joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424340
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
mov dword [ebp - 0x10], edx
test esi, esi
je 0x424485
test edx, edx
js 0x424485
mov eax, dword [ebp + 8]
test eax, eax
je 0x42446c
push ebx
mov ebx, edx
mov dword [ebp - 8], ebx
test edx, edx
jle 0x424466
push edi
cmp ebx, 3
jl 0x4243eb
mov dl, byte [esi + 1]
mov cl, byte [esi]
mov bl, byte [esi + 2]
add esi, 3
mov dword [ebp - 0xc], esi
movzx esi, cl
mov ecx, esi
movzx edi, dl
shr ecx, 2
shl esi, 4
movsx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [eax], cx
mov ecx, edi
shr ecx, 4
or ecx, esi
movzx esi, bl
mov ebx, dword [ebp - 8]
and ecx, 0x3f
mov edx, esi
shr edx, 6
movsx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [eax + 2], cx
lea ecx, [edi*4]
or edx, ecx
and edx, 0x3f
and esi, 0x3f
movsx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [eax + 4], cx
lea ecx, [eax + 6]
movsx ax, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov esi, dword [ebp - 0xc]
jmp 0x42444e
mov dl, byte [esi]
inc esi
cmp ebx, 2
jne 0x4243fb
mov cl, byte [esi]
inc esi
mov byte [ebp - 1], cl
jmp 0x4243ff
mov byte [ebp - 1], 0
movzx edi, byte [ebp - 1]
movzx edx, dl
mov ecx, edx
shl edx, 4
shr ecx, 2
movsx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [eax], cx
mov ecx, edi
shr ecx, 4
or ecx, edx
and ecx, 0x3f
movsx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [eax + 2], cx
cmp ebx, 1
jne 0x424437
lea ecx, [ebx + 0x3c]
jmp 0x424442
and edi, 0xf
movsx ecx, byte [edi*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov word [eax + 4], cx
lea ecx, [eax + 6]
mov eax, 0x3d
sub ebx, 3
mov word [ecx], ax
mov dword [ebp - 8], ebx
lea eax, [ecx + 2]
test ebx, ebx
jg 0x424376
mov edx, dword [ebp - 0x10]
pop edi
xor ecx, ecx
mov word [eax], cx
pop ebx
lea ecx, [edx + 2]
mov eax, 0x55555556
imul ecx
pop esi
mov eax, edx
shr eax, 0x1f
add eax, edx
shl eax, 2
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x426c20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x5add48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x404]
push 0x400
push 0
push eax
mov ebx, edx
mov esi, ecx
call fcn.00526ca0
push ebx
lea eax, [ebp - 0x404]
push esi
push eax
call fcn.00526e00
add esp, 0x18
xor eax, eax
test ebx, ebx
je 0x426c7d
nop word [eax + eax]
xor byte [ebp + eax - 0x404], 0x54
inc eax
cmp eax, ebx
jb 0x426c70
lea eax, [ebp - 0x404]
mov ecx, eax
sub edi, ecx
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edi + eax - 1], cl
test cl, cl
jne 0x426c87
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052404e
mov esp, ebp
pop ebp
ret
Function at 0x427f70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x550296
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x5add48]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 1
cmp dword [ebp + 0x18], 0
je 0x42818b
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call fcn.005298f5
add esp, 4
cmp eax, 0x10e0
jle 0x42818b
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 8
jb 0x427feb
mov eax, dword [ecx]
jmp 0x427fed
mov eax, ecx
xor edx, edx
push 0xffffffffffffffff
mov word [eax], dx
lea eax, [ebp + 0x20]
push edx
push eax
call fcn.004238c0
lea ecx, [ebp - 0x248]
call fcn.00421740
push 0
mov byte [ebp - 4], 2
call fcn.00528b20
add esp, 0x1c
mov edi, eax
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
call fcn.00526ca0
add esp, 0xc
lea ecx, [ebp - 0x260]
call fcn.00428740
mov byte [ebp - 4], 3
lea eax, [ebp - 0x248]
cmp dword [ebp - 0x234], 8
cmovae eax, dword [ebp - 0x248]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x5a3314
push str.updappuijg
push str.info
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00421ac0
cmp dword [ebp - 0x220], 0
je 0x4280d6
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call fcn.005298f5
add esp, 4
lea ecx, [ebp + 8]
cmp dword [ebp + 0x1c], 8
mov esi, eax
cmovae ecx, dword [ebp + 8]
push ecx
call fcn.005298f5
mov ecx, eax
sub edi, esi
shl ecx, 4
add esp, 4
sub ecx, eax
shl ecx, 2
cmp edi, ecx
jge 0x4280d6
xor bl, bl
jmp 0x4280d8
mov bl, 1
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x4280f6
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00424270
xor eax, eax
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x220], 0
cmp eax, 8
jb 0x428131
inc eax
lea ecx, [ebp - 0x260]
push eax
push dword [ebp - 0x260]
call fcn.00424270
xor eax, eax
mov dword [ebp - 0x24c], 7
mov word [ebp - 0x260], ax
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x250], 0
cmp eax, 8
jb 0x42816c
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.00424270
xor eax, eax
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
jmp 0x42818d
xor bl, bl
mov eax, dword [ebp + 0x1c]
cmp eax, 8
jb 0x4281a2
inc eax
lea ecx, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.00424270
mov ecx, dword [ebp + 0x34]
xor eax, eax
mov dword [ebp + 0x1c], 7
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
cmp ecx, 8
jb 0x4281cb
inc ecx
push ecx
push dword [ebp + 0x20]
lea ecx, [ebp + 0x20]
call fcn.00424270
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052404e
mov esp, ebp
pop ebp
ret
Function at 0x428670
Capabilities:
Get explorer pid

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5add48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
push 0
call esi
push 1
mov dword [ebp - 0x24], eax
call esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
call dword [sym.imp.USER32.dll_GetShellWindow]
mov ebx, eax
lea eax, [ebp - 8]
push eax
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call esi
lea eax, [ebp - 0xc]
push eax
push edi
call esi
lea eax, [ebp - 0x10]
push eax
push ebx
call esi
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
je 0x428720
cmp eax, dword [ebp - 0x10]
je 0x428720
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x24]
jl 0x428720
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x28]
jl 0x428720
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052404e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052404e
mov esp, ebp
pop ebp
ret
Function at 0x428740
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x550388
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x5add48]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x224], esi
mov dword [esi + 0x10], 0
jb 0x4287ab
mov eax, dword [esi]
jmp 0x4287ad
mov eax, esi
xor ecx, ecx
mov word [eax], cx
push 0x208
push ecx
lea eax, [ebp - 0x218]
mov dword [ebp - 4], ecx
push eax
mov dword [ebp - 0x21c], 1
call fcn.00526ca0
add esp, 0xc
lea eax, [ebp - 0x218]
push 1
push 0x1c
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x23c]
push str._s_fysoft_
push eax
call fcn.0043aa40
add esp, 0xc
mov edi, eax
mov dword [ebp - 4], 1
cmp esi, edi
je 0x42884a
cmp dword [esi + 0x14], 8
jb 0x428823
mov eax, dword [esi + 0x14]
mov ecx, esi
inc eax
push eax
push dword [esi]
call fcn.00424270
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x42883b
mov eax, dword [esi]
jmp 0x42883d
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push edi
call fcn.004239e0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x228]
cmp eax, 8
jb 0x42886c
inc eax
lea ecx, [ebp - 0x23c]
push eax
push dword [ebp - 0x23c]
call fcn.00424270
cmp dword [esi + 0x14], 8
jb 0x428876
mov eax, dword [esi]
jmp 0x428878
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
cmp eax, 0x10
je 0x428899
cmp dword [esi + 0x14], 8
jb 0x42888e
mov eax, dword [esi]
jmp 0x428890
mov eax, esi
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
push 0xd
push str.updcache.info
mov ecx, esi
call fcn.004323b0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052404e
mov esp, ebp
pop ebp
ret
Function at 0x428920
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
mov eax, dword [0x5add48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x428a09
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
cmp eax, 0xffffffff
je 0x428a09
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x38
lea eax, [ebp - 0x290]
push 0
push eax
call fcn.00526ca0
add esp, 0xc
mov dword [ebp - 0x294], 0x3c
mov dword [ebp - 0x290], pe_nt_image_headers32
mov dword [ebp - 0x28c], 0
call fcn.004288d0
cmp eax, 6
mov dword [ebp - 0x284], esi
mov edx, str.runas
mov dword [ebp - 0x280], edi
mov ecx, str.open
mov dword [ebp - 0x27c], 0
lea eax, [ebp - 0x294]
mov dword [ebp - 0x278], 1
cmovge ecx, edx
mov dword [ebp - 0x274], 0
push eax
mov dword [ebp - 0x288], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne bl
call dword [sym.imp.ole32.dll_CoUninitialize]
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052404e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052404e
mov esp, ebp
pop ebp
ret
Function at 0x4304a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5510c2
mov eax, dword fs:[0]
push eax
sub esp, 0x16c
mov eax, dword [0x5add48]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x16c], esi
mov dword [ebp - 0x174], esi
mov dword [ebp - 0x170], 0
mov dword [ebp - 4], 1
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x430513
mov eax, dword [esi]
jmp 0x430515
mov eax, esi
mov byte [eax], 0
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x168]
lea eax, [ebp + 8]
mov dword [ebp - 0x170], 1
cmovae eax, dword [ebp + 8]
xor ebx, ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
cmp eax, 0xffffffff
push eax
cmovne ebx, dword [ebp - 0x148]
call dword [sym.imp.KERNEL32.DLL_FindClose]
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push 0x5a3d7c
cmovae eax, dword [ebp + 8]
push eax
call fcn.0052d109
add esp, 8
mov dword [ebp - 0x16c], eax
test eax, eax
je 0x43060b
xor ecx, ecx
mov eax, ebx
add eax, 1
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.005299ad
add esp, 4
mov edi, eax
lea eax, [ebx + 1]
push eax
push 0
push edi
call fcn.00526ca0
add esp, 0xc
push dword [ebp - 0x16c]
push ebx
push 1
push edi
call fcn.0052d2ec
push dword [ebp - 0x16c]
call fcn.0052d493
add esp, 0x14
mov dword [ebp - 0x14], 0xf
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
push ebx
push edi
call fcn.00424100
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
cmp esi, eax
je 0x4305ed
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00423cd0
push edi
call fcn.005299b8
mov eax, dword [ebp - 0x14]
add esp, 4
cmp eax, 0x10
jb 0x43060b
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00423fe0
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x430620
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00423fe0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052404e
mov esp, ebp
pop ebp
ret
Function at 0x436f40
Capabilities:
Encrypt data using rc4 prga
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5add48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor edx, edx
push edi
mov edi, dword [ebp + 8]
lea eax, [esi + 0x16]
nop dword [eax]
movzx ecx, byte [eax - 2]
lea eax, [eax + 4]
mov byte [ebp + edx - 0xc], cl
movzx ecx, byte [eax - 5]
mov byte [ebp + edx - 0xb], cl
movzx ecx, byte [eax - 4]
mov byte [ebp + edx - 0xa], cl
movzx ecx, byte [eax - 3]
mov byte [ebp + edx - 9], cl
add edx, 4
cmp edx, 8
jb 0x436f60
mov edx, dword [esi + 0x14]
lea ebx, [esi + 0x5c]
shr edx, 3
mov ecx, 0x38
and edx, 0x3f
mov eax, 0x78
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovb eax, ecx
mov ecx, esi
push eax
push ebx
call fcn.00436e70
push 8
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.00436e70
lea ecx, [edi + 1]
mov edi, 4
lea edx, [esi + 6]
nop dword [eax]
movzx eax, byte [edx - 2]
lea edx, [edx + 4]
mov byte [ecx - 1], al
lea ecx, [ecx + 4]
movzx eax, byte [edx - 5]
mov byte [ecx - 4], al
movzx eax, byte [edx - 4]
mov byte [ecx - 3], al
movzx eax, byte [edx - 3]
mov byte [ecx - 2], al
sub edi, 1
jne 0x436fd0
xor eax, eax
mov edi, esi
xorps xmm0, xmm0
mov ecx, 0x27
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 4]
mov dword [esi + 0x18], eax
xor ecx, ebp
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
movups xmmword [ebx], xmm0
pop edi
movups xmmword [ebx + 0x10], xmm0
pop esi
movups xmmword [ebx + 0x20], xmm0
movups xmmword [ebx + 0x30], xmm0
mov byte [ebx], 0x80
pop ebx
call fcn.0052404e
mov esp, ebp
pop ebp
ret 4

Function at 0x437860
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x551723
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
mov eax, dword [0x5add48]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0xc0], esi
mov dword [ebp - 0xc4], 0
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x60], xmm0
mov dword [ebp - 0xbc], vtable.MD5_CTX.0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xb8], 0x67452301
mov dword [ebp - 0xb4], 0xefcdab89
mov dword [ebp - 0xb0], 0x98badcfe
mov dword [ebp - 0xac], 0x10325476
movups xmmword [ebp - 0x50], xmm0
mov byte [ebp - 0x60], 0x80
movups xmmword [ebp - 0x40], xmm0
movups xmmword [ebp - 0x30], xmm0
mov byte [ebp - 4], 1
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0xbc]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
call fcn.00436e70
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0xbc]
call fcn.00436f40
push ecx
lea edx, [ebp - 0x20]
mov ecx, esi
call fcn.00437760
mov ecx, dword [ebp + 0x1c]
add esp, 4
cmp ecx, 0x10
jb 0x437952
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00423fe0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052404e
mov esp, ebp
pop ebp
ret
Function at 0x43a420
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x551a28
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x5add48]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push ecx
cmovae eax, dword [ebp + 8]
push 0
push 0
push 0
push eax
push dword [edi]
mov dword [ebp - 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43a512
mov eax, dword [ebp - 0x14]
xor ecx, ecx
add eax, 2
