joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49be97
Capabilities:
Read .ini file

Disassembly:
push 8
mov eax, 0x511c9d
call fcn.004d6783
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push 0x200
mov esi, 0x100
call fcn.004d62d5
mov edi, eax
pop ecx
mov dword [ebp - 0x14], edi
and dword [ebp - 4], 0
push dword [ebx + 4]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
mov ebx, eax
cmp ebx, 0xfe
jne 0x49bf1e
or dword [ebp - 4], 0xffffffff
add esi, esi
push edi
call fcn.004d62d0
and dword [ebp - 0x14], 0
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004d62d5
pop ecx
mov edi, eax
pop ecx
mov dword [ebp - 0x14], edi
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
push dword [eax + 4]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
mov ebx, eax
lea eax, [esi - 2]
cmp ebx, eax
je 0x49bed6
mov ecx, dword [ebp + 8]
call fcn.00457206
lea ecx, [ebp - 0x10]
call fcn.0040ce6d
mov byte [ebp - 4], 1
xor esi, esi
movzx eax, word [edi + esi*2]
test ax, ax
je 0x49bf48
push eax
lea ecx, [ebp - 0x10]
call fcn.00471ca0
jmp 0x49bf65
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x49bf5d
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0046b650
lea ecx, [ebp - 0x10]
call fcn.0040d600
inc esi
cmp esi, ebx
jbe 0x49bf34
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0
call fcn.0040d133
or dword [ebp - 4], 0xffffffff
push edi
call fcn.004d62d0
and dword [ebp - 0x14], 0
pop ecx
call fcn.004d674c
ret 4

Function at 0x49c084
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50ef72
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x573080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x20]
mov dword [esi], 0x53b70c
cmp dword [eax - 0xc], 0
je 0x49c0c0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esi + 0x34]
call fcn.0040d133
lea ecx, [esi + 0x30]
call fcn.0040d133
lea ecx, [esi + 0x28]
call fcn.0040d133
lea ecx, [esi + 0x24]
call fcn.0040d133
lea ecx, [esi + 0x20]
call fcn.0040d133
lea ecx, [esi + 8]
call fcn.0040d133
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
leave
ret

Function at 0x49d443
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push 0
mov esi, ecx
mov edx, dword [eax]
lea eax, [ebp + 8]
push eax
mov eax, dword [edx - 0xc]
add eax, eax
push eax
push edx
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
pop esi
pop ebp
ret 4
Function at 0x49e87a
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push esi
push edi
push eax
push 0xf003f
xor esi, esi
mov edi, ecx
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x49e8a8
xor al, al
jmp 0x49e8fe
mov edi, dword [edi]
mov eax, dword [edi - 0xc]
cmp eax, 0x4f
jle 0x49e8bb
lea edi, [edi + eax*2]
add edi, 0xffffff62
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
lea eax, [ebp - 4]
push eax
push esi
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x49e8e4
cmp esi, 0xea
jne 0x49e8f0
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
pop edi
pop esi
leave
ret

Function at 0x49f279
Capabilities:
Connect pipe
Read file on windows

Disassembly:
push 4
mov eax, 0x50e3d4
call fcn.004d6783
mov esi, ecx
cmp byte [ebp + 0x10], 0
jne 0x49f2af
push 0
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x49f2af
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
je 0x49f2af
cmp byte [esi + 0x11], 0
je 0x49f301
push 0
lea eax, [ebp + 0x10]
push eax
push 0x7f90
push dword [esi + 0xc]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x10]
xor edi, edi
mov edx, dword [esi + 0xc]
shr ecx, 1
mov word [edx + ecx*2], di
test eax, eax
je 0x49f301
cmp dword [ebp + 0x10], edi
je 0x49f301
push dword [esi + 0xc]
lea ecx, [ebp - 0x10]
call fcn.0040d91c
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
and dword [ebp - 4], edi
push eax
call fcn.00407141
lea ecx, [ebp - 0x10]
call fcn.0040d133
jmp 0x49f309
mov ecx, dword [ebp + 8]
call fcn.0040ce6d
mov eax, dword [ebp + 8]
call fcn.004d674c
ret 0xc

Function at 0x49f314
Capabilities:
Write file on windows

Disassembly:
push 4
mov eax, 0x4fa7ac
call fcn.004d6783
mov esi, ecx
xor ebx, ebx
cmp dword [ebp + 0xc], 0xffffffff
mov dword [ebp - 0x10], ebx
jne 0x49f337
mov ecx, dword [ebp + 8]
call fcn.0040ce6d
jmp 0x49f36e
mov eax, dword [ebp + 0x10]
lea edx, [ebp + 0x10]
push ebx
push edx
mov ecx, dword [eax]
mov eax, dword [ecx - 0xc]
add eax, eax
push eax
push ecx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x49f35f
mov ecx, dword [ebp + 8]
call fcn.0040ce6d
jmp 0x49f36e
push 1
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.0049f279
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 1
mov eax, dword [ebp + 8]
call fcn.004d674c
ret 0xc
Function at 0x4a4a04
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x50fae9
call fcn.004d6783
mov ebx, ecx
mov edx, dword [0x575298]
lea edi, [ebx + 4]
push ecx
mov ecx, dword [edi]
call fcn.00470b50
mov ecx, edi
call fcn.0042ded8
mov eax, dword [ebx + 0x28]
push dword [eax]
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [ebp - 0x10]
call fcn.0040ce6d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
push 0xdc
call fcn.0040d58d
push 0x40a
push dword [edi]
call dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [edi]
lea ecx, [ebx + 0x40]
call fcn.004a66e2
push dword [edi]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea eax, [ebp - 0x14]
push eax
xor eax, eax
push eax
push ebx
push 0x4a4aa7
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
mov dword [ebx + 0x30], eax
call fcn.0040d133
xor eax, eax
call fcn.004d674c
ret 0x10

Function at 0x4a5464
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, ecx
cmp byte [edi + 0x1c], 0
je 0x4a549d
push 0xe801
push dword [edi - 0x1c]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [esp + 0xc], 2
jne 0x4a548d
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4a54a4
cmp dword [esp + 0xc], 0
jne 0x4a549d
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esp + 0xc], 1
je 0x4a54ba
mov ecx, dword [esp + 0x10]
mov eax, ecx
shr eax, 0x10
cwde
push eax
movsx eax, cx
mov ecx, edi
push eax
call fcn.004a54c0
xor eax, eax
pop edi
ret 0x10
Function at 0x4b0a36
Capabilities:
Connect pipe
Read file on windows

Disassembly:
push 0x38
mov eax, 0x515279
call fcn.004d67b7
mov edi, ecx
mov bl, byte [ebp + 0x10]
xor eax, eax
and dword [ebp - 0x30], 0
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x2c], ecx
test bl, bl
jne 0x4b0a81
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x4b0a6e
xor eax, eax
inc eax
jmp 0x4b0a7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x217
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp - 0x2c]
and dword [ebp - 0x18], 0
xor edx, edx
and dword [ebp - 0x14], 0
and dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], dx
inc edx
mov dword [ebp - 4], edx
test eax, eax
jne 0x4b0abe
test bl, bl
jne 0x4b0abe
and dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 0x30], edx
mov byte [ebp - 4], al
jmp 0x4b0b9e
xor ebx, ebx
mov dword [ebp - 0x3c], edx
add edi, 0x3c
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x4b0ad0
mov eax, dword [edi]
push 0
lea edx, [ebp - 0x40]
push edx
push 0x400
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x34], eax
test eax, eax
jne 0x4b0afb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x4b0b84
mov ecx, dword [ebp - 0x40]
mov eax, edi
add ebx, ecx
cmp dword [edi + 0x14], 8
jb 0x4b0b0a
mov eax, dword [edi]
shr ecx, 1
xor edx, edx
mov dword [ebp - 0x38], edi
mov word [eax + ecx*2], dx
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x4b0b22
mov eax, dword [edi]
mov dword [ebp - 0x38], eax
push eax
call fcn.004dbc76
pop ecx
push eax
push dword [ebp - 0x38]
lea ecx, [ebp - 0x28]
call fcn.00412200
lea eax, [ebp - 0x3c]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp dword [ebp - 0x3c], 0
mov ecx, dword [ebp - 0x2c]
ja 0x4b0ac6
cmp dword [ebp - 0x34], 0
je 0x4b0b84
test ebx, ebx
je 0x4b0b84
xor ebx, ebx
lea eax, [ebp - 0x28]
mov byte [ebp - 0x34], bl
mov ecx, esi
push dword [ebp - 0x34]
mov dword [esi + 0x10], ebx
push eax
mov dword [esi + 0x14], ebx
call fcn.00405342
mov dword [ebp - 0x30], 1
mov byte [ebp - 4], bl
jmp 0x4b0b9e
and dword [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 0x30], 1
mov byte [ebp - 4], al
lea ecx, [ebp - 0x28]
call fcn.0040569b
mov eax, esi
call fcn.004d6761
ret 0xc
Function at 0x4b0bb0
Capabilities:
Write file on windows

Disassembly:
push 8
mov eax, 0x5152b7
call fcn.004d6783
mov esi, ecx
xor ebx, ebx
cmp dword [ebp + 0xc], 0xffffffff
mov dword [ebp - 0x10], ebx
jne 0x4b0be7
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], 7
mov word [eax], cx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 1
jmp 0x4b0c3b
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + 0x10]
add eax, eax
cmp dword [ecx + 0x14], 8
jb 0x4b0bf7
mov ecx, dword [ecx]
push ebx
lea edx, [ebp + 0x10]
push edx
push eax
push ecx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4b0c1f
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], 7
mov word [eax], cx
jmp 0x4b0bdb
push 1
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.004b0a36
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 1
mov eax, dword [ebp + 8]
call fcn.004d674c
ret 0xc

Function at 0x4b0c43
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov edx, dword [eax + 0x10]
add edx, edx
cmp dword [eax + 0x14], 8
jb 0x4b0c59
mov eax, dword [eax]
push 0
lea ecx, [ebp + 8]
push ecx
push edx
push eax
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
pop esi
pop ebp
ret 4

Function at 0x4b4779
Capabilities:
Check if file exists

Disassembly:
push 0x50
mov eax, 0x515f2a
call fcn.004d67b7
mov edi, dword [ebp + 8]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5c], esp
xor esi, esi
add edi, 4
push edi
mov dword [ecx + 0x10], esi
mov dword [ecx + 0x14], esi
call fcn.00404b8e
mov dword [ebp - 4], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00465b90
mov dword [ebp - 4], 1
jmp 0x4b480f
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00468590
mov byte [ebp - 4], 5
cmp dword [eax + 0x14], 8
jb 0x4b47d1
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.0040569b
test esi, esi
jne 0x4b483d
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x28]
call fcn.00468d70
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push eax
call fcn.00404232
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.0040569b
cmp dword [ebp - 0x18], 0
jne 0x4b47b9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040569b
cmp dword [edi + 0x14], 8
jb 0x4b4829
mov edi, dword [edi]
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsUNCW]
test eax, eax
setne al
call fcn.004d6761
ret 4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040569b
mov al, 1
jmp 0x4b4835
Function at 0x4f714f
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x3c
mov eax, dword [0x573080]
xor eax, esp
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
push ebx
push ebp
movsx ebp, ax
mov ebx, ecx
shr eax, 0x10
and dword [edx], 0
push esi
cwde
push edi
mov edi, dword [ebx + 0x30]
mov dword [esp + 0x14], eax
jmp 0x4f71c7
mov esi, dword [edi]
lea ecx, [esp + 0x34]
xorps xmm0, xmm0
movups xmmword [esp + 0x34], xmm0
push ecx
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x40]
push dword [esp + 0x14]
lea eax, [esp + 0x38]
push ebp
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4f71c4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x80]
test al, al
je 0x4f71c4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x88]
test al, al
jne 0x4f71f1
mov edi, dword [edi + 8]
test edi, edi
jne 0x4f717e
mov ecx, dword [ebx + 0x34]
test ecx, ecx
je 0x4f71da
mov eax, dword [ecx]
call dword [eax + 0x5c]
and dword [ebx + 0x34], edi
mov ecx, dword [esp + 0x44]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004d5b75
add esp, 0x3c
ret 0x10
mov ecx, dword [ebx + 0x34]
cmp esi, ecx
je 0x4f7204
test ecx, ecx
je 0x4f7201
mov eax, dword [ecx]
call dword [eax + 0x5c]
mov dword [ebx + 0x34], esi
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
mov dword [esp + 0x18], ebp
and ax, cx
lea edx, [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], ecx
xor cx, cx
cmp cx, ax
mov ecx, dword [ebx + 0x34]
push edx
sbb eax, eax
neg eax
mov dword [esp + 0x24], eax
mov eax, dword [ecx]
call dword [eax + 0x58]
xor eax, eax
lea edi, [esp + 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebx + 4]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 0x10
mov dword [esp + 0x2c], 2
call dword [sym.imp.USER32.dll_TrackMouseEvent]
jmp 0x4f71da

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40238f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x208
mov eax, dword [0x42d040]
xor eax, esp
mov dword [esp + 0x204], eax
mov eax, dword [esp + 0x20c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x220]
mov ebp, 0x100
push edi
xor edi, edi
mov dword [esp + 0x10], eax
mov ecx, edi
mov eax, ecx
mov byte [esp + ecx + 0x14], cl
cdq
idiv dword [esp + 0x228]
mov al, byte [edx + esi]
mov byte [esp + ecx + 0x114], al
inc ecx
cmp ecx, ebp
jl 0x4023c2
mov esi, edi
mov ebx, edi
mov dl, byte [esp + esi + 0x14]
movzx eax, byte [esp + esi + 0x114]
add eax, ebx
movzx ecx, dl
add ecx, eax
mov ebx, ecx
and ebx, 0x800000ff
jns 0x402408
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [esp + ebx + 0x14]
mov byte [esp + esi + 0x14], al
inc esi
mov byte [esp + ebx + 0x14], dl
cmp esi, ebp
jl 0x4023e3
mov ebx, edi
mov ebp, edi
cmp dword [esp + 0x220], ebx
jle 0x402494
inc edi
and edi, 0x800000ff
jns 0x402437
dec edi
or edi, 0xffffff00
inc edi
mov cl, byte [esp + edi + 0x14]
movzx esi, cl
add ebx, esi
and ebx, 0x800000ff
jns 0x402450
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [esp + ebx + 0x14]
mov byte [esp + edi + 0x14], al
push ecx
mov byte [esp + ebx + 0x18], cl
mov ecx, 0x42e098
mov dword [esp], 0x40495270
call fcn.00402081
push eax
call fcn.004019ae
movzx eax, byte [esp + edi + 0x18]
add eax, esi
pop ecx
mov ecx, dword [esp + 0x10]
movzx eax, al
mov al, byte [esp + eax + 0x14]
xor byte [ecx + ebp], al
inc ebp
cmp ebp, dword [esp + 0x220]
jl 0x402426
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040614a
add esp, 0x208
ret

Function at 0x403062
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
push edi
mov edi, dword [esp + 0xc]
cmp dword [esp + 0x10], esi
jbe 0x40309f
mov al, byte [edi + esi]
xor al, 0x73
sub al, 0x15
push 0
mov byte [edi + esi], al
call dword [sym.imp.USER32.DLL_OpenIcon]
mov al, byte [edi + esi]
sub al, 0x57
xor al, 0x74
add al, 0x4e
xor al, 0x70
sub al, 0x65
xor al, 0x22
sub al, 0x73
xor al, 0x2a
mov byte [edi + esi], al
inc esi
cmp esi, dword [esp + 0x10]
jb 0x403070
pop edi
pop esi
ret

Function at 0x403d0a
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
push eax
push 0x40
mov edi, 0x4ac
mov esi, 0x47fc18
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
push edi
push esi
call fcn.00403062
pop ecx
pop ecx
call fcn.00403048
mov edx, 0x47fc18
add edx, 0x188
mov esi, 0x42f018
push esi
call edx
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x4068f7
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test eax, eax
je 0x406936
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x406936
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x406936
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x406936
cmp dword [ecx + 0x74], 0xe
jbe 0x406936
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x414a0d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x414a1c
pop dword [ebp - 0xc]
mov eax, 0xcbe248bb
sub eax, 0xcba0fe9f
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x29ed8514
add dword [ebp - 0x1c], 0x2464c037
mov dword [ebp - 0x18], 0x42356188
sub dword [ebp - 0x18], 0x10021543
mov dword [ebp - 0x14], 0x7ae9c745
sub dword [ebp - 0x14], 0x2e9d8317
mov dword [ebp - 0x10], 0x9e1612ac
sub dword [ebp - 0x10], 0x9e1612ac
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x90222a1b
add dword [ebp - 0x1c], 0xe4503f3b
mov dword [ebp - 0x18], 0xf26546b3
sub dword [ebp - 0x18], 0xb0f8e53e
mov dword [ebp - 0x14], 0x5ff00cca
add dword [ebp - 0x14], 0x37f5fa2
mov dword [ebp - 0x10], 0xfa75316a
sub dword [ebp - 0x10], 0xfa75316a
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3bcce
push 0
call eax
mov ecx, 0x6e795bc0
sub ecx, 0x6e7910a9
mov ebx, eax
mov edi, 0x7b6556e8
sub edi, 0x7b1cf8e8
add edi, dword [ebp - 0xc]
mov edx, 0xfbe34767
xor dword [ebp - 8], 0x92afa8a5
mov esi, dword [edi]
add dword [ebp - 4], esi
sub esi, edx
sub dword [ebp - 8], ecx
mov dword [ebx], esi
add dword [ebp - 8], 0x1aab5b6b
add ebx, 0xdbfd37a1
sub ebx, 0xdbfd379d
add edi, 0x4ae36788
add edi, 0xb51c987c
loop 0x414b2e
add eax, 0xf686117b
add eax, 0x97b0db4
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x403000
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0042dad5
Function at 0x4041a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4041b5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4041f6
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4041f2
nop word [eax + eax]
cmp esi, edx
jae 0x4041f6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x4041e0
cmp esi, edx
jb 0x4041fb
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x4113c0
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x5e5044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x44]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0x40
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
je 0x41143b
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x411401
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov esi, dword [eax]
lea eax, [ebp - 0x44]
push eax
push 0x40
push ebx
call fcn.00558b20
add esp, 0xc
push esi
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push 0x40
push edi
call fcn.00558b20
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054c90d
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054c90d
mov esp, ebp
pop ebp
ret 8
Function at 0x4154e0
Capabilities:
Resolve dns

Disassembly:
push ebx
push 0x3f2
mov ebx, ecx
call fcn.00422fe1
push 0x3f3
mov ecx, ebx
mov dword [ebx + 0x308], eax
call fcn.00422fe1
push 0x3f4
mov ecx, ebx
mov dword [0x5ea064], eax
call fcn.00422fe1
push 0x3f5
mov ecx, ebx
mov dword [ebx + 0x30c], eax
call fcn.00422fe1
push 0x58aee0
mov dword [ebx + 0x310], eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
push eax
call dword [sym.imp.WS2_32.dll_htonl]
push str.192.168.1.100
mov dword [ebx + 0x158], eax
call dword [sym.imp.WS2_32.dll_inet_addr]
push eax
call dword [sym.imp.WS2_32.dll_htonl]
push 0
mov ecx, ebx
mov dword [ebx + 0x160], eax
call fcn.0042bab1
pop ebx
ret
Function at 0x41d8e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push str.Printer.ini
lea eax, [ebp - 4]
push 0x5ea0a4
push eax
call fcn.00417950
add esp, 0xc
push dword [eax]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 4]
mov esi, eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x41d92b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41d930
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x5e5044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
push str.Printer.ini
mov dword [ebp - 0x12c], eax
lea eax, [ebp - 0x128]
push 0x5ea0a4
push eax
mov dword [ebp - 0x130], 0
call fcn.00417950
add esp, 0xc
push dword [eax]
lea eax, [ebp - 0x124]
push 0x80
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, dword [ebp - 0x128]
or eax, 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41d9b0
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 0x12c]
lea eax, [ebp - 0x124]
push eax
call fcn.00402a50
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x12c]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0054c90d
mov esp, ebp
pop ebp
ret