joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bbc8d
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x10], 0
jne 0x4bbcc9
push 1
push 0x14
call fcn.004bd45c
add esp, 8
mov dword [ebp - 4], eax
push 0x14
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.0048e2b0
add esp, 0xc
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x4bbccf
mov edx, dword [ebp + 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x30]
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x4bbd09
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call fcn.004bd432
add esp, 4
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
shl edx, 1
push edx
mov eax, dword [ebp - 4]
add eax, 0x10
push eax
push 0
push 0
push 1
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x4bbd49
push 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
add eax, 0x10
push eax
call fcn.004bd45c
add esp, 8
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4bbea2
Capabilities:
Encrypt data using rc4 via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
je 0x4bbebb
cmp dword [ebp + 0xc], 0
jne 0x4bbebf
xor eax, eax
jmp 0x4bbf2c
call fcn.004bbf30
test eax, eax
jne 0x4bbecd
or eax, 0xffffffff
jmp 0x4bbf2c
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x8004
mov ecx, dword [0x53f3b4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4bbf29
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x4bbf1f
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
push 0x6801
mov ecx, dword [0x53f3b4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4bbf30
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x53f3b4], 0
je 0x4bbf43
mov eax, 1
jmp 0x4bbf80
push 0
push 1
push 0x5379c4
push 0
push 0x53f3b4
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x4bbf7b
push 8
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0
push 0x53f3b4
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x4bbf7b
xor eax, eax
jmp 0x4bbf80
mov eax, 1
pop ebp
ret
Function at 0x4cda4d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.004cdaf5
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
cmp dword [ebp - 0xc], 0
je 0x4cdab2
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4cdaa4
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp edx, 3
jge 0x4cdaa4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
test ecx, ecx
jne 0x4cda6f
mov edx, dword [ebp - 0xc]
push edx
call fcn.004bd432
add esp, 4
jmp 0x4cdae7
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4cdae7
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp ecx, 3
jge 0x4cdae7
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
test eax, eax
jne 0x4cdab2
mov eax, dword [ebp - 4]
neg eax
sbb eax, eax
and eax, 0xa
mov esp, ebp
pop ebp
ret

Function at 0x4cdbc9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call fcn.004cdaf5
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4cdc0e
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
push eax
call fcn.004bd432
add esp, 4
jmp 0x4cdc23
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4cdee2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3b0
cmp dword [0x53f3e4], 0
je 0x4cdf14
push 0x118
mov eax, dword [0x53f3e4]
push eax
lea ecx, [ebp - 0x13c]
push ecx
call fcn.00485580
add esp, 0xc
mov byte [ebp - 0x24], 0
jmp 0x4cdf8f
call fcn.004cdb7d
test eax, eax
je 0x4cdf7d
lea edx, [ebp - 0x3ac]
push edx
push 0x118
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x3ac]
push eax
call fcn.004ce086
add esp, 4
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 0
je 0x4cdf7b
push 0x118
mov ecx, dword [ebp - 0x3b0]
push ecx
lea edx, [ebp - 0x13c]
push edx
call fcn.00485580
add esp, 0xc
mov byte [ebp - 0x24], 0
mov eax, dword [ebp - 0x3b0]
push eax
call fcn.004bd432
add esp, 4
jmp 0x4cdf8f
lea ecx, [ebp - 0x13c]
push ecx
push 0x118
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [ebp - 0x13c]
push edx
call fcn.00487820
add esp, 4
mov dword [ebp - 4], eax
jmp 0x4cdfac
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x4cdfc4
mov ecx, dword [ebp - 4]
movsx edx, byte [ebp + ecx - 0x13d]
cmp edx, 0x5c
jne 0x4cdfc4
jmp 0x4cdfa3
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x13c], 0
lea ecx, [ebp - 0x13c]
push ecx
push str._s_sqlite_
mov edx, dword [ebp + 8]
push edx
call fcn.0047ed20
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.00487820
add esp, 4
mov dword [ebp - 0x140], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x140]
push ecx
push 0xf
call fcn.004dae10
add esp, 8
mov dword [ebp - 4], 0
jmp 0x4ce02e
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x140]
add eax, 1
mov dword [ebp - 0x140], eax
cmp dword [ebp - 4], 0xf
jge 0x4ce05d
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x140]
xor eax, eax
mov al, byte [ecx]
xor edx, edx
mov ecx, 0x3e
div ecx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x140]
mov cl, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [eax], cl
jmp 0x4ce016
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x140]
mov byte [edx], 0
mov eax, dword [ebp + 8]
push eax
call fcn.004cdbc9
add esp, 4
test eax, eax
jne 0x4ce07b
jmp 0x4ce080
jmp 0x4cdfcf
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4ce33c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
jne 0x4ce34c
xor eax, eax
jmp 0x4ce3c7
call fcn.004cdb7d
test eax, eax
jne 0x4ce36c
mov eax, dword [ebp + 8]
push eax
call fcn.00487820
add esp, 4
cmp eax, 0x104
jbe 0x4ce36c
xor eax, eax
jmp 0x4ce3c7
mov ecx, dword [ebp + 8]
push ecx
call fcn.004cdaf5
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4ce39c
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call fcn.004bd432
add esp, 4
jmp 0x4ce3a9
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4ce3b3
xor eax, eax
jmp 0x4ce3c7
mov edx, dword [ebp - 8]
and edx, 0x10
cmp edx, 0x10
je 0x4ce3c2
xor eax, eax
jmp 0x4ce3c7
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4ce9c4
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x53f3ec], 0
jne 0x4cea0e
call fcn.004ce93c
cmp dword [0x53f3ec], 0
jne 0x4cea09
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x53f3d8], eax
cmp dword [0x53f3d8], 0xffffffff
jne 0x4ce9ff
call fcn.004ce94e
xor eax, eax
jmp 0x4ceab3
mov dword [0x53f3ec], 1
call fcn.004ce94e
mov eax, dword [0x53f3d8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jle 0x4cea6b
cmp dword [ebp - 4], 0
jne 0x4cea69
push 0xc
call fcn.004cda00
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4cea69
mov ecx, dword [ebp - 4]
mov edx, dword [0x510530]
mov dword [ecx], edx
mov eax, dword [0x510534]
mov dword [ecx + 4], eax
mov edx, dword [0x510538]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [0x53f3d8]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x4ceab0
cmp dword [ebp - 4], 0
je 0x4ceab0
cmp dword [ebp + 8], 0
jge 0x4ceab0
push 0xc
push 0x510530
mov edx, dword [ebp - 4]
push edx
call fcn.004a2520
add esp, 0xc
test eax, eax
jne 0x4ceab0
mov eax, dword [ebp - 4]
push eax
call fcn.004cda35
add esp, 4
push 0
mov ecx, dword [0x53f3d8]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4dba95
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0xc], 2
jge 0x4dbaab
mov eax, 0x17
jmp 0x4dbb5d
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax]
xor edx, edx
mov dl, byte [ecx + 0x5103b8]
mov eax, edx
shl eax, 2
mov ecx, dword [ebp + 8]
add ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx - 1]
xor ecx, ecx
mov cl, byte [edx + 0x5103b8]
imul ecx, ecx, 3
xor eax, ecx
xor eax, dword [ebp + 0xc]
cdq
mov ecx, 0x7f
idiv ecx
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
xor eax, eax
mov al, byte [edx + str.Pk_]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x4dbb09
mov ecx, dword [ebp - 8]
xor edx, edx
mov dl, byte [ecx + 0x510aec]
sub edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