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.005299ad
mov ecx, dword [ebp - 0x14]
mov esi, eax
add ecx, 2
push ecx
push 0
push esi
call fcn.00526ca0
add esp, 0x10
lea eax, [ebp - 0x14]
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp + 8]
cmovae ecx, dword [ebp + 8]
push eax
push esi
push 0
push 0
push ecx
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43a509
cmp word [esi], ax
jne 0x43a4d9
xor ecx, ecx
jmp 0x43a4ef
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43a4e0
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x18]
push esi
call fcn.00423500
push esi
call fcn.005299b8
add esp, 4
mov esi, 1
jmp 0x43a514
push esi
call fcn.005299b8
add esp, 4
xor esi, esi
mov ecx, dword [ebp + 0x1c]
cmp ecx, 8
jb 0x43a529
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00424270
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052404e
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x43c350
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x5add48]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x43c3a0
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x43c39a
shr eax, 8
cmp al, 2
jne 0x43c39a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052404e
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov eax, 2
xor ecx, ebp
call fcn.0052404e
mov esp, ebp
pop ebp
ret
Function at 0x43f3a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
call fcn.0043f3c0
add esp, 4
mov dword [ebp + 0x10], eax
pop ebp
jmp fcn.0053b261

Function at 0x4448f0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x1505
add eax, esi
mov ecx, eax
sub ecx, esi
push edi
xor edi, edi
cmp esi, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x444939
mov al, byte [esi]
push eax
call fcn.00451ef0
movsx ecx, al
lea esi, [esi + 1]
mov eax, ebx
inc edi
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp edi, dword [ebp + 8]
jb 0x444917
pop edi
pop esi
movzx eax, bl
pop ebx
pop ebp
ret

Function at 0x445b80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x445b9e
cmp dword [esi + 0x6c], 0
je 0x445b9e
push 2
push 3
push esi
call fcn.0043f1e0
add esp, 0xc
push dword [ebp + 0xc]
call fcn.00452540
add esp, 4
test esi, esi
je 0x445bbe
cmp dword [esi + 0x6c], 0
je 0x445bbe
push 3
push esi
call fcn.0043f220
add esp, 8
pop esi
pop ebp
ret
Function at 0x44f9c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x1d0], 0
je 0x44fa04
push esi
push 1
push edi
call fcn.00440e30
push dword [edi + 0x15c]
mov eax, dword [edi + 0x1d0]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.00440e30
add esp, 0x24
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x44fa3a
push dword [edi + 0x158]
lea eax, [eax + eax*2]
push 1
add eax, 0x554d68
push 2
push eax
call fcn.0052e1eb
push dword [edi + 0x158]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0052e1eb
add esp, 0x20
xor eax, eax
pop edi
pop ebp
ret

Function at 0x44fdf0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push eax
push edi
mov esi, dword [edi + eax*4 + 0x1a8]
call fcn.00450300
add esp, 8
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call dword [sym.imp.WS2_32.dll_send]
mov ebx, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
cmp ebx, 0xffffffff
jne 0x44fe74
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x44fe4c
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebx
mov dword [eax], 0x51
xor eax, eax
pop ebp
ret
push esi
push edi
call fcn.00473570
push eax
push str.Send_failure:__s
push dword [edi]
call fcn.0044fa40
mov eax, dword [edi]
add esp, 0x14
mov dword [eax + 0x48d4], esi
mov eax, dword [ebp + 0x18]
mov dword [eax], 0x37
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x450300
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
shl eax, 4
push edi
mov edx, dword [ebx + ecx*4 + 0x1a8]
lea esi, [ebx + 0x1cc]
add esi, eax
mov dword [ebp + 8], edx
mov eax, dword [ebx + 0x2c8]
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x40], 3
je 0x4503bd
cmp dword [ebx + ecx*4 + 0x1bc], 0x44fd40
jne 0x4503bd
cmp dword [esi], 0
je 0x45034f
test edi, edi
je 0x4503bd
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push edx
call fcn.0044f570
add esp, 0x14
cmp eax, 0xffffffff
je 0x4503bd
test al, 1
je 0x4503bd
cmp dword [esi], 0
jne 0x4503a4
mov eax, dword [ebx]
mov eax, dword [eax + 0x4c8]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [section..data]
mov edi, dword [esi + 4]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test eax, eax
jne 0x4503a4
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x4503bd
add dword [esi + 8], eax
pop edi
pop esi
pop ebx
pop ebp
ret