joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402bfa
Capabilities:
Delete service

Disassembly:
mov eax, 0x405aca
call fcn.00405300
sub esp, 0x38
mov dword [ebp - 0x2c], ecx
and dword [ebp - 0x10], 0
xor eax, eax
inc eax
test eax, eax
je 0x402d7e
push 0x18
push dword [ebp - 0x2c]
call fcn.00403304
pop ecx
pop ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x402c81
cmp dword [ebp + 8], 1
jne 0x402c81
push 0xffffffffffffffff
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x2c]
call fcn.0040370c
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x34]
push dword [eax]
push 0x24
push dword [ebp - 0x2c]
call fcn.004035d7
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00401168
jmp 0x402d7e
push 0x1a
push dword [ebp - 0x2c]
call fcn.00403304
pop ecx
pop ecx
push 0xf0000
push str.named
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x402cff
cmp dword [ebp + 8], 1
jne 0x402cff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
je 0x402cfd
push 0xffffffffffffffff
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x2c]
call fcn.0040370c
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x3c]
push dword [eax]
push 0x25
push dword [ebp - 0x2c]
call fcn.004035d7
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00401168
jmp 0x402d7e
jmp 0x402d77
push 0x1b
push dword [ebp - 0x2c]
call fcn.00403304
pop ecx
pop ecx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x402d77
cmp dword [ebp + 8], 1
jne 0x402d77
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x430
je 0x402d77
cmp dword [ebp - 0x1c], 0x424
je 0x402d77
push 0xffffffffffffffff
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x2c]
call fcn.0040370c
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x44]
push dword [eax]
push 0x2a
push dword [ebp - 0x2c]
call fcn.004035d7
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401168
jmp 0x402d7e
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0x14], 0
je 0x402d8d
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x18], 0
je 0x402d9c
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp + 8], 0
je 0x402db2
push dword [ebp - 0x10]
push 0x3f0
mov ecx, dword [ebp - 0x2c]
call fcn.004032cd
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4
Function at 0x402dc0
Capabilities:
Get common file path
Persist via windows service
Set registry value

Disassembly:
mov eax, 0x405af5
call fcn.00405300
sub esp, 0x254
mov dword [ebp - 0x248], ecx
push 0x104
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.bindevt.dll
lea eax, [ebp - 0x22c]
push eax
push str._s_s
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.MSVCR70.dll_sprintf]
add esp, 0x10
push 0x1c
push dword [ebp - 0x248]
call fcn.00403304
pop ecx
pop ecx
lea eax, [ebp - 0x120]
push eax
push str.SYSTEMCurrentControlSetServicesEventLogApplication_named
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x402e87
push 0xffffffffffffffff
lea eax, [ebp - 0x234]
push eax
mov ecx, dword [ebp - 0x248]
call fcn.0040370c
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x250], eax
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x250]
push dword [eax]
push 0x2f
lea eax, [ebp - 0x230]
push eax
call fcn.004011d4
add esp, 0xc
push 0x4071f0
lea eax, [ebp - 0x230]
push eax
call sub.MSVCR70.dll__CxxThrowException
lea eax, [ebp - 0x11c]
push eax
call sub.MSVCR70.dll_strlen
pop ecx
inc eax
push eax
lea eax, [ebp - 0x11c]
push eax
push 2
push 0
push str.EventMessageFile
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x402f0d
push 0xffffffffffffffff
lea eax, [ebp - 0x23c]
push eax
mov ecx, dword [ebp - 0x248]
call fcn.0040370c
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x258], eax
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x258]
push dword [eax]
push 0x30
lea eax, [ebp - 0x238]
push eax
call fcn.004011d4
add esp, 0xc
push 0x4071f0
lea eax, [ebp - 0x238]
push eax
call sub.MSVCR70.dll__CxxThrowException
mov dword [ebp - 0x10], 7
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push str.TypesSupported
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x402f8a
push 0xffffffffffffffff
lea eax, [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x248]
call fcn.0040370c
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x260], eax
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x260]
push dword [eax]
push 0x30
lea eax, [ebp - 0x240]
push eax
call fcn.004011d4
add esp, 0xc
push 0x4071f0
lea eax, [ebp - 0x240]
push eax
call sub.MSVCR70.dll__CxxThrowException
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
push 0x3f1
mov ecx, dword [ebp - 0x248]
call fcn.004032cd
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x402fb4
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
and dword [ebp - 4], 0
and dword [ebp - 8], 0
xor eax, eax
inc eax
test eax, eax
je 0x40300d
push 0x1d
push dword [ebp - 0xc]
call fcn.00403304
pop ecx
pop ecx
lea eax, [ebp - 8]
push eax
push str.SYSTEMCurrentControlSetServicesEventLogApplication
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x402ff2
jmp 0x40300d
push str.named
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x403006
jmp 0x40300d
mov dword [ebp - 4], 1
cmp dword [ebp - 8], 0
je 0x40301c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 8], 0
je 0x403032
push dword [ebp - 4]
push 0x3f1
mov ecx, dword [ebp - 0xc]
call fcn.004032cd
leave
ret 4

