joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004bbd
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
push edi
mov edi, 0x20a
push edi
mov esi, ecx
call fcn.01001544
pop ecx
push eax
mov ecx, esi
call fcn.0100be01
push edi
push 0
push dword [esi]
call sub.msvcrt.dll_memset
mov esi, dword [esi]
add esp, 0xc
push 0x105
push esi
push 0x1004c04
call dword [sym.imp.API_MS_Win_Core_ProcessEnvironment_L1_1_0.dll_ExpandEnvironmentStringsW]
pop edi
pop esi
test eax, eax
je 0x1010814
xor eax, eax
ret
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
test eax, eax
jle 0x1004c03
and eax, 0xffff
or eax, 0x80070000
ret

Function at 0x1004c4c
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor eax, eax
xor esi, esi
mov dword [ebp - 0x10], esi
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.API_MS_Win_Core_File_L1_1_0.dll_GetFileSizeEx]
test eax, eax
je 0x1010c27
cmp dword [ebp - 0xc], esi
jne 0x1010c44
cmp dword [ebp - 0x10], esi
je 0x1010c4e
test byte [ebp - 0x10], 1
jne 0x1010c4e
mov edi, dword [sym.imp.API_MS_Win_Core_File_L1_1_0.dll_ReadFile]
push esi
lea eax, [ebp - 4]
push eax
push 2
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call edi
test eax, eax
je 0x1010c27
cmp dword [ebp - 4], 2
jne 0x1010c4e
mov eax, 0xfeff
cmp word [ebp - 8], ax
jne 0x1010c4e
mov esi, dword [ebp - 0x10]
push ebx
shr esi, 1
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.01001544
pop ecx
push 0
lea ecx, [ebp - 4]
push ecx
lea ebx, [esi + esi]
push ebx
push eax
push dword [ebp + 8]
mov dword [ebp - 8], eax
call edi
test eax, eax
je 0x1010c58
lea eax, [esi + esi - 2]
cmp dword [ebp - 4], eax
jne 0x1010c7d
mov eax, dword [ebp - 8]
xor ecx, ecx
mov word [ebx + eax - 2], cx
mov ecx, dword [ebp + 0xc]
push eax
call fcn.0100be01
push 0
call fcn.01001514
xor eax, eax
pop ecx
pop ebx
pop edi
pop esi
leave
ret 8
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp eax, esi
jle 0x1004d32
and eax, 0xffff
or eax, 0x80070000
jmp 0x1004d32
mov eax, 0x8007000e
jmp 0x1004d32
mov eax, 0x80070057
jmp 0x1004d32
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
test eax, eax
jle 0x1010c6c
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push dword [ebp - 8]
call fcn.01001514
mov eax, esi
jmp 0x1004d30
mov esi, 0x80004005
jmp 0x1010c6e
Function at 0x100678a
Capabilities:
Terminate process

Disassembly:
test byte [ebp - 0x40], 1
jne 0x100d834
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call fcn.010098a1
mov dword [0x10220e8], eax
cmp dword [0x10220dc], ebx
jne 0x100d87d
push eax
call dword [sym.imp.msvcrt.dll_exit]
nop
nop
nop
nop
nop
call fcn.01004308
push 0x5c
push 0x10068f0
call fcn.01001810
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x102214c
push ebx
push esi
push edi
call dword [sym.imp.API_MS_Win_Core_Interlocked_L1_1_0.dll_InterlockedCompareExchange]
cmp eax, ebx
jne 0x100d7e6
xor esi, esi
inc esi
mov eax, dword [0x1022114]
cmp eax, esi
je 0x100d805
mov eax, dword [0x1022114]
test eax, eax
jne 0x1006927
mov dword [0x1022114], esi
push 0x10068ec
push 0x10068e0
call fcn.01006761
pop ecx
pop ecx
test eax, eax
jne 0x100d8a0
mov eax, dword [0x1022114]
cmp eax, esi
jne 0x100683d
push 0x10068dc
push 0x1006884
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1022114], 2
cmp dword [ebp - 0x20], ebx
jne 0x100684a
push ebx
push edi
call dword [sym.imp.API_MS_Win_Core_Interlocked_L1_1_0.dll_InterlockedExchange]
cmp dword [0x102cc90], ebx
jne 0x100d812
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x100d8a0
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
jbe 0x1006918
cmp cx, 0x22
je 0x100d83d
inc eax
inc eax
jmp 0x1006865
cmp cx, bx
je 0x1006932
cmp dword [ebp - 0x1c], ebx
je 0x1006932
jmp 0x1006875
mov dword [0x102cee8], esi
jmp 0x1006819
movzx ecx, word [eax]
cmp cx, bx
je 0x1002732
cmp cx, 0x20
ja 0x1002732
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x1006932
cmp eax, esi
jne 0x100d7f5
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x10067e0
push 0x3e8
call dword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_Sleep]
jmp 0x10067cc
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1006819
push 0x102cc90
call fcn.0101496c
pop ecx
test eax, eax
je 0x1006856
push ebx
push 2
push ebx
call dword [0x102cc90]
jmp 0x1006856
movzx ecx, word [ebp - 0x3c]
jmp 0x100273f
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
jmp 0x100687f
cmp dword [0x102cee8], ebx
jne 0x100d88b
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x10220e8]
jmp 0x100d8ac
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01001a7c
ret
Function at 0x1006e46
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
cmp dword [esi + 0x24], ecx
jbe 0x1006ee3
push ebx
push edi
xor ebx, ebx
mov eax, dword [esi + 0x20]
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 4]
push edx
lea edx, [ebp - 8]
push edx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], 4
mov edi, dword [ebx + eax + 4]
mov eax, dword [esi + 4]
push ecx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
mov eax, dword [0x10220c0]
cmp eax, 0x10220c0
je 0x1006ea8
test byte [eax + 0x1c], 8
jne 0x101082d
cmp dword [ebp - 0x10], 0
jne 0x1006ecf
cmp dword [ebp - 8], 4
jne 0x1006ecf
mov eax, dword [esi + 0x20]
add eax, ebx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x1006ec9
cmp dword [ebp - 4], ecx
ja 0x101084e
mov ecx, dword [ebp - 4]
mov dword [eax + 8], ecx
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
add ebx, 0x10
cmp eax, dword [esi + 0x24]
jae 0x1006ee1
xor ecx, ecx
jmp 0x1006e63
pop edi
pop ebx
mov byte [esi + 0x28], 1
pop esi
leave
ret
push dword [ebp - 0x10]
push dword [ebp - 4]
push dword [ebp - 8]
push edi
push 0x10122a8
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101ab9b
jmp 0x1006ea8
mov dword [ebp - 4], ecx
jmp 0x1006ec9

Function at 0x1006f33
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, ecx
call fcn.0100bb88
lea edi, [esi + 4]
xor ebx, ebx
mov dword [edi], ebx
mov dword [ebp - 0x10], 0xc
call fcn.01004c41
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push 0x20019
push ebx
push ebx
push ebx
push 0x1007008
push 0x80000002
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x101088e
mov ecx, esi
call fcn.01004bbd
cmp eax, ebx
jl 0x1007092
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x10108a3
push ebx
push 1
push ebx
push ebx
call dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_CreateEventW]
mov dword [esi + 8], eax
cmp eax, ebx
je 0x10108b5
push 0x80
push 0xffffffffffffffff
push esi
push 0x1006e00
push eax
lea eax, [esi + 0xc]
push eax
jmp 0x1036771
pop edi
pop esi
pop ebx
leave
ret
jle 0x1007092
and eax, 0xffff
or eax, 0x80070000
jmp 0x1007092
mov eax, dword [esi]
push ebx
push eax
call dword [sym.imp.API_MS_Win_Core_File_L1_1_0.dll_CreateDirectoryW]
test eax, eax
jne 0x1006fa6
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp eax, ebx
jmp 0x101088e
Function at 0x1008ecc
Capabilities:
Check for sandbox username or hostname
Get session user name

Disassembly:
push 4
mov eax, 0x101dca9
call fcn.01001448
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push dword [ebp + 8]
lea ecx, [ebx + 4]
mov dword [ebx], 0x10017bc
call fcn.0100894b
xor eax, eax
push eax
lea ecx, [ebx + 0xc]
mov dword [ebp - 4], eax
mov dword [ebx + 8], eax
call fcn.01009ade
mov eax, dword [ebp + 0xc]
push dword [ebp + 0x10]
mov dword [ebx + 0x24], 1
mov byte [ebx + 0x28], 0
lea edi, [ebx + 0x2c]
mov esi, 0x100a86c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ecx, [ebx + 0x40]
mov byte [ebp - 4], 1
mov dword [ebx + 0x3c], eax
call fcn.0100b3de
lea esi, [ebx + 0x4c]
xor eax, eax
mov dword [esi], eax
lea ecx, [ebp + 8]
push ecx
push eax
push 2
mov byte [ebp - 4], 3
mov dword [ebp + 8], eax
call sub.SspiCli.dll_GetUserNameExW
test al, al
jne 0x100f990
mov eax, dword [ebp + 8]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.01001544
pop ecx
push eax
mov ecx, esi
call fcn.0100be01
mov esi, dword [esi]
lea eax, [ebp + 8]
push eax
push esi
push 2
call sub.SspiCli.dll_GetUserNameExW
test al, al
je 0x100f9a8
mov eax, ebx
call fcn.010016a1
ret 0xc
push 0x67
push 0x10121b4
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
push eax
push 0x10111a0
call fcn.010132c1
push 0x69
push 0x10121b4
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
push eax
push 0x1011120
jmp 0x100f9a3
Function at 0x10095c4
Capabilities:
Get session user name

Disassembly:
push 8
mov eax, 0x101c8a1
call fcn.01001448
mov ebx, ecx
lea eax, [ebx + 0xc]
push eax
lea ecx, [ebp - 0x14]
call fcn.01001a1a
and dword [ebp - 4], 0
mov ecx, ebx
call fcn.01009658
test eax, eax
jne 0x100c0f7
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x1009601
mov eax, dword [ebx + 0x38]
mov dword [eax + 0xe8], ecx
mov ecx, dword [ebx + 0x38]
mov eax, dword [ecx]
sub esp, 0x10
mov edi, esp
lea esi, [ebx + 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [eax + 4]
mov edi, eax
xor esi, esi
cmp edi, esi
jl 0x100c0ff
mov dword [ebx + 0x24], 4
mov eax, dword [0x10220c0]
cmp eax, 0x10220c0
je 0x100963e
test byte [eax + 0x1c], 0x80
jne 0x100c1ab
mov esi, edi
push dword [ebp - 0x14]
call dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_LeaveCriticalSection]
mov eax, esi
call fcn.010016a1
ret 4
xor esi, esi
inc esi
jmp 0x1009640
mov dword [ebp - 0x10], esi
mov dword [ebp + 8], esi
lea eax, [ebp - 0x10]
push eax
push esi
push 2
mov byte [ebp - 4], 1
call sub.SspiCli.dll_GetUserNameExW
test al, al
jne 0x100c148
mov eax, dword [ebp - 0x10]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.01001544
pop ecx
push eax
lea ecx, [ebp + 8]
call fcn.0100be01
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 2
call sub.SspiCli.dll_GetUserNameExW
mov eax, dword [ebx + 0x38]
add eax, 4
mov eax, dword [eax]
cmp eax, esi
je 0x100c158
mov eax, dword [eax]
jmp 0x100c15a
xor eax, eax
mov ecx, dword [0x102210c]
push esi
push esi
push edi
push dword [ebp + 8]
push eax
push 0x1010f08
call fcn.0101710c
mov eax, dword [0x10220c0]
cmp eax, 0x10220c0
je 0x100c19a
test byte [eax + 0x1c], 0x80
je 0x100c19a
lea ecx, [ebx + 0x28]
push ecx
push ebx
push 0x1010f34
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010127a9
push dword [ebp + 8]
mov dword [ebx + 0x24], esi
call fcn.01001514
pop ecx
jmp 0x100963e
lea ecx, [ebx + 0x28]
push ecx
push ebx
push 0x1010f34
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010127a9
jmp 0x100963e
Function at 0x100be51
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
je 0x1010c9b
xor eax, eax
cmp dword [ebp + 0xc], ecx
jle 0x100be93
push esi
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp + 8]
movzx edx, byte [ecx + eax]
mov eax, dword [ebp + 0x10]
movzx esi, al
xor edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x102c878]
inc ecx
cmp ecx, dword [ebp + 0xc]
mov dword [ebp + 0x10], eax
jl 0x100be70
pop esi
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
jmp 0x100be93
Function at 0x1018606
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2bc
mov eax, dword [0x10220c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x10186b0
lea edi, [ebp - 0x68]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x56
lea eax, [ebp - 0x5a]
push 0
push eax
mov ebx, ecx
movsw word es:[edi], word [esi]
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x28
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebx + 0x1c]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
je 0x10186a0
lea eax, [ebp - 0xb8]
push eax
push 0x32
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x2bc], 0x1fe
call fcn.0100838a
lea eax, [ebp - 0x2bc]
push eax
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x68]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x10186a0
lea eax, [ebp - 0x2b8]
push eax
lea ecx, [ebx + 0x34]
call fcn.010045a1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001e90
leave
ret
Function at 0x101a2cf
Capabilities:
Create thread
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0x18]
xor esi, esi
push 4
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
push esi
call dword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_CreateThread]
mov edi, dword [ebp + 0x14]
mov dword [edi], eax
cmp eax, esi
je 0x101a315
mov ecx, dword [ebp + 0x10]
push dword [ecx*4 + 0x102ce88]
push eax
call dword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_SetThreadPriority]
test eax, eax
je 0x101a315
push dword [edi]
call dword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_ResumeThread]
test eax, eax
jne 0x101a32b
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp eax, esi
jle 0x101a329
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
ret 0x14

Function at 0x101aad6
Capabilities:
Enumerate gui resources

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0x101aa64
mov dword [ebp - 4], 1
mov byte [ebp - 8], 0
call dword [sym.imp.USER32.dll_EnumWindows]
cmp byte [ebp - 8], 0
jne 0x101ab11
mov dword [ebp - 4], 0x80004005
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x101b648
Capabilities:
Query service status
Start service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
xor esi, esi
push 1
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp eax, esi
jne 0x101b675
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
mov ebx, eax
jmp 0x101b709
push edi
push 0x14
push 0x101b714
push eax
call dword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_OpenServiceW]
mov edi, eax
cmp edi, esi
jne 0x101b692
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
jmp 0x101b6eb
push esi
push esi
push edi
call dword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_StartServiceW]
mov esi, dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
test eax, eax
jne 0x101b6b1
call esi
mov ebx, eax
cmp ebx, 0x420
jne 0x101b6f6
mov ebx, 0x5b4
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.API_MS_WIN_Service_winsvc_L1_1_0.dll_QueryServiceStatus]
test eax, eax
je 0x101b6e9
cmp dword [ebp - 0x20], 4
je 0x101b6ef
cmp dword [ebp - 0x20], 1
je 0x101b6f3
push 0x1f4
call dword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_Sleep]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
ja 0x101b6f6
jmp 0x101b6b6
call esi
mov ebx, eax
jmp 0x101b6f6
xor ebx, ebx
jmp 0x101b6f6
mov ebx, dword [ebp - 0x18]
mov esi, dword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_CloseServiceHandle]
test edi, edi
je 0x101b703
push edi
call esi
push dword [ebp - 8]
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x103ab15d
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
push ebp
movsx edx, bp
shl bp, 0xdd
mov ebp, esp
sub esp, 0x50
rcr al, 0xdc
push ebx
sar dh, 0xe6
push esi
cwde
push edi
cmp sp, 0xe07
mov edi, dword [ebp + 8]
shl si, 0x9d
cmovle dx, bx
bts si, ax
mov ecx, dword [edi + 0x38]
mov eax, dword [edi + 0x10]
mov edx, dword [edi + 0x3c]
bsf si, bp
cmovbe esi, esp
mov dword [ebp - 0x20], eax
bswap ax
stc
mov eax, dword [edi + 0x40]
test esp, 0x3dc32a9b
mov ebx, dword [edi + 0x34]
bsr esi, esi
movzx esi, dx
mov dword [ebp - 0x18], ecx
bts ecx, ecx
mov ecx, dword [edi + 0x44]
sub si, ax
mov esi, dword [edi + 0x20]
stc
cmp sp, bp
mov dword [ebp - 0x30], eax
shr ax, cl
mov dword [ebp - 0x38], ecx
sar ch, 0xf2
mov ecx, dword [edi + 8]
mov dword [ebp - 0x2c], edx
mov edx, 1
bts ax, sp
shl ax, cl
sal ah, 0xe
shl edx, cl
inc ax
clc
movzx eax, sp
mov ecx, dword [edi + 4]
mov eax, 1
clc
cmp si, bp
shl eax, cl
inc ch
mov cx, sp
mov ecx, dword [edi + 0x14]
dec edx
mov dword [ebp - 0x34], ecx
xchg ecx, ecx
cmovbe ecx, ecx
mov ecx, dword [edi + 0x24]
dec eax
mov dword [ebp - 0x48], eax
mov eax, dword [edi]
test bh, 0x32
clc
stc
mov dword [ebp - 0x40], eax
xor al, ch
mov ax, 0x609b
mov eax, dword [edi + 0x28]
test dx, di
mov dword [ebp - 0x24], eax
and eax, 0x387f1a67
mov eax, dword [edi + 0x2c]
stc
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 0x18]
cmc
mov dword [ebp - 0xc], ecx
test sp, bx
mov ecx, dword [edi + 0x30]
mov dword [ebp - 4], eax
test si, cx
bt eax, 0x74
mov eax, dword [edi + 0x1c]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x50], edx
stc
mov dword [ebp - 0x3c], ecx
shrd ecx, ebp, 0x55
shl ch, cl
mov dword [ebp - 0x28], 0
rol ecx, 0x68
movsx cx, cl
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4012ce
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
push esi
push edi
xor ebx, ebx
push 0x400
lea eax, [ebp - 0x400]
push ebx
push eax
call fcn.004038d0
add esp, 0xc
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov edi, dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x400], ax
mov ax, word [ebp + 0x14]
push 1
mov word [ebp - 0x3fe], ax
call edi
mov word [ebp - 0x3fc], ax
lea eax, [ebp - 0x3f4]
push eax
mov word [ebp - 0x3fa], bx
push dword [ebp + 0x10]
mov word [ebp - 0x3f8], bx
mov word [ebp - 0x3f6], bx
call fcn.00401387
pop ecx
mov esi, eax
pop ecx
add esi, 0xc
push 0xf
call edi
mov word [ebp + esi - 0x400], ax
inc esi
push 1
inc esi
call edi
push 0x10
mov word [ebp + esi - 0x400], ax
push dword [ebp + 0xc]
add esi, 2
lea eax, [ebp - 0x400]
push ebx
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_sendto]
xor ecx, ecx
pop edi
test eax, eax
setle cl
pop esi
mov eax, ecx
pop ebx
leave
ret

Function at 0x40172c
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, str.iphlpapi.dll
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
test eax, eax
je 0x40174a
cmp eax, 0xffffffff
jne 0x401751
push esi
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
je 0x40182a
cmp eax, 0xffffffff
je 0x40182a
push str.GetNetworkParams
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edi, eax
test edi, edi
je 0x40182a
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
mov esi, 0x4000
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
lea ecx, [ebp - 0xc]
mov dword [ebp - 4], eax
push ecx
push eax
mov dword [ebp - 0xc], esi
call edi
test eax, eax
jne 0x40182a
and dword [ebp - 8], eax
mov eax, dword [ebp - 4]
lea edi, [eax + 0x10c]
test edi, edi
je 0x401817
lea esi, [edi + 4]
test esi, esi
je 0x401813
push 0x35
mov word [ebp - 0x1c], 2
call dword [sym.imp.WS2_32.dll_htons]
push esi
mov word [ebp - 0x1a], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
test eax, eax
mov dword [ebp - 0x18], eax
je 0x4017e0
cmp eax, 0xffffffff
jne 0x4017f5
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x401813
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x401813
cmp eax, 0xffffffff
je 0x401813
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call section..text
pop ecx
mov dword [ebp - 8], eax
test eax, eax
pop ecx
jne 0x401817
mov edi, dword [edi]
jmp 0x4017b0
push dword [ebp - 4]
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [ebp - 8]
jmp 0x40182c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401854
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x401862
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
cmp esi, 8
push edi
not eax
mov ecx, 0xff
jl 0x40194c
mov edi, esi
shr edi, 3
mov ebx, edi
neg ebx
lea esi, [esi + ebx*8]
mov dword [ebp + 0x10], esi
movzx ebx, byte [edx]
mov esi, eax
and esi, ecx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0x407198]
xor eax, ebx
inc edx
mov esi, eax
movzx ebx, byte [edx]
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x407198]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x407198]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x407198]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x407198]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x407198]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x407198]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x407198]
xor eax, esi
inc edx
dec edi
jne 0x40188a
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x401969
movzx ebx, byte [edx]
mov edi, eax
and edi, ecx
xor edi, ebx
shr eax, 8
mov edi, dword [edi*4 + 0x407198]
xor eax, edi
inc edx
dec esi
jne 0x401950
pop edi
pop esi
not eax
pop ebx
pop ebp
ret