joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481250
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x2820
call fcn.00492b90
mov eax, dword [esp + 0x2824]
push ebx
push esi
push edi
push eax
lea ecx, [esp + 0x20]
push str..PhysicalDrive_d
push ecx
call fcn.00493892
add esp, 0xc
lea edx, [esp + 0x1c]
push 0
push 0
push 3
push 0
push 3
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4813fd
xor eax, eax
mov ecx, 0x9c4
mov dword [esp + 0x10], eax
lea edi, [esp + 0x11c]
mov dword [esp + 0x14], eax
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push eax
push ecx
lea edx, [esp + 0x124]
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push 0x2710
push edx
lea eax, [esp + 0x20]
push 0xc
push eax
push 0x2d1400
push esi
mov dword [esp + 0x2c], 0
call ebx
test eax, eax
je 0x4813fd
mov ecx, dword [esp + 0x283c]
mov edx, dword [esp + 0x128]
push ecx
push 0
lea eax, [esp + 0x124]
push edx
push eax
call fcn.00481410
mov ecx, dword [esp + 0x2848]
mov edx, dword [esp + 0x13c]
push ecx
push 0
lea eax, [esp + 0x134]
push edx
push eax
call fcn.00481410
mov ecx, dword [esp + 0x2860]
mov edx, dword [esp + 0x150]
push ecx
push 0
lea eax, [esp + 0x144]
push edx
push eax
call fcn.00481410
mov ecx, dword [esp + 0x2864]
mov edx, dword [esp + 0x164]
push ecx
push 1
lea eax, [esp + 0x154]
push edx
push eax
call fcn.00481410
mov ecx, dword [esp + 0x2884]
add esp, 0x40
xor eax, eax
lea edi, [esp + 0x11c]
mov dword [ecx], 1
mov ecx, 0x9c4
lea edx, [esp + 0xc]
push eax
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x124]
push 0x2710
push eax
push 0
push 0
push 0x700a0
push esi
call ebx
test eax, eax
je 0x4813fd
mov edi, dword [esp + 0x124]
mov edx, dword [esp + 0x2848]
mov eax, dword [esp + 0x284c]
xor ecx, ecx
cmp edi, 0xc
push esi
setne cl
inc ecx
mov dword [edx], ecx
mov ecx, dword [esp + 0x138]
mov edx, dword [esp + 0x13c]
mov dword [eax], ecx
mov dword [eax + 4], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x2820
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x2820
ret
Function at 0x482b90
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x575e2c]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x482ba3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x482be4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x575ed4]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x482c16
mov bl, byte [esp + ecx + 0x4c]
jmp 0x482c1a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x482c0b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x482c38
mov bl, byte [esp + ecx + 0x4c]
jmp 0x482c3c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x482c2d
xor ecx, ecx
mov eax, 0x575e3c
xor ebx, ebx
mov bl, byte [ecx + 0x575ee4]
cmp byte [esp + ebx + 0x14], 0
je 0x482c67
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x575efc]
cmp byte [esp + ebx + 0x14], 0
je 0x482c7e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x482c4e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x482bd7
lea edx, [esp + 0x84]
push edx
call fcn.00482cc0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x484ae0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x484b46
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x484b46
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x484b27
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x484ed0
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x484f08
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x485b40
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x485b89
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x486000
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b3340
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00485bb0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00485c30
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00485c30
lea ecx, [esi + 0xc]
call fcn.004a2a95
lea ecx, [esi + 0x10]
call fcn.004a2a95
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004871c0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004871c0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004871c0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004a2b0a
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004a2b0a
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4a4f27
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4a4f5f
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004a2fb1
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004a2f89
jmp 0x4a4f6b
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4a6615
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4a6657
call fcn.004ac5c1
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4a6657
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4a664e
xor eax, eax
jmp 0x4a665f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004a6665
pop edi
pop esi
pop ebx
ret 4

Function at 0x4acaf1
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4acb1f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4acb3d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004aca57
jmp 0x4acb3d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4acb3d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004aca57
test edi, edi
mov eax, edi
jne 0x4acb27
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x43bc50
Capabilities:
Encode data using xor

Disassembly:
loope 0x43bc75
rcr edx, 0xb1
mov al, 0xc1
push dword [eax + 0x12]
or byte [ecx + edi + 0x4a], 0x58
xor byte [esi - 0x53], bh
aad 0x72
aad 0x18
adc dword [eax], edx
mov bh, 0xc1
mov al, 0x6f
invalid
mov edx, 0x9ea86a7e
mov esi, 0x9d4e49a3
jo 0x43bc1b
pop ebp
dec ebx
mov byte [esi + 0x66], dh
and dword [eax - 0x7a], esp
inc eax
ret
cmpsd dword [esi], dword es:[edi]
invalid
imul esi, dword [esi], 0xc280a374
pop ecx
sbb esp, esp
das
adc al, byte [ebx + 0x33]
xchg edi, eax
cmp dh, byte [edx + edi*8 + 0x1ad035cd]
loop 0x43bca9
mov dl, 0x9a
les edx, [eax + 0x28]
sal dl, 1
invalid
sbb ecx, dword [eax - 0x70]
and dword [edx], edi
daa
mov byte [0x3af1be78], al
sar dword [edx + edx + 0x5218f816], cl
int1
cmp dl, bl
mov esp, 0x18f81612
push edx
adc dl, byte [esi]
clc
sbb byte [edx + 1], dl
sahf
add ebp, dword [esi]
test al, 0xd9
add dword [esi - 0x2657d1fd], ebx
or byte [eax - 0x631677d5], al
mov cl, ch
pushfd
lahf
test dword [edx - 0x38a81f97], edi
jne 0x43bc55
mov ss, word [eax + ebp*8 - 0x5d57c7ee]
add al, 0xfa
cli
jb 0x43bcb7
ror byte [eax - 0x50], 0x28
je 0x43bc68
sbb dword [ebx + 0x49], ebx
and al, al
loope 0x43bc9c
push edx
jo 0x43bca5
push 0xffffffffffffffb6
lea edi, [0xe8199aa]
mov ss, word [ebx + esi*8 - 0x45]
cdq
or dword [esi], 0xbbf3548e
and dword [edi + 0x47], esi
mov dword [0xc4d76081], eax