jl 0x4dbb58
mov eax, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [eax + 0x510b60]
cmp ecx, dword [ebp + 0xc]
jne 0x4dbb56
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
xor edx, edx
mov dx, word [ecx*2 + 0x510bd4]
add edx, str.ABORTABLEFTEMPORARYADDATABASELECTHENDEFAULTRANSACTIONATURALTERAISEACHECKEYAFTEREFERENCESCAPELSEXCEPTRIGGEREGEXPLAINITIALLYANALYZEXCLUSIVEXISTSTATEMENTANDEFERRABLEATTACHAVINGLOBEFOREIGNOREINDEXAUTOINCREMENTBEGINNERENAMEBETWEENOTNULLIKEBYCASCADEFERREDELETECASECASTCOLLATECOLUMNCOMMITCONFLICTCONSTRAINTERSECTCREATECROSSCURRENT_DATECURRENT_TIMESTAMPLANDESCDETACHDISTINCTDROPRAGMATCHFAILIMITFROMFULLGROUPDATEIFIMMEDIATEINSERTINSTEADINTOFFSETISNULLJOINORDEREPLACEOUTERESTRICTPRIMARYQUERYRIGHTROLLBACKROWHENUNIONUNIQUEUSINGVACUUMVALUESVIEWHERE
push edx
call fcn.004bd904
add esp, 0xc
test eax, eax
jne 0x4dbb56
mov eax, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [eax + 0x510cbc]
mov eax, ecx
jmp 0x4dbb5d
jmp 0x4dbaf8
mov eax, 0x17
mov esp, ebp
pop ebp
ret
Function at 0x4e2bf0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
jne 0x4e2c01
xor eax, eax
jmp 0x4e2d55
push 1
push 0x44
call fcn.004bd370
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4e2c1d
xor eax, eax
jmp 0x4e2d55
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 5]
mov byte [eax + 5], dl
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.004e2844
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
call fcn.004e297c
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
push ecx
call fcn.004e26d0
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
push ecx
call fcn.004e2844
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
push ecx
call fcn.004e26d0
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
push ecx
call fcn.004e2844
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 4]
mov byte [eax + 4], dl
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
push ecx
call fcn.004e2bf0
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
push ecx
call fcn.004e26d0
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
push ecx
call fcn.004e26d0
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x30], 0xffffffff
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x34], 0xffffffff
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov cl, byte [eax + 6]
mov byte [edx + 6], cl
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov cl, byte [eax + 7]
mov byte [edx + 7], cl
mov edx, dword [ebp - 4]
mov byte [edx + 8], 0
mov eax, dword [ebp - 4]
mov byte [eax + 9], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x24], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], 0xffffffff
mov eax, dword [ebp - 4]
mov dword [eax + 0x3c], 0xffffffff
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x40], 0xffffffff
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0xd6c058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xd6c1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd6c07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd6c06a
add dl, dl
jne 0xd6c089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd6c0dc
xor eax, eax
add dl, dl
jne 0xd6c096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd6c17d
add dl, dl
jne 0xd6c0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd6c0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd6c0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd6c0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd6c0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd6c075
mov eax, 1
add dl, dl
jne 0xd6c0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd6c0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd6c0e1
sub eax, ebx
mov ebx, 1
jne 0xd6c128
mov ecx, 1
add dl, dl
