joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dbd40
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, ebx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, ah
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, ecx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8]
movzx ecx, ch
xor edx, dword [ebp + ecx*8 + 3]
mov ecx, esi
shr ebx, 0x10
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
shr eax, 0x18
xor edx, dword [ebp + eax*8 + 1]
mov eax, dword [esp + 4]
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x4dbd60
lea ebp, [ebp + 0x880]
mov edi, dword [ebp - 0x80]
mov esi, dword [ebp - 0x60]
mov edi, dword [ebp - 0x40]
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp]
mov esi, dword [ebp + 0x20]
mov edi, dword [ebp + 0x40]
mov esi, dword [ebp + 0x60]
lea ebp, [ebp - 0x80]
mov esi, eax
and esi, 0xff
movzx esi, byte [ebp + esi]
movzx edi, dh
movzx edi, byte [ebp + edi]
shl edi, 8
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [ebp + edi]
shl edi, 0x10
xor esi, edi
mov edi, ebx
shr edi, 0x18
movzx edi, byte [ebp + edi]
shl edi, 0x18
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
movzx esi, byte [ebp + esi]
movzx edi, ah
movzx edi, byte [ebp + edi]
shl edi, 8
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [ebp + edi]
shl edi, 0x10
xor esi, edi
mov edi, ecx
shr edi, 0x18
invalid
mov dh, 0x7c
invalid

Function at 0x4dcc30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ecx, dword [esp + 0x1c]
cmp ecx, 0
je 0x4dcded
call fcn.004dcc46
Function at 0x5369c0
Capabilities:
Encode data using base64
Encrypt data using speck
Parse pe header

Disassembly:
call fcn.004062b0
lea eax, [esp + 0x18b8]
movsx cx, dh
push eax
not cl
jmp 0x619f41
jmp 0x745029
lea ecx, [esp + 0x688]
mov byte [esp + 0x1bf4], 0x65
jmp 0x79673f
mov byte [esp + 0x18c2], 0x52
mov byte [esp + 0x18c3], 0x5f
mov byte [esp + 0x18c4], 0x57
mov byte [esp + 0x18c5], 0x49
jmp 0x17b77fa
mov byte [esp + 0x18bf], 0x52
jmp 0x182c0af
push 0x9141b0fa
call fcn.00609eab
mov byte [esp + 0x18be], 0x45
jmp 0x730294
call fcn.004062b0
lea ecx, [esp + 0x6bc]
cmove dx, ax
cdq
push ecx
movzx edx, bp
lea edx, [esp + 0xb50]
not ecx
jmp loc.0043a368
mov byte [esp + 0x18c6], 0x4e
jmp 0x17d7763
mov byte [esp + 0x18c7], 0x3e
mov byte [esp + 0x18c8], 0
jmp 0x534991
mov byte [esp + 0x18c1], 0x45
jmp 0x6cdad9
mov byte [esp + 0x18c0], 0x56
jmp 0x17e4d78

Function at 0x536c80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x536d8c
test eax, eax
je 0x536d8c
push esi
push edi
mov ecx, 0x10
mov esi, 0x551ff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x536d73
lea edi, [eax + 4]
jmp 0x536cd7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x536cec
mov dword [ebp - 4], 2
jmp 0x536d0d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x536d03
mov dword [ebp - 4], 1
jmp 0x536d0d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x536d83
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x536d46
mov byte [ecx], 0x3d
jmp 0x536d52
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x536d5d
mov byte [ecx], 0x3d
jmp 0x536d63
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x536cd4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53afea
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push ebx
not esi
lea esi, [esp + 0x3a4]
lea eax, [esp + 0x6d8]
call fcn.004082c0
add esp, 4
mov ax, sp
movsx ax, cl
lea eax, [esp + 0x6d4]
jmp loc.0069306b
push 0x66c1c525
call fcn.0062dfc4
bswap esi
push ebx
mov esi, ebx
lea esi, [esp + 0x320]
lea eax, [esp + 0x6d8]
call fcn.004082c0
add esp, 4
movsx eax, di
cmovl eax, ecx
lahf
lea eax, [esp + 0x6d4]
call fcn.00408310
test al, al
jmp 0x18120b2
push 0x4d
jmp 0x17ae8b5
push edx
jmp 0x1862ae0
lea edx, [esp + 0x2e0]
jmp 0x7772d0
je 0x421833
mov ecx, dword [esp + 0x14]
mov dh, al
push ecx
setb ah
lea edx, [esp + 0x6d8]
push edx
bswap cx
lea eax, [esp + 0xb14]
bswap dx
movzx edx, bp
xchg ecx, ecx
push eax
lea ecx, [esp + 0x950]
cwd
cdq
push ecx
mov dh, 0xe8
cdq
cwd
push 3
jmp 0x180d186
call fcn.018bb5d6
add esp, 0x1c
jmp 0x421833

Function at 0x5a7ef4
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
push 0x824efe28
call fcn.006a61a9
xchg dl, dl

Function at 0x5b1fb5
Capabilities:
Authenticate hmac
Check http status code
Encode data using base64
Execute anti-debugging instructions
Parse pe header
Write file on windows

Disassembly:
push ebp
test cl, al
mov ebp, esp
bts ax, dx
ror ax, 0xa4
inc al
push 0xfffffffffffffffe
push 0x17f2318
and ah, 0x6b
sete al
shrd eax, ecx, 0x79
push 0x473a90
not ah
rcl eax, cl
mov eax, dword fs:[0]
clc
cmp ecx, 0x6a6806a1
test cx, bx
push eax
add ax, dx
btr ax, 0x99
sub esp, 8
mov eax, 0xc4d0d40
movsx ax, ch
mov eax, 0x1e50
call fcn.00474480
mov eax, dword [0x51f620]
cmp esp, 0x3d1a46b7
cmc
test bh, dh
xor dword [ebp - 8], eax
stc
cmc
xor eax, ebp
mov dword [ebp - 0x1c], eax
jmp 0x182e517
mov dword fs:[0], eax
cbw
mov dword [ebp - 0x18], esp
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1e40], eax
xchg ah, ah
not al
movsx esi, di
mov dword [ebp - 0x1e38], ecx
mov esi, dword [ebp + 0x10]
cwde
setg cl
mov dword [ebp - 0x1e30], esi
mov ecx, 0x3bc11366
mov dword [ebp - 0x1e2c], edx
movsx ax, dh
jmp 0x736a00
push eax
movsx eax, di
lea eax, [ebp - 0x10]
bswap esi
cmova si, cx
jmp 0x5e680c
mov eax, dword [ebp + 0x14]
movsx ecx, bp
jmp 0x79c286
mov dword [ebp - 0x1e28], eax
cwde
cmovns edx, eax
bswap cx
mov ecx, dword [ebp + 0x18]
movzx edx, ax
bswap eax
mov dword [ebp - 0x1e58], ecx
mov al, 0x33
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x1e5c], edx
bswap ax
not ax
mov dword [esi], 0
cbw
push 0
mov ah, 0x50
mov eax, dword [0x52afa0]
jmp loc.00421ac1
push edi
jmp 0x61a888
push ebx
push esi
xchg ebx, ebx
jmp 0x7b471b