xchg dword [edx + 0xa9bf1f9], edx
jo 0x43bcdc
and byte [esi], 0x3b
shr byte [ecx + 0x11], cl
cmp esp, eax
sti
jb 0x43bd10
sbb al, 0x4f
mov ebp, 0x74776ae0
wait
or al, 0xd0
out dx, al
jle 0x43bccb
mov dh, 0xe0
les edx, [esp + edx*2]
inc ecx
call 0xcf71ee0
mov ds, word [eax - 0x25]
or eax, 0x9a8d1221
mov dword [ebp + 6], ebx
ret 0xb361
adc cl, byte [ebp + 0x65d899a]
pushal
mov edi, 0xe3cdbecd
adc byte [esi - 0x59], bh
cwde
push esi
daa
add eax, 0xd311170b
and dword [ebp - 0x2e], ebx
mov dl, 0xc5
adc dword [edx - 0x655a54dc], edi
stc
cmc
xor dword [eax], ebp
and eax, 0xaa51d0d1
shl dword [edi - 0xb], 1
ja 0x43bd45
mov ebx, 0x33b7091d
mov bl, 0xe2
jle 0x43bce3
rcr al, 0xdf
pushfd
and al, 0x9a
xor eax, 0x82f313dc
les esp, [esi - 0x3b]
sal byte [edx], 0x4f
add eax, 0x27192629
call 0x20633d2e
push eax
out dx, eax
loope 0x43bd1a
pushfd
mov cl, 0x66
jle 0x43bd23
pop es
invalid
Function at 0x44a680
Capabilities:
Encode data using xor

Disassembly:
sal dword [ebx], 0x3e
int3
mov edx, 0x8bdd2d28
or edx, edi
loopne 0x44a6ee
xor byte [edi + 0x18], cl
xor byte [eax - 0x7f39cdd4], 0x98
mov edi, 0x93226c60
adc byte [edi], al
or eax, 0x481ae2fa
loop 0x44a6b8
dec eax
sar byte [ebp + 0x3f9e48a0], 1
lodsb al, byte [esi]
jbe 0x44a66d
sahf
out dx, al
xor esi, dword [ecx]
jbe 0x44a6f7
adc dword [edi + 0x31], edx
xchg esi, eax
retf 0x2052
and byte [eax - 0x277e40cc], al
lea ebx, [edi - 0x45]
xor dh, bl
mov cl, ah
sbb eax, 0x32bb5f8d
mov cl, ah
mov al, 0x28
xor byte [edx - 0x19], dl
push esp
xor eax, edi
cmp al, 0x8e
or byte [ebp - 0x2d], ah
sbb cl, cl
and eax, 0xd2bdec20
les esp, [ebp - 0xa]
jle 0x44a6ea
push es
adc dword [edx], ebp
cmpsb byte [esi], byte es:[edi]
sub eax, 0xa3166c70
mov ch, 0xf0
pushal
aam 0x12
movsd dword es:[edi], dword [esi]
cwde
push ecx
add eax, 0xd02da640
sub ah, byte [eax - 0x65030b8f]
xor al, 0x26
aaa
sub eax, 0x71a02ad0
hlt
aaa
jno 0x44a69c
push ebp
push cs
sal ecx, 1
loope 0x44a6b4
mov edi, 0x40b4b503
push edi
add byte [esi + 0x5214b8e3], al
inc ebx
adc al, 0x71
add al, 0x96
push es
mov edi, 0x7381e577
xor eax, 0x8fd14bb1
salc
inc esp
adc dword [ecx + 0x665926fe], ecx
push ebp
mov al, byte [eax]
test dh, ah
jae 0x44a70d
or eax, dword [edi + eax*8 - 0x5e358d69]
add esi, 0x8a200094
aad 0x62
jl 0x44a74a
insd dword es:[edi], dx
xlatb
mov dl, 0x8b
call dword [ebp - 0x75]
in al, dx
mov eax, dword [ebp + 0x10]
and dword [eax], 0
and byte [eax], al
push esi
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi]
test ecx, ecx
push edi
je 0x44a766
cmp ecx, 0x9bfbbc02
jne 0x44a787
mov edi, 0x7dbd81a0
jmp 0x44a76b
mov edi, 0x7dbe3038
push 4
pop ecx
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x44a787
mov ecx, dword [ebp + 8]
test ecx, ecx
mov dword [eax], ecx
je 0x44a787
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
xor eax, eax
jmp 0x44a78c
mov eax, 0x80004002
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x5628e0
Capabilities:
Encode data using xor

Disassembly:
inc eax
cmp eax, 0xefe24e5b
shr byte [eax + edi - 0x8a19ea0], cl
test dword [ecx - 0x3b341521], ebx
fdiv qword [eax + 2]
das
fild word [ebx - 0x2446168a]
dec eax
mov dl, 0xfd
or byte [ecx - 0x21ac323c], dh
dec ecx
and bl, byte [esi]
xor byte [edi - 0x5fe37078], bh
mov al, byte [0xbfe7b14]
mov al, byte [0xbfe7b14]
jno 0x562930
pop ds
jl 0x5628b1
shl byte [ebx], 1
