joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4650cc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4902e8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x46510c
cmp byte [ebx], 0xa
jne 0x46510c
or byte [eax + edi + 0x28], 4
jmp 0x465111
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x46520f
mov al, byte [edx]
cmp al, 0x1a
je 0x4651f1
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x465140
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x465165
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x46516f
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x465122
jmp 0x46520f
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4651ec
cmp dword [ebp - 0xc], 0
je 0x4651ec
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x4902e8]
test byte [eax + edi + 0x28], 0x48
je 0x4651c6
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4651b1
mov byte [esi], dl
jmp 0x4651c2
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4902e8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x46520f
cmp byte [ebp - 1], 0xa
jne 0x4651d5
cmp esi, ebx
jne 0x4651d5
mov byte [esi], 0xa
jmp 0x46520e
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00464e47
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x46520f
mov byte [esi], 0xd
jmp 0x46520e
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x4902e8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x46520b
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x46520f
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x465218
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x4902e8]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x46525b
cmp word [esi], dx
jne 0x46525b
or byte [edi + eax + 0x28], 4
jmp 0x465260
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x4653b3
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x465393
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x4652a2
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4652d8
cmp eax, edx
jae 0x4652e4
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x46527a
jmp 0x4653b3
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46538f
cmp dword [ebp - 0x14], 0
je 0x46538f
mov eax, dword [ebx*4 + 0x4902e8]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x465367
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x465330
mov word [esi], cx
jmp 0x465363
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x4902e8]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x4902e8]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x4902e8]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x4653b3
pop ebx
cmp word [ebp - 4], bx
jne 0x465378
cmp esi, dword [ebp + 0xc]
jne 0x465378
mov word [esi], bx
jmp 0x4653b0
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00464e47
add esp, 0x10
cmp word [ebp - 4], bx
je 0x4653b3
push 0xd
jmp 0x4653ac
mov ecx, dword [ebx*4 + 0x4902e8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4653aa
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4653b3
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4023f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push edi
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0x30]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
add eax, 0xc
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
push 0x208
push 0
lea eax, [ebp - 0x224]
push eax
call fcn.0040d390
add esp, 0xc
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0xc]
je 0x4024d6
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
lea edi, [ebp - 0x224]
xor al, al
mov ecx, 0x208
rep stosb byte es:[edi], al
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 0x2c]
shr ecx, 1
add ecx, 1
cmp ecx, 0x103
jbe 0x40246e
mov dword [ebp - 0x10], 0x103
jmp 0x40247d
mov edx, dword [ebp - 4]
movzx eax, word [edx + 0x2c]
shr eax, 1
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x30]
push eax
lea ecx, [ebp - 0x224]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