Function at 0x403489
Capabilities:
Start service

Disassembly:
mov eax, 0x405b4d
call fcn.00405300
sub esp, 0x28
mov dword [ebp - 0x24], ecx
push 0x1f
push dword [ebp - 0x24]
call fcn.00403304
pop ecx
pop ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4034f6
push 0xffffffffffffffff
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x24]
call fcn.0040370c
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
push dword [eax]
push 0x24
push dword [ebp - 0x24]
call fcn.004035d7
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00401168
push 0xf01ff
push str.named
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x40354e
push 0xffffffffffffffff
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
call fcn.0040370c
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x34]
push dword [eax]
push 0x25
push dword [ebp - 0x24]
call fcn.004035d7
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00401168
push 0
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x4042fb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40431a
xor eax, eax
jmp 0x404395
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x404330
xor eax, eax
jmp 0x404395
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x404378
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jae 0x404378
mov eax, dword [ebp - 4]
movzx eax, word [eax]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax*2 + 2]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
jmp 0x404351
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jb 0x404384
xor eax, eax
jmp 0x404395
mov eax, dword [ebp - 4]
movzx eax, word [eax]
test eax, eax
jne 0x404392
xor eax, eax
jmp 0x404395
mov eax, dword [ebp - 4]
leave
ret
Function at 0x404b82
Capabilities:
Get file version info

Disassembly:
mov eax, 0x405bb6
call fcn.00405300
sub esp, 0x16c
mov dword [ebp - 0x178], ecx
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x178]
mov dword [eax], 0x406e60
mov ecx, dword [ebp - 0x178]
add ecx, 4
call fcn.0040412d
mov byte [ebp - 4], 1
push 0x140
push 0
lea eax, [ebp - 0x15c]
push eax
call sub.MSVCR70.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x178]
and dword [eax + 0x18], 0
mov eax, dword [ebp - 0x178]
and dword [eax + 8], 0
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 0x178]
add ecx, 4
call fcn.004041b2
lea eax, [ebp - 0x15c]
push eax
lea ecx, [ebp + 8]
call fcn.00404214
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x404c31
mov eax, dword [ebp - 0x178]
mov dword [eax + 0x18], 2
mov eax, dword [ebp - 0x178]
and dword [eax + 0xc], 0
jmp 0x404d71
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp + 8]
call fcn.00404214
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x178]
and dword [eax + 0xc], 0
cmp dword [ebp - 0x14], 0
jne 0x404c73
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x178]
mov dword [ecx + 0x18], eax
jmp 0x404d64
push dword [ebp - 0x14]
call sub.MFC70.DLL_Ordinal_256
pop ecx
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x16c]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp - 0x178]
push dword [eax + 0xc]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea ecx, [ebp + 8]
call fcn.00404214
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x404ce8
mov eax, dword [ebp - 0x178]
cmp dword [eax + 0xc], 0
je 0x404ce3
mov eax, dword [ebp - 0x178]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x170], eax
push dword [ebp - 0x170]
call sub.MFC70.DLL_Ordinal_705
pop ecx
mov eax, dword [ebp - 0x178]
and dword [eax + 0xc], 0
jmp 0x404d71
and dword [ebp - 0x160], 0
and dword [ebp - 0x168], 0
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x168]
push eax
push 0x406a00
mov eax, dword [ebp - 0x178]
push dword [eax + 0xc]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x404d4e
mov eax, dword [ebp - 0x178]
cmp dword [eax + 0xc], 0
je 0x404d4c
mov eax, dword [ebp - 0x178]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x174], eax
push dword [ebp - 0x174]
call sub.MFC70.DLL_Ordinal_705
pop ecx
mov eax, dword [ebp - 0x178]
and dword [eax + 0xc], 0
jmp 0x404d71
mov eax, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x168]
mov dword [eax + 0x10], ecx
and dword [ebp - 0x164], 0
mov eax, dword [ebp - 0x178]
mov dword [eax + 8], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401168
mov eax, dword [ebp - 0x178]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4
Function at 0x404e55
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 7
push 0
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.00404214
push eax
mov ecx, dword [ebp + 8]
call fcn.00404e8c
mov ecx, eax
call fcn.00404214
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
leave
ret 4

