joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12ca820
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9f8000]
push edi
jmp 0x12ca83a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x12ca841
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x12ca830
mov eax, 1
add ebx, ebx
jne 0x12ca853
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x12ca864
jne 0x12ca883
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x12ca883
dec eax
add ebx, ebx
jne 0x12ca870
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x12ca848
add ebx, ebx
jne 0x12ca87f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x12ca8d5
xor ecx, ecx
sub eax, 3
jb 0x12ca89b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x12ca90a
sar eax, 1
mov ebp, eax
jmp 0x12ca8a6
add ebx, ebx
jne 0x12ca8a6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x12ca874
inc ecx
add ebx, ebx
jne 0x12ca8b4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x12ca874
add ebx, ebx
jne 0x12ca8c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x12ca8b6
jne 0x12ca8d2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x12ca8b6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x12ca8f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x12ca8e6
jmp 0x12ca836
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x12ca8f4
add edi, ecx
jmp 0x12ca836
pop esi
mov edi, esi
mov ecx, 0x47bb00
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x12ca92f
cmp byte [edi], 0x21
jne 0x12ca914
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x12ca912
lea edi, [esi + 0xec5000]
mov eax, dword [edi]
or eax, eax
je 0x12ca980
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xeee4e4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xeee6f0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x12ca935
mov ecx, edi
jns 0x12ca964
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xeee6f8]
or eax, eax
je 0x12ca97a
mov dword [ebx], eax
add ebx, 4
jmp 0x12ca952
call dword [esi + 0xeee6f4]
mov ebp, dword [esi + 0xeee6fc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x12ca9b4
sub esp, 0xffffff80
jmp 0x87c87c
Function at 0x402dbc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x477008], 0x8088405
inc edx
mov dword [ebx + 0x477008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x402dd8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x477008], 0x8088405
inc edx
mov dword [ebx + 0x477008], edx
fld qword [ebx + 0x477054]
push 0
push edx
fild qword [esp]
add esp, 8
fmulp st(1)
pop ebx
ret

Function at 0x403158
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x477010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4031f0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4031d0
xor eax, eax
push ebp
push 0x4031c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40320c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4031d0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x477010]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x477010], ax
mov esp, ebp
pop ebp
ret

Function at 0x403c60
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x47904c], 0
je 0x403cc1
cmp word [0x479220], 0xd7b2
jne 0x403c89
cmp dword [0x479228], 0
jbe 0x403c89
mov eax, 0x47921c
call dword [0x479238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x47707c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403ce8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x47701c], 0
jne 0x403cdd
push 0
push 0x47709c
push 0x47707c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x405b4d
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
adc al, 0xf
mov bh, 0x71
push es
test esi, esi
lea eax, [eax + ecx + 0x18]
inc esp
or byte [eax], bl
jbe fcn.00405b88

Function at 0x405e10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ebp
ret

Function at 0x4063f4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
Function at 0x40640c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
movsd dword es:[edi], dword [esi]
aas
cld
invalid
inc dword [eax]
mov byte [ebp - 0x3c0], 0x21
inc eax
cld
invalid
jmp dword [ecx]
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
cld
invalid
jmp dword [edi]
mov byte [ebp - 0x3ae], 0x66
invalid

Function at 0x4066c8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x51e], 0x8b
mov byte [ebp - 0x51d], 0x9a
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
lea eax, [ebp - 0x524]
push eax
call fcn.00405b1d
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00405ad2
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.00405b0d
jne 0x4066cb
cli
invalid
fld dword es:[eax - 0x5135b]
inc dword [eax]
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.00405b1d
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00405ad2
add esp, 0xc
mov dword [ebp - 0x33c], eax
invalid
push edx

Function at 0x406a28
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, 0x8fffff0
mov al, byte [0x2ff845c6]
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
invalid
jmp [edx - 0x3685a80]
invalid
inc dword [eax]
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
invalid
Function at 0x407e44
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov esi, edx
mov ebx, eax
mov dword [esp + 8], 4
xor eax, eax
mov dword [esp], eax
test ebx, ebx
je 0x407e88
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0
mov eax, esi
call fcn.004042c8
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x407e88
cmp dword [esp + 4], 4
je 0x407e8d
xor eax, eax
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0xc
pop esi
pop ebx
ret

Function at 0x407e98
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
push eax
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
call fcn.004042c8
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete al
pop ebp
ret

Function at 0x407fa8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
test ebx, ebx
je 0x407fd5
lea eax, [esp + 4]
push eax
push 0
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.004042c8
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x407fd9
xor eax, eax
jmp 0x407fdb
mov al, 1
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x408dc4
Capabilities:
Create thread

Disassembly:
push ebx
mov eax, dword [0x478bd0]
mov byte [eax], 1
mov edx, dword [0x406274]
xor eax, eax
call fcn.004102e8
mov ebx, eax
mov byte [ebx + 0x18], 1
lea eax, [ebx + 0x1e]
push eax
push 4
push ebx
push 0x408db4
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [ebx + 0x1a], eax
mov eax, ebx
pop ebx
ret
Function at 0x40f144
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x40f2a7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov ebx, 0x10
test esi, esi
jne 0x40f181
or ebx, 0x8000000
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.00402d9c
mov dword [ebp - 0x54], 0x44
mov word [ebp - 0x24], si
mov dword [ebp - 0x28], 1
cmp dword [ebp + 8], 0
je 0x40f1af
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
xor esi, esi
cmp dword [ebp - 8], 0
je 0x40f1c1
mov eax, dword [ebp - 8]
call fcn.004042c8
mov esi, eax
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00403e94
mov edx, dword [ebp - 0x10]
mov eax, 0x40f2c4
call fcn.004043b0
test eax, eax
jle 0x40f208
mov edx, dword [ebp - 0x10]
mov eax, 0x40f2d0
call fcn.004043b0
test eax, eax
jg 0x40f208
push 0x40f2d0
push dword [ebp - 0x10]
push 0x40f2d0
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404190
cmp dword [ebp - 0x10], 0
je 0x40f21f
test edi, edi
je 0x40f21f
lea eax, [ebp - 0x10]
mov edx, 0x40f2c4
call fcn.004040d8
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push 0
push ebx
push 0
push 0
push 0
lea eax, [ebp - 0x68]
mov ecx, edi
mov edx, dword [ebp - 0x10]
call fcn.0040411c
mov eax, dword [ebp - 0x68]
call fcn.004042c8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x40f289
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x64]
push eax
call fcn.00405c28
test eax, eax
jne 0x40f272
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle_1
mov byte [ebp - 9], 1
jmp 0x40f280
cmp dword [ebp + 8], 0
je 0x40f280
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x64]
mov dword [eax], edx
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f2ae
lea eax, [ebp - 0x68]
call fcn.00403dfc
lea eax, [ebp - 0x10]
call fcn.00403dfc
ret
Function at 0x40f2d4
Capabilities:
Shutdown system

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd4
mov byte [esp + 1], cl
mov byte [esp], dl
mov edi, eax
xor ebx, ebx
call fcn.00405b08
test eax, eax
jge 0x40f323
test edi, edi
jne 0x40f3f6
mov ebx, 1
cmp byte [esp + 1], 0
je 0x40f305
or ebx, 2
cmp byte [esp], 0
je 0x40f30e
or ebx, 4
push 0
push ebx
call fcn.00405e88
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
jmp 0x40f3f6
lea eax, [esp + 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [esp + 0x10]
push eax
push 0x40f400
mov eax, edi
call fcn.004042c8
mov esi, eax
push esi
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
je 0x40f3f6
push esi
push edi
lea esi, [esp + 0x14]
lea edi, [esp + 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 2
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x20]
push eax
push 0x10
lea eax, [esp + 0x18]
push eax
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
lea eax, [esp + 0x10]
push eax
push 0x40f414
push esi
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
je 0x40f3f6
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 2
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x20]
push eax
push 0x10
lea eax, [esp + 0x18]
push eax
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
cmp byte [esp + 1], 1
cmc
sbb eax, eax
push eax
cmp byte [esp + 4], 1
cmc
sbb eax, eax
push eax
push 0
push 0
push esi
call sub.advapi32.dll_InitiateSystemShutdownA
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, ebx
add esp, 0x2c
pop edi
pop esi
pop ebx
ret
Function at 0x417548
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042b8
xor eax, eax
push ebp
push 0x417713
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00403dfc
cmp dword [ebp - 4], 0
je 0x4176f0
jmp 0x417599
lea eax, [ebp - 4]
mov edx, 0x41772c
call fcn.004040d8
mov eax, dword [ebp - 4]
call fcn.004040d0
and eax, 0x80000003
jns 0x4175ad
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x41758c
mov ebx, 1
xor esi, esi
mov eax, dword [ebp - 4]
call fcn.004040d0
mov edi, eax
cmp edi, ebx
jl 0x4176f0
jmp 0x417655
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx - 1]
xor edx, edx
mov dl, al
cmp edx, 0x3d
jg 0x4175f8
je 0x417626
sub edx, 0x2b
je 0x41760f
sub edx, 2
je 0x41760f
sub edx, 2
je 0x417615
dec edx
sub edx, 0xa
jb 0x41761b
jmp 0x417641
add edx, 0xffffffbf
sub edx, 0x1a
jb 0x41762b
sub edx, 4
je 0x417615
add edx, 0xfffffffe
sub edx, 0x1a
jb 0x417636
jmp 0x417641
mov ax, 0x3e
jmp 0x417645
mov ax, 0x3f
jmp 0x417645
and eax, 0xff
sub ax, 0xfffc
jmp 0x417645
or eax, 0xffffffff
jmp 0x417645
and eax, 0xff
sub ax, 0x41
jmp 0x417645
and eax, 0xff
sub ax, 0x47
jmp 0x417645
mov ax, 0xfffe
cmp ax, 0xfffe
je 0x417654
movzx edx, si
mov word [ebp + edx*2 - 0x10], ax
inc esi
inc ebx
cmp edi, ebx
jl 0x417663
cmp si, 4
jb 0x4175cf
cmp si, 4
jne 0x4176e8
xor esi, esi
lea eax, [ebp - 0x14]
mov dx, word [ebp - 0x10]
shl edx, 2
movsx ecx, word [ebp - 0xe]
shr ecx, 4
or dl, cl
call fcn.00403fdc
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.004040d8
mov eax, dword [ebp - 8]
cmp word [ebp - 0xc], 0xffff
je 0x4176f0
lea eax, [ebp - 0x18]
mov dx, word [ebp - 0xe]
shl edx, 4
movsx ecx, word [ebp - 0xc]
shr ecx, 2
or dl, cl
call fcn.00403fdc
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.004040d8
mov eax, dword [ebp - 8]
cmp word [ebp - 0xa], 0xffff
je 0x4176f0
lea eax, [ebp - 0x1c]
mov dx, word [ebp - 0xc]
shl edx, 6
mov cx, word [ebp - 0xa]
or dl, cl
call fcn.00403fdc
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.004040d8
mov eax, dword [ebp - 8]
cmp edi, ebx
jge 0x417655
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41771a
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403e20
lea eax, [ebp - 4]
call fcn.00403dfc
ret
Function at 0x417730
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042b8
xor eax, eax
push ebp
push 0x4177b4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004040d0
mov esi, eax
test esi, esi
jle 0x417783
mov ebx, 1
lea eax, [ebp - 4]
call fcn.00404320
mov edx, edi
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x41776a
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004040d0
mov ecx, eax
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404328
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4177bb
lea eax, [ebp - 4]
call fcn.00403dfc
ret

Function at 0x41bae0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x41bb7a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403dfc
lea eax, [ebp - 0x105]
xor ecx, ecx
mov edx, 0x105
call fcn.00402d9c
lea eax, [ebp - 0x105]
push eax
push 0
push 0
push esi
push 0
call sub.shell32.dll_SHGetFolderPathA
test eax, eax
jne 0x41bb61
push ebx
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00404064
mov eax, dword [ebp - 0x10c]
mov ecx, 0x105
mov edx, 1
call fcn.00404328
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41bb81
lea eax, [ebp - 0x10c]
call fcn.00403dfc
ret

Function at 0x41bb98
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042b8
mov eax, dword [ebp - 8]
call fcn.004042b8
xor eax, eax
push ebp
push 0x41bc48
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402d9c
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x440
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
test bl, bl
je 0x41bc00
call fcn.00405b08
cmp al, 6
jb 0x41bc00
mov eax, 0x41bc5c
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
call fcn.004042c8
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.004042c8
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x41bc2d
mov esi, dword [ebp - 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41bc4f
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403e20
ret
Function at 0x41bd18
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042b8
mov eax, dword [ebp - 8]
call fcn.004042b8
xor eax, eax
push ebp
push 0x41bd84
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
push 0x41bd90
mov eax, dword [ebp - 8]
call fcn.004042c8
push eax
mov eax, dword [ebp - 4]
call fcn.004042c8
push eax
push 0x41bd90
push ebx
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41bd8b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403e20
ret
Function at 0x41dadc
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff818
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x7e4], ebx
mov dword [ebp - 0x7e8], ebx
mov dword [ebp - 0x7e0], ebx
mov byte [ebp - 6], cl
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x41dc3b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov dl, byte [ebp - 6]
call fcn.00403fdc
lea eax, [ebp - 0x1a0]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x41dc1d
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0x400
lea eax, [ebp - 0x7dc]
push eax
push 0
push 0
push 0x4004747f
mov eax, dword [ebp - 0xc]
push eax
call sub.WS2_32.DLL_WSAIoctl
inc eax
je 0x41dc0f
mov eax, dword [ebp - 0x10]
mov ecx, 0x4c
cdq
idiv ecx
mov esi, eax
dec esi
test esi, esi
jl 0x41dc0f
inc esi
lea ebx, [ebp - 0x7dc]
mov eax, dword [ebx]
and eax, 4
cmp eax, 4
jne 0x41dba3
cmp byte [ebp - 5], 0
jne 0x41dc09
cmp dword [ebp - 4], 0
je 0x41dbcc
push dword [ebx + 8]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x7e0]
call fcn.00403fec
mov edx, dword [ebp - 0x7e0]
mov eax, dword [ebp - 4]
call fcn.00413588
push dword [edi]
push dword [ebx + 8]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x7e4]
call fcn.00403fec
push dword [ebp - 0x7e4]
lea eax, [ebp - 0x7e8]
mov dl, byte [ebp - 6]
call fcn.00403fdc
push dword [ebp - 0x7e8]
mov eax, edi
mov edx, 3
call fcn.00404190
add ebx, 0x4c
dec esi
jne 0x41db93
mov eax, dword [ebp - 0xc]
push eax
call sub.wsock32.dll_closesocket
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41dc42
lea eax, [ebp - 0x7e8]
mov edx, 3
call fcn.00403e20
ret

Function at 0x41de14
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042b8
xor eax, eax
push ebp
push 0x41de9b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403dfc
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.004042c8
push eax
call sub.wsock32.dll_gethostbyname
mov esi, eax
call fcn.00405a98
test eax, eax
jne 0x41de85
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, ebx
call fcn.00403fec
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41dea2
lea eax, [ebp - 4]
call fcn.00403dfc
ret
Function at 0x41dec0
Capabilities:
Initialize winsock library
Resolve dns
Send icmp echo request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe3c
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004042b8
xor eax, eax
push ebp
push 0x41dfab
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
lea eax, [ebp - 0x1a4]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.004042c8
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
call fcn.00405a98
test eax, eax
jne 0x41df95
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
call sub.icmp.dll_IcmpCreateFile
mov dword [ebp - 0xc], eax
mov eax, 0x3c
call fcn.00402534
mov ebx, eax
lea eax, [ebp - 0x1c4]
mov dword [ebx + 0x10], eax
mov word [ebx + 0xc], 0x20
test esi, esi
jle 0x41df80
push 0xbb8
push 0x3c
push ebx
push 0
push 0x20
lea eax, [ebp - 0x1c4]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.icmp.dll_IcmpSendEcho
call fcn.00405a98
cmp dword [ebx + 4], 0
jne 0x41df73
inc edi
test edi, edi
jle 0x41df7d
cmp byte [ebp - 5], 0
jne 0x41df80
dec esi
jne 0x41df47
mov eax, dword [ebp - 0xc]
push eax
call sub.icmp.dll_IcmpCloseHandle
mov eax, ebx
call fcn.00402554
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41dfb2
lea eax, [ebp - 4]
call fcn.00403dfc
ret