lea edx, [ebp - 0x224]
push edx
call dword [sym.imp.USER32.dll_CharLowerW]
mov ecx, eax
call fcn.00402e20
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x1c], 0x65b06c6b
jne 0x4024c9
cmp dword [ebp - 0x18], 0x9c6d
jne 0x4024c9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
jmp 0x4024d8
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
jmp 0x402430
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4024e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x402507
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x402507
xor eax, eax
jmp 0x402637
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
cmp dword [edx], 0x4550
je 0x402525
xor eax, eax
jmp 0x402637
mov eax, dword [ebp - 0x18]
add eax, 0x18
mov dword [ebp - 0x20], eax
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx + 0x60]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x14], edx
mov dword [ebp - 8], 0
mov dword [ebp - 8], 0
jmp 0x40258d
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 4
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
add edx, 2
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x18]
jae 0x4025ce
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, dword [edx]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call fcn.00402f20
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov ecx, dword [ebp - 0x38]
cmp ecx, dword [ebp + 0xc]
jne 0x4025cc
mov edx, dword [ebp - 0x34]
cmp edx, dword [ebp + 0x10]
jne 0x4025cc
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax]
mov dword [ebp - 0x1c], ecx
jmp 0x4025ce
jmp 0x402572
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 0x18]
jne 0x4025dd
xor eax, eax
jmp 0x402637
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + eax*4]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
add edx, dword [ecx + eax + 0x64]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.004023c0
add esp, 0xc
movzx ecx, al
test ecx, ecx
je 0x402634
cmp dword [ebp + 0x14], 0
je 0x402634
mov edx, dword [ebp + 0x14]
mov byte [edx], 1
mov eax, dword [ebp - 0x24]
mov esp, ebp
pop ebp
ret
Function at 0x402e20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, ecx
test edi, edi
jne 0x402e41
or eax, 0xffffffff
or edx, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [edi]
xor dl, dl
movzx esi, word [edi]
mov cl, 6
mov byte [esp + 0x17], al
mov al, 0x81
mov byte [esp + 0x24], 0x88
mov bl, 0xeb
test si, si
je 0x402ee5
mov ecx, 0xeb818806
mov dword [esp + 0x1c], 0xf6b36571
mov eax, esi
mov ebp, ecx
mov edx, 0xf6b36571
mov dword [esp + 0x18], eax
nop word [eax + eax]
xor esi, esi
movzx eax, ax
and ecx, 0x1ffffff
lea edi, [edi + 2]
shld esi, ecx, 7
shrd ebp, edx, 0x19
shl ecx, 7
shr edx, 0x19
or ecx, ebp
or esi, edx
cdq
xor ecx, eax
xor edx, esi
mov ebx, ecx
mov eax, edx
shrd ebx, eax, 0x18
mov eax, edx
mov esi, ecx
shrd esi, eax, 0x10
mov eax, edx
mov ebp, ecx
mov dword [esp + 0x28], esi
mov esi, ecx
shrd esi, eax, 8
mov eax, dword [esp + 0x18]
mov byte [esp + 0x16], al
movzx eax, word [edi]
mov dword [esp + 0x24], esi
mov esi, eax
mov dword [esp + 0x18], esi
test ax, ax
jne 0x402e80
mov eax, dword [esp + 0x28]
mov dl, byte [esp + 0x16]
mov dh, byte [esp + 0x17]
xorps xmm0, xmm0
movlpd qword [esp + 0x28], xmm0
mov byte [esp + 0x2a], cl
mov ecx, dword [esp + 0x24]
mov byte [esp + 0x28], dh
mov byte [esp + 0x29], dl
mov byte [esp + 0x2c], al
mov byte [esp + 0x2b], cl
mov eax, dword [esp + 0x28]
mov byte [esp + 0x2d], bl
mov edx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402f20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
test edi, edi
jne 0x402f3f
or eax, 0xffffffff
or edx, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov bl, byte [edi]
xor bh, bh
mov byte [esp + 0xf], bl
mov cl, 6
mov byte [esp + 0x10], 0x88
mov al, 0xeb
mov byte [esp + 0x14], 0x81
test bl, bl
je 0x402fcb
mov ecx, 0xeb818806
mov dword [esp + 0x24], 0xf6b36571
mov eax, ecx
mov edx, 0xf6b36571
nop dword [eax]