fnsave dword [edi - 0x1e91eee4]
xchg ebp, eax
movsb byte es:[edi], byte [esi]
rcl dh, 1
pop ds
pop edi
pop esp
cmp byte [esi + 0x1a4c7f11], ch
cld
call 0x96a4f67a
inc ebx
inc eax
pop ecx
scasd eax, dword es:[edi]
mov bh, 0x1c
push 0xffffffffffffff8e
add byte [edx + 0x73], ch
iretd
mov ah, 0x70
jae 0x56299c
sbb al, 7
mov cl, 0x14
in al, dx
fsubr qword [esi]
cmpsd dword [esi], dword es:[edi]
outsb dx, byte [esi]
add byte [edx + 0x6f426653], bl
outsd dx, dword [esi]
jge 0x5629b3
jo 0x562985
loope 0x562942
mov byte [0x488d631], al
add al, 0x6b
iretd
fldcw word [ecx + esi*8 + 0x32]
mov cl, 5
lds esi, [esi]
push es
push dword [eax + 0x68]
cmpsb byte [esi], byte es:[edi]
push cs
cwde
out dx, al
adc al, 0xf9
lcall 0x6790, 0x9c2cb92f
ret
nop
ret
popal
fldcw word [ecx + 0x27]
mov dword [0x232a2c50], eax
mov esi, ds
lcall 0x97b4, 0x7ebc813
mov ch, 0x19
mov cl, 0x47
lea eax, [esp + ebx*2]
lock xor dword [edi], ebp
xor dword [eax - 0x64], eax
les ecx, [ebp + 0x11]
push eax
adc ecx, edi
fisttp word [ebx - 0x2900e3d8]
andnps xmm6, xmm4
movsd dword es:[edi], dword [esi]
or ebp, dword [edx]
sbb dword [edi], esi
shr word [ebx + 0x3d18dca0], 1
les esp, [edx - 0x249595f5]
nop
shr bl, cl
and dword [esi - 0x5a], edi
popfd
push ecx
popfd
out dx, eax
stosd dword es:[edi], eax
push ss
mov ds, word [0x2f5a2101]
cmp ebp, dword gs:[edi]
mov al, byte [0x8b889089]
inc ecx
cmp al, 0xfd
and dword [eax + 0x5b], esi
das
adc esi, ecx
out 0xae, eax
and edx, eax
push edi
mov dword [0xedef0b1], eax
rcl dword [eax + 0x1c0ea23b], 0x7b
mov bh, 0xe1
pop ds
or byte [edi + 0x3877f075], 0xa
loop 0x5629d3
dec ebp
adc dword [eax + 0x13], edx
iretd
test byte [edx + 0x431dd5dc], 0xc0
test dword [0x116afec8], esp
add ebp, edi
bound ecx, qword [edi + 0x12]
mov dword [ebx], esp
cmp dl, byte [ecx + 0x761c6b21]
and dword [ebx], 0xad88f5
sbb dword [edx], esp
lahf
and eax, 0x351380d
inc dword [eax]
into
push ecx
add edi, edi
add dh, cl
pop edx
push 0xcb10dc0e
fdecstp
inc esp
xchg esi, eax
mov esp, 0x11158ad2
sub al, 0xc0
pop esp
and bl, ch
loope 0x562a5a
jge 0x562aa9
jg 0x562ab4
fnstenv [eax + 0x64]
mov esi, 0xff739940
int1
pop esi
inc ecx
ja 0x562a48
pop esp
loope 0x562ac5
dec ebp
fmul dword [edi - 0x6eb15aea]
invalid
mov ebp, 0xdd0f42ce
ret 0x8e16
invalid
xlatb
invalid
Function at 0x401000
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
push ebx
push esi
xor esi, esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], eax
cmp esi, dword [ebp + 0x10]
jge 0x401191
mov eax, dword [ebp - 0x10]
push 3
pop edx
cmp eax, edx
mov dword [ebp - 0xc], edx
jge 0x401032
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov eax, 0x3d3d3d3d
lea edi, [ebp - 4]
stosw word es:[edi], ax
test ecx, ecx
stosb byte es:[edi], al
jle 0x401059
mov eax, dword [ebp + 8]
lea edi, [ebp - 4]
add esi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, edx
rep movsb byte es:[edi], byte [esi]
mov cl, byte [ebp - 4]
mov al, cl
shr al, 2
test ebx, ebx
mov byte [ebp - 1], al
je 0x40108e
mov edi, dword [ebp + 0x14]
test edi, edi
jle 0x401096
mov eax, ebx
mov esi, dword [ebp + 0xc]
sub eax, dword [ebp - 8]
cdq
idiv edi
test edx, edx
jne 0x401099
mov byte [ebx + esi], 0xd
inc ebx
mov byte [ebx + esi], 0xa
inc ebx
add dword [ebp - 8], 2
jmp 0x401099
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
jmp 0x401099
mov esi, dword [ebp + 0xc]
movzx eax, byte [ebp - 1]
mov edx, dword [str.iomcagey]
and cl, 3
shl cl, 4
mov al, byte [eax + edx]
mov byte [ebx + esi], al
mov al, byte [ebp - 3]
mov dl, al
inc ebx
shr dl, 4
add cl, dl
test ebx, ebx
je 0x4010df
test edi, edi
jle 0x4010df
mov eax, ebx
sub eax, dword [ebp - 8]
cdq
idiv edi
test edx, edx
jne 0x4010dc
mov byte [ebx + esi], 0xd
inc ebx
mov byte [ebx + esi], 0xa
inc ebx
add dword [ebp - 8], 2
mov al, byte [ebp - 3]
mov edx, dword [str.iomcagey]
and al, 0xf
movzx ecx, cl
shl al, 2
mov cl, byte [ecx + edx]
mov byte [ebx + esi], cl
mov cl, byte [ebp - 2]
mov dl, cl
inc ebx
shr dl, 6
add al, dl
test ebx, ebx
mov byte [ebp - 1], al
je 0x401123
test edi, edi
jle 0x401123
mov eax, ebx
sub eax, dword [ebp - 8]
cdq
idiv edi
test edx, edx
jne 0x401123
mov byte [ebx + esi], 0xd
inc ebx
mov byte [ebx + esi], 0xa
inc ebx
add dword [ebp - 8], 2
movzx eax, byte [ebp - 1]
mov edx, dword [str.iomcagey]
mov al, byte [eax + edx]
mov byte [ebx + esi], al
inc ebx
cmp dword [ebp - 0xc], 2
jg 0x40113f
mov byte [ebx + esi - 1], 0x3d
and cl, 0x3f
test ebx, ebx
je 0x401164
test edi, edi
jle 0x401164
mov eax, ebx
sub eax, dword [ebp - 8]
cdq
idiv edi
test edx, edx
jne 0x401164
mov byte [ebx + esi], 0xd
inc ebx
mov byte [ebx + esi], 0xa
inc ebx
add dword [ebp - 8], 2
movzx eax, cl
mov ecx, dword [str.iomcagey]
mov al, byte [eax + ecx]
mov byte [ebx + esi], al
inc ebx
cmp dword [ebp - 0xc], 1
jg 0x40117f
mov byte [ebx + esi - 1], 0x3d
mov esi, dword [ebp - 0x14]
add esi, 3
sub dword [ebp - 0x10], 3
mov dword [ebp - 0x14], esi
jmp 0x401019
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x401198
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
and dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
push 4
push 0x40f244
call fcn.00403434
pop ecx
pop ecx
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x401282
push ebx
push esi
push edi
mov ebx, str.UiGK
push eax
push ebx
call fcn.00403464
pop ecx
mov dword [ebp - 0xc], eax
pop ecx
lea eax, [ebp - 0x110]
push 0x104
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x401276
lea eax, [ebp - 0x110]
push eax
call fcn.0040c3e8
xor edi, edi
pop ecx
cmp dword [ebp - 0xc], edi
jle 0x40126e
push edi
push ebx
call fcn.00403434
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00403b7d
add esp, 0x10
test eax, eax
je 0x401268
push 0x40fb6f
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x401268
push 2
push str.O__9_r
call fcn.00403434
pop ecx
pop ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401261
lea ecx, [ebp - 0x110]
push ecx
push dword [ebp - 4]
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
inc edi
cmp edi, dword [ebp - 0xc]
jl 0x40120f
inc dword [ebp - 8]
jmp 0x4011df
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401284
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
lea eax, [ebp + 0xc]
push esi
and dword [ebp - 4], 0
push eax
push dword [ebp + 0xc]
mov esi, 0x400
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4012b8
xor eax, eax
jmp 0x4013a4
push ebx
push edi
mov edi, str.UiGK
push 0
push edi
call fcn.00403464
pop ecx
mov dword [ebp + 8], eax
pop ecx
lea eax, [ebp - 8]
xor ebx, ebx
push eax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0xc], esi
push eax
mov dword [ebp - 8], esi
push dword [ebp - 4]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x401397
cmp dword [ebp - 0x10], 1
je 0x40130f
and byte [ebp - 0x814], al
lea eax, [ebp - 0x414]
push eax
call fcn.0040c3e8
lea eax, [ebp - 0x814]
push eax
call fcn.0040c3e8
cmp dword [ebp + 8], 0
pop ecx
pop ecx
jle 0x40138f
push ebx
push edi
call fcn.00403434
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.00403b7d
add esp, 0x10
test eax, eax
jne 0x401379
push dword [ebp - 0x14]
lea eax, [ebp - 0x814]
push eax
call fcn.00403b7d
pop ecx
test eax, eax
pop ecx
jne 0x401379
lea eax, [ebp - 0x414]
push 0x40e034
push eax
call fcn.00407280
pop ecx
test eax, eax
pop ecx
jne 0x401389
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
inc ebx
cmp ebx, dword [ebp + 8]
jl 0x40132f
inc dword [ebp - 4]
jmp 0x4012cc
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop ebx
pop esi
leave
ret 8
Function at 0x4013fa
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
push ebx
push 0x40e0c0
call fcn.00407460
xor ebx, ebx
mov dword [esp], str.M_c__
push ebx
mov dword [ebp - 0x14], eax
call fcn.004052d3
push ebx
push 0x40fba1
call fcn.00403464
add esp, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 0x444]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push dword [ebp + 8]
mov dword [ebp - 0x340], 0x224
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x340]
mov dword [ebp - 0x18], eax
push ecx
push eax
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x4015ef
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.00407370
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.0040c540
add esp, 0x10
test eax, eax
je 0x4015ef
push dword [ebp - 0x338]
push ebx
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x4015ef
push esi
mov esi, 0x80000
push edi
push esi
mov edi, 0x411970
push ebx
push edi
call fcn.00407310
mov eax, dword [ebp - 0x328]
add esp, 0xc
cmp eax, esi
jb 0x4014e1
mov eax, esi
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 8], ebx
jne 0x401506
lea ecx, [ebp - 8]
push ecx
push eax
push edi
push dword [ebp - 0x32c]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x4015e1
cmp dword [ebp - 4], ebx
mov dword [ebp + 8], ebx
jbe 0x4015e1
push dword [ebp + 8]
push 0x40fba1
call fcn.00403434
push eax
mov dword [ebp - 0x10], eax
call fcn.00407460
xor esi, esi
add esp, 0xc
cmp dword [ebp + 0xc], esi
mov ebx, eax
je 0x40153c
lea eax, [ebx + 0x6e]
mov dword [ebp - 8], eax
jmp 0x40153f
mov eax, dword [ebp - 8]
sub eax, ebx
sub eax, 0xa
je 0x4015d2
push dword [ebp - 0x14]
lea edi, [esi + 0x411970]
push edi
push 0x40e0c0
call fcn.0040c490
add esp, 0xc
test eax, eax
je 0x4015cb
cmp dword [ebp + 0xc], 0
jne 0x40158b
push ebx
push edi
push dword [ebp - 0x10]
call fcn.0040c490
add esp, 0xc
test eax, eax
je 0x40158b
mov eax, dword [ebp - 8]
inc esi
sub eax, ebx
sub eax, 0xa
cmp esi, eax
jb 0x40154a
jmp 0x4015d2
push 0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0x40fdcc
call fcn.00403434
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.00403b7d
add esp, 0x10
test eax, eax
jne 0x4015cb
lea eax, [ebp - 0x11c]
push eax
call fcn.00403dfa
pop ecx
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp + 8], eax
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
jb 0x401512
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop ebx
pop edi
pop esi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebx
leave
ret 8