Function at 0x4053ef
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x406ef8
call fcn.0040574c
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40542c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40542c
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x405444
cmp eax, 0x20b
je 0x405431
mov dword [ebp - 0x1c], ebx
jmp 0x405458
cmp dword [ecx + 0x84], 0xe
jbe 0x40542c
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x405452
cmp dword [ecx + 0x74], 0xe
jbe 0x40542c
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCR70.dll___set_app_type]
pop ecx
or dword [0x409340], 0xffffffff
or dword [0x409344], 0xffffffff
call dword [sym.imp.MSVCR70.dll___p__fmode]
mov ecx, dword [0x409334]
mov dword [eax], ecx
call dword [sym.imp.MSVCR70.dll___p__commode]
mov ecx, dword [0x409330]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR70.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x40933c], eax
call fcn.004056a8
call fcn.00405748
cmp dword [0x409074], ebx
jne 0x4054b8
push fcn.00405748
call dword [sym.imp.MSVCR70.dll___setusermatherr]
pop ecx
call fcn.00405736
push 0x409018
push 0x409014
call sub.MSVCR70.dll__initterm
push 0x4056ec
call fcn.004052e8
mov eax, dword [0x40932c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x409328]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.MSVCR70.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x30], eax
cmp eax, ebx
jge 0x40550c
push 8
call sub.MSVCR70.dll__amsg_exit
pop ecx
push 0x409010
push section..data
call sub.MSVCR70.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR70.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x34], esi
cmp byte [esi], 0x22
jne 0x405566
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x40553a
cmp al, 0x22
jne 0x40552c
cmp byte [esi], 0x22
jne 0x405543
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x40554d
cmp al, 0x20
jbe 0x40553f
mov dword [ebp - 0x4c], ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x4c], 1
je 0x405571
movzx eax, word [ebp - 0x48]
jmp 0x405574
cmp byte [esi], 0x20
jbe 0x405543
inc esi
mov dword [ebp - 0x34], esi
jmp 0x405566
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.00405800
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x405591
push esi
call dword [sym.imp.MSVCR70.dll_exit]
call dword [sym.imp.MSVCR70.dll__cexit]
jmp 0x4055c6
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00405787
ret
Function at 0x67010a39
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x1c]
xor eax, eax
mov edx, dword [esp + 0x14]
push esi
push edi
mov edi, dword [esp + 0x20]
mov esi, eax
mov dword [esp + 0x10], eax
cmp edi, 0x20
jb 0x67010ac4
lea eax, [ecx + 0x10]
mov dword [esp + 0x14], eax
mov eax, edx
sub eax, ecx
mov dword [esp + 0xc], eax
push 0x10
pop eax
sub eax, ecx
mov ecx, dword [esp + 0xc]
mov dword [esp + 8], eax
movups xmm1, xmmword [esi + edx]
mov edi, dword [esp + 0x14]
add esi, 0x20
movaps xmm0, xmm1
psrlw xmm1, 8
psllw xmm0, 8
movups xmm2, xmmword [ecx + edi]
pxor xmm0, xmm1
movups xmmword [edi - 0x10], xmm0
movaps xmm0, xmm2
psrlw xmm2, 8
psllw xmm0, 8
pxor xmm0, xmm2
movups xmmword [edi], xmm0
add edi, 0x20
add eax, edi
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x20]
cmp eax, edi
mov eax, dword [esp + 8]
jbe 0x67010a73
mov ecx, dword [esp + 0x24]
lea eax, [esi + 0x10]
cmp eax, edi
ja 0x67010ae6
movups xmm1, xmmword [esi + edx]
movaps xmm0, xmm1
psrlw xmm1, 8
psllw xmm0, 8
pxor xmm0, xmm1
movups xmmword [esi + ecx], xmm0
mov esi, eax
cmp esi, edi
jae 0x67010b3e
lea eax, [esi + ecx]
sub edx, ecx
mov dword [esp + 0x20], eax
xor ecx, ecx
mov dword [esp + 0x1c], edx
cmp ecx, 0x10
jae 0x67010b3e
add eax, edx
push 2
push eax
lea eax, [esp + 0x10]
push eax
call sub.VCRUNTIME140.dll_memcpy
push dword [esp + 0x2c]
push dword [esp + 0x18]
call fcn.67010940
mov eax, dword [esp + 0x34]
add esi, 2
mov ecx, dword [esp + 0x24]
add eax, 2
mov edx, dword [esp + 0x30]
add ecx, 2
add esp, 0x14
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], ecx
cmp esi, edi
jb 0x67010af9
mov eax, edi
pop edi
pop esi
add esp, 0x10
ret

Function at 0x67010f0a
Capabilities:
Initialize winsock library

Disassembly:
push ebp
lea ebp, [esp - 0x128]
sub esp, 0x1a8
mov eax, dword [0x6753165c]
xor eax, ebp
mov dword [ebp + 0x124], eax
push esi
mov esi, ecx
lea eax, [ebp - 0x6c]
push eax
push 2
and dword [esi], 0
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x67010f5e
movaps xmm0, xmmword [0x671be450]
lea eax, [ebp - 0x80]
push str.QTcpSocketAPI:_WinSock_v2.0_initialization_failed.
push eax
movups xmmword [ebp - 0x80], xmm0
mov dword [ebp - 0x70], 0x671bd654
call sym.Qt5Core.dll_public:_void___cdecl_QMessageLogger::warning_char_const__const
pop ecx
pop ecx
jmp 0x67010f64
mov dword [esi], 0x20
mov ecx, dword [ebp + 0x124]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.671a2acb
add ebp, 0x128
leave
ret
Function at 0x67010f25
Capabilities:
Initialize winsock library

Disassembly:
push ebp
lea ebp, [esp - 0x128]
sub esp, 0x1a8
mov eax, dword [0x6753165c]
xor eax, ebp
mov dword [ebp + 0x124], eax
push esi
mov esi, ecx
lea eax, [ebp - 0x6c]
push eax
push 2
and dword [esi], 0
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x67010f5e
movaps xmm0, xmmword [0x671be450]
lea eax, [ebp - 0x80]
push str.QTcpSocketAPI:_WinSock_v2.0_initialization_failed.
push eax
movups xmmword [ebp - 0x80], xmm0
mov dword [ebp - 0x70], 0x671bd654
call sym.Qt5Core.dll_public:_void___cdecl_QMessageLogger::warning_char_const__const
pop ecx
pop ecx
jmp 0x67010f64
mov dword [esi], 0x20
mov ecx, dword [ebp + 0x124]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.671a2acb
add ebp, 0x128
leave
ret

Function at 0x67011afc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x6753165c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x67533890]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x208], esi
cmp eax, 0xfffffffe
jle 0x67011b28
call fcn.6701195f
push 0x200
lea eax, [ebp - 0x204]
push eax
call sub.WS2_32.dll_gethostname
cmp eax, 0xffffffff
jne 0x67011b46
mov dword [esi], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
jmp 0x67011b5c
push 0xffffffffffffffff
lea eax, [ebp - 0x204]
mov byte [ebp - 5], 0
push eax
push esi
call sym.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromLocal8Bit_char_const___int_
add esp, 0xc
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.671a2acb
leave
ret

Function at 0x67011b6b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x6753165c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x54]
push eax
push 0x20119
xor esi, esi
mov dword [ebp - 0x58], edi
push esi
push str.SOFTWAREMicrosoftCryptography
push 0x80000002
mov dword [ebp - 0x54], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x67011bee
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x4a
push eax
lea eax, [ebp - 0x50]
push eax
push esi
push esi
push str.MachineGuid
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x54]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x67011bee
mov ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x50]
dec ecx
mov dword [ebp - 0x5c], eax
shr ecx, 1
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0x60]
push edi
call fcn.67012a29
jmp 0x67011bf4
mov dword [edi], sym.Qt5Core.dll_struct_QArrayData_const__const_const_QArrayData::shared_null
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.671a2acb
leave
ret
Function at 0x67017423
Capabilities:
Print debug messages

