joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d560
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1006e57c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10076b6c]
cmp eax, dword [ecx + 4]
jle 0x1000d5b8
push 0x10076b6c
call fcn.1002ce3d
add esp, 4
cmp dword [0x10076b6c], 0xffffffff
jne 0x1000d5b8
push 0x40
push 0x1000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x10076b6c
mov dword [0x10076b68], eax
call fcn.1002cdfe
add esp, 4
mov edx, dword [0x10076b68]
push esi
lea esi, [edx + 0x1000]
cmp edx, esi
je 0x1000d5e3
nop dword [eax]
lea ecx, [edx + 0x1c]
call fcn.1000d550
test eax, eax
je 0x1000d5e7
add edx, 0x20
cmp edx, esi
jne 0x1000d5d0
xor eax, eax
pop esi
ret
mov eax, edx
pop esi
ret

Function at 0x1000d5f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov edi, ecx
call fcn.1000d560
mov ebx, eax
xor esi, esi
mov dword [ebp - 4], ebx
nop word [eax + eax]
lea ecx, [esi + edi]
call fcn.1000d310
add esi, eax
cmp esi, 5
jl 0x1000d610
test esi, esi
jle 0x1000d641
mov ecx, ebx
mov edx, esi
mov ebx, edi
sub ebx, ecx
nop dword [eax + eax]
mov al, byte [ebx + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x1000d630
mov ebx, dword [ebp - 4]
lea ecx, [esi + ebx]
lea eax, [edi - 5]
mov byte [ecx], 0xe9
sub esi, ecx
add eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ecx + 1], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push edi
call esi
mov eax, dword [ebp - 0xc]
sub eax, edi
mov byte [edi], 0xe9
sub eax, 5
mov dword [edi + 1], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push edi
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000df00
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 1]
push eax
call fcn.10030000
add esp, 0xc
xorps xmm0, xmm0
movq qword [esi + 0x44], xmm0
mov ecx, esi
movups xmmword [esi + 0x4c], xmm0
push dword [ebp + 0xc]
movups xmmword [esi + 0x5c], xmm0
mov byte [esi], 0
push dword [ebp + 8]
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
call fcn.100121c0
mov ecx, esi
call fcn.10012270
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x1000e680
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10053f40
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x1006c070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x28], 0x64005c
push 0x2800
push eax
push 0x10073de0
mov dword [ebp - 0x24], 0x650073
mov dword [ebp - 0x20], 0x750074
mov dword [ebp - 0x1c], 0x2e0070
mov dword [ebp - 0x18], 0x6c0064
mov dword [ebp - 0x14], 0x6c
call fcn.10030000
add esp, 0xc
push 0x10073de0
call fcn.1000eed0
test al, al
je 0x1000e8f8
mov ecx, 0x10073de0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000e701
sub ecx, edx
sar ecx, 1
je 0x1000e8f8
push 0x100745e0
call fcn.1000ea90
test al, al
je 0x1000e8f8
mov ecx, 0x100745e0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000e730
sub ecx, edx
sar ecx, 1
je 0x1000e8f8
push 0x10074de0
call fcn.1000f100
test al, al
je 0x1000e8f8
mov ecx, 0x10074de0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000e760
sub ecx, edx
sar ecx, 1
je 0x1000e8f8
push 0x100755e0
call fcn.1000f250
test al, al
je 0x1000e8f8
mov ecx, 0x100755e0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000e790
sub ecx, edx
sar ecx, 1
je 0x1000e8f8
push 0x10075de0
lea eax, [ebp - 0x28]
push eax
call fcn.1000e4e0
test al, al
je 0x1000e8f8
mov eax, 0x10075de0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000e7c3
sub eax, edx
sar eax, 1
je 0x1000e8f8
push 0x10073de0
lea ecx, [ebp - 0x40]
call fcn.1000c540
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.1000dff0
push eax
mov ecx, 0x100765e0
call fcn.10002f00
lea ecx, [ebp - 0x58]
call fcn.10002e90
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.1000c500
push 0x100745e0
lea ecx, [ebp - 0x40]
call fcn.1000c540
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.1000dff0
push eax
mov ecx, 0x100765f8
call fcn.10002f00
lea ecx, [ebp - 0x58]
call fcn.10002e90
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.1000c500
push 0x10074de0
lea ecx, [ebp - 0x40]
call fcn.1000c540
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.1000dff0
push eax
mov ecx, 0x10076610
call fcn.10002f00
lea ecx, [ebp - 0x58]
call fcn.10002e90
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.1000c500
push 0x100755e0
lea ecx, [ebp - 0x70]
call fcn.1000c540
lea eax, [ebp - 0x70]
mov dword [ebp - 4], 3
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.1000dff0
push eax
mov ecx, 0x10076628
call fcn.10002f00
lea ecx, [ebp - 0x88]
call fcn.10002e90
lea ecx, [ebp - 0x70]
call fcn.1000c500
push 0
push 0
push 0x1000e600
call fcn.100384fb
add esp, 0xc
mov al, 1
jmp 0x1000e8fa
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002ccf4
mov esp, ebp
pop ebp
ret
Function at 0x10010e30
Capabilities:
Create thread
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
sub dword [ebp + 0xc], 1
jne 0x10010f49
push esi
mov esi, dword [ebp + 8]
mov dword [0x1006fd88], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x10010de0
mov dword [ebp - 4], 1
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x10010e83
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x10010e83
mov eax, dword [ebp - 8]
test eax, eax
jne 0x10010e85
xor eax, eax
push esi
mov dword [0x1006fd8c], eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
mov esi, eax
mov dword [ebp - 0xc], 0xc
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
push 1
push str.D:P_D_OICI_GA___BG__D_OICI_GA___AN_
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x10010edc
push dword [ebp - 8]
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_SetKernelObjectSecurity]
test eax, eax
jne 0x10010ee4
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
push str._GL2UseGameGuard__3HA
push str.core.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10010f2b
lea eax, [ebp + 0xc]
push eax
push 4
push 1
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10010f2b
lea eax, [ebp + 0xc]
mov byte [esi], 0
push eax
push dword [ebp + 0xc]
push 1
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10010f33
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x100020a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10011060
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100540d8
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x1006c070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, str.Initializing_extender
mov ecx, 0x1006dda0
call fcn.10007a20
push eax
call fcn.10007f40
add esp, 4
cmp dword [0x1006fd84], 0
jne 0x100112c6
mov dword [0x1006fd84], 1
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
call fcn.10011970
mov dword [ebp - 0x60], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push 8
push str.dsetup.u
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.10003110
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x60]
call fcn.10004a50
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
mov bl, al
call fcn.10002e90
test bl, bl
je 0x100111dd
push 9
push str.server_ip
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.10003110
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x60]
call fcn.100050a0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.10002e90
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
mov dword [ebp - 0x68], 0xf
push eax
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x6c], 0
mov byte [ebp - 0x7c], 0
call fcn.10003210
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x7c]
mov byte [ebp - 4], 5
push eax
mov ecx, 0x10076790
call fcn.10003210
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 4
call fcn.10002e90
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x40]
call fcn.10011a00
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 6
mov ecx, 0x1006dda0
call fcn.10007cd0
push eax
call fcn.10007f40
add esp, 8
lea ecx, [ebp - 0x40]
call fcn.10002e90
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0
call fcn.10002e90
jmp 0x100111f5
mov edx, str.Failed_to_load_configuration.
mov ecx, 0x1006dda0
call fcn.10007a20
push eax
call fcn.10007f40
add esp, 4
call fcn.100156f0
test al, al
je 0x100112a9
mov edx, str.PHX_created
mov ecx, 0x1006dda0
call fcn.10007a20
push eax
call fcn.10007f40
add esp, 4
call fcn.1000e680
test al, al
je 0x100112a9
mov edx, str.HWID_created
mov ecx, 0x1006dda0
call fcn.10007a20
push eax
call fcn.10007f40
add esp, 4
lea eax, [ebp - 0x40]
push eax
call fcn.100095e0
mov byte [ebp - 4], 7
cmp dword [eax + 0x14], 0x10
jb 0x10011254
mov eax, dword [eax]
push eax
call dword [0x100766d8]
lea ecx, [ebp - 0x40]
mov dword [0x1006f97c], eax
mov byte [ebp - 4], 0
call fcn.10002e90
cmp dword [0x1006f97c], 0
je 0x100112a9
mov edx, str.ENGINE_created
mov ecx, 0x1006dda0
call fcn.10007a20
push eax
call fcn.10007f40
push 0
push 0
push 0x10010f60
call fcn.100384fb
push 0
push 0
push 0x10011310
call fcn.100384fb
add esp, 0x1c
mov eax, dword [ebp - 0x60]
lea ecx, [ebp - 0x60]
push eax
push dword [eax]
lea eax, [ebp - 0x64]
push eax
call fcn.10011440
push dword [ebp - 0x60]
call fcn.1002ccef
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002ccf4
mov esp, ebp
pop ebp
ret
Function at 0x100126d0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10054148
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x1006c070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x78]
push 9
push str.127.0.0.1
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x64], 0xf
mov dword [ebp - 0x68], 0
mov byte [ebp - 0x78], 0
call fcn.10003110
mov dword [ebp - 4], 0
lea eax, [ebp - 0x78]
cmp dword [ebp - 0x64], 0x10
cmovae eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10012774
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
test ecx, ecx
je 0x10012774
movzx eax, byte [ecx + 3]
push eax
movzx eax, byte [ecx + 2]
push eax
movzx eax, byte [ecx + 1]
push eax
movzx eax, byte [ecx]
push eax
lea eax, [ebp - 0x60]
push str._u._u._u._u
push eax
call fcn.10012660
add esp, 0x18
lea edx, [ebp - 0x60]
jmp 0x10012779
mov edx, 0x10063d68
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [edx], 0
jne 0x10012793
xor ecx, ecx
jmp 0x100127a1
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10012798
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.10003110
lea ecx, [ebp - 0x78]
call fcn.10002e90
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002ccf4
mov esp, ebp
pop ebp
ret 4

