joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a7cbb
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4a7ce9
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4a7d07
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004a7c21
jmp 0x4a7d07
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4a7d07
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004a7c21
test edi, edi
mov eax, edi
jne 0x4a7cf1
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x407bff
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], 0x29c27be8
add dword [ebp - 8], 0x4196
mov byte [ebp - 1], 1
lea edi, [ebp - 0x1c]
lea esi, [0x42e63e]
mov ecx, 0x11
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 8]
mov edx, eax
sub edx, eax
mov dword [ebp - 8], edx
lea edi, [ebp - 0x2b]
lea esi, [0x42e64f]
mov ecx, 0xf
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x32]
lea esi, [0x42e65e]
mov ecx, 7
rep movsb byte es:[edi], byte [esi]
sub dword [ebp - 8], 0x6151
cmp byte [ebx], 0x67
jne 0x407c7a
inc ebx
add byte [ebp - 1], 1
mov eax, dword [ebp - 8]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], eax
mul dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov dword [ebp - 8], eax
mov byte [ebp - 9], 0
jmp 0x407c96
mov al, byte [ebx]
movzx edx, byte [ebp - 9]
cmp al, byte [ebp + edx - 0x1c]
jne 0x407c92
add byte [ebp - 1], 4
jmp 0x407c9c
add byte [ebp - 9], 1
cmp byte [ebp - 9], 0x11
jb 0x407c80
xor dword [ebp - 8], 0x774b
mov byte [ebp - 0xa], 0
jmp 0x407d57
mov al, byte [ebx]
movzx edx, byte [ebp - 0xa]
cmp al, byte [ebp + edx - 0x2b]
jne 0x407d53
add byte [ebp - 1], 1
mov eax, 0x67c6
mul dword [ebp - 8]
mov dword [ebp - 0x38], eax
mov dword [ebp - 8], eax
movzx eax, byte [ebx + 1]
cmp eax, 0xc0
jge 0x407d38
movzx eax, byte [ebx + 1]
and eax, 0xc0
cmp eax, 0x40
jne 0x407ceb
add byte [ebp - 1], 1
movzx eax, byte [ebx + 1]
mov edx, eax
and edx, 7
cmp edx, 4
je 0x407d03
cmp edx, 5
jne 0x407d07
cmp eax, 0x40
jge 0x407d07
add byte [ebp - 1], 1
sub dword [ebp - 8], 0x251a
movzx eax, byte [ebx + 1]
test byte [ebx + 1], 0xc0
jne 0x407d24
and eax, 7
cmp eax, 5
jne 0x407d24
add byte [ebp - 1], 3
movzx eax, byte [ebx + 1]
and eax, 0xc0
cmp eax, 0x80
jne 0x407d38
add byte [ebp - 1], 4
movzx eax, byte [ebx]
cmp eax, 0xf7
jne 0x407d4c
test byte [ebx + 1], 0x38
jne 0x407d4c
add byte [ebp - 1], 4
sub dword [ebp - 8], 0x2d1d
add byte [ebp - 0xa], 1
cmp byte [ebp - 0xa], 0xf
jb 0x407cac
mov byte [ebp - 0xb], 0
jmp 0x407d7d
mov al, byte [ebx]
movzx edx, byte [ebp - 0xb]
cmp al, byte [ebp + edx - 0x32]
jne 0x407d79
add byte [ebp - 1], 1
jmp 0x407d83
add byte [ebp - 0xb], 1
cmp byte [ebp - 0xb], 7
jb 0x407d67
mov eax, 0x7d5b
mul dword [ebp - 8]
mov dword [ebp - 0x38], eax
mov dword [ebp - 8], eax
movzx eax, byte [ebx]
cmp eax, 0x83
jne 0x407d9f
add byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403410
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
sub eax, ebx
push esi
push edi
je 0x40342c
dec eax
je 0x403428
dec eax
jne 0x403431
push 4
pop esi
jmp 0x403434
push 2
jmp 0x403425
xor esi, esi
inc esi
jmp 0x403434
mov esi, dword [ebp - 4]
push str.JavaQuickStarterService
push ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov edi, eax
cmp edi, ebx
jne 0x40345a
mov byte [0x40aa2d], bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_report_messages_to_system_event_log:_RegisterEventSource_failed__error__d__n
jmp 0x4034c2
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ebx
push 1
push ebx
push 0x40000001
push ebx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x4034a9
call esi
cmp eax, 0x5de
mov byte [0x40aa2d], bl
jne 0x40349c
push str.Unable_to_report_messages_to_system_event_log:_event_log_is_full_n
call fcn.004033b4
jmp 0x4034a8
push eax
push str.Unable_to_report_messages_to_system_event_log:_ReportEvent_failed__error__d__n
call fcn.004033b4
pop ecx
pop ecx
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
test eax, eax
jne 0x4034c9
mov byte [0x40aa2d], bl
call esi
push eax
push str.Unable_to_report_messages_to_system_event_log:_DeregisterEventSource_failed__error__d__n
call fcn.004033b4
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403904
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x40a8c8]
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x403936
push eax
push str.Unable_to_initialize_socket_library__error__d_n
call fcn.00403668
pop ecx
pop ecx
mov ecx, dword [esp + 0x190]
call fcn.00404b93
add esp, 0x194
ret

Function at 0x403aa6
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
mov eax, 0x405248
call fcn.00404a90
sub esp, 0x24
push esi
mov esi, ecx
lea ecx, [esi + 0xc]
mov dword [ebp - 0x10], esi
mov dword [esi], 0x408228
call fcn.00403988
and dword [ebp - 4], 0
push 6
push 1
push 2
mov byte [esi + 0x14], 0
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x403afe
push str.socket___failed
lea ecx, [ebp - 0x30]
call fcn.004043d8
push 0x408b20
lea eax, [ebp - 0x30]
push eax
call sub.MSVCR71.dll__CxxThrowException
mov ecx, dword [ebp - 0xc]
mov dword [esi + 8], accept
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x403c03
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 0x10
push dword [ebp + 8]
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x403c50
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274d
lea ecx, [ebp - 0x20]
jne 0x403c38
call fcn.0040420b
push 0x408cc4
jmp 0x403c47
push str.connect___failed
call fcn.004043d8
push 0x408b20
lea eax, [ebp - 0x20]
push eax
call sub.MSVCR71.dll__CxxThrowException
leave
ret 4
Function at 0x403c95
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, esi
cdq
mov edi, 0x3e8
idiv edi
sub esi, 0x7fffffff
imul edx, edx, 0x3e8
mov dword [ebp - 8], eax
neg esi
sbb esi, esi
lea eax, [ebp - 8]
and esi, eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp + 8]
mov ecx, eax
xor edi, edi
inc edi
dec ecx
neg ecx
sbb ecx, ecx
mov dword [ebp - 4], edx
push esi
not ecx
lea edx, [ebp - 0x12c]
and ecx, edx
neg eax
push 0
push ecx
sbb eax, eax
not eax
mov ecx, edx
and eax, ecx
push eax
push edi
mov dword [ebp - 0x12c], edi
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x403d20
test eax, eax
je 0x403d11
cmp eax, edi
jne 0x403d20
xor ecx, ecx
cmp eax, edi
sete cl
pop edi
mov al, cl
pop esi
leave
ret 8
push str.select___failed
lea ecx, [ebp - 0x28]
call fcn.004043d8
push 0x408b20
lea eax, [ebp - 0x28]
push eax
call sub.MSVCR71.dll__CxxThrowException
int3

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0xaf3ca7
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 3]
jmp 0xaf3cf6
btr ebx, esp
bswap edi
mov byte [esp], dh
neg edx
mov cx, sp
not ah
jmp 0xaf3cdb
mov si, 0x23bf
pop esi
bsr bp, bp
mov bh, byte [esp + 1]
lea edi, [ebp + 0x37]
stc
jmp 0xaf3cae
Function at 0xaf3f00
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebp, [edi*4]
rcr ch, 5
jmp 0xaf3f4c
mov word [esp + 7], bx
mov al, ah
inc si
sub esp, 0x12
inc ebx
mov bp, word [esp + 0xb]
jmp 0xaf3f33

Function at 0xaf4986
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop di
mov dword [esp + 0xf], esi
push esp
pop edi
add esp, 3
mov di, 0x74b7
jmp 0xaf4a11
btr eax, esp