Function at 0x696538
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub ax, 0x5dd7
bts ax, di
sar ax, 0xde
lea esp, [esp - 0x16c]
rol eax, cl
rcl ax, cl
test ah, dh
mov eax, dword [0x51f620]
cmp ax, 0x4eea
xor eax, ebp
jmp 0x186eaad
push ebx
jmp 0x17f9fa3
push edi
call fcn.00741d58
lea eax, [ebp - 0x18]
jmp 0x7aab7b
mov byte [ebp - 0x17], 0x74
jmp loc.00449573
push eax
jmp 0x181d5fa
push esi
jmp 0x75e798
mov byte [ebp - 0x18], 0x6e
jmp 0x78652f
mov dword [ebp - 4], eax
jmp 0x7241a5
Function at 0x7916ef
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
mov byte [ebp - 0x19d], 0xba
jmp 0x40e2e8
push ebx
jmp 0x74d4b0
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
jmp 0x76e3f4
mov dword [ebp - 0x10], eax
jmp 0x531c8a
mov byte [ebp - 0x169], bl
setbe bl
mov bl, 0xd1
jmp 0x6ac555
jne 0x17fef58
push 0x80004005
jmp 0x17fef53
mov byte [ebp - 0x1a0], 0xb
jmp 0x18b3552
push eax
mov al, 0xa9
movsx eax, si
lahf
lea eax, [ebp - 0xc]
jmp 0x53fe8d
push esi
push edi
jmp 0x6b1e06
mov dword [ebp - 0x2cc], eax
jmp 0x188938d
push ebp
jmp 0x183337e
mov dword [ebp - 0x2c8], edx
jmp 0x184b1c2
call eax
add eax, 0x10
mov bl, 0x9f
mov dword [ebp - 0x2b4], eax
mov dword [ebp - 4], esi
mov bl, 0x37
mov dl, 0x27
mov al, 0xaf
mov dl, 0xac
mov cl, cl
jmp 0x18aaa0d
mov byte [ebp - 0x19e], 0x1a
jmp 0x530880
call fcn.00407150
mov edx, dword [eax]
mov ecx, eax
mov ax, 0x5d4c
setno ah
mov eax, dword [edx + 0xc]
jmp 0x17cf474
mov byte [ebp - 0x16a], bl
jmp 0x5db2fe
mov ebp, esp
rcr al, cl
movsx eax, sp
push 0xffffffffffffffff
push 0x4e38ab
bts eax, edx
and eax, edi
stc
mov eax, dword fs:[0]
cmc
test esi, 0x9b37d74
push eax
mov ah, 0xce
sub esp, 0x2c4
bt ax, cx
adc eax, 0x3a0a1860
shr ah, cl
mov eax, dword [0x51f620]
xor eax, ebp
jmp 0x59843c
call fcn.00450653
sub ecx, ecx
sbb cl, 0xd3
cmp bp, 0x6a9d
neg cl
sub esi, esi
cmp eax, esi
mov cl, 0xed
setne cl
cmc
cmp ecx, esi
jmp 0x64c3ed
mov dword [ebp - 0x2c4], ecx
jmp 0x79fcc1
mov cl, 0x53
jmp 0x181fd12
mov byte [ebp - 0x19f], cl
jmp 0x17f19b5

Function at 0x79ddfb
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push 0x824efe28
call fcn.006a61a9

Function at 0x17a5b42
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
push edi
mov di, dx
xchg di, di
mov edi, ecx
jmp 0x1857e26
mov byte [ebp - 0xd8], 0x52
mov byte [ebp - 0xd7], dl
mov byte [ebp - 0xd5], 0x47
mov byte [ebp - 0xd4], 0x65
mov byte [ebp - 0xd3], dl
jmp 0x17c6743
mov byte [ebp - 0x1c], al
mov byte [ebp - 0x19], al
mov byte [ebp - 0x18], al
mov byte [ebp - 0xd6], al
mov al, 0x97
mov al, 0x73
jmp 0x77ee68
mov byte [ebp - 0x1a], 0x64
mov byte [ebp - 0x17], 0
jmp 0x6b4136
mov byte [ebp - 0xcc], cl
jmp 0x1892432
mov byte [ebp - 0x20], 0x6e
jmp 0x18474b2
push ebp
xchg ebp, ebp
mov ebp, esp
xchg al, dl
lea esp, [esp - 0x160]
xadd dl, al
mov eax, dword [0x51f620]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
not al
xchg dl, al
mov al, 0x6c
mov dl, 0x74
mov bl, 0x6f
jmp 0x531ba3
mov byte [ebp - 0xd2], 0x4e
mov byte [ebp - 0xd1], dl
mov byte [ebp - 0xd0], 0x56
jmp 0x17ec145
mov byte [ebp - 0xcf], 0x65
jmp 0x182f539
mov byte [ebp - 0x1b], 0x2e
jmp 0x71c2e3
mov byte [ebp - 0xce], 0x72
mov byte [ebp - 0xcd], al
jmp 0x767646
mov byte [ebp - 0x1f], dl
jmp 0x18a8612
mov cl, 0x69
jmp 0x1862aa5
mov byte [ebp - 0x1d], al
jmp 0x6ed13b
mov byte [ebp - 0xcb], bl
jmp loc.00406206
mov byte [ebp - 0x1e], 0x64
jmp 0x17fc3b3
Function at 0x1808370
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
mov byte [ebp - 0x184], 0x18
mov byte [ebp - 0x183], 4
mov byte [ebp - 0x182], 0xd8
jmp 0x17eef46
mov byte [ebp - 0x185], 0x6e
jmp 0x5e84df
mov byte [ebp - 0x180], 0xf9
mov byte [ebp - 0x17f], 0xef
mov byte [ebp - 0x17e], 0xf3
jmp 0x762251
mov byte [ebp - 0x17a], 0x58
jmp loc.00434caf
mov byte [ebp - 0x17d], 0x3d
jmp 0x18026a4
mov byte [ebp - 0x181], 0x24
jmp 0x638e72
mov byte [ebp - 0x17c], cl
jmp 0x18e2eef
push 0xfbb094f2
call fcn.017f3b49
mov byte [ebp - 0x187], 0xea
mov byte [ebp - 0x186], 0xeb
jmp 0x5edab8
mov byte [ebp - 0x17b], 0xb3
jmp 0x6fd80b
Function at 0x183337e
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encode data using base64
Parse pe header

Disassembly:
mov byte [ebp - 0x19d], 0xba
jmp 0x40e2e8
push ebx
jmp 0x74d4b0
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
jmp 0x76e3f4
mov dword [ebp - 0x10], eax
jmp 0x531c8a
mov byte [ebp - 0x169], bl
setbe bl
mov bl, 0xd1
jmp 0x6ac555
jne 0x17fef58
push 0x80004005
jmp 0x17fef53
mov byte [ebp - 0x1a0], 0xb
jmp 0x18b3552
push eax
mov al, 0xa9
movsx eax, si
lahf
lea eax, [ebp - 0xc]
jmp 0x53fe8d
push esi
push edi
jmp 0x6b1e06
mov dword [ebp - 0x2cc], eax
jmp 0x188938d
push ebp
jmp 0x183337e
mov dword [ebp - 0x2c8], edx
jmp 0x184b1c2
call eax
add eax, 0x10
mov bl, 0x9f
mov dword [ebp - 0x2b4], eax
mov dword [ebp - 4], esi
mov bl, 0x37
mov dl, 0x27
mov al, 0xaf
mov dl, 0xac
mov cl, cl
jmp 0x18aaa0d
mov byte [ebp - 0x19e], 0x1a
jmp 0x530880
call fcn.00407150
mov edx, dword [eax]
mov ecx, eax
mov ax, 0x5d4c
setno ah
mov eax, dword [edx + 0xc]
jmp 0x17cf474
mov byte [ebp - 0x16a], bl
jmp 0x5db2fe
mov ebp, esp
rcr al, cl
movsx eax, sp
push 0xffffffffffffffff
push 0x4e38ab
bts eax, edx
and eax, edi
stc
mov eax, dword fs:[0]
cmc
test esi, 0x9b37d74
push eax
mov ah, 0xce
sub esp, 0x2c4
bt ax, cx
adc eax, 0x3a0a1860
shr ah, cl
mov eax, dword [0x51f620]
xor eax, ebp
jmp 0x59843c
call fcn.00450653
sub ecx, ecx
sbb cl, 0xd3
cmp bp, 0x6a9d
neg cl
sub esi, esi
cmp eax, esi
mov cl, 0xed
setne cl
cmc
cmp ecx, esi
jmp 0x64c3ed
mov dword [ebp - 0x2c4], ecx
jmp 0x79fcc1
mov cl, 0x53
jmp 0x181fd12
mov byte [ebp - 0x19f], cl
jmp 0x17f19b5
Function at 0x185cc9a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
cbw
shr ah, 0x9a
sbb edx, ebx
mov ebp, esp
rol cx, 0x58
sub esp, 0x84
movzx ecx, cx
rcr ecx, cl
mov eax, dword [0x51f620]
rol dl, cl
add dl, dl
xor eax, ebp
or ch, 0x47
bswap ecx
rcr edx, 0x8e
mov dword [ebp - 4], eax
rol ecx, 0x38
rcl eax, cl
push ebx
bsr ecx, ebp
mov eax, 0x53
cmp sp, 0x6018
mov edx, eax
jmp 0x1883b9b
mov word [ebp - 0x7c], ax
mov word [ebp - 0x78], dx
bsf dx, si
btr edx, eax
shr ah, 0xdc
mov ecx, 0x59
mov eax, 0x515b769e
mov word [ebp - 0x7a], cx
bt edx, 0x43
xor eax, edi
mov eax, 0x54
mov word [ebp - 0x76], ax
mov ecx, 0x45
shl edx, cl
bt dx, 0x50
mov word [ebp - 0x74], cx
shrd edx, ebx, 7
bsr dx, sp
mov eax, 0x5c
rol ecx, 0xe4
mov word [ebp - 0x70], ax
cbw
mov edx, 0x4d
and cl, 0x70
mov word [ebp - 0x72], dx
sar ecx, 0x10
add ecx, eax
bts ecx, ebx
mov ecx, 0x43
xadd al, dl
rcl eax, cl
mov word [ebp - 0x6e], cx
or ecx, edx
mov eax, 0x72
rol ecx, cl
clc
mov ecx, eax
mov word [ebp - 0x6a], ax
mov word [ebp - 0x68], cx
rcl edx, cl
mov edx, 0x75
mov ah, dl
mov word [ebp - 0x6c], dx
mov eax, 0x6e
btc dx, 0xdd
setl dh
rol dh, 0x25
mov word [ebp - 0x64], ax
bts dx, ax
stc
shrd edx, ecx, 0x73
mov edx, 0x65
cwde
btr cx, 0xef
mov word [ebp - 0x66], dx
cmp eax, 0x4661797b
shrd cx, si, 0xee
rol edx, 0xfa
mov eax, 0x6f
add cx, 0x714
movsx ecx, ax
mov word [ebp - 0x5e], ax
btr cx, 0xf6
xadd dh, dh
mov edx, 0x43
bt ax, 0xc8
mov word [ebp - 0x60], dx
rol ch, cl
sal ecx, 0xfc
cmp cx, bx
mov ecx, 0x74
dec al
mov word [ebp - 0x62], cx
btr dx, 0xed
ror eax, 0x35
mov eax, 0x72
ror ecx, 0x69
btc cx, 0xf
movsx edx, bp
mov word [ebp - 0x58], ax
xor eax, ebx
sbb cx, 0x4d0a
mov edx, 0x74
dec ah
movsx ecx, cx
mov eax, ebp
mov word [ebp - 0x5a], dx
btr dx, 0xea
mov ecx, 0x6e
and eax, edx
sub ax, 0x4656
mov word [ebp - 0x5c], cx
cmp ax, di
mov eax, 0x53
jmp loc.004295f0
Function at 0x186ea92
Capabilities:
Parse pe header

Disassembly:
jmp 0x63ea8c
jb 0x186ea9c
mov eax, dword [eax + 4]
jmp 0x75581a
sub edi, edi
movzx esi, bx
xchg esi, esi
mov si, bp
lea esi, [esp + 0x50c]
jmp 0x17c1269
call fcn.0046e038
mov ecx, dword [esp + 0x14]
cwd
mov edx, dword [ecx + 0x84]
mov dword [edx + 0xcd8], eax
jmp 0x71c2de
jmp 0x74019e
call fcn.0046e038
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x84]
clc
mov dword [edx + 0xcd0], eax
bt eax, 0xf4
add esp, 4
inc ah
movzx eax, ax
mov eax, dword [esp + 0x18]
jmp 0x185a62b
mov dword [esp + 0x18], eax
jmp 0x7a4352
call fcn.00440fd0
cmp dword [eax + 0x18], 0x10
jmp 0x17cf40f
call fcn.0046e038
mov ecx, dword [esp + 0x14]
movzx edx, bx
mov edx, edx
sets dl
mov edx, dword [ecx + 0x84]
jmp 0x18d5f6d
jmp 0x63ea8c
mov edi, 1
lea esi, [esp + 0x50c]
jmp 0x17f0b2e
add eax, 4
jmp 0x733e3c
push eax
jmp 0x6079f5
push eax
jmp 0x6974c7
jmp 0x18150b2
add eax, 4
jmp 0x74019e
jl 0x188e36e
lea esi, [esp + 0x50c]
jmp 0x188a7af
mov byte [esp + 0x1ba4], 0x54
mov byte [esp + 0x1ba5], 0x5f
jmp 0x186d410
mov byte [esp + 0x1ba1], 0x4c
jmp 0x187f2ff
call fcn.00440fd0
cmp dword [eax + 0x18], 0x10
jmp 0x5b04f4
jb 0x72faac
mov eax, dword [eax + 4]
jmp 0x733e3c
call fcn.00440fd0
cmp dword [eax + 0x18], 0x10
jb 0x77af46
mov eax, dword [eax + 4]
jmp 0x62b7e2
mov byte [esp + 0x1ba0], 0x3c
jmp 0x17b9238
push eax
jmp 0x63ea72
mov byte [esp + 0x1ba7], 0x45
jmp loc.0041ece5
je 0x5e3b38
sub eax, 1
je 0x71cb43
sub eax, 1
jne 0x63ea94
lea edi, [eax + 2]
lea esi, [esp + 0x50c]
jmp 0x66b708
inc eax
cmp eax, ebx
jmp 0x664f56
mov byte [esp + 0x1ba6], 0x53
jmp 0x181bd2f
push 0xa8a6708f
call fcn.0040172c
add eax, 4
jmp 0x18150b2
mov byte [esp + 0x1ba3], 0x53
jmp 0x17a5424
mov byte [esp + 0x1ba2], 0x41
jmp 0x18730dc
call fcn.00440f80
sub edi, edi
cmovl ecx, eax
movzx eax, di
lea eax, [esp + 0x1b9c]
push eax
lea ecx, [esp + 0xde8]
jmp 0x1808631
sub eax, 0
jmp 0x181e761
mov dword [edx + 0xcd4], eax
jmp 0x53b590
Function at 0x412200
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40f015
lea edi, [esi - 0xe015]
push edi
jmp 0x41221a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x412221
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x412210
mov eax, 1
add ebx, ebx
jne 0x412233
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x412228
jne 0x412244
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x412228
xor ecx, ecx
sub eax, 3
jb 0x412258
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4122ca
mov ebp, eax
add ebx, ebx
jne 0x412263
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x412270
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x412294
inc ecx
add ebx, ebx
jne 0x412280
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x412275
jne 0x412291
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x412275
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4122b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4122a5
jmp 0x412216
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4122b4
add edi, ecx
jmp 0x412216
pop esi
mov edi, esi
mov ecx, 0x113
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4122d2
cmp byte [edi], 2
jne 0x4122d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4122d7
lea edi, [esi + 0x10000]
mov eax, dword [edi]
or eax, eax
je 0x412346
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1203c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x412304
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12044]
or eax, eax
je 0x412340
mov dword [ebx], eax
add ebx, 4
jmp 0x412321
call dword [esi + 0x12040]
mov ebp, dword [esi + 0x12048]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x123a1]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x412392
sub esp, 0xffffff80
jmp 0x4012e0
Function at 0x10002378
Capabilities:
Check internet connectivity via wininet
Check mutex on windows

Disassembly:
push 0x18
push 0x1006c5f0
call fcn.10031bdc
xor esi, esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], esi
push str.HP_INet_Connection
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x24], eax
cmp eax, esi
jne 0x100023a4
xor eax, eax
jmp 0x100023c2
push 0xffffffffffffffff
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, esi
je 0x100023c8
mov dword [ebp - 0x20], esi
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
call fcn.10031c24
ret
mov dword [ebp - 4], esi
push esi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0xfffffffe
call fcn.100023e7
jmp 0x100023b6

Function at 0x1000243a
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, ecx
push 0x1006143c
mov dword [esi], eax
mov eax, dword [esp + 0x14]
push 1
mov dword [esi + 4], eax
mov eax, dword [esp + 0x1c]
push str.UseInstanceForLogStore
push str.MagicNumber
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
jne 0x1000248d
xor ecx, ecx
push ecx
lea eax, [esi + 0xc]
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push dword [esp + 0x24]
mov dword [eax], ecx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, esi
pop esi
ret 0x10

Function at 0x10002493
Capabilities:
Read .ini file

Disassembly:
push esi
push 0x1006143c
push 1
push str.UseInstanceForLogStore
push str.MagicNumber
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
jne 0x100024bf
mov eax, dword [esi + 0xc]
test eax, eax
je 0x100024bf
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
ret
Function at 0x100089f8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x1007b940]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x10061e84
mov esi, ecx
push eax
push eax
lea ecx, [ebp - 0x40]
mov dword [esi], vtable.CMarsDiskIO.0
call fcn.10024db6
and dword [esi + 4], 0
push 0x10061e4c
push 0
push str.Logging
push str.MagicNumber
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x10008a45
mov dword [esi + 4], ecx
lea ecx, [ebp - 0x40]
call fcn.10024a7a
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100302c9
leave
ret

Function at 0x10009629
Capabilities:
Read .ini file

Disassembly:
push 0x10062074
push dword [esp + 0xc]
push dword [esp + 0xc]
push str.MagicNumber
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
ret