xor esi, esi
lea edi, [edi + 1]
shrd eax, edx, 0x19
and ecx, 0x1ffffff
mov bh, bl
shld esi, ecx, 7
shr edx, 0x19
or esi, edx
shl ecx, 7
or ecx, eax
movsx eax, bl
mov bl, byte [edi]
cdq
xor ecx, eax
xor edx, esi
mov eax, edx
mov esi, ecx
shrd esi, eax, 0x18
mov eax, edx
mov dword [esp + 0x18], esi
mov esi, ecx
shrd esi, eax, 0x10
mov eax, edx
mov dword [esp + 0x14], esi
mov esi, ecx
shrd esi, eax, 8
mov eax, ecx
mov dword [esp + 0x10], esi
test bl, bl
jne 0x402f70
mov bl, byte [esp + 0xf]
mov eax, dword [esp + 0x18]
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov byte [esp + 0x1a], cl
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x1b], cl
mov ecx, dword [esp + 0x14]
pop edi
mov byte [esp + 0x14], bl
mov byte [esp + 0x15], bh
mov byte [esp + 0x19], al
mov eax, dword [esp + 0x14]
mov byte [esp + 0x18], cl
mov edx, dword [esp + 0x18]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405480
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword fs:[0x18]
mov edx, 0x30
push ebx
mov dword [esp + 8], 0
push ebp
mov eax, dword [eax + 0x30]
push esi
push edi
mov dword [esp + 0x18], ecx
lea ecx, [edx - 0x29]
mov eax, dword [eax + 0x10]
push 0x1fd
push 0x1bf55743
mov esi, dword [eax + 0x44]
call fcn.004027f0
add esp, 8
lea ecx, [esp + 0x14]
push ecx
push esi
call eax
mov ecx, dword [esp + 0x14]
mov ebp, eax
cmp ecx, 3
jl 0x405595
xor edi, edi
test ecx, ecx
jle 0x405595
lea ebx, [edi + 0x7f]
mov byte [esp + 0x1f], 0x3a
mov byte [esp + 0x20], 0x37
mov byte [esp + 0x21], 0x36
mov byte [esp + 0x22], 0x37
mov byte [esp + 0x23], 0x35
mov byte [esp + 0x24], 0x37
mov byte [esp + 0x25], 0x7a
mov byte [esp + 0x26], 0x37
mov byte [esp + 0x27], 0x2d
mov byte [esp + 0x28], 0x37
mov byte [esp + 0x29], 0x37
mov byte [esp + 0x2a], 0x37
mov al, byte [esp + 0x1f]
mov byte [esp + 0x2b], 0
cmp byte [esp + 0x2b], 0
jne 0x405554
xor ecx, ecx
nop
mov al, byte [esp + ecx + 0x1f]
movzx edx, al
sub edx, 0x37
mov eax, edx
shl eax, 4
sub eax, edx
cdq
idiv ebx
lea eax, [edx + 0x7f]
cdq
idiv ebx
mov byte [esp + ecx + 0x1f], dl
inc ecx
cmp ecx, 0xc
jb 0x405530
lea ebx, [edi*4]
mov edx, 0x35
add ebx, ebp
push 0xc682
push 0x11fa576c
lea ecx, [edx - 0x34]
mov esi, dword [ebx]
call fcn.004027f0
add esp, 8
lea ecx, [esp + 0x1f]
push ecx
push esi
call eax
test eax, eax
je 0x40559f
inc edi
mov ebx, 0x7f
cmp edi, dword [esp + 0x14]
jl 0x4054e0
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov ebp, dword [esp + 0x18]
mov byte [ebp + 0x30], 1
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
mov edx, 2
lea esi, [eax + 5]
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040b1b0
add esp, 4
mov dword [ebp + 0x2c], eax
test eax, eax
je 0x405595
mov edi, eax
lea ecx, [esi + esi]
mov edx, 0x2f
xor al, al
rep stosb byte es:[edi], al
mov esi, dword [ebx + 4]
lea ecx, [edx - 0x2e]
mov edi, dword [ebp + 0x2c]
push 0x5b8a
push 0x409d576c
call fcn.004027f0
add esp, 8
push esi
push edi
call eax
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x1c
ret
Function at 0x405f30
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ebx
push ebp
push esi
push edi
mov ebp, ecx
nop dword [eax]
mov eax, dword [0x455ee4]
test eax, eax
jne 0x405f7d
push 0xc8
call fcn.0040b1b0
add esp, 4
test eax, eax
je 0x405f76
mov word [eax], 0x101
mov dword [eax + 4], 0x1e
mov dword [eax + 8], 5
mov dword [eax + 0x10], 3
jmp 0x405f78
xor eax, eax
mov dword [0x455ee4], eax
test byte [eax + 0x10], 1
je 0x405f8f
cmp dword [ebp + 0x98], 1
sete cl
jmp 0x405f91
mov cl, 1
mov eax, dword [eax + 0x10]
shr eax, 1
test al, 1
je 0x405fa6
cmp dword [ebp + 0x9c], 2
sete al
jmp 0x405fa8
mov al, 1
test cl, cl
je 0x405fb0
test al, al
jne 0x405fd3
mov edx, 0x5a
push 0xf006
push 0x194f7053
lea ecx, [edx - 0x59]
call fcn.004027f0
add esp, 8
push 0xa
call eax
jmp 0x405f40
xor eax, eax
mov ecx, dword [eax + 0x413638]
cmp ecx, 0xffffffff
je 0x405fe8
test ecx, ecx
jne 0x40607a
add eax, 0x110
cmp eax, 0x42680
jl 0x405fd5
mov esi, dword [0x455c80]