push dword [esp + 8]
jmp 0xaf4970
pop dword [esp + 0xf]
mov byte [esp + 0x19], dh
push esp
xchg byte [esp + 0x12], al
sub esp, 0xa
mov si, word [esp + 0x1a]
jmp 0xaf4a40
bswap edi
mov word [esp + 8], sp
lea ebp, [esp + eax]
inc esi
rdtsc
mov edx, ebp
jmp 0xaf49ea
cmc
pop bp
not di
pop dword [esp + 6]
mov edi, 0xaaeac276
mov ebp, dword [esp]
jmp 0xaf4a8d
popal
pop word [esp + 3]
push dword [esp + 0xa]
setg dh
xchg dx, ax
sub esp, 0xc
jmp 0xaf4a22
setle bh
push word [esp + 0x2f]
cmc
rdtsc
mov ax, 0x99cb
jmp 0xaf4aa0
xchg edx, eax
mov esi, 0xe89c6d1e
mov di, word [esp + 0x23]
neg edx
mov byte [esp + 0x25], bh
add al, dh
jmp 0xaf4a55
mov cx, sp
mov bx, sp
cmc
xchg word [esp + 0xf], cx
mov bl, bh
sub esp, 0x1c
jmp 0xaf4a6b
bswap edi
push word [esp + 0x10]
mov bx, 0x8c1b
mov ax, sp
xchg di, cx
pop dword [esp + 5]
jmp 0xaf4b1c
lea ebp, [ecx - 0x63]
pushal
lea esp, [esp + 0x51]
mov ebp, 0x8e658b74
push edx
call fcn.00af4ad0
mov dh, byte [esp + 7]
xchg ebp, eax
setno ch
push word [esp + 1]
cld
cld
jmp 0xaf4b34
xchg ecx, eax
mov byte [esp + 0x1f], ch
xchg word [esp + 0x1a], si
xchg di, bx
mov byte [esp + 0x1d], bh
mov dh, byte [esp + 0x24]
jmp 0xaf4aea
xchg dword [esp], eax
xchg ch, dl
add esp, 5
lea esi, [ebp*4]
jmp 0xaf4cfd
mov dword [esp + 8], esi
neg edx
mov dx, 0xe06d
sub esp, 0x16
lea esi, [ecx + 0xc3]
xchg byte [esp + 0x26], dl
jmp 0xaf4bc4
xchg word [esp + 1], bx
mov dword [esp], esi
mov edi, dword [esp + 2]
pop di
not ah
pushal
jmp 0xaf4b63
mov word [esp], di
add esp, 3
push word [esp]
push word [esp + 2]
add esp, 2
sub bl, ah
jmp 0xaf4b89
pop dword [esp + 0x19]
pushal
lea esp, [esp + 0x55]
mov al, 0x6e
mov di, word [esp]
rol bx, cl
jmp 0xaf4c6f
shl cx, cl
xchg ah, bl
add esp, 9
mov ecx, dword [esp + 5]
xchg esi, edx
pop word [esp + 3]
jmp 0xaf4bad
cpuid
mov edx, ebp
btr ebx, edx
mov dl, dh
push edx
mov word [esp], di
jmp 0xaf4c1d
mov bl, bh
bswap ecx
mov cl, byte [esp]
lea esi, [ecx + edx]
lea esi, [edx + ebx]
xchg ebp, ecx
jmp 0xaf4bf5
mov al, ah
mov al, 0x76
push word [esp + 1]
pop word [esp + 1]
mov cl, ch
btc edi, ebx
jmp 0xaf4c57
mov bx, word [esp + 0x2e]
push dword [esp + 0x38]
sub esp, 0x1e
lea esp, [esp + 0x5c]
bswap esi
lea ebx, [ebp + 0x4cbf8edf]
jmp 0xaf4c0c
mov cl, ch
mov dword [esp], ecx
clc
clc
lea edi, [ebx + ebx]
bswap eax
jmp 0xaf4c81
btr eax, edx
not di
pushal
pop ax
push dword [esp + 0xc]
sub esp, 0x18
jmp 0xaf4c3d
mov byte [esp + 2], ch
mov cl, ch
pop word [esp]
lea ecx, [ebp - 0xaf]
call fcn.00af4cdc
mov eax, dword ss:[0x8a35031]
pushal
mov dword [0x8d2435da], eax
test eax, 0xffffff15
lea ebp, [ecx - 0xeb]
sub esp, 0xa
btc ebx, ebx
cpuid
rcl cx, cl
push dword [esp + 1]
jmp 0xaf4be0
mov cx, word [esp + 2]
pop word [esp]
mov byte [esp + 1], bh
add bx, 0x2b56
inc cl
xchg word [esp], si
jmp 0xaf4ca1
Function at 0xaf5049
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 0x80]
jmp 0xaf5087
lea esp, [esp + 3]
mov dword [esp + 0x80], edi
jmp 0xaf5033
mov eax, dword fs:[0x30]
jmp 0xaf506d

Function at 0xaf509f
Capabilities:
Parse pe header

Disassembly:
pop dword [esp + 0x26]
mov dword [esp + 0x1f], esi
mov byte [esp + 0x12], dh
push word [esp + 0xb]
lea esp, [esp + 0x2b]
mov byte [esp + 1], ah
jmp 0xaf5060
mov dword [esp + 0x74], esi
pushal
pushal
mov word [esp + 0x1a], sp
pop dword [esp + 2]
mov dword [esp + 0x1f], esi
jmp 0xaf4ffd
push dword [esp + 7]
pop dword [esp + 3]
mov byte [esp + 7], ah
pop word [esp + 7]
lea esp, [esp + 1]
push dword [esp + 1]
lea esp, [esp + 1]
jmp 0xaf501e
Function at 0x401f6d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x40ac24], 0
push esi
jne 0x401fa4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x401f7e
mov dword [ecx*4 + 0x40ac20], eax
inc ecx
cmp ecx, 0x100
jl 0x401f79
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x401fd5
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x40ac20]
xor eax, esi
inc ecx
dec edx
jne 0x401fb7
pop edi
not eax
pop esi
ret 0xc

Function at 0x411d70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
js 0x411d72
add byte [eax], al
add byte [eax], al
add byte [eax], al
pop es
add byte [eax], al
and byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esi + 0x7a2b3d72], cl
inc byte [edx]
mov byte [eax], bh
add byte [eax], al
add byte [eax], al
add byte [eax], al
pop es
add byte [eax], al
and byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx + esi*2 - 0x85d4c1], cl
add cl, byte [eax + 0x78]
add byte [eax], al
add byte [eax], al
pop es
add byte [eax], al
and byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx + 0x7a2b3972], cl
add byte [ebx], al
mov byte [eax], bh
add byte [eax], al
add byte [eax], al
add byte [eax], al
pop es
add byte [eax], al
and byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x7a2b3b72], cl
add dword [ebx], eax
mov byte [eax], bh
add byte [eax], al
add byte [eax], al
add byte [eax], al
pop es
add byte [eax], al
and byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esi + 0x7a2b2572], dh
add al, byte [ebx]
mov byte [eax], bh
add byte [eax], al
add byte [eax], al
add byte [eax], al
pop es
add byte [eax], al
and byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx + esi*2 + 0x37a2b27], dh
add ecx, dword [eax + 0x78]
add byte [eax], al
add byte [eax], al
pop es
add byte [eax], al
and byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx + 0x7a2b2172], dh
add al, 3
mov byte [eax], bh
js 0x411e52
Function at 0x403d94
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
push esi
push edi
lea edi, [ebp - 0x400]
mov edx, dword [ebp + 0x10]
push 8
push edx
push edi
call fcn.004053bc
push dword [ebp + 0x14]
push 8
push edi
call fcn.00403d38
xor eax, eax
xor ecx, ecx
mov edi, dword [ebp + 0x14]
xor edx, edx
cmp ecx, dword [ebp + 0xc]
jge 0x403df0
mov esi, ecx
inc esi
and esi, 0xff
mov al, byte [edi + esi]
add dl, al
mov bl, byte [edi + edx]
mov byte [edi + esi], bl
mov byte [edi + edx], al
add al, bl
mov al, byte [edi + eax]
mov esi, dword [ebp + 8]
xor byte [esi + ecx], al
inc ecx
jmp 0x403dc6
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4050c2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x9c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x80
mov eax, dword [ebp + 8]
or eax, eax
jne 0x4051a9
mov eax, dword [ebp + 0x10]
or eax, eax
je 0x40521f
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push edi
call fcn.00405343
or eax, eax
js 0x405111
mov ecx, dword [ebp - 0x10]
shr ecx, 1
sub ecx, 3
sub ecx, eax
jns 0x405145
xor ecx, ecx
and eax, 0x7fffffff
shl eax, 1
add eax, 3
lea edi, [ebp - 0x14]
lea edx, [ebp - 0x10]
mov dword [edi], ecx
mov dword [edx], eax
push 4
push 0x1000
push edx
push ecx
push edi
push 0xffffffffffffffff
call dword [ebx + 0x3806]
or eax, eax
jne 0x40521f
mov edi, dword [edi]
jmp 0x4050f5
mov ecx, dword [ebp - 0x10]
mov edx, edi
mov al, 0x2e
repne scasb al, byte es:[edi]
jne 0x40521f
dec edi
xor eax, eax
stosb byte es:[edi], al
mov esi, edi
repne scasb al, byte es:[edi]
jne 0x40521f
push ecx
push edx
push edi
call fcn.0040537e
or eax, eax
js 0x40521f
push esi
call fcn.004052ce
mov dword [ebp + 0xc], eax
push edi
call fcn.0040524a
or eax, eax
jns 0x4051a9
lea esi, [ebp + 8]
lea eax, [ebp - 0x1c]
push edi
push eax
call dword [ebx + 0x3802]
lea eax, [ebp - 0x1c]
push esi
push eax
push 0
push 0
call dword [ebx + 0x37fe]
or eax, eax
jne 0x40521f
mov eax, dword [ebp + 8]
mov edi, eax
add eax, dword [eax + 0x3c]
mov edx, dword [eax + 0x78]
or edx, edx
je 0x40521f
mov ecx, dword [eax + 0x7c]
add edx, edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
mov ecx, dword [edx + 0x18]
mov esi, dword [edx + 0x20]
mov dword [ebp - 4], ecx
add esi, edi
dec dword [ebp - 4]
js 0x40521f
lodsd eax, dword [esi]
add eax, edi
push eax
call fcn.004052ce
xor eax, dword [ebp + 0xc]
jne 0x4051cb
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x20]
add eax, edi
sub esi, eax
shr esi, 1
add esi, dword [edx + 0x24]
add esi, edi
sub esi, 2
movzx esi, word [esi]
shl esi, 2
add esi, dword [edx + 0x1c]
add esi, edi
mov eax, dword [esi]
add eax, edi
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
add ecx, edx
cmp eax, edx
jb 0x405222
cmp eax, ecx
jg 0x405222
push eax
push 0
push 0
call fcn.004050c2
or eax, eax
jns 0x405222
or eax, 0xffffffff
xor ecx, ecx
cmp ecx, dword [ebp - 0x14]
je 0x405244
mov edi, eax
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x10]
mov dword [edx], ecx
push 0x8000
push edx
push eax
push 0xffffffffffffffff
call dword [ebx + 0x3812]
mov eax, edi
pop edi
pop esi
leave
ret 0xc

Function at 0x40524a
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor eax, eax
mov eax, dword fs:[eax + 0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
lea edi, [eax + 0x1c]
mov esi, edi
mov edi, dword [edi]
cmp edi, esi
je 0x40527a
push dword [edi + 0x20]
push dword [ebp + 8]
call fcn.0040530d
or eax, eax
jne 0x405260
mov eax, dword [edi + 8]
jmp 0x40527d
or eax, 0xffffffff
pop edi
pop esi
leave
ret 4
Function at 0x405283
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor eax, eax
mov esi, dword [ebp + 0xc]
lodsw ax, word [esi]
lea edx, [eax + 2]
cmp edx, dword [ebp + 0x10]
jbe 0x40529f
or eax, 0x80000000
jmp 0x4052c7
mov edi, dword [ebp + 8]
mov ebx, edi
shr eax, 1
je 0x4052be
mov edx, eax
or ecx, 0xffffffff
lodsw ax, word [esi]
ror ah, cl
xor ah, cl
dec cl
rol al, cl
xor al, cl
stosw word es:[edi], ax
dec edx
jne 0x4052ad
xor eax, eax
stosw word es:[edi], ax
sub edi, ebx
lea eax, [edi - 2]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x41bc20
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x484e3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0047944b
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x41bca2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00476b4a
mov eax, dword [eax]
push 0x4f31e0
push eax
call fcn.00469814
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004796d6
test bl, bl
je 0x41bca2
push 0x4f31e0
lea ecx, [esp + 0xc]
call fcn.00479a66
push 0x4f6d78
lea ecx, [esp + 0xc]
call fcn.00479a66
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41bcde
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004796d6
jmp 0x41bda9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x41bd62
lea edx, [esp + 0x7c]
push 0x4f6d74
push edx
call fcn.00469814
add esp, 8
test eax, eax
je 0x41bd62
lea eax, [esp + 0x7c]
push 0x4f6d70
push eax
call fcn.00469814
add esp, 8
test eax, eax
je 0x41bd62
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41bcf2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004796d6
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x41c5c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x41c622
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc