joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4272f4
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x42bec8
call fcn.0040795c
sub esp, 0x110
mov eax, dword [0x439d24]
xor eax, dword [ebp + 4]
push esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
lea ecx, [ebp - 0x18]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x4273af
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov ebx, 0xff
jmp 0x427378
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00401bd0
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
call fcn.004272f4
mov ecx, dword [ebp - 0x1c]
mov esi, eax
test esi, esi
setne byte [ebp - 0x11]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00401310
cmp byte [ebp - 0x11], 0
jne 0x42738d
push ebx
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x18]
call edi
mov esi, eax
test esi, esi
je 0x42733c
cmp esi, 0x103
pop edi
pop ebx
je 0x42739f
cmp esi, 0x3f2
jne 0x4273af
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, dword [ebp + 4]
mov eax, esi
pop esi
call fcn.0040600b
leave
ret 8

Function at 0x427beb
Capabilities:
Get thread local storage value

Disassembly:
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x427c08
mov ecx, dword [esp + 4]
cmp ecx, dword [eax + 8]
jge 0x427c08
mov eax, dword [eax + 0xc]
mov eax, dword [eax + ecx*4]
jmp 0x427c0a
xor eax, eax
ret 4

Function at 0x427d02
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x427d36
call fcn.004112fe
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret
Function at 0x427d9e
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x427dcc
mov eax, dword [esp + 0x10]
cmp eax, dword [esi + 8]
jl 0x427e67
cmp dword [esp + 0x14], ebx
je 0x427e67
jmp 0x427e09
push 0x10
call fcn.00427ab0
cmp eax, ebx
je 0x427de2
mov ecx, eax
call fcn.00427cf9
mov esi, eax
jmp 0x427de4
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
lea ebx, [edi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
push ebx
mov dword [edi + 0x14], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ebx, ebx
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x427e20
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x427e30
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
mov dword [esi + 0xc], eax
jne 0x427e3c
call fcn.004112fe
mov eax, dword [esi + 8]
mov ecx, dword [edi + 0xc]
sub ecx, eax
shl ecx, 2
push ecx
mov ecx, dword [esi + 0xc]
lea eax, [ecx + eax*4]
push ebx
push eax
call fcn.00407350
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [esi + 0xc]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
pop edi
pop esi
mov dword [eax + edx*4], ecx
pop ebx
ret 8

Function at 0x427f2c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x427f5a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x427f78
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00427e96
jmp 0x427f78
mov eax, dword [esi + 0x14]
test eax, eax
je 0x427f78
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00427e96
test edi, edi
mov eax, edi
jne 0x427f62
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x43cb6c]
test ecx, ecx
je 0x42802b
jmp 0x427f2b
ret 8
Function at 0x428413
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x439d24]
xor eax, dword [ebp + 4]
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.00407df6
mov esi, eax
test esi, esi
pop ecx
je 0x4284b1
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, esi
je 0x4284a7
push ebx
push edi
mov edi, SysAllocStringLen
and byte [eax], 0
push eax
push esi
call fcn.00408965
pop ecx
pop ecx
lea eax, [ebp + 8]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4284a5
push 0x105
lea eax, [ebp - 0x10c]
push eax
xor ebx, ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x428482
inc ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x4284a5
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x5c
push esi
call fcn.00406ff4
test eax, eax
pop ecx
pop ecx
jne 0x428449
pop edi
pop ebx
push esi
call fcn.00406a0a
xor eax, eax
pop ecx
inc eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
call fcn.0040600b
leave
ret 4

Function at 0x429a48
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push esi
xor esi, esi
inc esi
test al, 1
push edi
je 0x429a8f
push ebx
push 0
mov ebx, 0x431024
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov edi, str.Insertable
push edi
push dword [ebp + 8]
call esi
test eax, eax
jne 0x429a89
push eax
push ebx
push 1
push edi
push dword [ebp + 0xc]
call esi
test eax, eax
jne 0x429a89
xor esi, esi
inc esi
jmp 0x429a8b
xor esi, esi
mov eax, dword [ebp + 0x10]
pop ebx
xor edi, edi
test al, 2
je 0x429a9a
mov edi, 0x439b6c
test al, 4
je 0x429aa3
mov edi, 0x439b80
and eax, 6
cmp al, 6
jne 0x429aaf
mov edi, 0x439b78
test edi, edi
je 0x429afa
lea eax, [ebp + 0x10]
push eax
push str.InprocServer32
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x429afa
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push edi
push 1
push 0
push str.ThreadingModel
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x10]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebp
ret 0xc
Function at 0x429bcd
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x42c276
call fcn.0040795c
sub esp, 0x118
mov eax, dword [0x439d24]
xor eax, dword [ebp + 4]
push esi
push edi
mov dword [ebp - 0x10], eax
call fcn.00413085
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
and dword [ebp - 4], 0
call fcn.00413085
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
and dword [ebp - 0x20], 0
mov edi, SysAllocStringLen
cmp dword [ebp + 0x18], edi
mov byte [ebp - 4], 1
jne 0x429c34
lea eax, [ebp - 0x20]
push eax
push 0x42dec4
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
mov dword [ebp - 0x24], 1
je 0x429cfa
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
add dword [ebp + 8], 4
cmp dword [ebp + 0x18], edi
jne 0x429c61
cmp byte [esi], 0
je 0x429ce1
push esi
call ebx
push dword [ebp + 0x10]
lea eax, [eax + esi + 1]
push dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
push esi
lea eax, [ebp - 0x18]
push eax
call fcn.0041ecf3
push dword [ebp + 0x10]
lea eax, [ebp - 0x1c]
push dword [ebp + 0xc]
push dword [ebp - 0x14]
push eax
call fcn.0041ecf3
cmp dword [ebp + 0x18], edi
mov eax, dword [ebp - 0x18]
jne 0x429c9b
cmp dword [eax - 0xc], 0
je 0x429ce1
cmp dword [ebp + 0x14], 0
jne 0x429cc4
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x124]
push ecx
push eax
push dword [ebp + 0x18]
mov dword [ebp - 0x14], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x429ce1
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
push esi
mov dword [ebp - 0x14], eax
call ebx
push eax
push esi
push 1
push dword [ebp - 0x14]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
test eax, eax
jne 0x429cf0
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
jne 0x429c4f
jmp 0x429cf9
cmp eax, 5
je 0x429cf9
and dword [ebp - 0x24], 0
pop ebx
cmp dword [ebp - 0x20], 0
pop edi
pop esi
je 0x429d0b
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00401310
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401310
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x24]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, dword [ebp + 4]
call fcn.0040600b
leave
ret 0x14
Function at 0x474564
Capabilities:
Encode data using xor

Disassembly:
insb byte es:[edi], dx
imul esp, ecx, 0x3e
xor edi, dword [eax]
mov cl, 0xf7
je 0x474565
mov dword [0xb3cc11ac], eax
in eax, dx
popal
invalid

Function at 0x515d94
Capabilities:
Encode data using xor

Disassembly:
in al, 0xd5
and esp, dword [ecx]
movntps xmmword [esi + 0x21], xmm3
mov esi, 0x56a7ce1e
cmp byte [edi - 0x31], al
pop eax
test byte [ecx], al
sti
sal ah, 1
lea ebp, [edi - 0x41b809d8]
sbb dword [edi + 0x2e1710f1], ebx
dec esi
lahf
int1
adc byte [edi], dl
dec esi
cmpsb byte [esi], byte es:[edi]
adc edi, dword [eax]
cmp bh, byte [edi]
xchg esi, eax
sal dword [eax - 2], 1
inc ecx
xor byte [eax - 0x59], dh
lss edx, [0xa5e7e155]
push ebp
loope 0x515d7e
movsd dword es:[edi], dword [esi]
push ebp
loope 0x515d7e
movsd dword es:[edi], dword [esi]
rcl byte [edi - 0x2fd3d10a]
xchg byte [0x20bcf6b4], dh
push edx
push cs
inc eax
and al, 0x5b
mov byte [0x608252a], al
push 0x2d
je 0x515d61
invalid
Function at 0x562ed4
Capabilities:
Encode data using xor

Disassembly:
xchg ebx, eax
shl dword [edi + 0x6880c0e7], cl
sub bh, cl
sub byte [eax + 0x28], 0xcf
invalid
lahf
fbstp tbyte [edi]
ja 0x562ee9
push eax
sbb dword [ecx + 0x7e], ebx
salc
salc
xchg esi, eax
jno 0x562f13
inc esi
push es
and dword [ecx - 0x77], esp
leave
scasb al, byte es:[edi]
out dx, al
mov bl, 0x96
test byte [ecx + 0x4f6ab89d], ah
outsb dx, byte [esi]
dec ebx
pop ecx
jl 0x562f37
aaa
adc cl, byte [eax]
sub eax, 0x3261a3f
sal esp, 1
aad 0xf0
loop 0x562ecd
sti
fimul word [ecx + ebp*4 - 0x280d1f3b]
jmp 0x562ede
cmp eax, 0x13360a2f
inc ecx
jle 0x562f77
dec ecx
insb byte es:[edi], dx
push eax
jne 0x562ec8
and byte [ebx - 0x724e6b7a], 0xa8
cli
fistp word [esi + 0x7b]
imul ecx, dword [eax + esi*2 + 0x55], 0xa683a287
cmpsd dword [esi], dword es:[edi]
retf
sbb dword [eax + 0x4af39f46], esp
inc esi
lahf
dec edx
lcall 0x569, 0x30d66f03
mov esp, 0x4bdd148
loop 0x562fc4
push edi
out dx, al
jno 0x562f75
test byte [0x57ee82db], bh
mov dword [0x9ef563a], eax
sar byte [ebp + eax - 0x66dfb32b], 1
jg 0x562fc7
dec edx
pop es
sahf
dec ebx
lodsd eax, dword [esi]
je 0x562fc2
mov eax, dword [0xea533fa6]
or al, 0x55
cmp dword [eax + 0x3881ed74], eax
fiadd word [edi]
imul edx, edx, 2
wait
test dword [esi - 0x58], 0xd0249df1
cmp dword [eax], 0xd26b07de
add bl, byte [ebx - 0xe57b109]
popfd
and al, 0xd0
dec ecx
and eax, 0xcfa37a9c
jbe 0x562fb5
jp 0x562f6c
iretd
jo 0x562fea
movsd dword es:[edi], dword [esi]
inc ebx
sbb dh, byte [esi - 0x31]
cmp esp, dword [edx + 0x489177ce]
and al, 0x9d
dec ebp
aam 0xb8
add edi, esp
mov esi, 0x69f6bd2
push 0xffffffffffffffd3
xor eax, 0x653980ec
dec edx
cmp dword [ebp + 0x4a], esp
std
adc al, 0xfb
dec esp
inc ebx
push es
sub dword [esi - 0x50e7886f], ebx
mov al, byte [0x343b8ca3]
sar byte [0xefc0858a], cl
pop eax
push edi
mov cl, 0xde
imul esp, dword [esi - 0x18], 0x997f70c7
jbe 0x562fd3
into
mov esp, dword [ebx + edx + 0x2295fa1c]
sub eax, 0xb9b6012e
pop edi
mov al, 7
or byte [ebp + 0x62], cl
aad 0xda
cmp al, 0x53
in al, 0xeb
jle 0x56307e
out 0xe9, al
pavgb mm2, qword [edi + 0x58]
sbb eax, 0x6c8a8532
add esi, dword [ebx + edi*4 + 0x2f2097b8]
xor al, byte [ebp - 0x4bfc9376]
mov ebx, 0x2f2097b8
leave
xchg ecx, eax
sahf
fcomi st(4)
inc ebx
dec esp
stosb byte es:[edi], al
lds esi, [edx + 0x7d]
fsubr qword [ebx + 0x64]
sub byte [ebp - 0x26], 0xd5
nop
mov edi, 0x8ee10708
cmp dword [esi], esi
xor eax, 0x44a2ad1a
stosd dword es:[edi], eax
sbb al, 0x13
push esi
jns 0x563034
shl dword [edi], 0x48
push eax
push 0x60dccf5b
xchg ebx, eax
pop es
adc al, 0xff
int3
dec edi
mov esp, 0xe3d03b28
ja 0x5630eb
fsubr dword [ebx + 0x3302c3f]
xchg edi, eax
test byte [eax], bh
retf
and dword [edx - 0x2ab10492], ebx
mov bl, 0xf4
iretd
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
mov esi, 0x529a68ff
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x431060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x4e8a5e10
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x95d058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x95d1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x95d07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x95d06a
add dl, dl
jne 0x95d089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x95d0dc
xor eax, eax
add dl, dl
jne 0x95d096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x95d17d
add dl, dl
jne 0x95d0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x95d0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x95d0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x95d0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x95d0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x95d075
mov eax, 1
add dl, dl
jne 0x95d0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x95d0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x95d0e1
sub eax, ebx
mov ebx, 1
jne 0x95d128
mov ecx, 1
add dl, dl
jne 0x95d10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x95d119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x95d105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x95d075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x95d13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x95d14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x95d136
cmp eax, 0x7d00
jae 0x95d16d
cmp eax, 0x500
jb 0x95d168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x95d075
cmp eax, 0x7f
ja 0x95d170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x95d075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x95d19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x95d075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x4fa064], 1
mov dword [0x4fa060], 1
mov dword [0x4fa05c], 1
mov dword [0x4fa054], 1
jne 0x401060
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010c0
mov dword [0x4fa014], eax
mov eax, dword [0x4fa070]
test eax, eax
je 0x4010b0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x4fa084]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x4fa06c]
mov dword [eax], edx
call sym.__setargv
cmp dword [0x4af050], 1
je 0x4010f0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x40107a
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401060
cmp dword [ecx + 0x84], 0xe
jbe 0x401060
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401060
mov dword [esp], sym.__matherr
call sym.___mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401060
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401060

Function at 0x401658
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
lea eax, [ebp - 0x19c]
mov dword [esp + 4], eax
mov dword [esp], 2
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
test eax, eax
sete al
test al, al
je 0x4016de
mov dword [esp + 4], 0x100
lea eax, [ebp - 0x29c]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_gethostname]
call eax
sub esp, 8
test eax, eax
sete al
test al, al
je 0x4016de
lea eax, [ebp - 0x29c]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_gethostbyname]
call eax
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4016de
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_inet_ntoa]
call eax
sub esp, 4
jmp 0x4016e3
mov eax, str.Get_IP_failed.
leave
ret
Function at 0x40b190
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sym.___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call sym.___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x40b1f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x4fa078]
test esi, esi
jle 0x40b310
mov eax, dword [0x4fa07c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x40b224
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x40b2a7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x40b210
mov dword [esp], ebx
call sym.___mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x40b337
mov eax, dword [0x4fa07c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call sym.__GetPEImageBase
mov edx, dword [0x4fa07c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40b317
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x40b2a0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x40b2b0
add dword [0x4fa078], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x4fa07c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x40b2a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call sym.___report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40b22e
mov eax, dword [0x4fa07c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call sym.___report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call sym.___report_error
lea esi, [esi]
nop
Function at 0x40b7f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4fa094
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4fa08c]
sub esp, 4
test ebx, ebx
je 0x40b845
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40b83e
test esi, esi
je 0x40b83e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40b820
mov dword [esp], 0x4fa094
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40bb70
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x40bb95
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x40bba0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x40bb95
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x40bbe8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40bbde
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40bbea
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x40bbd0
xor eax, eax
pop ebx
pop esi
ret