joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a55e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x5a575e
mov eax, dword [ebp + 8]
dec edi
push ebx
shr edi, 3
push esi
mov esi, dword [ebp + 0xc]
lea ebx, [eax + 0xc]
lea edx, [eax + 0x14]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], edx
inc edi
nop
movzx eax, byte [esi + 1]
lea esi, [esi + 8]
movzx ecx, byte [esi - 8]
shl eax, 8
or ecx, eax
movzx eax, byte [esi - 6]
shl eax, 0x10
or ecx, eax
movzx eax, byte [esi - 5]
shl eax, 0x18
or ecx, eax
movzx eax, byte [esi - 3]
shl eax, 8
mov dword [ebp + 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], ecx
movzx ecx, byte [esi - 4]
or ecx, eax
movzx eax, byte [esi - 2]
shl eax, 0x10
or ecx, eax
movzx eax, byte [esi - 1]
shl eax, 0x18
or ecx, eax
movzx eax, byte [ebx]
and al, 0xdf
mov dword [ebp - 4], ecx
or al, 0x40
mov dword [ebp - 0x10], ecx
mov byte [ebx], al
movzx eax, byte [edx]
and al, 0xbf
mov dword [ebp - 0x18], ecx
or al, 0x20
push ebx
mov byte [edx], al
call fcn.0050d9d0
lea eax, [ebp - 0x9c]
push eax
push ebx
call fcn.0050d790
push 1
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0054c850
mov ebx, dword [ebp - 8]
push ebx
call fcn.0050d9d0
lea eax, [ebp - 0x9c]
push eax
push ebx
call fcn.0050d790
push 1
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0054c850
mov ecx, dword [ebp - 4]
add esp, 0x30
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x10]
xor edx, ecx
xor ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
xor ebx, eax
mov dword [ebp - 4], ecx
xor eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword [ebp + 0x10], eax
mov byte [ecx], al
shr eax, 8
mov byte [ecx + 1], al
mov eax, dword [ebp + 0x10]
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, dword [ebp + 0x10]
shr eax, 0x18
mov byte [ecx + 3], al
mov eax, edx
mov byte [ecx + 4], dl
shr eax, 8
mov byte [ecx + 5], al
mov eax, edx
shr eax, 0x10
mov byte [ecx + 6], al
mov eax, ebx
shr edx, 0x18
mov byte [ecx + 7], dl
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
shr eax, 8
mov byte [ecx + 1], al
mov eax, ebx
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, edx
shr eax, 8
mov byte [ecx + 5], al
mov eax, edx
mov byte [ecx], bl
shr ebx, 0x18
mov byte [ecx + 4], dl
shr edx, 0x18
shr eax, 0x10
mov byte [ecx + 3], bl
mov ebx, dword [ebp - 0xc]
mov byte [ecx + 7], dl
mov edx, ecx
mov byte [ecx + 6], al
sub edi, 1
jne 0x5a5610
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x5a58b0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x4c
push 0
lea eax, [esi + 0x14]
push eax
call fcn.005d6d60
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov eax, 1
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
pop esi
pop ebp
ret
Function at 0x5a98c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov ecx, dword [edx + 4]
mov esi, edx
push edi
mov edi, dword [ebp + 0x10]
cmp ecx, dword [edi + 4]
cmovge esi, edi
cmovge edi, edx
mov dword [ebp + 0xc], esi
push dword [edi + 4]
push ebx
call fcn.004f89c0
add esp, 8
test eax, eax
jne 0x5a98f5
pop edi
pop esi
pop ebx
pop ebp
ret
xor eax, eax
cmp dword [esi + 4], eax
jle 0x5a9918
nop dword [eax]
mov ecx, dword [esi]
mov edx, dword [edi]
mov esi, dword [ecx + eax*4]
xor esi, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], esi
inc eax
mov esi, dword [ebp + 0xc]
cmp eax, dword [esi + 4]
jl 0x5a9900
mov ecx, dword [edi + 4]
cmp eax, ecx
jge 0x5a9932
nop
mov ecx, dword [edi]
mov edx, dword [ebx]
mov ecx, dword [ecx + eax*4]
mov dword [edx + eax*4], ecx
inc eax
mov ecx, dword [edi + 4]
cmp eax, ecx
jl 0x5a9920
push ebx
mov dword [ebx + 4], ecx
call fcn.004f87f0
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5af4b0
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x4c
push 0
lea eax, [esi + 0x20]
push eax
call fcn.005d6d60
add esp, 0xc
mov dword [esi], 0xc1059ed8
mov dword [esi + 4], 0x367cd507
mov eax, 1
mov dword [esi + 8], 0x3070dd17
mov dword [esi + 0xc], 0xf70e5939
mov dword [esi + 0x10], 0xffc00b31
mov dword [esi + 0x14], 0x68581511
mov dword [esi + 0x18], 0x64f98fa7
mov dword [esi + 0x1c], 0xbefa4fa4
mov dword [esi + 0x6c], 0x1c
pop esi
pop ebp
ret

Function at 0x5af800
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x4c
push 0
lea eax, [esi + 0x20]
push eax
call fcn.005d6d60
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov eax, 1
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
pop esi
pop ebp
ret

Function at 0x5af970
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.005afa40

Function at 0x5af980
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0x30
mov eax, 1
pop ebp
ret
Function at 0x5aff40
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0x40
mov eax, 1
pop ebp
ret

Function at 0x5cbdcd
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005cbc43

Function at 0x5cff6e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005cfac1

Function at 0x5da670
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0x10
push dword [ebp + 8]
mov edi, ecx
push dword [edi]
call dword [sym.imp.WS2_32.dll_connect]
mov esi, eax
test esi, esi
je 0x5da6c3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [0x6a3d5c]
cmp eax, 0x2733
mov ecx, 0xb
cmove eax, ecx
mov ecx, dword fs:[0x2c]
mov ecx, dword [ecx + edx*4]
mov dword [ecx + 0x7c], eax
cmp esi, 0xffffffff
jne 0x5da6bb
mov dword [edi + 4], eax
pop edi
mov eax, esi
pop esi
pop ebp
ret 4
pop edi
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x5dac20
Capabilities:
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
lea eax, [ebp - 0x190]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edx, eax
test edx, edx
je 0x5dac68
mov ecx, dword fs:[0x2c]
cmp edx, 0x2733
mov eax, 0xb
cmove edx, eax
mov eax, dword [0x6a3d5c]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x7c], edx
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x5dacaf
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [0x6a3d5c]
cmp eax, 0x2733
mov ecx, 0xb
cmove eax, ecx
mov ecx, dword fs:[0x2c]
mov ecx, dword [ecx + edx*4]
mov dword [ecx + 0x7c], eax
call dword [sym.imp.WS2_32.dll_WSACleanup]
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
inc dword [0x6a48c8]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x5dad90
Capabilities:
Convert ip address from string
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor eax, eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx ecx, word [edi]
cmp ecx, 2
setne al
lea eax, [eax*4 + 4]
add eax, edi
push eax
push esi
push ecx
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jne 0x5dae49
movzx eax, word [edi]
xorps xmm0, xmm0
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x20]
mov dword [ebp + 0xc], 0
push eax
push 0
push esi
movups xmmword [ebp - 0x10], xmm0
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x5dae21
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [0x6a3d5c]
cmp eax, 0x2733
mov ecx, 0xb
cmove eax, ecx
mov ecx, dword fs:[0x2c]
pop edi
pop esi
mov ecx, dword [ecx + edx*4]
mov dword [ecx + 0x7c], eax
xor al, al
mov esp, ebp
pop ebp
ret
cmp word [edi], 2
mov ecx, 0x10
mov esi, dword [ebp + 0xc]
mov eax, 0x1c
cmove eax, ecx
push eax
push dword [esi + 0x18]
push edi
call fcn.005d67e0
add esp, 0xc
push esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5dae60
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
push ebx
push esi
mov esi, edx
mov ebx, ecx
and esi, 1
shl esi, 2
push 0
mov eax, esi
or eax, 1
and dl, 2
push 0
cmove eax, esi
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.WS2_32.dll_sendto]
mov esi, eax
test esi, esi
jns 0x5daecb
push edi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword fs:[0x2c]
cmp eax, 0x2733
mov edi, dword [0x6a3d5c]
mov ecx, 0xb
cmove eax, ecx
mov ecx, dword [edx + edi*4]
mov dword [ecx + 0x7c], eax
cmp esi, 0xffffffff
jne 0x5daec8
mov dword [ebx + 4], eax
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x5fa3b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
mov eax, 1
push esi
push edi
mov ecx, 0x3020100
mov edx, dword [ebx + 0x118]
mov dword [ebx + 0x120], 0x3020100
nop dword [eax]
nop word [eax + eax]
add ecx, 0x4040404
mov dword [ebx + eax*4 + 0x120], ecx
inc eax
cmp eax, edx
jbe 0x5fa3e0
xor esi, esi
xor edi, edi
cmp dword [ebp + 0xc], esi
je 0x5fa43b
nop dword [eax + eax]
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
movzx eax, byte [esi + ebx]
or edi, eax
mov cl, byte [eax + edx + 0x120]
mov byte [esi + ebx], cl
mov ebx, edx
mov byte [edx + 0x11f], cl
nop
mov cl, byte [eax + ebx + 0x11f]
mov edx, eax
sub eax, 1
mov byte [edx + ebx + 0x120], cl
jns 0x5fa420
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x5fa400
mov eax, dword [ebp + 0x10]
shr edi, 2
mov dword [eax + 0x118], edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4012f2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [ebp + 8]
imul eax, eax, 0xaf
cmp dword [eax + 0x431e4b], 0
jne 0x401312
jmp 0x401452
push 0x100
push 0
lea ecx, [ebp - 0x154]
push ecx
call fcn.00410e60
add esp, 0xc
mov edx, dword [ebp + 8]
imul edx, edx, 0xaf
add edx, 0x431dc1
push edx
mov eax, dword [0x42cd98]
push eax
push str._s_s.exe
lea ecx, [ebp - 0x154]
push ecx
call fcn.00410dfc
add esp, 0x10
push 0x44
push 0
lea edx, [ebp - 0x54]
push edx
call fcn.00410e60
add esp, 0xc
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 1
mov eax, dword [ebp + 8]
imul eax, eax, 0xaf
cmp dword [eax + 0x431e47], 0
jne 0x40138a
mov word [ebp - 0x24], 5
jmp 0x401390
mov word [ebp - 0x24], 0
push 0x10
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.00410e60
add esp, 0xc
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x54]
push eax
mov ecx, dword [0x42cd9c]
push ecx
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x154]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401424
push 0xbb8
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
lea ecx, [ebp - 0x154]
push ecx
push str.Process_name__s__started.
push 0xf5
push 0x421db0
push 0x421dcc
call fcn.0040237f
add esp, 0x14
mov edx, dword [ebp + 8]
imul edx, edx, 0xaf
mov byte [edx + 0x431e46], 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401447
lea edx, [ebp - 0x154]
push edx
push str.Start_process_name__s__fault.
push 0xfb
push 0x421dfc
push 0x421e18
call fcn.0040237f
add esp, 0x14
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esp, ebp
pop ebp
ret
Function at 0x4019e6
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push 0x445c
push 0
push 0x431da0
call fcn.00410e60
add esp, 0xc
mov eax, dword [0x42cda8]
push eax
push 0
push str.modulecount
push 0x4220e0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jl 0x401a33
cmp dword [ebp - 0x108], 0x64
jl 0x401a53
push str.Failed_to_read_module_s_.ini
push 0x7c
push 0x422108
push 0x422124
call fcn.0040237f
add esp, 0x10
xor eax, eax
jmp 0x401c4c
mov ecx, dword [ebp - 0x108]
mov dword [ebp - 0x104], ecx
cmp dword [ebp - 0x104], 0x64
jle 0x401a72
mov dword [ebp - 0x104], 0x64
mov dword [ebp - 0x10c], 1
jmp 0x401a8d
mov edx, dword [ebp - 0x10c]
add edx, 1
mov dword [ebp - 0x10c], edx
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x104]
jg 0x401c47
mov ecx, dword [ebp - 0x10c]
push ecx
push str.module_d
lea edx, [ebp - 0x100]
push edx
call fcn.00410dfc
add esp, 0xc
mov eax, dword [0x42cda8]
push eax
push 0x20
mov ecx, dword [ebp - 0x10c]
sub ecx, 1
imul ecx, ecx, 0xaf
add ecx, 0x431da0
push ecx
push 0x42e4fc
push str.ModuleName
lea edx, [ebp - 0x100]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x42e500
mov eax, dword [ebp - 0x10c]
sub eax, 1
imul eax, eax, 0xaf
add eax, 0x431da0
push eax
call fcn.00410ec0
add esp, 8
test eax, eax
jne 0x401b3d
mov ecx, dword [ebp - 0x10c]
push ecx
push str.Name_of_moudule__d_is_null_
push 0x8f
push 0x422168
push 0x422184
call fcn.0040237f
add esp, 0x14
jmp 0x401a7e
mov edx, dword [0x42cda8]
push edx
push 0x7f
mov eax, dword [ebp - 0x10c]
sub eax, 1
imul eax, eax, 0xaf
add eax, 0x431dc1
push eax
push 0x42e504
push str.startscript
lea ecx, [ebp - 0x100]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x42e508
mov edx, dword [ebp - 0x10c]
sub edx, 1
imul edx, edx, 0xaf
add edx, 0x431dc1
push edx
call fcn.00410ec0
add esp, 8
test eax, eax
jne 0x401bc1
mov eax, dword [ebp - 0x10c]
push eax
push str.start_script_of_moudule__d_is_null_
push 0x97
push 0x4221c4
push 0x4221e0
call fcn.0040237f
add esp, 0x14
jmp 0x401a7e
mov ecx, dword [0x42cda8]
push ecx
push 0
push str.ShankHandWay
lea edx, [ebp - 0x100]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0x10c]
sub ecx, 1
imul ecx, ecx, 0xaf
mov byte [ecx + 0x431e45], al
mov edx, dword [0x42cda8]
push edx
push 1
push str.NeedHide
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
sub eax, 1
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp - 0x10c]
sub ecx, 1
imul ecx, ecx, 0xaf
mov dword [ecx + 0x431e47], eax
mov edx, dword [ebp - 0x10c]
sub edx, 1
imul edx, edx, 0xaf
mov dword [edx + 0x431e4b], 1
jmp 0x401a7e
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x401cf0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0x20cf0000
push 0x422280
push str.ZXIN10_MONITOR
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x42e4e0], eax
cmp dword [0x42e4e0], 0
jne 0x401d3a
xor eax, eax
jmp 0x401d7c
push 0
mov ecx, dword [0x42e4e0]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x42e4e0]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 2
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, 1
pop ebp
ret

Function at 0x401f11
Capabilities:
Shutdown system
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x401f4a
push str.OpenProcessToken_Error
push 0x209
push 0x422308
push 0x422324
call fcn.0040237f
add esp, 0x10
lea ecx, [ebp - 0xc]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 2
push 0
push 0
push 0
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x401fa9
push str.ExitWindowsEx_Error.
push 0x214
push 0x422360
push 0x42237c
call fcn.0040237f
add esp, 0x10
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x409a78
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0x42e820
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.FILE:_s_LINE:_d_STOP_SYS__name___s_
push 0xf06
push 0x42ca6c
mov edx, dword [0x42cdac]
push edx
call fcn.00402631
add esp, 0x1c
cmp dword [0x43639c], 0
je 0x409ad9
xor eax, eax
mov ax, word [0x42e8da]
cmp eax, 0x64
jge 0x409ad9
xor ecx, ecx
mov cx, word [0x42e8da]
imul ecx, ecx, 0x4c7
mov edx, dword [0x43639c]
mov byte [edx + ecx + 0xbb], 0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x40a274
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 8], eax
push 0x4c7
mov ecx, dword [ebp + 8]
push ecx
push 0x42e818
call fcn.00411910
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x40a2ec
push 0x430868
mov edx, dword [ebp + 0xc]
push edx
call fcn.00410ec0
add esp, 8
test eax, eax
je 0x40a2ec
push 0x21
push 0
push 0x42e820
call fcn.00410e60
add esp, 0xc
push 0x20
mov eax, dword [ebp + 0xc]
push eax
push 0x42e820
call fcn.00411580
add esp, 0xc
jmp 0x40a32f
mov ecx, 0x42e820
test ecx, ecx
je 0x40a30b
push 0x43086c
push 0x42e820
call fcn.00410ec0
add esp, 8
test eax, eax
jne 0x40a32f
push 0x21
push 0
push 0x42e820
call fcn.00410e60
add esp, 0xc
push 0x20
push 0x42e820
mov edx, dword [ebp - 8]
push edx
call fcn.0040a149
add esp, 0xc
mov eax, 0x42e820
test eax, eax
je 0x40a34e
push 0x430870
push 0x42e820
call fcn.00410ec0
add esp, 8
test eax, eax
jne 0x40a355
xor al, al
jmp 0x40a48f
call fcn.00402608
test eax, eax
jne 0x40a365
xor al, al
jmp 0x40a48f
call fcn.0040b4e0
and eax, 0xff
test eax, eax
jne 0x40a39d
push str.Can_not_init_env_param_list
push 0x1028
push 0x42cbb0
mov ecx, dword [0x42cdac]
push ecx
call fcn.00402631
add esp, 0x10
call fcn.0040261f
xor al, al
jmp 0x40a48f
mov dword [0x42eda4], 0x52872134
mov word [0x42eda2], 0
push str.zxcomm
push 0x42ece8
call fcn.00410f50
add esp, 8
push 0x42cbd4
push 0x42ed09
call fcn.00410f50
add esp, 8
push 0x42cbe0
push 0x42ed2a
call fcn.00410f50
add esp, 8
push 0x4368a0
call fcn.0040c767
add esp, 4
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00404946
add esp, 8
and eax, 0xff
test eax, eax
jne 0x40a410
xor al, al
jmp 0x40a48f
mov ecx, dword [0x42e96b]
push ecx
call fcn.00406307
add esp, 4
xor edx, edx
mov dx, word [0x43620f]
xor eax, eax
mov ax, word [0x436203]
lea ecx, [eax + edx*2]
xor edx, edx
mov dx, word [0x436207]
add ecx, edx
xor eax, eax
mov ax, word [0x436205]
lea ecx, [ecx + eax + 1]
push ecx
push 0
call fcn.0040ee9d
add esp, 8
test eax, eax
jne 0x40a47b
push str.create_Comm_Hash_Table_fail_
push 0x103f
push 0x42cc08
mov edx, dword [0x42cdac]
push edx
call fcn.00402631
add esp, 0x10
xor al, al
jmp 0x40a48f
push 0x3f2
call fcn.00409ae3
add esp, 4
call fcn.0040a264
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x40c86b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40c8a0
cmp dword [ebp + 0x18], 0
je 0x40c8a0
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
cmp dword [ebp - 4], 0
jne 0x40c8aa
xor al, al
jmp 0x40c8ac
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x40daca
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 4
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
push 0x42d354
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40db06
xor eax, eax
jmp 0x40db85
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push 0
push 0x42d38c
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40db30
cmp dword [ebp - 0xc], 1
je 0x40db3e
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40db85
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
push 0
push 0
push str.CtlIpaddress
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x40db70
xor eax, eax
jmp 0x40db85
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call sub.WS2_32.dll_ntohl
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x40db89
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 4
mov dword [ebp - 8], 4
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x18]
push eax
push 0xf003f
push 0
push 0x42d3a8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40dbcc
xor eax, eax
jmp 0x40dc45
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0
push 0
push 0x42d3e0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40dbf6
cmp dword [ebp - 0x14], 1
je 0x40dc04
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40dc45
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push str.CtlPortbase
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10], 0
je 0x40dc36
xor eax, eax
jmp 0x40dc45
mov eax, dword [ebp + 8]
mov cx, word [ebp - 0xc]
mov word [eax], cx
mov eax, 1
mov esp, ebp
pop ebp
ret