jne 0xd6c10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd6c119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd6c105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd6c075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd6c13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd6c14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd6c136
cmp eax, 0x7d00
jae 0xd6c16d
cmp eax, 0x500
jb 0xd6c168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd6c075
cmp eax, 0x7f
ja 0xd6c170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd6c075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd6c19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd6c075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401321
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
lea ebp, [esp - 0xfb8]
mov eax, 0x1038
call fcn.004105e0
mov eax, dword [0x43cddc]
xor eax, ebp
mov dword [ebp + 0xfb4], eax
push edi
mov edi, dword [ebp + 0xfc0]
lea eax, [ebp - 0x7c]
push eax
call fcn.00429947
pop ecx
mov dword [ebp - 0x78], eax
cmp eax, 0xffffffff
jne 0x401366
push 5
call fcn.00409a61
pop ecx
jmp 0x401452
push esi
call fcn.004082d1
push eax
push 0x5c
call fcn.00408c45
push eax
push 0x4360e8
mov esi, 0x400
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.00408299
push dword [ebp - 0x7c]
lea eax, [ebp + 0x7ac]
push 0x4360f8
push esi
push eax
call fcn.00408299
and dword [ebp - 0x64], 0
lea eax, [ebp + 0x7ac]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
mov dword [ebp - 0x74], str.JavaWSSplashScreen
mov dword [ebp - 0x70], 0x436128
mov dword [ebp - 0x68], edi
call fcn.00429947
add esp, 0x34
test eax, eax
jne 0x401449
mov word [ebp - 0x64], ax
lea edi, [ebp - 0x62]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x80], 0x10
call dword [sym.imp.WSOCK32.dll_accept]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401401
push 6
jmp 0x40144b
push 0
push 6
lea eax, [ebp + 0xfac]
push eax
push esi
call dword [sym.imp.WSOCK32.dll_recv]
cmp eax, 6
je 0x40141c
push 7
jmp 0x40144b
lea eax, [ebp + 0xfac]
push eax
call fcn.00429947
pop ecx
mov dword [0x4360e0], eax
test eax, eax
jg 0x401436
push 8
jmp 0x40144b
push esi
call fcn.00408098
push dword [ebp - 0x78]
call fcn.00408098
pop ecx
xor eax, eax
jmp 0x401450
push 0
call fcn.00409a61
pop ecx
pop esi
mov ecx, dword [ebp + 0xfb4]
xor ecx, ebp
pop edi
call fcn.0040ffe6
add ebp, 0xfb8
leave
ret
Function at 0x406f15
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1198]
mov eax, 0x1218
call fcn.004105e0
mov eax, dword [0x43cddc]
xor eax, ebp
mov dword [ebp + 0x1194], eax
push edi
push 0x437f38
push 0x437f68
push 0xffffffffffffffff
lea eax, [ebp - 0x74]
push 0x1000
push eax
call fcn.00429947
add esp, 0x18
lea eax, [ebp - 0x78]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x74]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x406f77
xor eax, eax
jmp 0x406ffb
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0xf8c]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push str.Path
push dword [ebp - 0x78]
mov dword [ebp - 0x80], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x78]
test eax, eax
je 0x406fac
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x406f70
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x7c], 1
jne 0x406f70
mov eax, dword [esi + 4]
test eax, eax
je 0x406fc6
push eax
call fcn.00429947
pop ecx
push edi
call fcn.00429947
lea ecx, [esi + 8]
push ecx
push eax
mov dword [esi + 4], eax
call fcn.00406c53
mov eax, dword [esi]
add esp, 0xc
test eax, eax
je 0x406fe9
push eax
call fcn.00429947
pop ecx
lea eax, [ebp + 0xf8c]
push eax
call fcn.00429947
mov dword [esi], eax
xor eax, eax
pop ecx
inc eax
mov ecx, dword [ebp + 0x1194]
xor ecx, ebp
call fcn.0040ffe6
add ebp, 0x1198
leave
ret
Function at 0x407010
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x1c8]
sub esp, 0x248
mov eax, dword [0x43cddc]
xor eax, ebp
mov dword [ebp + 0x1c4], eax
mov eax, dword [ebp + 0x1d0]
push ebx
push esi
xor ebx, ebx
push str.FORCED_FX_ROOT
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x6c]
push ebx
push eax
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x74], 0x1fe
xor esi, esi
mov dword [ebp - 0x6c], ebx
call fcn.004107d9
add esp, 0xc
cmp dword [ebp - 0x6c], ebx
je 0x40709e
cmp eax, ebx
jne 0x40709e
push 0x34
push 1
call fcn.00429947
push str.2.0
mov esi, eax
call fcn.00429947
lea ecx, [esi + 8]
push ecx
push eax
mov dword [esi + 4], eax
call fcn.00406c53
push dword [ebp - 0x6c]
call fcn.00429947
mov dword [esi], eax
push dword [ebp - 0x6c]
call fcn.00429947
add esp, 0x1c
jmp 0x407159
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push ebx
push str.SoftwareOracleJavaFX
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4070c3
xor eax, eax
jmp 0x40715b
push edi
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x70]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x80], eax
cmp eax, ebx
jne 0x40713c
cmp dword [ebp - 0x78], ebx
je 0x4070f8
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x78]
call fcn.00406eb4
pop ecx
pop ecx
jmp 0x4070fb
xor eax, eax
inc eax
cmp eax, ebx
je 0x40713c
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00406c53
pop ecx
pop ecx
cmp esi, ebx
je 0x407127
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.00406cf7
pop ecx
pop ecx
test eax, eax
je 0x40713c
jmp 0x407134
push 0x34
push 1
call fcn.00429947
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0x3c]
call fcn.00406f15
inc dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x1fe
cmp dword [ebp - 0x80], ebx
je 0x4070c4
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
mov ecx, dword [ebp + 0x1c4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ffe6
add ebp, 0x1c8
leave
ret

Function at 0x4074b6
Capabilities:
Send data
Send data on socket

Disassembly:
cmp dword [esp + 8], 0
jne 0x4074c0
xor eax, eax
ret
mov eax, dword [esp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4074c7
sub eax, edx
sar eax, 1
push esi
lea esi, [eax + eax + 6]
lea eax, [esi + esi]
push edi
push eax
call fcn.00429947
mov edi, eax
pop ecx
test edi, edi
je 0x407536
push dword [esp + 0x10]
push str._s_r_n
push esi
push edi
call fcn.00408299
mov eax, edi
add esp, 0x10
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x407504
sub eax, ecx
sar eax, 1
push 0
add eax, eax
push eax
push edi
push dword [esp + 0x18]
call dword [sym.imp.WSOCK32.dll_send]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
push edi
mov esi, ecx
call fcn.00429947
pop ecx
mov eax, esi
pop edi
pop esi
ret
Function at 0x407539
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
push edi
mov edi, 0x44a698
xor ebx, ebx
mov esi, edi
push 0
push 2
push esi
push dword [esp + 0x1c]
call dword [sym.imp.WSOCK32.dll_recv]
cmp eax, 0xffffffff
je 0x407580
test eax, eax
je 0x407584
movzx eax, word [esi]
cmp eax, 0xa
je 0x407584
cmp eax, 0xd
je 0x40756e
inc ebx
add esi, 2
cmp esi, 0x44ae96
jl 0x407545
xor eax, eax
mov word [0x44ae96], ax
jmp 0x40758e
xor eax, eax
jmp 0x407590
xor eax, eax
mov word [ebx*2 + 0x44a698], ax
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x407ff9
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x43cddc]
xor eax, esp
mov dword [esp + 0x190], eax
cmp dword [0x451730], 0
jne 0x408083
push esi
push edi
xor edi, edi
push str.ws2_32.dll
inc edi
call fcn.00429947
mov esi, eax
pop ecx
test esi, esi
jne 0x40804d
push str.wsock32.dll
call fcn.00429947
mov esi, eax
xor edi, edi
pop ecx
test esi, esi
jne 0x40804d
push 0xd
call fcn.00409a61
pop ecx
push eax
call fcn.00407f5a
lea eax, [esp + 8]
push eax
push 2
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x408062
push 0xe
jmp 0x408041
test edi, edi
je 0x408077
push str.WSASendDisconnect
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x45172c], eax
pop edi
mov dword [0x451730], 1
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0040ffe6
add esp, 0x194
ret