax + 0x18]
jmp 0x3addb5f8
mov eax, dword [eax]
cmp ebp, eax
jne 0x3addb5a3
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x407fb0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [0x4395ec]
xor eax, esp
mov dword [esp + 0x198], eax
push esi
lea eax, [esp + 8]
mov esi, ecx
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x400
lea ecx, [esi + 0x14]
mov dword [esi], 0xffffffff
push 0
push ecx
call fcn.0041a0a0
push 0x400
lea ecx, [esi + 0x414]
push 0
push ecx
call fcn.0041a0a0
mov ecx, dword [esp + 0x1b4]
add esp, 0x18
mov eax, esi
pop esi
xor ecx, esp
call fcn.00415b03
mov esp, ebp
pop ebp
ret

Function at 0x4084a0
Capabilities:
Connect socket
Connect udp socket
Create udp socket
Get networking parameters

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
push edi
push 0x248
push 0x40
mov edi, ecx
call ebx
mov esi, eax
mov dword [ebp - 4], 0x248
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetNetworkParams]
cmp eax, 0x6f
jne 0x4084e1
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 4]
push 0x40
call ebx
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetNetworkParams]
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi], eax
lea ebx, [edi + 4]
xorps xmm0, xmm0
mov eax, 2
movdqu xmmword [ebx], xmm0
push 0x35
mov word [ebx], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [edi + 6], ax
add esi, 0x10c
je 0x408542
lea eax, [esi + 4]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x10
push ebx
push dword [edi]
mov dword [edi + 8], eax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x408559
mov esi, dword [esi]
test esi, esi
jne 0x408520
push dword [edi]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [edi], 0xffffffff
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [edi]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [edi], 0xffffffff
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret