joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484ca0
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x490074]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], edx
mov ebx, dword [eax]
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], 0
push edi
test ebx, ebx
jne 0x484d01
push ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
push 0x40ed4d
mov byte [esi], bl
call fcn.0041a4e0
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00439f4c
mov esp, ebp
pop ebp
ret
mov eax, ebx
xor edi, edi
and eax, 3
jne 0x484d19
cmp byte [ebx + edx - 1], 0x3d
je 0x484d19
xor ecx, ecx
mov dword [esp + 0xc], ecx
jmp 0x484d34
mov ecx, 1
mov dword [esp + 0xc], ecx
cmp eax, 2
ja 0x484d32
cmp byte [ebx + edx - 2], 0x3d
jne 0x484d32
xor eax, eax
jmp 0x484d34
mov eax, ecx
sub ebx, ecx
mov dword [esp + 0x18], eax
and ebx, 0xfffffffc
mov dword [esp + 0x40], 0xf
mov ecx, ebx
mov dword [esp + 0x1c], ebx
shr ecx, 2
push 0
mov dword [esp + 0x40], edi
mov byte [esp + 0x30], 0
lea eax, [eax + ecx*2]
add eax, ecx
lea ecx, [esp + 0x30]
add eax, dword [esp + 0x10]
push eax
call fcn.0041a3d0
cmp dword [esp + 0x40], 0x10
lea eax, [esp + 0x2c]
cmovae eax, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
test ebx, ebx
je 0x484dfd
mov edx, dword [esp + 0x10]
lea eax, [ebx - 1]
mov ebx, dword [esp + 0x14]
inc edx
shr eax, 2
inc eax
mov dword [esp + 0x20], eax
mov esi, eax
nop dword [eax + eax]
movzx eax, byte [edx - 1]
lea edx, [edx + 4]
mov ecx, dword [eax*4 + 0x40f130]
movzx eax, byte [edx - 4]
shl ecx, 6
or ecx, dword [eax*4 + 0x40f130]
movzx eax, byte [edx - 3]
shl ecx, 6
or ecx, dword [eax*4 + 0x40f130]
movzx eax, byte [edx - 2]
shl ecx, 6
or ecx, dword [eax*4 + 0x40f130]
mov eax, ecx
sar eax, 0x10
mov byte [ebx + edi], al
mov eax, ecx
sar eax, 8
mov byte [ebx + edi + 1], al
mov byte [ebx + edi + 2], cl
add edi, 3
sub esi, 1
jne 0x484da0
mov esi, dword [esp + 0x24]
mov ebx, dword [esp + 0x1c]
cmp dword [esp + 0xc], 0
je 0x484e50
add ebx, dword [esp + 0x10]
movzx eax, byte [ebx]
movzx ecx, byte [ebx + 1]
mov edx, dword [eax*4 + 0x40f130]
shl edx, 6
or edx, dword [ecx*4 + 0x40f130]
mov ecx, dword [esp + 0x14]
shl edx, 0xc
mov eax, edx
sar eax, 0x10
cmp dword [esp + 0x18], 0
mov byte [ecx + edi], al
je 0x484e50
movzx eax, byte [ebx + 2]
sar edx, 8
mov eax, dword [eax*4 + 0x40f130]
shl eax, 6
sar eax, 8
or al, dl
mov byte [ecx + edi + 1], al
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
mov ecx, dword [esp + 0x40]
cmp ecx, 0x10
jae 0x484e88
mov eax, dword [esp + 0x3c]
add eax, 1
je 0x484e8e
push eax
lea eax, [esp + 0x30]
push eax
push esi
call fcn.0043b420
mov ecx, dword [esp + 0x4c]
add esp, 0xc
jmp 0x484e8e
mov eax, dword [esp + 0x2c]
mov dword [esi], eax
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x10], eax
mov eax, esi
mov dword [esi + 0x14], ecx
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00439f4c
mov esp, ebp
pop ebp
ret
Function at 0x484eb0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0xaaaaaaab
mov dword [ebp - 4], edx
push edi
mov edi, ecx
mov dword [ebp - 0x18], 0
mov esi, dword [esi]
add esi, 2
mov dword [ebp - 8], edi
mul esi
push 0x3d
shr edx, 1
shl edx, 2
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
push edx
mov byte [edi], 0
call fcn.0041a3d0
cmp dword [edi + 0x14], 0x10
jb 0x484eff
mov ebx, dword [edi]
jmp 0x484f01
mov ebx, edi
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [ebp + 8], 3
xor esi, esi
mov ecx, dword [eax]
mov eax, ecx
div dword [ebp + 8]
sub ecx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp + 8], ecx
je 0x484faf
mov ecx, dword [ebp - 4]
mov eax, 0xaaaaaaab
inc ecx
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 1]
mul ecx
mov eax, edx
mov edx, dword [ebp - 0xc]
shr eax, 1
inc eax
mov edi, eax
movzx ecx, byte [edx - 1]
lea edx, [edx + 3]
movzx eax, byte [edx - 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 2]
shl ecx, 8
or ecx, eax
mov eax, ecx
shr eax, 0x12
movzx eax, byte [eax + 0x40ee00]
mov byte [esi + ebx], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x40ee00]
mov byte [esi + ebx + 1], al
mov eax, ecx
shr eax, 6
and ecx, 0x3f
and eax, 0x3f
movzx eax, byte [eax + 0x40ee00]
mov byte [esi + ebx + 2], al
movzx eax, byte [ecx + 0x40ee00]
mov byte [esi + ebx + 3], al
add esi, 4
sub edi, 1
jne 0x484f42
mov edi, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
test edx, edx
je 0x485026
mov eax, dword [ebp - 4]
movzx ecx, byte [ecx + eax]
sub edx, 1
je 0x484fd9
mov edi, dword [ebp - 4]
mov eax, dword [ebp + 8]
shl ecx, 8
movzx eax, byte [eax + edi + 1]
mov edi, dword [ebp - 8]
or ecx, eax
mov eax, ecx
shr eax, 0xa
jmp 0x484fde
mov eax, ecx
shr eax, 2
mov al, byte [eax + 0x40ee00]
mov byte [esi + ebx], al
mov eax, ecx
test edx, edx
je 0x484ff5
shr eax, 4
and eax, 0x3f
jmp 0x484ffb
and eax, 3
shl eax, 4
mov al, byte [eax + 0x40ee00]
mov byte [esi + ebx + 1], al
test edx, edx
je 0x485020
and ecx, 0xf
mov al, byte [ecx*4 + 0x40ee00]
mov byte [ebx + esi + 2], al
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, 0x3d
mov byte [ebx + esi + 2], al
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x485090
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x40f780
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4850c2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x485188
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 1
push 0
push 0x40f7a8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x485188
mov ecx, 0x40f86c
call fcn.004851a0
test eax, eax
jne 0x485188
mov ecx, 0x40f878
call fcn.004851a0
test eax, eax
jne 0x485188
mov ecx, 0x40f884
call fcn.004851a0
test eax, eax
jne 0x48518f
mov ecx, 0x40f898
call fcn.004851a0
test eax, eax
jne 0x485188
mov ecx, 0x40f8a0
call fcn.004851a0
test eax, eax
jne 0x485188
mov ecx, 0x40f8a8
call fcn.004851a0
test eax, eax
jne 0x485188
mov ecx, 0x40f8c0
call fcn.004851a0
test eax, eax
jne 0x485188
mov ecx, 0x40f8d4
call fcn.004851a0
test eax, eax
jne 0x485188
mov ecx, 0x40f8ec
call fcn.004851a0
test eax, eax
jne 0x485188
mov ecx, 0x40f904
call fcn.004851a0
test eax, eax
jne 0x485188
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
neg eax
sbb eax, eax
inc eax
mov esp, ebp
pop ebp
ret
push 0
call fcn.0045c7eb
push 0
call fcn.0045c7eb
int3
Function at 0x401a34
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push 0xfffffffffffffff5
call sub.KERNEL32.dll_GetStdHandle
mov dword [ebp - 4], eax
push dword [ebp + 8]
call fcn.00401aa0
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call sub.KERNEL32.dll_WriteFile
mov eax, dword [ebp - 8]
leave
ret 4
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push str.drcomwall.exe
push 0
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
pop edi
je 0x401060
mov edx, dword [esp + 4]
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edx
call esi
mov eax, dword [esp + 4]
push eax
call esi
mov eax, 1
pop esi
add esp, 0x54
ret
xor eax, eax
add esp, 0x54
ret

Function at 0x401070
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [str.DrcomwallClientWndClass]
sub esp, 0x104
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
push 0
push eax
call esi
test eax, eax
jne 0x4010a4
call fcn.00401000
test eax, eax
jne 0x401099
or esi, 0xffffffff
jmp 0x4010a6
mov ecx, dword [str.DrcomwallClientWndClass]
push 0
push ecx
call esi
mov esi, eax
mov edx, dword [esp + 0x10c]
lea eax, [edx - 0x8007]
cmp eax, 7
ja case.0x4010bc.32779
jmp dword [eax*4 + 0x4011ac]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push 0x9c42
jmp 0x40110d
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push 0x9c45
jmp 0x40110d
push 0
push 0x9c46
jmp 0x40110d
push 0
push 0x41f
push 0x111
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push 0x9c41
push 0x111
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, 1
pop esi
add esp, 0x104
ret
push ebx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push 0x104
push eax
call fcn.00412430
mov edi, str.helpwall.chm
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 5
push eax
push eax
mov ecx, ebx
lea eax, [esp + 0x18]
and ecx, 3
push eax
push str.open
rep movsb byte es:[edi], byte [esi]
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop ebx
mov eax, 1
pop esi
add esp, 0x104
ret
xor eax, eax
pop esi
add esp, 0x104
ret

Function at 0x403950
Capabilities:
Log keystrokes via application hook

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x64]
test eax, eax
jne 0x403972
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push eax
lea eax, [esi + 0x40]
push 0
push eax
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [esi + 0x64], eax
pop esi
ret
Function at 0x404d10
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor edi, edi
cmp ecx, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ecx
jle 0x404d8c
push ebp
mov eax, dword [esp + 0x1c]
push esi
movsx ebp, byte [edi + eax]
call fcn.00404db0
imul eax, ebp
mov ecx, dword [esp + 0x14]
push ebx
xor ecx, eax
mov dword [esp + 0x18], ecx
call fcn.00404db0
imul eax, ebp
mov edx, dword [esp + 0x18]
mov ecx, 0x13
xor edx, eax
lea eax, [esi + 7]
mov dword [esp + 0x18], edx
add esp, 8
cdq
idiv ecx
lea eax, [ebx + 0xd]
mov ecx, 0x17
mov esi, edx
cdq
idiv ecx
mov eax, dword [esp + 0x14]
inc edi
cmp edi, eax
mov ebx, edx
jl 0x404d37
pop ebp
mov eax, dword [esp + 0xc]
mov ecx, 0x188b9
xor eax, 0x18901
pop edi
cdq
idiv ecx
pop esi
pop ebx
mov eax, edx
add esp, 8
ret

Function at 0x404dd0
Capabilities:
Modify service
Start service

Disassembly:
sub esp, 0x20
push ebp
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
mov dword [esp + 4], ebp
jne 0x404e02
push eax
push str.OpenSCManager_Error
call fcn.00409d30
add esp, 8
xor eax, eax
pop ebp
add esp, 0x20
ret
mov eax, dword [esp + 0x28]
push ebx
push esi
push edi
push 0xf01ff
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
xor esi, esi
test edi, edi
je 0x404ee9
mov eax, dword [esp + 0x38]
cmp eax, 0xffffffff
jne 0x404e42
push esi
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov esi, eax
test esi, esi
jne 0x404e63
push eax
push str.Control_start_Service__Error
jmp 0x404e5b
lea ecx, [esp + 0x14]
push ecx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov esi, eax
test esi, esi
jne 0x404e63
push eax
push str.ControlService_Error
call fcn.00409d30
add esp, 8
mov ebx, dword [esp + 0x3c]
cmp ebx, 0xffffffff
je 0x404ef8
push ebp
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov ebp, eax
push 0
test ebp, ebp
je 0x404ec7
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0xffffffffffffffff
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
mov esi, eax
test esi, esi
jne 0x404eab
push eax
push str.ChangeServiceConfig_Error
call fcn.00409d30
add esp, 8
push ebp
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
mov ebp, dword [esp + 0x10]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x20
ret
push str.the_database_is_locked_by_another_process
call fcn.00409d30
mov ebp, dword [esp + 0x18]
add esp, 8
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x20
ret
push 0
push str.OpenService_Error
call fcn.00409d30
add esp, 8
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x20
ret
Function at 0x404f10
Capabilities:
Query service status

Disassembly:
sub esp, 0x1c
xor eax, eax
mov ecx, 7
push ebx
push esi
push edi
lea edi, [esp + 0xc]
push 0xf003f
push eax
rep stosd dword es:[edi], eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x404f4d
push eax
push str.OpenSCManager_Error
call fcn.00409d30
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x1c
ret
push esi
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov ebx, eax
test ebx, ebx
jne 0x404f78
push eax
push str.the_database_is_locked_by_another_process
call fcn.00409d30
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x1c
ret
mov eax, dword [esp + 0x2c]
push ebp
push 0xf01ff
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x404fa9
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x404fa9
push edi
call ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
push esi
call ebp
mov eax, dword [esp + 0x14]
pop ebp
cmp eax, 1
je 0x404f44
test eax, eax
je 0x404f44
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x1c
ret
Function at 0x404fd0
Capabilities:
Query service configuration

Disassembly:
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x10], esi
jne 0x405004
push ebx
push str.OpenSCManager_Error
call fcn.00409d30
add esp, 8
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
push esi
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
cmp eax, ebx
mov dword [esp + 0xc], eax
jne 0x405030
push ebx
push str.the_database_is_locked_by_another_process
call fcn.00409d30
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x18]
push ebp
push edi
push 0xf01ff
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, eax
xor esi, esi
cmp ebp, ebx
je 0x40510d
push 0x1000
push 0x40
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov edi, eax
test edi, edi
je 0x405106
push 0x1000
push 0x40
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
test eax, eax
mov dword [esp + 0x10], eax
je 0x405106
lea ecx, [esp + 0x20]
push ecx
push 0x1000
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x405106
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x20]
push edx
push 0x1000
push eax
push 1
push ebp
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfig2A]
test eax, eax
je 0x405106
mov ecx, dword [edi + 0x20]
mov esi, dword [sym.imp.MSVCRT.dll__strlwr]
push ecx
call esi
mov edx, dword [edi + 0xc]
push edx
call esi
mov eax, dword [esp + 0x2c]
mov ecx, dword [edi + 0x20]
mov ebx, dword [sym.imp.MSVCRT.dll_strstr]
push eax
push ecx
call ebx
mov edx, dword [esp + 0x38]
mov esi, eax
mov eax, dword [edi + 0xc]
push edx
neg esi
sbb esi, esi
push eax
neg esi
call ebx
mov ebx, eax
add esp, 0x18
neg ebx
sbb ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_LocalFree]
neg ebx
call edi
mov ecx, dword [esp + 0x10]
push ecx
call edi
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop ebp
test esi, esi
je 0x404ffc
test ebx, ebx
je 0x404ffc
pop esi
mov eax, 1
pop ebx
add esp, 0xc
ret

Function at 0x405140
Capabilities:
Reference cloudflare dns server

Disassembly:
mov eax, dword [0x42868c]
test eax, 0x2000000
je 0x405155
xor eax, eax
mov dword [0x41e154], eax
jmp 0x405167
not eax
shr eax, 0x18
mov dword [0x41e154], 1
and eax, 1
push esi
mov dword [0x41e158], eax
push edi
mov edi, str.1.1.1.1
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x4293d8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
Function at 0x4051d0
Capabilities:
Create thread
Print debug messages

Disassembly:
mov eax, dword [0x42868c]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
push edi
mov edi, 0x800000
test edi, eax
je 0x4051ee
mov eax, dword [esp + 0x10]
push eax
call esi
mov eax, dword [0x42946c]
xor ebx, ebx
cmp eax, ebx
je 0x405203
mov dword [0x429478], 1
mov eax, dword [0x4294a0]
mov dword [0x42946c], ebx
cmp eax, ebx
je 0x40521a
mov dword [eax + 0x18], ebx
call fcn.0040d770
test byte [0x428684], 2
je 0x405239
test dword [0x42868c], edi
je 0x405232
push str.Login_Error_called__reset_driver_dog.
call esi
call fcn.00416c00
jmp 0x405242
mov ecx, dword [0x428308]
mov dword [ecx + 0x18], ebx
mov eax, dword [0x4294a8]
mov dword [0x428cc0], ebx
cmp eax, 2
mov dword [0x42842c], ebx
jne 0x405285
mov dword [0x4294a8], 3
call fcn.0040b220
lea edx, [esp + 0x10]
push edx
push ebx
push 1
push 0x40dad0
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop edi
pop esi
mov dword [0x4294a4], eax
pop ebx
ret
mov eax, dword [0x4294ac]
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
cmp eax, ebx
je 0x4052aa
mov eax, dword [0x42868c]
test ah, 0x40
je 0x4052aa
mov eax, dword [0x428cd4]
push ebx
push ebx
push 2
push eax
call edi
cmp dword [0x42949c], ebx
jne 0x405319
mov ecx, dword [0x428cc8]
mov esi, dword [sym.imp.USER32.dll_EnableMenuItem]
push ebx
push 0x13e
push ecx
call esi
mov edx, dword [0x428cc8]
push ebx
push 0x131
push edx
call esi
mov eax, dword [0x428cc8]
push ebx
push 0x143
push eax
call esi
mov ecx, dword [0x428cc8]
push ebx
push 0x130
push ecx
call esi
mov edx, dword [0x428cc8]
push ebx
push 0x12f
push edx
call esi
push 0x4b
call fcn.004047d0
push eax
call fcn.0040a1e0
push 4
call fcn.0040f0b0
add esp, 0xc
push ebx
call dword [sym.imp.USER32.dll_MessageBeep]
cmp byte [0x42949b], bl
je 0x405341
mov eax, dword [0x428394]
push ebx
push 0x12f
push 0x111
push eax
mov byte [0x42949b], bl
call edi
mov ecx, dword [0x428cd4]
push ecx
call dword [sym.imp.USER32.dll_DrawMenuBar]
push ebx
push 1
push 0x6e
call fcn.004047d0
add esp, 4
push eax
call fcn.00409d70
mov eax, dword [0x428684]
add esp, 0xc
test eax, 0x10000
je 0x40538d
call fcn.004183d0
test eax, eax
jne 0x40538d
mov edx, dword [0x428cd4]
push ebx
push 0x12f
push 0x111
push edx
call edi
mov eax, dword [0x41e194]
mov dword [0x4290d0], ebx
cmp eax, ebx
jne 0x4053bb
test dword [0x42874c], 0x2000000
je 0x4053bb
test byte [0x429498], 0x80
je 0x4053bb
mov dword [0x429478], 1
pop edi
pop esi
pop ebx
ret

Function at 0x4053c0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x405fb0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push 0xfe
push 0x424ccc
push 0x42052c
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
test eax, eax
jg 0x405fdf
mov byte [0x424ccc], 0
mov eax, 0x424ccc
ret
Function at 0x406260
Capabilities:
Resolve dns

Disassembly:
push edi
push 0x41e510
push 0x428588
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x40627f
sub eax, 0x428588
jmp 0x406290
mov edi, 0x428588
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, ecx
lea ecx, [eax + 2]
cmp ecx, 0xfc
jge 0x40630a
lea edx, [eax + 0x428589]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40630a
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x40630a
cmp word [eax + 8], 2
jne 0x40630a
mov eax, dword [eax + 0xc]
mov edx, 0x1010101
mov ecx, dword [eax]
test ecx, ecx
je 0x4062e0
mov ecx, dword [ecx]
mov dword [0x428a74], edx
mov dword [0x428688], ecx
add eax, 4
mov ecx, dword [eax]
test ecx, ecx
je 0x4062f7
mov ecx, dword [ecx]
mov dword [0x428a78], edx
mov dword [0x428a74], ecx
add eax, 4
mov eax, dword [eax]
test eax, eax
je 0x40630a
mov eax, dword [eax]
mov dword [0x428a7c], edx
mov dword [0x428a78], eax
pop edi
ret

Function at 0x406310
Capabilities:
Read file on windows
Reference cloudflare dns server

Disassembly:
sub esp, 0x108
push ebx
push esi
push edi
mov ecx, 0x1ff
xor eax, eax
mov edi, 0x428478
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x11]
mov byte [esp + 0x10], al
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push eax
call fcn.00412430
mov edi, str.ishare_user.dat
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
push eax
push 3
mov ecx, ebx
push eax
push eax
and ecx, 3
lea eax, [esp + 0x24]
push SysReAllocString
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x406429
lea ecx, [esp + 0xc]
push 0
push ecx
push 0x7fc
push 0x428478
push esi
mov dword [esp + 0x20], 0x7fc
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edx, dword [esp + 0xc]
push edx
push 1
call fcn.00406180
add esp, 8
test eax, eax
jne 0x406429
mov eax, dword [0x428688]
test eax, eax
je 0x40641d
cmp eax, 0x1010101
je 0x40641d
cmp eax, 0xffffffff
je 0x40641d
push 0x428688
mov dword [0x429490], eax
call fcn.0040a1d0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x41e198
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret
push 0x10
push 0x2d
call fcn.004047d0
add esp, 4
push eax
push 0x6b
call fcn.004047d0
add esp, 4
push eax
mov eax, dword [0x428cd4]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x108
ret