joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c4bd5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4c4ced
push eax
call dword [sym.imp.USER32.dll_IsWindow_1]
test eax, eax
je 0x4c4ced
mov eax, dword [esi + 0x3c]
push eax
call fcn.005571ee
mov esi, eax
test esi, esi
je 0x4c4ced
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA_1]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x4c4ced
mov ecx, esi
call fcn.004c4b60
cmp edi, eax
jge 0x4c4ced
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x4c4c73
mov dword [esp + 0x34], 1
jmp 0x4c4cce
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x4c4ced
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen_1]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.004c4110
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x517f40
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x517f5e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x517f53
pop esi
ret

Function at 0x518ab0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x518b19
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.kernel32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.00516790
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.kernel32.dll_ReadFile]
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x51def0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + 0x5d8330]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x5d82c0]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x51df03
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x51df44
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x5d8368]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x51df76
mov bl, byte [esp + ecx + 0x4c]
jmp 0x51df7a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x51df6b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x51df98
mov bl, byte [esp + ecx + 0x4c]
jmp 0x51df9c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x51df8d
xor ecx, ecx
mov eax, 0x5d82d0
xor ebx, ebx
mov bl, byte [ecx + 0x5d8378]
cmp byte [esp + ebx + 0x14], 0
je 0x51dfc7
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x5d8390]
cmp byte [esp + ebx + 0x14], 0
je 0x51dfde
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, 0x5d8330
jl 0x51dfae
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x51df37
lea edx, [esp + 0x84]
push edx
call fcn.0051e020
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x52ed97
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x52edd9
call fcn.00531e6c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.kernel32.dll_FindResourceA]
cmp eax, edi
je 0x52edd9
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
cmp eax, edi
jne 0x52edd0
xor eax, eax
jmp 0x52ede1
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0052ede7
pop edi
pop esi
pop ebx
ret 4

Function at 0x52faee
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x533734
call fcn.0052227c
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.00531e6c
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x52fb2d
call fcn.00531e6c
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.kernel32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.kernel32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x52fb3b
push edi
call dword [sym.imp.kernel32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x52fb49
or eax, 0xffffffff
jmp 0x52fc31
mov ecx, esi
call fcn.0052fa64
mov dword [ebp - 0x14], eax
call fcn.0052d3de
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x52fb80
push dword [ebp - 0x14]
call dword [sym.imp.user32.dll_IsWindowEnabled]
test eax, eax
je 0x52fb80
push edi
push dword [ebp - 0x14]
call dword [sym.imp.user32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.0052d392
push dword [ebp - 0x14]
call fcn.0052cec4
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.0052f7fc
cmp eax, edi
je 0x52fbf3
test byte [esi + 0x24], 0x10
je 0x52fbc1
push 4
mov ecx, esi
pop ebx
call fcn.0052c8c4
test ah, 1
je 0x52fbb9
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.0052eee9
cmp dword [esi + 0x1c], edi
je 0x52fbf3
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.0052c8f8
jmp 0x52fbf3
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x52fc07
push 1
push dword [ebp - 0x14]
call dword [sym.imp.user32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x52fc20
call dword [sym.imp.user32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x52fc20
push dword [ebp - 0x14]
call dword [sym.imp.user32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.0052fa9e
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x534c00
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x5edb8c]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x534c13
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x534c54
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x5edc34]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x534c86
mov bl, byte [esp + ecx + 0x4c]
jmp 0x534c8a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x534c7b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x534ca8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x534cac
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x534c9d
xor ecx, ecx
mov eax, 0x5edb9c
xor ebx, ebx
mov bl, byte [ecx + 0x5edc44]
cmp byte [esp + ebx + 0x14], 0
je 0x534cd7
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x5edc5c]
cmp byte [esp + ebx + 0x14], 0
je 0x534cee
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x534cbe
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x534c47
lea edx, [esp + 0x84]
push edx
call fcn.00534d30
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x556577
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.00560e82
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA_1]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource_1]
test eax, eax
je 0x5565a8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource_1]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.005565bb
pop edi
pop esi
pop ebx
ret 8

Function at 0x557b92
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x557bca
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00555bd8
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA_1]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00555bb0
jmp 0x557bd6
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x559483
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5594c5
call fcn.00560e82
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA_1]
cmp eax, edi
je 0x5594c5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource_1]
cmp eax, edi
jne 0x5594bc
xor eax, eax
jmp 0x5594cd
push eax
call dword [sym.imp.KERNEL32.dll_LockResource_1]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005594d3
pop edi
pop esi
pop ebx
ret 4

Function at 0x5613b2
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection_1]
cmp dword [esp + 0x10], 0
jne 0x5613e0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue_1]
test eax, eax
je 0x5613fe
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00561318
jmp 0x5613fe
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5613fe
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00561318
test edi, edi
mov eax, edi
jne 0x5613e8
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection_1]
pop esi
pop ebx
ret 8
Function at 0x90b84a
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x568bce1a
not word [esp]
adc ebp, 4
neg byte [esp]
neg byte [esp + 3]
mov dword [esp], ecx
popfd
call fcn.00bbdbc7
dec ebx
lodsd eax, dword [esi]
mov esp, 0x961f6da8
xchg edx, eax
lodsb al, byte [esi]
rcr dword [ebx - 0xd91bc1c], cl
lodsd eax, dword [esi]
mov ebx, 0xe1443203
add dword [edx - 0x5643678b], edx
mov edi, 0x8e11b63a
dec ebx
push edi
mov bl, ah
cdq
insd dword es:[edi], dx
add ch, byte [ebx]
insb byte es:[edi], dx
push edi
mov dword [eax - 0x1663a3e7], ebp
invalid

Function at 0x92f18a
Capabilities:
Encode data using xor

Disassembly:
movzx ebx, byte [edx]
mov dword [esp], 0xda248d11
sar byte [esp + 2], 0x45
jnp 0xcb5e12
mov ecx, 0x7ab37b0
sar cl, 0x47
movsx eax, cl
mov ax, word [edi + ecx - 0x7ab37ff]
push ecx
not dword [esp + ecx*2 - 0xf566ffe]
inc cl
mov cx, word [edi + ecx - 0x7ab36fe]
push 0xafbc8b2a
push 0x4f9a9083
adc edi, 2
xor byte [esp + 2], 0x84
not ax
not cx
call fcn.008d69ae
xor ebx, ecx
call fcn.00c48fe9
sub eax, ebp
pushfd
cmp byte [edi - 0x5c], ah
movsd dword es:[edi], dword [esi]
lea ecx, [edx + edi*2 + 0x1f]
jae 0xcb5e81
movsb byte es:[edi], byte [esi]
daa
pop edx
add bh, byte [edi + esi - 0x4c]
jne 0xcb5e44
in al, dx
invalid
xor bh, byte [ecx + 0x642f8ddd]
push es
and eax, 0x4d0bfcdb
les edi, [edx - 0x73eb693c]
fld dword [edx + 0x13]
mov cl, 0x5e
sub dword [edx + 0x58d43b11], esp
int 0xce
in eax, 0xef
or byte [ecx + ebp*4 + 0x5c5b11aa], ah
invalid
mov al, byte gs:[0x76437654]
push ebx
xor eax, 0x4873d060
ja 0xcb5ee8
jge 0xcb5e29
sbb al, 0xe9
wait
adc cl, dh
cdq
bound ebp, qword [ebx + 0x63]
inc edx
sub byte [ecx + 0x4ca476ed], cl
psubusb mm4, qword [0x77020429]
jmp 0x4bc8ee9f
cli
int3

Function at 0xc3574d
Capabilities:
Encode data using xor

Disassembly:
push 0x49b38e95
lea esp, [esp + 0x10]
je 0xc9e294
jmp 0xc84da9
shr dx, cl
push 0xac0ec926
jmp 0xbae1db
push 0xdc38440c
not edx
mov dword [esi], edx
lea esp, [esp + 4]
jmp fcn.00cc9f37
adc esi, 3
jmp 0xca389d
push esi
jmp fcn.00bc6583
mov word [ebp], dx
lea esp, [esp + 8]
jmp fcn.008c58c7
jle 0x92a87c
ror byte [esp], 0x22
jb 0x8d08c0
mov dh, 0xed
lodsd eax, dword [esi]
xor al, 0x50
jne 0xc35761
cdq
stosb byte es:[edi], al
leave
lodsd eax, dword [esi]
dec esp
insb byte es:[edi], dx
stc
cwde
sbb eax, 0xc7f245be
call esi
xchg edi, eax
sti
invalid
jmp 0x92bc07
jmp 0x8f8ac4
xor edx, edx
mov dword [esp + 4], 0x6c2b3733
mov dword [esp], 0xf69e96b5
push 0x290286ba
test ecx, ecx
jmp 0x8b04f4
Function at 0xc3c9fe
Capabilities:
Encode data using xor

Disassembly:
push eax
mov ax, word [ebp + 2]
sar dword [esp], 0x56
adc dword [esp], 0x48b66d15
shl byte [esp + 1], 0xe4
adc ebp, 2
and dx, ax
not word [esp]
call fcn.00c9b509
mov ecx, 0x2e9bca1f
mov edx, ecx
mov ecx, dword [edi + ecx*2 - 0x5d37943e]
jmp 0xc9a486
sal dword [esp + 4], 0x31
jbe 0xd05273
xor ebx, edx
call fcn.009141a9
int 0xff
mov eax, dword [esi]
mov edx, 0xedade783
sar dl, 0xe7
mov dl, byte [esi + 4]
jne 0xc8fdf9
push ebx
or al, 0x83
dec esp
dec ecx
pop esi
mov bh, ah
push eax
out 0x50, eax
mov edi, 0xb81f258a
stosd dword es:[edi], eax
and al, 0x41
outsb dx, byte [esi]
xchg esp, eax
fist dword [esi + eax - 0x13]
mov eax, 0x58f79313
mov cl, 0xdf
cwde
xor ebx, dword [edi + ebx*8 + 0x319ecdad]
shl dword [ecx - 0xe], cl
scasb al, byte es:[edi]
xor ebx, dword [ebp + 0x65]
out 0x1b, eax
or edi, dword [edi - 0x5f]
js 0xc3ca19
jl 0xc3caa8
jp 0xc3c9fc
ljmp 0x31fe:0x9f004345
int1
test byte [edx + ecx*4 + 0x15], cl
aad 0x22
mov byte [ebx + esi], dl
test byte [eax], dl
dec ebx
aaa
pop ebp
into
xor bh, dh
movsb byte es:[edi], byte [esi]
shr dword [ebp - 0x53], 1
pop ds
ja 0xc3ca95
lds ebp, [ecx - 6]
push ecx
adc bl, byte [ebp + 0x168813b9]
leave
out 0xb3, eax
test al, 0xe6
add byte [edx], bl
invalid
bts eax, eax
jb 0x91b1c8
jmp 0x91e7bd

Function at 0xc46c3c
Capabilities:
Encode data using xor

Disassembly:
xor cl, bl
rol word [esp + 2], 0x89
mov word [esp], 0xef11
inc word [esp + 2]
lea esi, [ecx + esi - 0x651f750f]
movzx ecx, byte [edi + ecx - 0x651f7511]
mov dword [esp], 0x79b354a6
shr word [esp + 2], 0xc4
adc edi, 1
ror byte [esp + 1], 0xc1
jae 0x8ba368
mov ecx, 0xf9a4da03
adc dword [edx - 0x7f], edi
mov byte [ecx + ecx*4 - 0x5e0dad15], dh
sbb dl, bl
stosd dword es:[edi], eax
pop edx
or al, 0x49
ror dword [edx + 0x66dc3811], 0xad
aad 0xf8
xchg edx, eax
xor esp, dword [edi + 0x36fa23e8]
pop ds
stc
invalid

Function at 0xc53601
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [edi + 2]
add edi, 2
ror dword [esp], 0x55
jb 0xc58ee0
or eax, 0xc1fc7e00
aad 0x10
jle 0xb79d5b
rcl ebp, 0x10
invalid
push 0x369cf238
ror dword [esp], 0x3c
mov edx, dword [edi]
jae 0x909a8e
lea esp, [esp + 8]
jmp 0xc535e7
push ebx
mov ebx, 0x6822b1b4
mov ebx, dword [esp + ebx - 0x6822b1b4]
mov dword [esp], 0x52d3e2bf
call fcn.00bb6cda
push 0x1d3483ba
mov edx, 0xb183b58a
lea edx, [edx + edx - 0x4ae36062]
movzx dx, byte [edi + edx*4 - 0x60902ac8]
jmp 0xb79d49
call fcn.00c61056
Function at 0xcbebd1
Capabilities:
Authenticate hmac

Disassembly:
pop ebx
test byte [edi], bl
dec edx
sub al, 0xc3
in al, dx
mov dword [0xbcf7d00b], eax
or al, 0xa7
mov al, byte [0xd3f44fd7]
mov al, 0x20
invalid
dec eax
lea esp, [esp + 0x28]
jae fcn.00c9d59c
jmp 0xcbec08
aaa
pop ss
push ebx
add al, 0x54
cmp bh, ch
cmpsb byte [esi], byte es:[edi]
add dl, byte [esi - 7]
sub cl, byte [eax + 0x76c1b654]
in eax, dx
mov dh, 0xc1
jbe 0xcbebf9
and al, 0xa7
or ecx, ecx
pop ebp
sbb esp, dword [eax + 0x30]
jecxz 0xcbec5d
rcr dword [ebx], 0xc1
test eax, edi
movsb byte es:[edi], byte [esi]
jae 0xcbeba7
cmp eax, 0x4c571d97
pop esp
sar byte [0xc1fff687], 0x5c
inc edx
pop edi
dec ecx
out dx, eax
mov cs, word [edx + ecx*8 - 0x7f]
dec ecx
fcom dword [ebx]
and dh, ah
cmp edx, dword [edx + 0x39322938]
cmp al, 0xfa
invalid
Function at 0x402174
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 4]
push eax
push 0x403bdc
push 1
push 0
push 0x403ebc
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x40228d
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
push ecx
call dword [eax + 0x50]
cmp dword [ebp + 0x10], 0
je 0x4021d0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
push edx
call dword [ecx + 0x2c]
cmp dword [ebp + 0x14], 0
je 0x4021e6
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov eax, dword [ebp - 4]
push eax
call dword [edx + 0x1c]
cmp dword [ebp + 0x18], 0
je 0x4021fc
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
push ecx
call dword [eax + 0x24]
cmp dword [ebp + 0x1c], 0
jl 0x402212
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
push edx
call dword [ecx + 0x3c]
cmp dword [ebp + 0x20], 0
je 0x40222c
mov eax, dword [ebp + 0x24]
push eax
mov ecx, dword [ebp + 0x20]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
push ecx
call dword [eax + 0x44]
lea edx, [ebp - 0xc]
push edx
push 0x4042ec
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
push edx
call dword [ecx]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x402281
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
push 1
lea edx, [ebp - 0x214]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xc]
push edx
call dword [ecx + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xc]
push edx
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
push edx
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x10004770
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp eax, 0x4cb03d70
inc eax
inc eax
inc eax
mov eax, 0x8325ac3c
mov eax, ecx
mov eax, ecx
mov eax, ebx
nop
cmp eax, 0xfffffff2
mov eax, ebx
cmp eax, 0xffffff9b
nop
cmp eax, 0xb2fe7208
mov eax, ebx
mov eax, 0xf5afccb
inc eax
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
inc eax
mov eax, ebx
nop
mov eax, ebx
mov eax, ecx
nop
nop
nop
cmp eax, 0x48
cmp eax, 0xffffffe6
cmp eax, 0xffffffdc
mov eax, 0xf4bf426d
nop
cmp eax, 0x1d
mov eax, ecx
nop
cmp eax, 4
cmp eax, 0x12ff9e0f
mov eax, ebx
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
inc eax
cmp eax, 0x4c
cmp eax, 0x6c
cmp eax, 0x4a
cmp eax, 0xffffffc6
nop
mov eax, ebx
cmp eax, 0x19
cmp eax, 0x3f
mov eax, ebx
mov eax, ebx
mov eax, 0x128c9c2a
mov eax, 0x200ca246
nop
cmp eax, 0xffffffe1
inc eax
nop
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
push 0x1002beb4
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp eax, 0x1d
mov eax, ecx
cmp eax, 0xffffffec
mov eax, 0xbec93d1b
nop
cmp eax, 0xe5f70b17
mov eax, ecx
mov eax, ecx
inc eax
inc eax
inc eax
mov eax, ebx
mov eax, ecx
cmp eax, 0x60670cb1
mov eax, ecx
cmp eax, 0xffffffdc
nop
nop
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x1003e22c], eax
mov eax, ecx
mov eax, 0xb39c4fc6
nop
mov eax, ebx
mov eax, ecx
mov eax, ebx
mov eax, ecx
mov eax, ecx
mov eax, ebx
mov eax, ebx
mov eax, ebx
cmp eax, 0x67
cmp eax, 0xfffffff0
mov eax, 0x5dc5cd3d
mov eax, ebx
inc eax
mov eax, ecx
mov eax, ecx
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
cmp dword [0x1003e22c], 0
jne 0x1000491f
push 0x41030
push str.DllWrap
push str.miss
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 0xd886add9
mov eax, ebx
mov eax, 0xdb3ad3e2
inc eax
nop
mov eax, ebx
mov eax, ebx
mov eax, 0xd37ee622
inc eax
mov eax, ecx
cmp eax, 0xff4e2e3e
nop
cmp eax, 0x4b
mov eax, 0xcf0717df
nop
inc eax
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
cmp dword [0x1003e22c], 0
je 0x10004931
mov dword [ebp - 4], 1
jmp 0x10004938
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x401310
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x22c]
push esi
push 0x228
push 0
push eax
mov dword [ebp - 0x230], 0x22c
call fcn.0040f3c0
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40136d
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407dbf
mov esp, ebp
pop ebp
ret 4
push edi
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4013a8
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00408bf5
add esp, 8
test eax, eax
je 0x4013c4
lea eax, [ebp - 0x230]
push eax
push esi
call edi
test eax, eax
jne 0x401386
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407dbf
mov esp, ebp
pop ebp
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407dbf
mov esp, ebp
pop ebp
ret 4

Function at 0x401440
Capabilities:
Create udp socket
Initialize winsock library
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
xor eax, eax
push 0x18e
push eax
mov word [ebp - 0x1ac], ax
lea eax, [ebp - 0x1aa]
push eax
call fcn.0040f3c0
add esp, 0xc
lea eax, [ebp - 0x1ac]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4014ac
or eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00407dbf
mov esp, ebp
pop ebp
ret 4
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [ebp - 0x1b0]
push 4
push eax
push 0x1005
push 0xffff
push edi
mov dword [ebp - 0x1b0], 0xbb8
call esi
push 4
lea eax, [ebp - 0x1b0]
push eax
push 0x1006
push 0xffff
push edi
call esi
push 4
lea eax, [ebp - 0x1b0]
mov dword [ebp - 0x1b0], 4
push eax
push 0x1001
push 0xffff
push edi
call esi
xorps xmm0, xmm0
mov eax, 2
movdqu xmmword [ebp - 0x18], xmm0
push 0x501
mov word [ebp - 0x18], ax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x18]
push eax
push 0
push 4
lea eax, [ebp - 0x1b4]
mov dword [ebp - 0x14], 0x3d389f73
push eax
push edi
mov dword [ebp - 0x1b4], 0xd0d0d
call dword [sym.imp.WS2_32.dll_sendto]
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00407dbf
mov esp, ebp
pop ebp
ret 4