joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe612b8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor ebx, ebx
mov edi, 0xe650a0
push edi
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [ebp + 8]
dec dword [esi + 0xc]
lea eax, [ebp - 4]
push eax
push dword [esi]
call fcn.00e611ad
test eax, eax
jne 0xe61323
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0xe61340
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RegQueryValueExW]
test eax, eax
jne 0xe61323
cmp dword [ebp - 0x10], 4
jne 0xe61323
cmp dword [ebp - 8], 1
jne 0xe61323
cmp dword [esi + 0xc], ebx
je 0xe6136e
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 4], ebx
pop edi
pop esi
pop ebx
je 0xe6133b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RegCloseKey]
leave
ret 4
lea eax, [ebp + 8]
push eax
mov eax, dword [esi + 4]
mov dword [ebp + 8], ebx
push dword [eax + 0x14]
call dword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
je 0xe61323
mov eax, dword [esi + 4]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esi + 4]
mov dword [eax + 8], ebx
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_DeactivateActCtx]
jmp 0xe61323
Function at 0xe625d1
Capabilities:
Access pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
xor ebx, ebx
push edi
xor edi, edi
inc ebx
cmp eax, edi
jne 0xe62d32
mov eax, dword [esi + 0x30]
cmp eax, edi
jne 0xe6303e
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 8]
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
cmp eax, edi
je 0xe62616
push dword [eax + 0x64]
call dword [sym.imp.RPCRT4.dll_RpcMgmtSetServerStackSize]
cmp dword [esi + 0x34], edi
jne 0xe632d7
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 4
test byte [esi + 0x38], bl
jne 0xe632c4
push ebx
lea ecx, [esi + 0x20]
push ecx
push dword [esi + 0x1c]
push dword [esi + 0x18]
push dword [esi + 0x14]
push eax
call fcn.00e62d61
test eax, eax
jne 0xe625ec
jmp 0xe632bd
shl eax, 0xa
push eax
jmp 0xe62610
xor eax, eax
jmp 0xe6262b
push 4
push edi
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0xe625ec
jmp 0xe632bd
push ebx
push edi
push ebx
call dword [sym.imp.ntdll.dll_RtlSetProcessIsCritical]
add esp, 0xc
jmp 0xe6261f
Function at 0x11480
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
push 0x12080
call fcn.00011370
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x114ca
push 0x12090
call fcn.00011370
mov dword [ebp - 8], eax
push 0x120a0
call fcn.000113f0
mov dword [ebp - 0x10], eax
jmp 0x114d7
push 0x120b0
call fcn.000113f0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 8], 0
jne 0x114e4
xor eax, eax
jmp 0x11634
mov eax, dword [ebp - 8]
add eax, 0x14
mov dword [ebp - 4], eax
mov ecx, 1
test ecx, ecx
je 0x11632
mov edx, dword [ebp - 4]
movzx eax, byte [edx]
cmp eax, 0x64
jne 0x11624
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 1]
cmp edx, 0xa1
jne 0x11624
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 2]
cmp ecx, 0x24
jne 0x11624
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 3]
cmp eax, 1
jne 0x11624
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 4]
test edx, edx
jne 0x11624
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 5]
test ecx, ecx
jne 0x11624
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 6]
cmp eax, 0x8b
jne 0x11624
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 7]
cmp edx, 0xf8
jne 0x11624
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 8]
cmp ecx, 0x8a
jne 0x11624
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 9]
cmp eax, 0x87
jne 0x11624
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 0xa]
cmp edx, 0x40
jne 0x11624
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0xb]
cmp ecx, 1
jne 0x11624
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0xc]
test eax, eax
jne 0x11624
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 0xd]
test edx, edx
jne 0x11624
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0xe]
cmp ecx, 0x88
jne 0x11624
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0xf]
cmp eax, 0x45
jne 0x11624