Function at 0x100149a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
jmp 0x100149bc
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp - 4]
push eax
push dword [ebp + 8]
lea ecx, [ebx + 0x100]
mov dword [ebx + 0x110], eax
push ecx
call fcn.1002fa80
add esp, 0xc
xor eax, eax
nop dword [eax]
mov byte [eax + ebx], al
inc eax
cmp eax, 0x100
jl 0x100149e0
xor edi, edi
mov dword [ebx + 0x114], 0
mov dword [ebx + 0x118], 0
xor esi, esi
mov dword [ebp + 0xc], edi
nop word [eax + eax]
mov dl, byte [esi + ebx]
movzx eax, byte [ebx + edi + 0x100]
add eax, dword [ebp + 0xc]
movzx ecx, dl
add ecx, eax
movzx ecx, cl
mov dword [ebp + 0xc], ecx
mov al, byte [ecx + ebx]
mov byte [esi + ebx], al
lea eax, [edi + 1]
mov byte [ecx + ebx], dl
inc esi
cdq
idiv dword [ebx + 0x110]
mov edi, edx
cmp esi, 0x100
jl 0x10014a10
jmp 0x10014a59
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1004329f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1004311e

Function at 0x1004953d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100491fd

Function at 0x67687d1d
Capabilities:
Compare security identifiers

Disassembly:
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 4]
jmp 0x67687d39
push dword [esi]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x67687d45
add esi, 4
cmp esi, dword [edi + 8]
jne 0x67687d26
xor al, al
pop edi
pop esi
ret 4
mov al, 1
jmp 0x67687d40

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x2c33700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.02c3378f
jae 0x2c3370e
xor ecx, ecx
call fcn.02c3378f
jae 0x2c3373d
xor eax, eax
call fcn.02c3378f
jae 0x2c3374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.02c3378f
adc al, al
jae 0x2c3372f
jne 0x2c33779
stosb byte es:[edi], al
jmp 0x2c33711
call fcn.02c3379b
sub ecx, ebx
jne 0x2c33756
call fcn.02c33799
jmp 0x2c33775
lodsb al, byte [esi]
shr eax, 1
je 0x2c33783
adc ecx, ecx
jmp 0x2c33772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.02c33799
cmp eax, 0x7d00
jae 0x2c33772
cmp ah, 5
jae 0x2c33773
cmp eax, 0x7f
ja 0x2c33774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2c33711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
xor eax, eax
push edi
mov dword [esp + 4], eax
mov ecx, 0x11
mov dword [esp + 8], eax
lea edi, [esp + 0x14]
mov dword [esp + 0xc], eax
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea ecx, [esp + 4]
mov dword [esp + 0x10], eax
push ecx
mov ecx, dword [esp + 0x60]
push edx
push eax
push eax
push 0x20
push eax
push eax
push eax
push ecx
push eax
mov dword [esp + 0x3c], 0x44
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x68], 1
mov word [esp + 0x6c], ax
mov word [esp + 0x6e], ax
mov dword [esp + 0x70], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
jne 0x4010a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [sym.imp.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
push str.CreateProcess_Error_:
push edx
call dword [sym.imp.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::operator___class_std::basic_ostream_char__struct_std::char_traits_char_____char_const__]
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call dword [sym.imp.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char____]
add esp, 4
call dword [sym.imp.MSVCRT.dll_getchar]
xor eax, eax
add esp, 0x54
ret
mov eax, dword [esp]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp]
lea ecx, [esp + 0x58]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp + 0x58]
add esp, 0x54
ret

Function at 0x4029f0
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x10000
call fcn.00405ff0
mov ecx, dword [esp + 0x10004]
lea eax, [esp + 0x10008]
push eax
push ecx
lea edx, [esp + 8]
push 0xffff
push edx
call dword [sym.imp.MSVCRT.dll__vsnprintf]
add esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x10000
ret

Function at 0x402a80
Capabilities:
Set registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push str.Software_sunsi_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x402aca
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 4]
push edx
push 1
push eax
mov eax, dword [esp + 0x18]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x402aca
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret
mov eax, 1
pop ecx
ret
Function at 0x402e70
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x10004
call fcn.00405ff0
mov eax, dword [esp + 0x10014]
mov edx, dword [esp + 0x10010]
push esi
push eax
mov eax, dword [esp + 0x10014]
lea ecx, [esp + 0xc]
push 0x10000
push ecx
push 0x409878
push edx
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, dword [esp + 0x1000c]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.00405f54
mov eax, esi
pop esi
add esp, 0x10004
ret
Function at 0x403f30
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x406a1f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 0
call sub.MFC42.DLL_CString::CString_1
mov ebp, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0
push 0
mov dword [esp + 0x24], 1
call ebp
mov esi, eax
push esi
call sub.MFC42.DLL_operatornew
add esp, 4
mov edi, eax
push esi
push edi
call ebp
test eax, eax
je 0x403f8f
push edi
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator_1
push edi
call sub.MFC42.DLL_operatordelete
mov esi, dword [esp + 0x28]
add esp, 4
lea eax, [esp + 0xc]
mov ecx, esi
push eax
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x10], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4043e0
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x406ab5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x198
push esi
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0xc]
mov dword [esp + 0x1a4], 1
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x40444f
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov esi, dword [esp + 0x1ac]
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 8], 1
jmp 0x40449a
mov edx, dword [esp + 0x1b0]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x404479
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator_1
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov esi, dword [esp + 0x1ac]
lea edx, [esp + 4]
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x1a4], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x19c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1a4
ret
Function at 0x406026
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x407790
push 0x406020
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x409984], 0xffffffff
or dword [0x409988], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x40997c]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x409978]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x409980], eax
call fcn.0040615d
cmp dword [0x409870], 0
jne 0x4060a9
push 0x40615a
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.00406148
push 0x409018
push 0x409014
call sub.MSVCRT.dll__initterm
mov eax, dword [0x409974]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x409970]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x409010
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.00405330
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
jmp fcn.00431219