mov eax, dword [0x455c84]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
lea ebx, [esi + eax*4]
cmp esi, ebx
je 0x40603b
nop dword [eax]
push 0
push dword [esi]
call edi
mov edx, 0x5a
push 0xf006
push 0x194f7053
lea ecx, [edx - 0x59]
call fcn.004027f0
add esp, 8
push 0xa
call eax
add esi, 4
cmp esi, ebx
jne 0x406010
push 0
push dword [ebp + 0x20]
call edi
push 0
push dword [ebp + 0x24]
call edi
push 0
push dword [ebp + 0x28]
call edi
mov esi, dword [ebp + 0x1c]
mov edx, 0x39
push 0xf90
push 0x5fe36543
lea ecx, [edx - 0x38]
call fcn.004027f0
add esp, 8
push esi
call eax
pop edi
mov al, 1
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 0x5a
push 0xf006
push 0x194f7053
lea ecx, [edx - 0x59]
call fcn.004027f0
add esp, 8
push 0x64
call eax
jmp 0x405fd3
Function at 0x40aba0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [0x455ee0]
push ebp
mov ebp, ecx
test eax, eax
jne 0x40ac0e
push edi
push 0x427
call fcn.0040b1b0
mov edi, eax
add esp, 4
mov dword [0x455ee0], edi
test edi, edi
jne 0x40abcb
pop edi
pop ebp
pop ecx
ret
push ebx
push esi
mov ebx, 0x40e0d0
mov dword [esp + 0x10], 0x1a
xor esi, esi
sub ebx, edi
nop
mov eax, esi
lea ecx, [edi + esi]
xor edx, edx
inc esi
div dword [esp + 0x10]
mov al, byte [edx + 0x40e0b0]
xor al, byte [ebx + ecx]
mov byte [ecx], al
cmp esi, 0x427
jb 0x40abe0
pop esi
pop ebx
mov eax, edi
mov dword [ebp + 0xc4], 0x427
pop edi
pop ebp
pop ecx
ret
Function at 0x40be10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov dword [ebp - 0xc], ecx
push esi
mov edx, str.Ib_
lea ecx, [ebp - 4]
xor ebx, ebx
call fcn.0040ad60
mov eax, dword [ebp - 4]
cmp dword [eax - 0xc], ebx
je 0x40bece
xor esi, esi
push edi
lea esp, [esp]
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 8]
push edx
push 0
xor ecx, ecx
push 2
test esi, esi
push 0
setne cl
push 0
push 0
push eax
mov dword [ebp - 8], 0
add ecx, 0x80000001
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40bec0
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
test edx, edx
jne 0x40be81
lea eax, [edx + 0xd]
jmp 0x40beae
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40be86
sub eax, ebx
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push 0x4410a0
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test edi, edi
je 0x40bec0
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
inc esi
cmp esi, 2
jl 0x40be40
pop edi
lea esi, [eax - 0x10]
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40bee8
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100324c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [0x100ad24]
xor ebx, ebx
cmp eax, ebx
je 0x10032c4
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp + 8]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1003278
push ebx
lea ecx, [ebp - 4]
push ecx
sub eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
push dword [ebp + 8]
push dword [0x100ad24]
call esi
test eax, eax
je 0x10032c7
mov ecx, 0x100229c
mov eax, ecx
push edi
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10032a7
push ebx
lea edx, [ebp - 4]
push edx
sub eax, edi
push eax
push ecx
push dword [0x100ad24]
call esi
test eax, eax
pop edi
je 0x10032c7
xor ebx, ebx
inc ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
mov eax, ebx
pop ebx
leave
ret 4

Function at 0x10036a7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec edi
or al, 0xf
mov bh, pe_nt_image_headers32
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
add eax, edi
cmp dword [ebp - 0xc], eax
jae 0x10036bb
mov dword [ebp - 0xc], eax
add ecx, 0x28
dec edx
jne 0x10036ac
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x9d
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0x25
mov byte [ebp - 0x53], 7
mov byte [ebp - 0x52], 0x16
mov byte [ebp - 0x51], 0x31
mov byte [ebp - 0x50], 0x1b
mov byte [ebp - 0x4f], 0x11
mov byte [ebp - 0x4e], 0x16
mov byte [ebp - 0x4d], 7
mov byte [ebp - 0x4c], 0xf
mov byte [ebp - 0x4b], 0x2b
mov byte [ebp - 0x4a], 0xc
mov byte [ebp - 0x49], 4
mov byte [ebp - 0x48], 0xd
mov byte [ebp - 0x47], 0x62
call fcn.0100347d
push esp
add eax, 0x458d4bb0
test al, 0x50
call fcn.0100348d
mov edi, dword [ebp + 0xc]
push eax
push edi
push dword [ebp + 8]
call fcn.01003442
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0xc]
div ecx
test edx, edx
je 0x1003755
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
lea eax, [ebp - 0x30]
mov dword [ebp + 0xc], ecx
push eax
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], bl
mov byte [ebp - 0x2e], 0x6a
mov byte [ebp - 0x2d], bl
mov byte [ebp - 0x2c], 0xc3
mov byte [ebp - 0x2b], 0xfc
mov byte [ebp - 0x2a], 0xe7
out 0xc6, eax
inc ebp
xlatb
loope 0x1003747
inc ebp
fsub st(0)
Function at 0x10014fe0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
push ebx
push esi
push edi
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x114], 0
jmp 0x10015011
mov eax, dword [ebp - 0x114]
add eax, 1
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0x104]
jae 0x10015035
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp + eax*4 - 0x100]
cmp ecx, dword [ebp + 8]
jne 0x10015033
jmp 0x10015035
jmp 0x10015002
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0x104]
jne 0x1001506b
cmp dword [ebp - 0x104], 0x40
jae 0x1001506b
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x100], ecx
mov eax, dword [ebp - 0x104]
add eax, 1
mov dword [ebp - 0x104], eax
xor eax, eax
jne 0x10014ff6
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], 0
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
lea eax, [ebp - 0x110]
push eax
push 0
push 0
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp + 8]
add edx, 1
push edx
call dword [sym.imp.WS2_32.dll_select]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jle 0x100150cf
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_recv]
jmp 0x100150e7
cmp dword [ebp - 0x108], 0
jne 0x100150e1
mov eax, dword [ebp + 0x18]
mov dword [eax], 1
mov eax, dword [ebp - 0x108]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10015370
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
cmp dword [ebp + 0xc], 0
je 0x10015388
mov dword [ebp - 4], 0
jmp 0x1001538f
mov dword [ebp - 4], 1
lea eax, [ebp - 4]
push eax
push 0x8004667e
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100153b0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
push ebx
push esi
push edi
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x11c], 0
mov eax, dword [ebp + 0x10]
and eax, 1
je 0x100153ee
lea eax, [ebp - 0x104]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp + 0x10]
and eax, 2
je 0x10015402
lea eax, [ebp - 0x104]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp + 0x10]
and eax, 4
je 0x10015416
lea eax, [ebp - 0x104]
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x120], 0
jmp 0x1001543b
mov eax, dword [ebp - 0x120]
add eax, 1
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x120]
cmp eax, dword [ebp - 0x104]
jae 0x1001545f
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp + eax*4 - 0x100]
cmp ecx, dword [ebp + 8]
jne 0x1001545d
jmp 0x1001545f
jmp 0x1001542c
mov eax, dword [ebp - 0x120]
cmp eax, dword [ebp - 0x104]
jne 0x10015495
cmp dword [ebp - 0x104], 0x40
jae 0x10015495
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x100], ecx
mov eax, dword [ebp - 0x104]
add eax, 1
mov dword [ebp - 0x104], eax
xor eax, eax
jne 0x10015420
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], 0
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp - 0x11c]
push ecx
mov edx, dword [ebp - 0x118]
push edx
mov eax, dword [ebp - 0x114]
push eax
mov ecx, dword [ebp + 8]
add ecx, 1
push ecx
call dword [sym.imp.WS2_32.dll_select]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jle 0x100154e8
xor eax, eax
jmp 0x10015506
cmp dword [ebp - 0x108], 0
jne 0x10015503
push 0x274c
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, 1
jmp 0x10015506
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret