joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4056b0
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4058e0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405733
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4058e0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x405733
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4058fc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4057bc
xor eax, eax
push ebp
push 0x4057b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004054ec
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40579a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x40591c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40579a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4057bc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4058d6
cmp byte [ebp - 0xd], 0
jne 0x405803
cmp byte [ebp - 0x12], 0
je 0x4058d6
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x40581c
dec ebx
cmp byte [ebx], 0x2e
je 0x40582b
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40581b
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4058d6
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405868
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4058d6
cmp byte [ebp - 0xd], 0
je 0x4058d6
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4058d6
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406520
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004048f4
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x406539
test al, 0x10
je 0x40653d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x4066d0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, ebx
mov edx, esp
mov ecx, 0x104
call fcn.00404708
add esp, 0x104
pop ebx
ret

Function at 0x406700
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004048f4
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
setne al
pop ebx
ret

Function at 0x4069a0
Capabilities:
Encrypt data using rc6

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
lea edx, [esp + 4]
mov eax, dword [0x41a8b4]
mov ecx, 0x40
call fcn.00402f80
mov dword [0x41a800], 0xb7e15163
mov ebx, 0x2b
mov eax, 0x41a800
mov edx, dword [eax]
add edx, 0x9e3779b9
mov dword [eax + 4], edx
add eax, 4
dec ebx
jne 0x4069ce
xor ebx, ebx
xor edi, edi
xor esi, esi
xor ebp, ebp
mov dword [esp], 0x84
mov eax, dword [ebx*4 + 0x41a800]
add eax, esi
add eax, ebp
mov edx, 3
call fcn.00406868
mov esi, eax
mov dword [ebx*4 + 0x41a800], esi
lea edx, [ebp + esi]
mov eax, dword [esp + edi*4 + 4]
add eax, esi
add eax, ebp
call fcn.00406868
mov ebp, eax
mov dword [esp + edi*4 + 4], ebp
lea eax, [ebx + 1]
mov ecx, 0x2c
cdq
idiv ecx
mov ebx, edx
inc edi
and edi, 0x8000000f
jns 0x406a3e
dec edi
or edi, 0xfffffff0
inc edi
dec dword [esp]
jne 0x4069ee
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x406a90
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov eax, dword [0x41a8ac]
sub dword [ebx + 8], eax
mov eax, dword [0x41a8a8]
sub dword [ebx], eax
mov esi, 0x14
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 8]
mov dword [ebx + 0xc], edx
mov edx, dword [ebx + 4]
mov dword [ebx + 8], edx
mov edx, dword [ebx]
mov dword [ebx + 4], edx
mov dword [ebx], eax
mov eax, dword [ebx + 0xc]
mov edx, eax
add eax, eax
inc eax
imul edx, eax
mov eax, edx
mov edx, 5
call fcn.00406868
mov ebp, eax
mov eax, dword [ebx + 4]
mov edx, eax
add eax, eax
inc eax
imul edx, eax
mov eax, edx
mov edx, 5
call fcn.00406868
mov edi, eax
mov eax, dword [ebx + 8]
mov edx, esi
add edx, edx
sub eax, dword [edx*4 + 0x41a804]
mov edx, edi
call fcn.0040687c
xor eax, ebp
mov dword [ebx + 8], eax
mov eax, dword [ebx]
mov edx, esi
add edx, edx
sub eax, dword [edx*4 + 0x41a800]
mov edx, ebp
call fcn.0040687c
xor edi, eax
mov dword [ebx], edi
dec esi
test esi, esi
jne 0x406aaa
mov eax, dword [0x41a804]
sub dword [ebx + 0xc], eax
mov eax, dword [0x41a800]
sub dword [ebx + 4], eax
mov al, 1
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x407b38
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x407b8a
test eax, edx
je 0x407b8d
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x407b4d
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x407b73
add ecx, 4
js 0x407b63
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x407b70
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x407b99
test edx, edx
jne 0x407b40
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40aa8c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40aac5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404588
jmp 0x40aace
mov eax, ebx
mov edx, esi
call fcn.004044ec
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40aad8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40aafa
movzx eax, byte [esp]
jmp 0x40aafc
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b18c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b004
mov eax, dword [0x417c24]
cmp byte [eax], 0
je 0x40b208
mov eax, dword [0x417b34]
call fcn.00403284
call fcn.00402eec
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408388
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b250
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b23e
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x417b10]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x41a7f0]
call fcn.00405494
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x415070
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x1008], ecx
mov dword [ebp - 0x1004], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x415137
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1000]
mov ecx, 0x20
mov edx, 0x1000
call fcn.004032e8
sub ebx, 1
jb 0x4150c0
je 0x4150f6
dec ebx
je 0x4150ff
jmp 0x415119
lea eax, [ebp - 0x1000]
push eax
push 0x1000
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x1004]
lea edx, [ebp - 0x1000]
mov ecx, 0x1000
call fcn.00404588
mov eax, dword [ebp - 0x1004]
mov edx, esi
call fcn.00407ca4
jmp 0x415119
mov eax, esi
call fcn.0041503c
jmp 0x415119
lea edx, [ebp - 0x1008]
xor eax, eax
call fcn.0040317c
mov eax, dword [ebp - 0x1008]
mov edx, esi
call fcn.00408238
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41513e
lea eax, [ebp - 0x1008]
mov edx, 2
call fcn.004044bc
ret

Function at 0x415144
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
add esp, 0xffffff9c
mov esi, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0xc
call fcn.004032e8
lea eax, [esp + 0x10]
xor ecx, ecx
mov edx, 0x44
call fcn.004032e8
mov dword [esp + 4], 0xc
xor eax, eax
mov dword [esp + 0xc], eax
xor ebx, ebx
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0x10], 0x44
mov dword [esp + 0x3c], 1
mov word [esp + 0x40], 0
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x20
cmp bl, 1
cmc
sbb eax, eax
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x20]
push eax
mov eax, esi
call fcn.004048f4
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4151e1
push 0x30
push 0x415218
push 0x415220
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x41520c
push 0xffffffffffffffff
mov eax, dword [esp + 0x58]
push eax
call sub.kernel32.dll_WaitForSingleObject
push esp
mov eax, dword [esp + 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [esp + 0x58]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [esp + 0x54]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [esp]
add esp, 0x64
pop esi
pop ebx
ret
Function at 0x41523c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x41da08
mov esi, 0x41da0c
mov edi, 0x41da10
mov ebp, 0x41da20
mov eax, 0x41535c
call fcn.00406a4c
call fcn.004069a0
mov eax, dword [0x41d9fc]
push eax
call sub.kernel32.dll_LockResource
mov dword [0x41da00], eax
mov eax, dword [0x41d9f8]
push eax
mov eax, dword [0x41a7f0]
push eax
call sub.kernel32.dll_SizeofResource
call fcn.00402dc4
mov dword [0x41da04], eax
mov eax, dword [0x41da00]
mov dword [ebx], eax
mov eax, dword [0x41da04]
mov dword [esi], eax
mov dword [ebp], 0
mov dword [ebp + 4], 0
mov eax, dword [0x41d9f8]
push eax
mov eax, dword [0x41a7f0]
push eax
call sub.kernel32.dll_SizeofResource
xor edx, edx
mov dword [0x41da28], eax
mov dword [0x41da2c], edx
jmp 0x415304
mov edx, edi
mov eax, dword [ebx]
mov ecx, 0x10
call fcn.00402f80
mov eax, edi
call fcn.00406a90
mov edx, dword [esi]
mov eax, edi
mov ecx, 0x10
call fcn.00402f80
add dword [ebp], 0x10
adc dword [ebp + 4], 0
mov eax, dword [ebx]
add eax, 0x10
mov dword [ebx], eax
mov eax, dword [esi]
add eax, 0x10
mov dword [esi], eax
mov eax, dword [0x41da28]
mov edx, dword [0x41da2c]
sub eax, dword [ebp]
sbb edx, dword [ebp + 4]
cmp edx, 0
jne 0x415322
cmp eax, 0x10
jae 0x4152cb
jmp 0x415324
jge 0x4152cb
call fcn.00406a84
mov eax, dword [0x41da04]
xor edx, edx
add eax, dword [0x41da28]
adc edx, dword [0x41da2c]
sub eax, 1
sbb edx, 0
mov dword [ebx], eax
mov eax, dword [ebx]
movzx eax, byte [eax]
mov byte [0x41da34], al
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5a1d7cf5
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, str.Y7b
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x371931d2
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x430004
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x75267d6a
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x690b52af
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x74bc06c7
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x4097436e
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401699
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 4, 0
mov esi, eax
mov edx, dword [0x403050]
mov ebx, eax
xor edx, eax
mov eax, 0x403054
call fcn.00401606
lea edx, [ebp - 4]
push edx
mov edx, esi
or dl, 0x40
mov edi, 0x402acd
push edx
sub edi, fcn.00402298
push edi
xor eax, eax
push fcn.00402298
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp - 4], 0
je 0x401729
mov eax, fcn.00402298
mov ebx, esi
mov edx, edi
call fcn.00401606
mov edx, 0x1be00
mov eax, 0x403054
mov ebx, esi
call fcn.00401880
jmp 0x401729
leave
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x401f9a
Capabilities:
Delete file
Encode data using base64 via winapi
Get common file path
Initialize winsock library

Disassembly:
push ecx
push edx
enter 0x2cc, 0
push 0x104
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea eax, [ebp - 0x2cc]
push eax
push 2
call dword [sym.imp.WS2_32.DLL_WSAStartup]
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp - 0x1c], 6
xor eax, eax
push 0x7f00
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], eax
push eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.USER32.DLL_LoadCursorA]
push 0x7f00
push 0
mov dword [ebp - 0x20], eax
call dword [sym.imp.USER32.DLL_LoadIconA]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.DLL_RegisterClassA]
push 0
push 0
call dword [sym.imp.USER32.DLL_LoadAcceleratorsA]
push 0
push 0
call dword [sym.imp.SHLWAPI.DLL_PathAppendW]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push 1
lea eax, [ebp - 0x13c]
push eax
mov dword [ebp - 4], 0xa
mov byte [ebp - 0x13c], 0
call dword [sym.imp.CRYPT32.DLL_CryptBinaryToStringA]
push 0
call dword [sym.imp.USER32.DLL_GetDC]
call dword [sym.imp.WS2_32.DLL_WSACleanup]
movzx eax, byte [ebp - 0x10]
sub eax, 0x47
add eax, dword [ebp - 4]
leave
pop edx
pop ecx
ret

Function at 0xf4ec18
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf4ec22
pushal
call 0xf4ec28
pop ebp
sub ebp, 0x10
sub ebp, 0xb4ec18
jmp 0xf4ec3e
mov eax, 0xb4ec18
add eax, ebp
add eax, 0x4c
mov ecx, 0x5aa
mov edx, 0x9265c72b
xor byte [eax], dl
inc eax
dec ecx
jne 0xf4ec55
jmp 0xf4ec68
mov al, byte [0x17a2a0e6]
sub ebp, dword [ebx]
sub ebp, dword [edx + 0x2b2bd3ea]
sub ebp, dword [eax]
out 0x93, al
and ch, byte [ebx]
sub ebp, dword [ebx]
xchg ecx, eax
add ebp, dword [ebx]
sub ebp, dword [ebx]
fmul st(1), st(0)
sub bl, ah
mov al, byte [0x2b2b27aa]
sub ebp, dword [eax]
out dx, al
cmpsb byte [esi], byte es:[edi]
dec edi
invalid
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x401880
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
call fcn.00401bdb
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 8], 3
mov esi, eax
jl 0x40197b
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x4020e4
push dword [esi + 4]
call sub.ntdll.dll_swscanf_s
add esp, 0xc
cmp eax, 1
jne 0x40197b
mov eax, dword [esi + 4]
push edi
cmp word [eax], 0x30
jne 0x4018f3
movzx eax, word [eax + 2]
cmp eax, 0x78
je 0x4018ec
cmp eax, 0x58
jne 0x4018f3
mov eax, dword [ebp - 4]
mov edi, eax
jmp 0x401917
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
jne 0x401904
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 4], eax
push eax
push 0
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov eax, dword [ebp - 4]
test edi, edi
jne 0x40193a
test eax, eax
je 0x40192d
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
pop edi
mov eax, 0x57
pop esi
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 8], 3
mov dword [ebp - 0xc], 0
jle 0x40194c
mov eax, dword [esi + 0xc]
jmp 0x40194e
xor eax, eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
push 0
push eax
push dword [esi + 8]
push edi
call fcn.004012b0
add esp, 0x1c
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, 0x57
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1000130a
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp esi, 0xffffffff
je 0x10001342
push 2
push esi
call dword [sym.imp.WS2_32.dll_shutdown]
xor eax, eax
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0x80
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop esi
leave
ret

Function at 0x10001442
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10025014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x100
xor esi, esi
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.1000a7f0
add esp, 0xc
cmp dword [0x10028528], esi
je 0x100014a2
lea ecx, [ebp - 0x108]
call fcn.10004a02
test eax, eax
jne 0x100014a2
push 0x1388
push dword [0x10028520]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100014ba
cmp dword [0x1002851c], esi
jne 0x10001476
push esi
push esi
push esi
push 0x10002d18
push esi
push esi
call fcn.1000c6ba
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x100014bf
xor eax, eax
inc eax
jmp 0x10001508
call fcn.10002641
xor eax, eax
lea edi, [ebp - 0x118]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 1
call fcn.100060a1
push 0x3e8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100014ff
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10008f85
leave
ret