joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47e8a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, 0x4ce2cc
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x28]
shr edx, 1
add eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax + 0x28]
shr ecx, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
call fcn.00402da4
add dword [ebp - 4], 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ebx, dword [eax + 0x40]
shl ebx, 2
sub ebx, 5
test ebx, ebx
jl 0x47e961
inc ebx
mov eax, dword [ebp - 4]
mov esi, dword [eax]
mov eax, esi
shr eax, 8
and eax, 0xff
mov eax, dword [edi + eax*4]
mov edx, 8
call fcn.00463840
and esi, 0xff
xor eax, dword [edi + esi*4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
shr eax, 0x10
and eax, 0xff
mov eax, dword [edi + eax*4]
mov edx, 0x10
call fcn.00463840
pop edx
xor edx, eax
push edx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
shr eax, 0x18
mov eax, dword [edi + eax*4]
mov edx, 0x18
call fcn.00463840
pop edx
xor edx, eax
mov eax, dword [ebp - 4]
mov dword [eax], edx
add dword [ebp - 4], 4
dec ebx
jne 0x47e8f9
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x47f41c
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov dword [ebp - 4], edx
lea eax, [ebp - 0x100]
xor ecx, ecx
mov edx, 0x80
call fcn.00403550
mov dword [ebp - 8], 0x38
mov eax, 0x4ce7cc
lea edx, [ebp - 0x48]
mov bl, byte [eax]
mov ecx, ebx
and cl, 7
mov esi, 0x80
shr esi, cl
xor ecx, ecx
mov cl, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x47f470
mov byte [edx], 1
jmp 0x47f473
mov byte [edx], 0
inc edx
inc eax
dec dword [ebp - 8]
jne 0x47f44b
xor eax, eax
mov dword [ebp - 8], eax
mov esi, 0x4cf154
cmp byte [ebp + 8], 0
je 0x47f499
mov eax, 0xf
sub eax, dword [ebp - 8]
add eax, eax
mov dword [ebp - 0xc], eax
jmp 0x47f4a1
mov eax, dword [ebp - 8]
add eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0x10], eax
xor eax, eax
lea edx, [ebp - 0x80]
xor ecx, ecx
mov cl, byte [esi]
add ecx, eax
cmp ecx, 0x1c
jae 0x47f4c0
mov cl, byte [ebp + ecx - 0x48]
mov byte [edx], cl
jmp 0x47f4c6
mov cl, byte [ebp + ecx - 0x64]
mov byte [edx], cl
inc eax
inc edx
cmp eax, 0x1c
jne 0x47f4ad
mov eax, 0x1c
lea edx, [ebp - 0x64]
xor ecx, ecx
mov cl, byte [esi]
add ecx, eax
cmp ecx, 0x38
jae 0x47f4e8
mov cl, byte [ebp + ecx - 0x48]
mov byte [edx], cl
jmp 0x47f4ee
mov cl, byte [ebp + ecx - 0x64]
mov byte [edx], cl
inc eax
inc edx
cmp eax, 0x38
jne 0x47f4d5
mov ecx, 0x1000000
mov eax, 0x18
mov edx, 0x4ce804
shr ecx, 1
xor ebx, ebx
mov bl, byte [edx]
cmp byte [ebp + ebx - 0x80], 0
je 0x47f51b
mov ebx, dword [ebp - 0xc]
or dword [ebp + ebx*4 - 0x100], ecx
xor ebx, ebx
mov bl, byte [edx + 0x18]
cmp byte [ebp + ebx - 0x80], 0
je 0x47f531
mov ebx, dword [ebp - 0x10]
or dword [ebp + ebx*4 - 0x100], ecx
inc edx
dec eax
jne 0x47f504
inc dword [ebp - 8]
inc esi
cmp dword [ebp - 8], 0x10
jne 0x47f484
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x100]
mov ecx, eax
and ecx, 0xfc0000
shl ecx, 6
and eax, 0xfc0
shl eax, 0xa
or ecx, eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + eax*4 - 0x100]
mov eax, edx
and eax, 0xfc0000
shr eax, 0xa
or ecx, eax
and edx, 0xfc0
shr edx, 6
or ecx, edx
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
add dword [ebp + 0xc], 4
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x100]
mov ecx, eax
and ecx, 0x3f000
shl ecx, 0xc
and eax, 0x3f
shl eax, 0x10
or ecx, eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + eax*4 - 0x100]
mov eax, edx
and eax, 0x3f000
shr eax, 4
or ecx, eax
and edx, 0x3f
or ecx, edx
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
add dword [ebp + 0xc], 4
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x10
jne 0x47f548
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x47ff24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
add eax, eax
mov dword [ebp + 0xc], eax
lea edx, [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00473814
shr dword [ebp + 0xc], 1
lea eax, [ebp - 0xc]
xor ecx, ecx
mov edx, 8
call fcn.00403550
lea edx, [ebp - 0xc]
mov eax, ebx
mov ecx, dword [ebp + 0xc]
call fcn.00402da4
lea eax, [ebp - 0x14]
xor ecx, ecx
mov edx, 8
call fcn.00403550
lea edx, [ebp - 0x14]
mov eax, esi
mov ecx, dword [ebp + 0xc]
call fcn.00402da4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
push eax
push 0
lea edx, [ebp - 0xc]
mov ecx, 7
mov eax, dword [ebp - 4]
call fcn.0047f41c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
add eax, 0x80
push eax
push 1
lea edx, [ebp - 0xc]
mov ecx, 7
mov eax, dword [ebp - 4]
call fcn.0047f41c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
lea edx, [eax + 0x100]
lea eax, [ebp - 0x14]
mov ecx, 8
call fcn.00402da4
lea eax, [ebp - 0x1c]
xor ecx, ecx
mov edx, 8
call fcn.00403550
mov edi, 8
lea esi, [ebp - 0xc]
mov bl, byte [ebp - 0x1c]
xor bl, byte [ebp - 0x1b]
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x1b]
mov ecx, 7
call fcn.00402da4
xor eax, eax
mov al, bl
mov al, byte [eax + 0x4cf164]
xor al, byte [esi]
mov byte [ebp - 0x15], al
inc esi
dec edi
jne 0x47ffe9
mov edi, 8
lea esi, [ebp - 0x14]
mov bl, byte [ebp - 0x1c]
xor bl, byte [ebp - 0x1b]
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x1b]
mov ecx, 7
call fcn.00402da4
xor eax, eax
mov al, bl
mov al, byte [eax + 0x4cf164]
xor al, byte [esi]
mov byte [ebp - 0x15], al
inc esi
dec edi
jne 0x48001a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
lea edx, [eax + 0x108]
lea eax, [ebp - 0x1c]
mov ecx, 8
call fcn.00402da4
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4800b4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ecx, 0x4cf034
mov esi, 8
mov bl, byte [eax]
xor bl, byte [edx]
and ebx, 0xff
mov bl, byte [ecx + ebx]
xor byte [eax + 4], bl
inc edx
mov bl, byte [eax + 1]
xor bl, byte [edx]
and ebx, 0xff
mov bl, byte [ecx + ebx]
xor byte [eax + 5], bl
inc edx
mov bl, byte [eax + 2]
xor bl, byte [edx]
and ebx, 0xff
mov bl, byte [ecx + ebx]
xor byte [eax + 6], bl
inc edx
mov bl, byte [eax + 3]
xor bl, byte [edx]
and ebx, 0xff
mov bl, byte [ecx + ebx]
xor byte [eax + 7], bl
inc edx
mov bl, byte [eax + 4]
xor bl, byte [edx]
and ebx, 0xff
mov bl, byte [ecx + ebx]
xor byte [eax + 1], bl
inc edx
mov bl, byte [eax + 5]
xor bl, byte [eax + 4]
and ebx, 0xff
mov bl, byte [ecx + ebx]
xor byte [eax + 2], bl
mov bl, byte [eax + 6]
xor bl, byte [edx]
and ebx, 0xff
mov bl, byte [ecx + ebx]
xor byte [eax + 3], bl
inc edx
mov bl, byte [eax + 7]
xor bl, byte [edx]
and ebx, 0xff
mov bl, byte [ecx + ebx]
xor byte [eax], bl
inc edx
dec esi
jne 0x4800c0
mov bl, byte [eax]
xor bl, byte [edx]
and ebx, 0xff
mov bl, byte [ecx + ebx]
xor byte [eax + 4], bl
inc edx
mov bl, byte [eax + 1]
xor bl, byte [edx]
and ebx, 0xff
mov bl, byte [ecx + ebx]
xor byte [eax + 5], bl
inc edx
mov bl, byte [eax + 2]
xor bl, byte [edx]
and ebx, 0xff
mov bl, byte [ecx + ebx]
xor byte [eax + 6], bl
inc edx
mov bl, byte [eax + 3]
xor bl, byte [edx]
xor edx, edx
mov dl, bl
mov dl, byte [ecx + edx]
xor byte [eax + 7], dl
pop esi
pop ebx
ret
Function at 0x484320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x48434f
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x4843ce
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004822bc
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x48439c
mov cx, word [esp]
sub cx, si
jmp 0x48439e
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x484385
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4843c4
mov cx, word [esp]
sub cx, si
jmp 0x4843c6
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4843ad
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x48442b
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.00483ff4
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x484416
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x48442b
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x48432a
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48c300
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x407d38]
call fcn.0040557c
xor eax, eax
push ebp
push 0x48c444
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4d2a00], 0
jne 0x48c353
mov ecx, dword [0x4d2d14]
mov dl, 1
mov eax, dword [0x4081e0]
call fcn.0040cdb4
call fcn.004044d8
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403550
mov eax, ebx
call fcn.00405428
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x48c454
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004066dc
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00405438
test eax, eax
jle 0x48c3eb
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x48c3e4
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404e0c
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404df4
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00409168
test eax, eax
jne 0x48c3e4
mov ebx, 0x15
jmp 0x48c3f0
mov ebx, 0x10
jmp 0x48c3f0
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4d2a00]
call fcn.0048c258
mov eax, dword [ebp - 8]
call fcn.0048c258
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004066f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c44b
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404ba8
lea eax, [ebp - 0x10]
mov edx, dword [0x407d38]
call fcn.0040564c
ret

Function at 0x48f6e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff28
push ebx
push esi
xor eax, eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xd4], eax
xor eax, eax
push ebp
push 0x48f7ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [0x48f7bc]
mov byte [ebp - 1], al
push 0xc8
lea eax, [ebp - 0xc9]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
xor ebx, ebx
mov esi, 0x4d2a80
lea eax, [ebp - 0xd4]
lea edx, [ebp - 0xc9]
mov ecx, 0xc8
call fcn.00404df4
mov eax, dword [ebp - 0xd4]
lea edx, [ebp - 0xd0]
call fcn.0040d9f8
lea eax, [ebp - 0xd0]
mov edx, dword [esi]
call fcn.00404e4c
mov eax, dword [ebp - 0xd0]
call fcn.00409988
test al, al
je 0x48f785
mov edx, ebx
lea eax, [ebp - 0xd8]
mov cl, 1
call fcn.00403848
mov al, byte [ebp - 0xd8]
or al, byte [ebp - 1]
mov byte [ebp - 1], al
inc ebx
add esi, 4
cmp bl, 3
jne 0x48f727
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f7b3
lea eax, [ebp - 0xd4]
mov edx, 2
call fcn.00404ba8
ret
Function at 0x4a3240
Capabilities:
Get socket status

Disassembly:
add esp, 0xfffffefc
mov dword [esp], 1
mov dword [esp + 4], eax
push 0x4d4edc
push 0
push 0
lea eax, [esp + 0xc]
push eax
push 0
call sub.wsock32.dll_select
test eax, eax
setg al
add esp, 0x104
ret

Function at 0x4a32e4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [ebp + 0xc]
push ebx
lea ebx, [ebp - 0x10]
push ebx
mov ebx, dword [ebp + 0x14]
push ebx
push ecx
push edx
push eax
call sub.wsock32.dll_sendto
mov ebx, eax
mov eax, ebx
call fcn.004a2efc
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4a337c
Capabilities:
Get socket status

Disassembly:
push esi
push edi
add esp, 0xfffffef4
mov esi, ecx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
test dl, dl
je 0x4a33ae
push esp
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
call sub.wsock32.dll_select
jmp 0x4a33bf
push esp
push 0
lea eax, [esp + 0x10]
push eax
push 0
push 0
call sub.wsock32.dll_select
add esp, 0x10c
pop edi
pop esi
ret

Function at 0x4a33f4
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
add esp, 0xffffffec
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
push ebx
call sub.wsock32.dll_getsockname
test eax, eax
jne 0x4a3420
mov ax, word [esp + 6]
call fcn.004a3a10
movzx eax, ax
jmp 0x4a3422
xor eax, eax
add esp, 0x14
pop ebx
ret

Function at 0x4a9764
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x4a979c]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4a977a
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4a9789
or bl, 4
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4a9798
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x4aab38
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4d307c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4aab5e
push 0
mov eax, dword [0x4d307c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
ret
Function at 0x40c901
Capabilities:
Print debug messages
Set environment variable

Disassembly:
mov eax, dword [0x41504c]
push esi
push 0xff78
push 0x40
mov esi, ecx
call eax
mov edx, dword [esi]
mov ecx, eax
call fcn.0040f6d4
mov edx, dword [0x41541c]
mov ecx, eax
call fcn.0040f6d4
mov edx, dword [0x41541c]
mov ecx, eax
call fcn.0040f6d4
mov edx, dword [0x41541c]
mov ecx, eax
pop esi
jmp fcn.0040f6d4
Function at 0x40e893
Capabilities:
Print debug messages
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push str.ev_bj3j57db
xor ebx, ebx
mov edi, ecx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.XMLk3qw2tet
push 1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push ebx
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.WTMR_brv0m6mj
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.MTXy0tqqfbm
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x40e939
push str.gy3il5ab
push str.61ijgusu
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.reg5jw78kca
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x40e93b
call ebx
xor eax, eax
push eax
push 0xd1a
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.0umr1pzk
push str.ciz31gwo
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0x45
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov eax, dword [0x41504c]
push 0x41
push 0x40
call eax
and dword [ebp - 4], 0
mov ebx, eax
mov esi, ebx
sub esi, edi
cmp byte [edi], 0x20
je 0x40ea41
push str.026a5795a867a184e82f15f57faab366
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, eax
xor edx, edx
mov eax, dword [ebp - 4]
div ecx
mov cl, byte [edi]
mov eax, dword [ebp - 4]
xor cl, byte [edx + str.026a5795a867a184e82f15f57faab366]
inc eax
mov byte [esi + edi], cl
inc edi
mov dword [ebp - 4], eax
cmp eax, 0x40
jb 0x40e989
mov edi, dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
push str.WTMR_xcyik9up
push 1
push 0
call edi
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.regu9moraoy
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test esi, esi
je 0x40e9f9
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x40e9ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.wpymadjj
push str.yhxeq907
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.WTMR_1t3k8t8h
push 1
push 0
call edi
push str.tx23igu6v
mov esi, eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push str.SMPHR_c3q31ata
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
jmp 0x40ea45
mov byte [esi + edi], 0
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x40ead8
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
xor ebx, ebx
push str.XML5etlv74a
push 1
push ebx
push ebx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push ebx
push 1
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.67g73l7u
push str.ek1fmvtx
call ebx
push str.SMPHR_you9lq2s
push 1
push 0
push 0
call edi
xor edi, edi
push edi
push 1
push eax
call esi
test eax, eax
je 0x40eb48
lea eax, [ebp - 4]
push eax
push 0x20019
push edi
push str.reg12or90i2
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x148]
push eax
push str.s_rdla9yhl
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.ev_9votuiel
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push str.MTXkki2bsfd
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40eb9a
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x40eba6
push str.poxosjkw
push str.ix7r6bg7
call ebx
mov ecx, dword [0x415170]
mov esi, str.stasvasbas
push esi
push edi
push 0x1f0001
call ecx
test eax, eax
jne 0x40ebcc
push esi
push edi
push edi
call dword [0x415108]
xor eax, eax
inc eax
jmp 0x40ebce
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ebd3
Capabilities:
Print debug messages
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push str.ev_hwwyjjie
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x71
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esi, eax
push str.tllbhhk2j
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push str.MTXeh2rzj0d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x40ec41
push str.t26x658gu
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 8
pop esi
push str.tnyih57xw
call ebx
sub esi, 1
jne 0x40ec4a
xor ebx, ebx
push ebx
push 0x605
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push str.qkuxthna
push str.d9h8j3a6
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov esi, dword [0x415128]
lea eax, [ebp - 8]
push eax
push 8
mov dword [ebp - 4], ebx
call dword [0x415048]
push eax
call esi
test eax, eax
je 0x40ed12
mov eax, dword [0x415030]
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 4]
push ebx
push edi
push dword [ebp - 8]
call eax
test eax, eax
jne 0x40ecb8
call dword [0x4150b8]
cmp eax, 0x7a
jne 0x40ed12
push dword [ebp - 4]
mov eax, dword [0x415098]
push 0x40
call eax
mov ecx, dword [0x415030]
mov esi, eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push edi
push dword [ebp - 8]
call ecx
test eax, eax
je 0x40ed12
mov eax, dword [0x41505c]
lea ecx, [ebp - 0xc]
push ecx
mov dword [ebp - 0xc], ebx
push dword [esi]
call eax
test eax, eax
je 0x40ed12
push dword [ebp - 0xc]
mov eax, dword [0x41511c]
push dword [0x415580]
call eax
test eax, eax
push esi
cmovne edi, ebx
call dword [0x4150e0]
mov eax, edi
jmp 0x40ed14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ed19
Capabilities:
Print debug messages
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
xor eax, eax
push ebx
push esi
push eax
push 0x7b6
push eax
push 4
push eax
push 0xffffffffffffffff
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push str.9atgtoew
push str.habcdsl5
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.tu7wt8nzk
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x140]
push eax
push str.s_i7yskxaw
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push str.XMLborpyzmr
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push str.yik9mfrx
push str.rsdzw03h
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push str.WTMR_o64ygos5
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
test eax, eax
je 0x40edbb
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push 0xba0
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x415020]
lea ecx, [ebp - 0x390]
push ecx
push ebx
call eax
xor ecx, ecx
cmp eax, 0xffffffff
pop esi
setne cl
mov eax, ecx
pop ebx
leave
ret