Disassembly:
push 0x10
mov eax, 0x671a5e52
call fcn.671a2b02
push 0x67533c6c
lea ecx, [ebp - 0x1c]
call fcn.6700d3c3
xor esi, esi
mov ebx, 0x7ffe
mov dword [ebp - 4], esi
cmp dword [ebp + 8], ebx
jg 0x67017456
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x670174a3
push 0xfffe
call fcn.671a37a1
pop ecx
mov ecx, dword [ebp + 8]
mov edi, eax
test ecx, ecx
jle 0x6701749c
mov eax, dword [ebp + 0xc]
sub ecx, esi
cmp ecx, ebx
push edi
cmovg ecx, ebx
mov dword [ebp - 0x14], ecx
lea eax, [eax + esi*2]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
call fcn.67004d5a
xor ecx, ecx
push edi
mov word [edi + eax*2], cx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp + 8]
add esi, ebx
cmp esi, ecx
jl 0x6701746a
push edi
call fcn.671a37aa
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.6700d6e6
call fcn.671a2adc
ret
Function at 0x67017692
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [esp + 0x2c]
mov eax, ecx
push ebp
mov ebp, dword [esp + 0x2c]
sub ebx, ebp
sar ebx, 2
mov dword [esp + 0x1c], eax
mov dword [esp + 0x30], ebx
test ebx, ebx
je 0x67017866
push esi
mov esi, dword [eax + 4]
sub esi, dword [eax]
sar esi, 2
cmp ebx, 0x26f
jb 0x670176cb
push 0xb
jmp 0x670176e4
cmp ebx, 0x44
jb 0x670176d4
push 7
jmp 0x670176e4
cmp ebx, 0x27
jb 0x670176dd
push 5
jmp 0x670176e4
cmp ebx, 7
jb 0x670176e7
push 3
pop eax
jmp 0x670176ec
lea eax, [ebx - 1]
shr eax, 1
mov edx, ebx
mov ecx, ebx
sub edx, eax
shr edx, 1
add eax, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], eax
cmp ebx, esi
lea eax, [esi + 1]
cmovbe ecx, eax
mov eax, 0x8b8b8b8b
push edi
mov dword [esp + 0x1c], ecx
mov edi, ebp
mov ecx, ebx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x1c]
xor edi, edi
test eax, eax
je 0x670177d1
lea eax, [edi + edx]
xor edx, edx
div ebx
lea eax, [edx*4]
xor edx, edx
add eax, ebp
mov dword [esp + 0x2c], eax
mov eax, dword [eax]
mov dword [esp + 0x18], eax
mov eax, edi
div ebx
lea eax, [edi - 1]
mov dword [esp + 0x10], edx
xor edx, edx
div ebx
mov ecx, dword [ebp + edx*4]
mov edx, dword [esp + 0x10]
xor ecx, dword [esp + 0x18]
xor ecx, dword [ebp + edx*4]
mov eax, ecx
shr eax, 0x1b
xor eax, ecx
imul ecx, eax, 0x19660d
mov dword [esp + 0x28], ecx
test edi, edi
jne 0x67017778
mov eax, esi
jmp 0x67017794
cmp edi, esi
ja 0x67017792
xor edx, edx
lea eax, [edi - 1]
div esi
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
add eax, dword [esp + 0x10]
jmp 0x67017794
mov eax, edx
mov edx, dword [esp + 0x2c]
add ecx, eax
mov eax, dword [esp + 0x28]
add eax, dword [esp + 0x18]
mov dword [edx], eax
xor edx, edx
mov eax, dword [esp + 0x20]
add eax, edi
div ebx
lea eax, [edx*4]
mov edx, dword [esp + 0x14]
add dword [eax + ebp], ecx
inc edi
mov eax, dword [esp + 0x10]
mov dword [ebp + eax*4], ecx
mov eax, dword [esp + 0x1c]
cmp edi, eax
jb 0x67017724
add eax, ebx
mov dword [esp + 0x2c], eax
cmp edi, eax
jae 0x67017864
lea ecx, [edi - 1]
mov dword [esp + 0x1c], ecx
lea eax, [edx + 1]
xor edx, edx
add eax, ecx
div ebx
lea edi, [edx*4]
xor edx, edx
add edi, ebp
lea ebp, [ecx + 1]
mov eax, ebp
div ebx
mov eax, ecx
mov esi, dword [edi]
mov ebx, edx
xor edx, edx
div dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov ecx, dword [eax + edx*4]
mov edx, dword [esp + 0x20]
add ecx, esi
add ecx, dword [eax + ebx*4]
inc edx
mov eax, ecx
shr eax, 0x1b
xor eax, ecx
imul eax, eax, 0x5d588b65
xor esi, eax
mov ecx, eax
mov eax, dword [esp + 0x1c]
sub ecx, ebx
add eax, edx
mov dword [edi], esi
xor edx, edx
mov esi, dword [esp + 0x34]
div dword [esp + 0x38]
mov dword [esp + 0x1c], ebp
lea eax, [esi + edx*4]
mov edx, dword [esp + 0x14]
xor dword [eax], ecx
mov dword [esi + ebx*4], ecx
mov ecx, ebp
mov ebx, dword [esp + 0x38]
mov ebp, esi
lea eax, [ecx + 1]
cmp eax, dword [esp + 0x2c]
jb 0x670177e6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8