joyce8/EMBER2024-capa huggingface dataset:
Function at 0x576974
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x63c8b0]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
xor eax, ebp
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
mov eax, 0x100
cmp ebx, eax
ja 0x5769c7
push eax
lea eax, [ebp - 0x104]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, ebx
jne 0x5769c7
push edi
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x5769cf
push edi
push esi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00562b6e
leave
ret 8

Function at 0x5782e8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x63c8b0]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor eax, ebp
mov esi, ecx
cmp dword [esi + 0x50], 0
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
je 0x578339
push edi
call fcn.0057d026
mov esi, eax
test esi, esi
je 0x57835d
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
jmp 0x57835d
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push 0x5bc454
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push dword [esi + 0x64]
lea eax, [ebp - 0x14]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00562b6e
leave
ret 0xc

Function at 0x57bc00
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x63c8b0]
xor eax, ebp
cmp dword [ebp + 8], 0x800
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea eax, [ebp - 0x11c]
jne 0x57bc33
push 0x5d9da4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x57bc45
push 4
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x57bc7a
lea eax, [ebp - 0x11c]
push eax
push esi
mov esi, 0x112
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.00560ac3
add esp, 0x10
cmp eax, 0xffffffff
je 0x57bc7a
cmp eax, esi
jae 0x57bc7a
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x57bc7c
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00562b6e
leave
ret
Function at 0x57bc9f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x63c8b0]
push ebx
push esi
xor eax, ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push str.kernel32.dll
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], ebx
xor esi, esi
call edi
push str.GetUserDefaultUILanguage
push eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x57bd49
call eax
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ebx, 0x3ff
mov edi, 0xfc00
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ecx, cx
and eax, edi
or eax, ecx
push eax
mov dword [ebp - 0x1c], ecx
call esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
call esi
push str.GetSystemDefaultUILanguage
push dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ebx, cx
and eax, edi
or eax, ebx
push eax
call esi
push ebx
mov dword [ebp - 0x38], eax
call esi
mov dword [ebp - 0x34], eax
push 4
xor ebx, ebx
jmp 0x57be4b
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x57bdf9
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push str.Control_PanelDesktopResourceLocale
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x57be4c
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x57bdee
cmp dword [ebp - 0x24], 1
jne 0x57bdee
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push 0x5d9db4
push eax
call fcn.00562e58
add esp, 0xc
cmp eax, 1
jne 0x57bdee
mov eax, dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x40], eax
call esi
push 2
mov dword [ebp - 0x3c], eax
pop esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x57be4c
push str.ntdll.dll
call edi
cmp eax, ebx
je 0x57be4c
lea ecx, [ebp - 0x18]
push ecx
push 0x57bc89
push 1
push 0x10
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
cmp word [ebp - 0x18], bx
je 0x57be4c
movzx eax, word [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x40], eax
call esi
mov dword [ebp - 0x3c], eax
push 2
pop esi
mov dword [ebp + esi*4 - 0x40], 0x800
inc esi
xor edi, edi
cmp esi, ebx
jle 0x57be71
push dword [ebp + edi*4 - 0x40]
mov ecx, dword [ebp - 0x2c]
call fcn.0057bc00
cmp eax, ebx
pop ecx
jne 0x57be73
inc edi
cmp edi, esi
jl 0x57be5b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00562b6e
leave
ret 4
Function at 0x57be84
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x63c578
je 0x57bf40
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x57bf28
mov esi, dword [ebx + 4]
jmp 0x57bf22
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x57bf12
cmp dword [ebp - 0xc], 4
jne 0x57bf12
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x57bf0a
or dword [eax + 0x9c], ecx
jmp 0x57bf12
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x57bed6
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x57beb9
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x57c300
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x5b6fdb
call fcn.00562c0c
sub esp, 0x124
mov eax, dword [0x63c8b0]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor eax, ebp
mov dword [ebp - 0x10], esp
lea edx, [ebp - 0x124]
mov dword [ebp - 0x14], eax
mov eax, dword [edi]
push edx
push eax
push ecx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x128], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x57c40e
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x57c3e2
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.0055e00d
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.0057c300
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.0055dc74
test bl, bl
jne 0x57c3e2
or dword [ebp - 4], 0xffffffff
jmp 0x57c34d
cmp esi, 0x103
je 0x57c3f2
cmp esi, 0x3f2
jne 0x57c402
push dword [edi]
push dword [ebp - 0x12c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00562b6e
leave
ret 8
Function at 0x57c7e2
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x57c817
cmp edi, dword [esi + 0xc]
jge 0x57c817
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x57c817
cmp edi, dword [eax + 8]
jge 0x57c817
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x57c819
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x57c91d
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x57c951
jmp fcn.005711fd
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x57c9c2
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x57cabb
cmp eax, dword [edi + 0xc]
jge 0x57cabb
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x57ca13
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x57caa4
cmp dword [ebp + 0xc], ebx
je 0x57caa4
jmp 0x57ca3d
push 0x10
call fcn.0057c6ae
cmp eax, ebx
je 0x57ca29
mov ecx, eax
call fcn.0057c914
mov esi, eax
jmp 0x57ca2b
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x57ca54
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x57ca64
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x57ca76
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.005711fd
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.00562d40
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x57cab6
cmp ecx, dword [esi + 8]
jge 0x57cab6
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x57cabc
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x57cb7a
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x57cba8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x57cbc6
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0057cae4
jmp 0x57cbc6
mov eax, dword [esi + 0x14]
test eax, eax
je 0x57cbc6
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0057cae4
test edi, edi
mov eax, edi
jne 0x57cbb0
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x7e37dc]
test ecx, ecx
je 0x57cc79
jmp 0x57cb79
ret 8

Function at 0x57d949
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
mov ebx, dword [ebp + 8]
push edi
xor edi, edi
cmp ebx, edi
jne 0x57d966
cmp dword [ebp + 0xc], edi
je 0x57da5b
push 1
push ebx
call fcn.0057d552
test eax, eax
jne 0x57da5b
push esi
push edi
push ebx
call fcn.0057d552
mov esi, eax
cmp esi, edi
jne 0x57d9b2
call fcn.0057b347
mov ecx, dword [eax + 0x30]
push 0xffffffffffffffff
call fcn.00571725
mov esi, eax
cmp esi, edi
je 0x57da5a
push edi
push 0xffffffffffffffff
mov dword [esi + 4], ebx
call fcn.0057d869
push edi
push esi
push dword [esi + 4]
call fcn.0057d7a2
movzx eax, word [ebp + 0xc]
mov ebx, dword [ebp + 0xc]
shr ebx, 0x10
dec eax
je 0x57da0b
dec eax
je 0x57da01
dec eax
dec eax
je 0x57d9f7
sub eax, 4
je 0x57d9ed
sub eax, 8
je 0x57d9e3
sub eax, 0x10
jne 0x57da5a
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x30]
jmp 0x57da5a
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x2c]
jmp 0x57da5a
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x28]
jmp 0x57da5a
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x24]
jmp 0x57da5a
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x20]
jmp 0x57da5a
mov eax, dword [esi + 4]
mov dword [ebp - 0x108], eax
lea eax, [ebp - 8]
push eax
push edi
push edi
lea eax, [ebp - 0x10c]
push eax
push edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10c], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
jne 0x57da48
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp dword [ebp + 0xc], 1
je 0x57da52
cmp ebx, edi
je 0x57da5a
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x1c]
pop esi
pop edi
pop ebx
leave
ret 8
Function at 0x57dcad
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x5b6f90
call fcn.00562c0c
sub esp, 0x198
mov eax, dword [0x63c8b0]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, ebp
push 0x57bbd5
mov ecx, 0x7e3758
mov dword [ebp - 0x10], eax
call fcn.0057c842
mov edi, eax
xor ebx, ebx
cmp dword [edi + 0xc], ebx
jne 0x57dd11
cmp esi, ebx
jne 0x57dcef
lea esi, [ebp - 0x1a0]
push esi
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, ebx
jne 0x57dd43
cmp byte [esi], 1
jne 0x57dd3d
cmp byte [esi + 1], 1
jne 0x57dd3d
mov dword [edi + 0xc], 0x57dc7a
call fcn.0057b347
mov esi, eax
cmp dword [esi + 0x30], ebx
jne 0x57dd50
push 0x1c
call fcn.005719e2
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x57dd47
push 0xa
call fcn.00571840
jmp 0x57dd49
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x57ddb3
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x30], eax
cmp dword [esi + 0x34], ebx
jne 0x57dd82
push 0x1c
call fcn.005719e2
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], 1
je 0x57dd79
push 0xa
call fcn.00571840
jmp 0x57dd7b
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x34], eax
cmp dword [esi + 0x38], ebx
jne 0x57ddb0
push 0x1c
call fcn.005719e2
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], 2
je 0x57ddab
push 0xa
call fcn.00571388
jmp 0x57ddad
xor eax, eax
mov dword [esi + 0x38], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.00562b6e
leave
ret 4
Function at 0x1004a73a
Capabilities:
Encode data using xor

Disassembly:
not eax
setnp ah
pushfd
movzx ax, cl
nop
not ah
pushal
lea eax, [0x13218489]
bswap eax
mov eax, dword [esp + 0x24]
jmp 0x1005a746
wait
invalid
hlt
push ebp
pushfd
xchg dword [esp + 0x30], eax
pushfd
mov dword [esp + 0x30], eax
mov ah, dh
setno ah
call fcn.100954a5
rcl byte [edx + 0x69c5e6ed], 0x30
add byte [ecx + 0x66], ah
mov cl, 0xe4
aam 0x8c
sub eax, 0xaae0ea31
jp 0x1005a743
jb 0x1005a72e
mov ebx, dword [ebp + 0x104330df]
pop ss
outsd dx, dword [esi]
invalid

Function at 0x100ab8b2
Capabilities:
Encode data using xor

Disassembly:
add al, dh
dec al
mov al, 0x2e
clc
repne scasb al, byte es:[edi]
push 0xe90f0853
pushal
lea esp, [esp + 0x24]
jne 0x100ab76b
mov al, 0xa6
push 0xb81afd9f
movzx ax, dl
bswap eax
mov byte [edi - 1], 0
push 0x48a2cddc
mov dword [esp + 4], ebx
push dword [esp]
lea eax, [edx*2 - 0x684a3d74]
movzx ax, bl
bswap ax
lea eax, [0x100ab547]
call fcn.100a1c01
and byte [edi], bl
rol byte [ebp + ebp*4 - 0x43344e64], cl
and ebp, 0x3c
sub bh, byte [ecx]
call [esi - 8]
pop ss
and esp, esp
adc byte [ecx - 0x1c5305b9], 0xde
retf 0x354e
mov edi, dword [edi + ecx*4]
call fcn.100a6624
mov byte [esp], 0x1f
mov dword [esp], 0x100a913a
pushal
mov word [esp + 4], 0x5902
mov dword [esp + 0x1c], eax
push esp
push 0x3faf80ff
push dword [esp + 0x24]
ret 0x28
sub edi, 4
call fcn.100aa0d2
cmp eax, 0x4f8bcb24
pushfd
mov cl, 0x33
stc
insb byte es:[edi], dx
or bh, byte [0xf75cda6b]
xchg ecx, eax
cld
mov cl, byte [ecx - 0x1c6f09d1]
push ebp
jecxz 0x100ab928
call 0xea9a5226
lodsb al, byte [esi]
xchg ecx, eax
test cl, bh
mov esi, 0xea2aab66
mov ebx, esi
xchg ecx, eax
xor bh, ch
cwde
rcr ecx, cl
jb 0x100ab8d1
loop 0x100ab925
stosb byte es:[edi], al
daa
or eax, 0xa15eac86
mov al, byte [0xc2ef664f]
in eax, 0xe8
mov ebx, 0xdc554fa2
imul ebx, edx, 0xfffffffa
or eax, 0x8928e196
jmp 0xa24b726
pop esi
insd dword es:[edi], dx
jecxz 0x100ab971
dec eax
cmpsb byte ss:[esi], byte es:[edi]
mov esp, 0x3bd67cb7
adc eax, 0xf7c70120
rcl ecx, 0xd2
push edx
movsb byte es:[edi], byte [esi]
jmp 0x100a7cda
sar al, 3
sub al, dl
jbe 0x100a5a88
mov al, 0x2e
stc
clc
repne scasb al, byte es:[edi]
pushfd
pushfd
lea esp, [esp + 8]
jne 0x100ab76b
lea eax, [0x7ce30088]
mov byte [edi - 1], 0
push ebp
lahf
seto al
push dword [esp]
mov dword [esp + 4], ebx
not al
movsx eax, al
bswap ax
lahf
lea eax, [0x100ab547]
mov byte [esp], dl
jmp 0x100aabe8
Function at 0x430005
Capabilities:
Encode data using xor

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x72e004e5
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x37934fa8
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Create process on windows
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push esi
push edi
push 0x44
xor edi, edi
pop esi
lea eax, [ebp - 0xa0]
push esi
push edi
push eax
call sub.MSVCRT.dll_memset
push 0x10
lea eax, [ebp - 0x1c]
push edi
push eax
mov dword [ebp - 0xa0], esi
call sub.MSVCRT.dll_memset
add esp, 0x18
mov word [ebp - 0x70], 5
push 1
push edi
push edi
push dword [0x4043b4]
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
mov eax, dword [0x4043bc]
jle 0x40107c
add eax, 0x60
push eax
lea eax, [ebp - 0x5c]
push 0x3f
push eax
push 0x404068
push str.IDS_OPENSUCESS
push str.CUSTOM
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x10
jmp 0x4010a0
add eax, 0x60
push eax
lea eax, [ebp - 0x5c]
push 0x104
push eax
push 0x404044
push str.IDS_OPENFAIL
push str.CUSTOM
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 3
mov ecx, dword [0x4043bc]
mov esi, 0xbb8
lea eax, [ebp - 0x5c]
push esi
push eax
push dword [0x4043b4]
call fcn.00401d37
mov ecx, dword [0x4043bc]
call fcn.00401a78
test eax, eax
je 0x401109
mov eax, dword [0x4043bc]
add eax, 0x60
push eax
lea eax, [ebp - 0xc]
push 0xa
push eax
push 0x404030
push str.SetHidOnly
push 0x404020
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
cmp eax, 1
pop ecx
jne 0x401109
mov ecx, dword [0x4043bc]
call fcn.00401ee5
push dword [0x4043b8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x4043bc]
call fcn.00401ec3
mov eax, dword [0x4043bc]
push edi
push edi
push 0x10
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
xor eax, eax
pop esi
leave
ret
Function at 0x40113f
Capabilities:
Download url
Read .ini file
Receive data

Disassembly:
mov eax, 0x402678
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x320
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esi + 0x60]
push eax
lea eax, [ebp - 0x124]
push 0x104
push eax
push 0x4042e8
push str.DownLoadFile
push 0x404020
call edi
xor ebx, ebx
lea eax, [ebp - 0x124]
mov dword [esi + 0x178], ebx
push eax
mov dword [esi + 0x17c], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jle 0x4012dc
lea eax, [ebp - 0x124]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
jne 0x4011d0
lea eax, [ebp - 0x124]
push 0x2f2f
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x4012dc
inc eax
push eax
lea eax, [ebp - 0x32c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esi + 0x60]
push eax
lea eax, [ebp - 0x228]
push 0x104
push eax
push 0x4040a8
push str.IDS_DOWNP_TITLE
push str.CUSTOM
call edi
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [esi + 0x4f8]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, esi
push 0x404088
push str.IDS_PAPARE
call fcn.004014fc
mov edi, 0x403700
push 0x10
push edi
push edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4032c0
mov dword [ebp - 0x14], ebx
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
je 0x401265
push 0x10
push edi
push 0x4036f0
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x40126b
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00401469
lea eax, [ebp - 0x32c]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call sub.MFC42.DLL_operator
mov edi, dword [ebp + 8]
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::operator
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
push dword [ebp - 0x14]
mov edi, dword [edi]
lea eax, [ebp - 0x124]
push ebx
push edi
push eax
push ebx
call sub.urlmon.dll_URLDownloadToFileA
xor ecx, ecx
cmp eax, ebx
sete cl
mov edi, ecx
mov ecx, esi
push edi
call fcn.00401db0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov eax, edi
jmp 0x4012de
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4