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 0x10]
cmp edx, 0xe0
jne 0x11624
mov eax, dword [ebp - 4]
sub eax, 0xc
push eax
push str.NtReadVirtualMemoryAddr_x_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
mov ecx, dword [ebp - 4]
sub ecx, 0xc
mov dword [0x13018], ecx
mov eax, dword [ebp - 4]
sub eax, 0xc
jmp 0x11634
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x114ed
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x11640
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
push 0x120dc
call fcn.00011370
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1168a
push 0x120ec
call fcn.00011370
mov dword [ebp - 8], eax
push str.ntkrnlpa.exe
call fcn.000113f0
mov dword [ebp - 0x10], eax
jmp 0x11697
push str.ntoskrnl.exe
call fcn.000113f0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 8], 0
jne 0x116a4
xor eax, eax
jmp 0x117f6
mov eax, dword [ebp - 8]
add eax, 0x14
mov dword [ebp - 4], eax
mov ecx, 1
test ecx, ecx
je 0x117f4
mov edx, dword [ebp - 4]
movzx eax, byte [edx]
cmp eax, 0x64
jne 0x117e6
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 1]
cmp edx, 0xa1
jne 0x117e6
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 2]
cmp ecx, 0x24
jne 0x117e6
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 3]
cmp eax, 1
jne 0x117e6
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 4]
test edx, edx
jne 0x117e6
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 5]
test ecx, ecx
jne 0x117e6
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 6]
cmp eax, 0x8b
jne 0x117e6
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 7]
cmp edx, 0xf8
jne 0x117e6
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 8]
cmp ecx, 0x8a
jne 0x117e6
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 9]
cmp eax, 0x87
jne 0x117e6
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 0xa]
cmp edx, 0x40
jne 0x117e6
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0xb]
cmp ecx, 1
jne 0x117e6
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0xc]
test eax, eax
jne 0x117e6
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 0xd]
test edx, edx
jne 0x117e6
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0xe]
cmp ecx, 0x88
jne 0x117e6
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0xf]
cmp eax, 0x45
jne 0x117e6
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 0x10]
cmp edx, 0xe0
jne 0x117e6
mov eax, dword [ebp - 4]
sub eax, 0xc
cmp eax, dword [0x13018]
je 0x117e6
mov ecx, dword [ebp - 4]
sub ecx, 0xc
push ecx
push str.NtWriteVirtualMemoryAddr_x_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
mov eax, dword [ebp - 4]
sub eax, 0xc
jmp 0x117f6
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x116ad
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x11850
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push str.NtOpenProcess
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov dword [0x13008], eax
mov byte [ebp - 8], 0xff
mov byte [ebp - 7], 0x75
mov byte [ebp - 6], 0xc8
mov byte [ebp - 5], 0xff
mov byte [ebp - 4], 0x75
mov byte [ebp - 3], 0xdc
mov byte [ebp - 2], 0xe8
push 7
lea edx, [ebp - 8]
push edx
mov eax, dword [0x13008]
push eax
call fcn.000110a0
sub eax, 7
mov dword [0x13030], eax
mov ecx, dword [0x13030]
push ecx
push str.nHookNtOpenProcessAddr_x_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
mov edx, dword [0x13030]
add edx, 0xb
mov dword [0x1300c], edx
mov eax, dword [0x13030]
add eax, 6
mov dword [0x13020], eax
mov ecx, dword [0x1300c]
push ecx
push str.nHookNtOpenPrpcessJmp_x_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
mov edx, dword [0x13020]
push edx
push str.nHookNtOpenPrpcessOldJmp_x_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
push str.ObOpenObjectByPointer
call fcn.00011280
mov dword [section..data], eax
mov eax, dword [section..data]
push eax
push str.nObOpenObjectByPointerAddr_x_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
push 0x11800
mov ecx, dword [0x13030]
push ecx
call fcn.000111b0
mov esp, ebp
pop ebp
ret

Function at 0x119d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
call fcn.00011480
mov dword [0x13024], eax
mov eax, dword [0x13024]
push eax
push 0x1223c
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
mov ecx, dword [0x13024]
add ecx, 3
mov dword [0x1302c], ecx
mov edx, dword [0x1302c]
mov eax, dword [edx]
mov dword [0x1302c], eax
mov ecx, dword [0x1302c]
push ecx
push 0x1224c
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
mov edx, dword [0x13024]
add edx, 7
mov dword [0x1301c], edx
mov eax, dword [0x1301c]
push eax
push 0x1225c
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
push 0x11980
push 0xba
call fcn.00011170
pop ebp
ret

Function at 0x11ad0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
call fcn.00011640
mov dword [0x13028], eax
mov eax, dword [0x13028]
add eax, 3
mov dword [0x13010], eax
mov ecx, dword [0x13010]
mov edx, dword [ecx]
mov dword [0x13010], edx
mov eax, dword [0x13028]
add eax, 7
mov dword [0x13004], eax
push 0x11a80
push 0x115
call fcn.00011170
mov ecx, dword [0x1302c]
push ecx
push str.nNtReadVirtualMemoryAddr_3_x_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
pop ebp
ret

Function at 0x11b80
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
call fcn.00011850
call fcn.000119d0
push 0x122c0
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
call fcn.00011ad0
mov eax, dword [ebp + 8]
mov dword [eax + 0x34], 0x11b50
mov eax, 1
pop ebp
ret 8
Function at 0x5b7b99
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
jmp 0x5b7baf
xchg dword [esp + 4], edx
lea edx, [edx - 0x3b]
pushfd
xchg dword [esp + 8], edx
call fcn.005b7b71
jmp 0x5b7b49
pushfd
jmp 0x5b79e5

Function at 0x5b7c1a
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec cx
jo 0x5b7c4f
jno 0x5b7c4f
mov esi, esp
mov al, 0x49
mov cl, byte [esp]
xchg dx, bx
mov ecx, dword [esp]
jmp 0x5b7c6d
sub esp, 0xbc
jmp 0x5b7c37
stc
bt ax, bp
lea esp, [esp + 2]
mov eax, dword [esp]
jmp 0x5b7c77
mov ecx, ebp
sub esp, 0x1a
ja 0x5b7c57
stc
jmp 0x5b7c91
mov bx, 0xd330
mov bx, 0x787a
mov eax, 0x9c27e633
xchg dh, dl
jmp 0x5b7cd2
bt ax, bp
lea esp, [esp + 2]
mov eax, dword [esp]
mov bx, 0xd330
jmp 0x5b7c7b
not ebp
not edx
mov eax, dword [esp]
neg bx
jp 0x5b7cbc
dec dl
rcr dx, 0xe
jmp 0x5b7d23

Function at 0x5b7d28
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg dx
jle 0x5b7d07
jg 0x5b7d37
push esp
invalid
lea ebx, [edi - 0xf3]
not ax
mov bl, byte [esp + 3]
jmp fcn.005b7dcd

Function at 0x5b9649
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
xchg dword [esp], esi
xchg dh, dl
mov ecx, 0xd3bd0b8e
jmp 0x5b9657
push ax
bsf ecx, eax
neg ecx
mov bx, dx
xchg ah, al
jmp 0x5b9633
setbe ah
rdtsc
xchg ch, dl
lea esi, [esi - 0x2a]
lea eax, reloc.MSVFW32.dll_DrawDibDraw
jmp 0x5b9682
mov eax, ebp
rdtsc
bsr bx, cx
xchg dword [esp], esi
cpuid
mov dx, word [esp]
jmp 0x5b96c9
sub esp, 0xe

Function at 0x5e4b94
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 8]
movzx eax, ax
mov dword [ebp - 4], eax
jmp 0x5a946f
jmp 0x5e4aa1

Function at 0x5fe9c8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x5fe96c
push ebp
jmp 0x5ff0e9
lea esp, [esp + 4]
popal
mov word [ecx], ax
jmp 0x5fe961
push eax
jmp 0x5fe9b5
jne 0x5fe793
je 0x5fe934
insd dword es:[edi], dx
jl 0x5fe9a4
salc
mov fs, word [edx - 0x4572cce5]
xor eax, dword ds:[ecx + eax*2]
ret
pop ecx
stc
lea esp, [esp + 8]
cmp dword [ebp + 8], eax
jmp 0x5fe94a
push 0x103
sub esp, 2
lea esp, [esp + 2]
jmp 0x5fe98e
push ebx
push dword [ebp + 8]
push 0xffffffffffffffff
jmp 0x5fe99a
call fcn.005c15ed
cmc
jmp 0x5fe9c0
cmp eax, 0x1b6c4c0c
xor ecx, dword [ebp + reloc.MSVFW32.dll_DrawDibDraw]
lahf
out 0x11, al
nop
adc ecx, dword [edx + reloc.MSVFW32.dll_DrawDibDraw]
pop ebx
add al, ch
ret 0xffff
call dword [fcn.005b798c]
call fcn.005fe982
test eax, eax
call 0x5fe9c8
and eax, 0x2244c88
lea esp, [esp + 4]
je 0x5fe7ac
jne 0x5feae3
push esp
invalid
lea eax, reloc.MSVFW32.dll_DrawDibDraw
mov ax, 0xce30
xor eax, eax
call fcn.005fea1a
lea esp, [esp + 0x1c]
lea edi, [ebp - 8]
jmp 0x5feb39
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x5feb41
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
bswap edi
push eax
jmp 0x5feb23
lea edi, reloc.MSVFW32.dll_DrawDibDraw
mov dword [ebp - 0xc], edi
jmp 0x5fe835
mov ebp, edi
mov ax, word [ebp]
Function at 0x5fcb70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x567000
lea edi, [esi - 0x1a6000]
push edi
jmp 0x5fcb8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5fcb91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5fcb80
mov eax, 1
add ebx, ebx
jne 0x5fcba3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5fcbb4
jne 0x5fcbd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5fcbd3
dec eax
add ebx, ebx
jne 0x5fcbc0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5fcb98
add ebx, ebx
jne 0x5fcbcf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5fcc25
xor ecx, ecx
sub eax, 3
jb 0x5fcbeb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5fcc5a
sar eax, 1
mov ebp, eax
jmp 0x5fcbf6
add ebx, ebx
jne 0x5fcbf6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5fcbc4
inc ecx
add ebx, ebx
jne 0x5fcc04
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5fcbc4
add ebx, ebx
jne 0x5fcc11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5fcc06
jne 0x5fcc22
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5fcc06
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5fcc44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5fcc36
jmp 0x5fcb86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5fcc44
add edi, ecx
jmp 0x5fcb86
pop esi
mov edi, esi
mov ecx, 0x3ee5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5fcc62
cmp byte [edi], 0x11
jne 0x5fcc62
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5fcc67
lea edi, [esi + 0x1f5000]
mov eax, dword [edi]
or eax, eax
je 0x5fccdf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x320030]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3201ac]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5fcc94
mov ecx, edi
jns 0x5fccc3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3201b0]
or eax, eax
je 0x5fccd9
mov dword [ebx], eax
add ebx, 4
jmp 0x5fccb1
call dword [esi + 0x3201c0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5fcd10
cmp al, 0xef
ja 0x5fcd03
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5fcce5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x5fccf2
mov ebp, dword [esi + 0x3201b4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5fcd44
sub esp, 0xffffff80
jmp 0x427f4a
Function at 0x2d23700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.02d2378f
jae 0x2d2370e
xor ecx, ecx
call fcn.02d2378f
jae 0x2d2373d
xor eax, eax
call fcn.02d2378f
jae 0x2d2374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.02d2378f
adc al, al
jae 0x2d2372f
jne 0x2d23779
stosb byte es:[edi], al
jmp 0x2d23711
call fcn.02d2379b
sub ecx, ebx
jne 0x2d23756
call fcn.02d23799
jmp 0x2d23775
lodsb al, byte [esi]
shr eax, 1
je 0x2d23783
adc ecx, ecx
jmp 0x2d23772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.02d23799
cmp eax, 0x7d00
jae 0x2d23772
cmp ah, 5
jae 0x2d23773
cmp eax, 0x7f
ja 0x2d23774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2d23711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8

Function at 0x2d43700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.02d4378f
jae 0x2d4370e
xor ecx, ecx
call fcn.02d4378f
jae 0x2d4373d
xor eax, eax
call fcn.02d4378f
jae 0x2d4374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.02d4378f
adc al, al
jae 0x2d4372f
jne 0x2d43779
stosb byte es:[edi], al
jmp 0x2d43711
call fcn.02d4379b
sub ecx, ebx
jne 0x2d43756
call fcn.02d43799
jmp 0x2d43775
lodsb al, byte [esi]
shr eax, 1
je 0x2d43783
adc ecx, ecx
jmp 0x2d43772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.02d43799
cmp eax, 0x7d00
jae 0x2d43772
cmp ah, 5
jae 0x2d43773
cmp eax, 0x7f
ja 0x2d43774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2d43711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401235
Capabilities:
Check for peb beingdebugged flag

Disassembly:
jmp 0x410380
push 0xffffffffffffffff
push 0x594980
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
xor eax, eax
push esi
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x5ada48
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], eax
push ecx
push eax
push eax
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CGdiObject::Attach
mov esi, dword [esp + 0x30]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call sub.MFC42.DLL_CDC::SelectObject_3
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
mov dword [esp + 0x3c], eax
mov ecx, esi
lea eax, [edi + 2]
push eax
lea eax, [esp + 0x1c]
push ebx
push eax
call sub.MFC42.DLL_CDC::MoveTo
lea eax, [edi + 5]
mov ecx, esi
push eax
push ebx
call sub.MFC42.DLL_CDC::LineTo
lea ebp, [edi + 3]
lea eax, [ebx + 1]
push ebp
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
lea eax, [edi + 6]
mov ecx, esi
push eax
lea eax, [ebx + 1]
push eax
call sub.MFC42.DLL_CDC::LineTo
lea eax, [edi + 4]
lea ecx, [ebx + 2]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
lea eax, [edi + 7]
mov ecx, esi
push eax
lea eax, [ebx + 2]
push eax
call sub.MFC42.DLL_CDC::LineTo
lea eax, [ebx + 3]
push ebp
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
lea eax, [edi + 6]
mov ecx, esi
push eax
lea eax, [ebx + 3]
push eax
call sub.MFC42.DLL_CDC::LineTo
lea eax, [edi + 2]
lea ecx, [ebx + 4]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
lea eax, [edi + 5]
mov ecx, esi
push eax
lea eax, [ebx + 4]
push eax
call sub.MFC42.DLL_CDC::LineTo
lea ecx, [edi + 1]
lea eax, [ebx + 5]
push ecx
lea edx, [esp + 0x1c]
push eax
push edx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
lea eax, [edi + 4]
mov ecx, esi
push eax
lea eax, [ebx + 5]
push eax
call sub.MFC42.DLL_CDC::LineTo
add ebx, 6
push edi
lea eax, [esp + 0x1c]
push ebx
push eax
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
push ebp
push ebx
mov ecx, esi
call sub.MFC42.DLL_CDC::LineTo
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CDC::SelectObject_3
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [esp + 0x10], 0x5ada18
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 1
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x4013de
Capabilities:
Connect socket

Disassembly:
jmp 0x4248d0
sub esp, 0x30
push ebx
push ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [esp + 8], eax
jne 0x424903
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004020fe
add esp, 4
or eax, 0xffffffff
pop ebp
pop ebx
add esp, 0x30
ret
mov ebx, dword [esp + 0x3c]
mov ebp, dword [sym.imp.WS2_32.dll_WSAEventSelect]
push 0x10
push eax
push ebx
call ebp
cmp eax, 0xffffffff
jne 0x42493b
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.004020fe
add esp, 4
or eax, 0xffffffff
pop ebp
pop ebx
add esp, 0x30
ret
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
push esi
push edi
push 0
push 0
push 0
push 0
push ecx
push edx
push ebx
call dword [sym.imp.WS2_32.dll_WSAConnect]
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call edi
cmp esi, 0xffffffff
jne 0x4249d3
cmp eax, 0x2733
jne 0x4249d3
mov eax, dword [esp + 0x50]
push 1
push eax
lea ecx, [esp + 0x18]
push 1
push ecx
push 1
call dword [sym.imp.WS2_32.dll_WSAWaitForMultipleEvents]
test eax, eax
je 0x424995
call edi
push eax
call fcn.004020fe
add esp, 4
or esi, esi
jmp 0x4249d3
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push eax
push ebx
call dword [sym.imp.WS2_32.dll_WSAEnumNetworkEvents]
cmp eax, 0xffffffff
jne 0x4249bb
call edi
push eax
call fcn.004020fe
add esp, 4
or esi, 0xffffffff
jmp 0x4249d3
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4249d1
push eax
call fcn.004020fe
add esp, 4
or esi, 0xffffffff
jmp 0x4249d3
xor esi, esi
mov ecx, dword [esp + 0x10]
push 0
push ecx
push ebx
call ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret