joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44657c
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x18
mov dword [esp], 0x10
lea edx, [esp + 4]
lea eax, [esp]
push eax
push edx
push dword [ecx + 4]
call dword [sym.imp.WSOCK32.dll_getsockname]
mov eax, dword [esp + 8]
mov dword [esp + 0x14], eax
push dword [esp + 0x14]
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
test eax, eax
je 0x4465b2
add esp, 0x18
ret
mov eax, 0x4a3d40
add esp, 0x18
ret

Function at 0x4465bc
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push ebp
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x4465e3
push ebp
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x4465e5
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x4465e5
mov eax, dword [eax]
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4465ec
Capabilities:
Get socket status

Disassembly:
push edi
push ebx
sub esp, 0x10c
mov eax, ecx
mov ecx, dword [esp + 0x118]
xor ebx, ebx
mov edi, dword [eax + 4]
mov dword [esp], ebx
mov eax, 0x10624dd3
mov dword [esp + 4], edi
inc edi
inc dword [esp]
mul ecx
shr edx, 6
lea eax, [edx + edx]
add eax, eax
sub eax, edx
lea eax, [edx + eax*8]
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
add eax, eax
sub ecx, eax
mov dword [esp + 0x104], edx
lea eax, [ecx + ecx]
add eax, eax
sub eax, ecx
lea eax, [ecx + eax*8]
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
add eax, eax
mov dword [esp + 0x108], eax
lea edx, [esp]
lea eax, [esp + 0x104]
push eax
push ebx
push ebx
push edx
push edi
call dword [sym.imp.WSOCK32.dll_select]
test eax, eax
jle 0x446676
mov eax, 1
add esp, 0x10c
pop ebx
pop edi
ret 4
xor eax, eax
add esp, 0x10c
pop ebx
pop edi
ret 4

Function at 0x446768
Capabilities:
Send data
Send data on socket

Disassembly:
push edi
push esi
push ebp
push ebx
mov edi, ecx
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov eax, dword [edi + 0x2390]
lea edx, [ebp + eax]
cmp edx, 0x2000
jle 0x446814
lea edx, [eax + edi + 0x68]
neg eax
add eax, 0x2000
push eax
push esi
push edx
call fcn.0046e6c0
add esp, 0xc
lea ebx, [edi + 0x68]
push 0
push 0x2000
push ebx
push dword [edi + 4]
call dword [sym.imp.WSOCK32.dll_send]
mov edx, dword [edi + 0x2390]
sub esi, edx
add esi, 0x2000
mov eax, dword [esp + 0x18]
lea ebp, [eax + edx - 0x2000]
xor eax, eax
mov dword [edi + 0x2390], 0
cmp ebp, 0x2000
jbe 0x446817
push 0
push 0x2000
push esi
push dword [edi + 4]
call dword [sym.imp.WSOCK32.dll_send]
test eax, eax
je 0x446861
add esi, 0x2000
add ebp, 0xffffe000
cmp ebp, 0x2000
ja 0x4467e3
mov eax, dword [edi + 0x2390]
jmp 0x446817
lea ebx, [edi + 0x68]
lea eax, [eax + edi + 0x68]
push ebp
push esi
push eax
call fcn.0046e6c0
add esp, 0xc
add ebp, dword [edi + 0x2390]
mov dword [edi + 0x2390], ebp
push 0
push ebp
push ebx
push dword [edi + 4]
call dword [sym.imp.WSOCK32.dll_send]
test eax, eax
jne 0x44684c
xor eax, eax
pop ebx
pop ebp
pop esi
pop edi
ret 8
mov dword [edi + 0x2390], 0
mov eax, dword [esp + 0x18]
pop ebx
pop ebp
pop esi
pop edi
ret 8
xor eax, eax
pop ebx
pop ebp
pop esi
pop edi
ret 8
Function at 0x4468f0
Capabilities:
Send data
Send data on socket

Disassembly:
push edi
push esi
push ebp
push ebx
mov edi, ecx
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov edx, dword [edi + 0x2390]
lea eax, [ebp + edx]
mov ebx, ebp
cmp eax, 0x2000
jle 0x446998
lea eax, [edx + edi + 0x68]
neg edx
add edx, 0x2000
push edx
push esi
push eax
call fcn.0046e6c0
add esp, 0xc
lea eax, [edi + 0x68]
push 0
push 0x2000
push eax
push dword [edi + 4]
call dword [sym.imp.WSOCK32.dll_send]
mov eax, dword [edi + 0x2390]
sub esi, eax
add esi, 0x2000
lea ebx, [ebp + eax - 0x2000]
xor edx, edx
cmp ebx, 0x2000
mov dword [edi + 0x2390], 0
jbe 0x446998
push 0
push 0x2000
push esi
push dword [edi + 4]
call dword [sym.imp.WSOCK32.dll_send]
test eax, eax
je 0x4469b6
add esi, 0x2000
add ebx, 0xffffe000
cmp ebx, 0x2000
ja 0x446969
mov edx, dword [edi + 0x2390]
lea eax, [edx + edi + 0x68]
push ebx
push esi
push eax
call fcn.0046e6c0
add dword [edi + 0x2390], ebx
mov eax, ebp
add esp, 0xc
pop ebx
pop ebp
pop esi
pop edi
ret 8
xor eax, eax
pop ebx
pop ebp
pop esi
pop edi
ret 8

Function at 0x446c28
Capabilities:
Receive data
Receive data on socket

Disassembly:
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [ecx + 4]
call dword [sym.imp.WSOCK32.dll_recv]
ret 8

Function at 0x446df0
Capabilities:
Set socket configuration

Disassembly:
push edi
push esi
mov edi, ecx
movzx eax, word [0x49364c]
movzx eax, al
cmp eax, 2
jge 0x446e0a
xor eax, eax
pop ecx
pop edi
ret 4
mov eax, dword [esp + 0xc]
lea edx, [esp]
mov dword [esp], eax
push 4
push edx
push 0x1006
push 0xffff
push dword [edi + 4]
call dword [sym.imp.WSOCK32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x446e03
lea eax, [esp]
push 4
push eax
push 0x1005
push 0xffff
push dword [edi + 4]
call dword [sym.imp.WSOCK32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x446e03
mov eax, 0xffffffff
pop ecx
pop edi
ret 4
Function at 0x448794
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x473344
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
lea eax, [ecx + 4]
mov dword [ebp - 0x14], ecx
push eax
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 0x1c]
test edx, edx
je 0x4487ea
push 0x47e5f0
lea eax, [ebp - 0x34]
push eax
call fcn.0046538a
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x30]
push eax
push 4
push edx
push 0x448344
push dword [0x494b44]
push 0
call fcn.004653c4
add esp, 0x18
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x30]
mov dword [ecx + 0x44], eax
mov dword [ecx + 0x48], edx
test eax, eax
je 0x4488a1
mov eax, dword [ebp - 0x14]
push dword [eax + 0x20]
call fcn.00448e94
pop ecx
push eax
mov eax, dword [ebp - 0x14]
push dword [eax + 0x44]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x448851
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x47e590
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
call fcn.0046538a
mov eax, dword [ebp - 0x14]
push dword [eax + 0x44]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x448879
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x47e590
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
call fcn.0046538a
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x1c], 1
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x47e590
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0046538a
jmp 0x44881d
Function at 0x448ecc
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47342a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ecx
mov edx, dword [0x494b4c]
lea eax, [edx + 1]
mov dword [0x494b4c], eax
test edx, edx
je 0x448f18
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x494b40], eax
cmp eax, 0xffffffff
jne 0x448f3f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x47e590
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
push eax
call fcn.0046538a
mov dword [ebp - 0x44], 0
push 0x18
call fcn.004639c5
mov dword [ebp - 0x1c], eax
add esp, 4
mov dword [ebp - 0x40], eax
test eax, eax
je 0x4490ac
mov dword [ebp - 0x44], 1
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x1c]
mov dword [0x494b74], eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x3c], 0
push 0x60
call fcn.004639c5
mov dword [ebp - 0x14], eax
add esp, 4
mov dword [ebp - 0x38], eax
test eax, eax
je 0x4490a2
mov dword [ebp - 0x3c], 1
mov dword [ebp - 4], 1
mov ecx, eax
push 1
push 0
call fcn.004488c0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
push 2
lea esi, [edx + 0x44]
xor ecx, ecx
push ecx
push ecx
push esi
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x449024
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x47e590
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push eax
call fcn.0046538a
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [ebp - 0x14]
push edx
push dword [0x494b40]
mov dword [edx + 0x48], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x449058
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x47e590
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
call fcn.0046538a
push 1
call fcn.00448e94
pop ecx
push eax
mov eax, dword [ebp - 0x14]
push dword [eax + 0x44]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x449088
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x47e590
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0046538a
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x448fc8
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x448f7a
Function at 0x449b8c
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
sub esp, 0xc
mov ecx, dword [esp + 0x14]
movzx ebp, cx
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
shr ecx, 0x10
test edx, edx
je 0x449cd7
test eax, eax
jbe 0x449ccb
mov dword [esp + 8], ebx
mov dword [esp], esi
mov esi, eax
mov dword [esp + 4], edi
mov edi, edx
cmp esi, 0x15b0
jae 0x449bcd
mov ebx, esi
jmp 0x449bd2
mov ebx, 0x15b0
sub esi, ebx
cmp ebx, 0x10
jl 0x449c6b
movzx eax, byte [edi]
add eax, ebp
movzx ebp, byte [edi + 1]
add ecx, eax
add ebp, eax
movzx eax, byte [edi + 2]
add ecx, ebp
add eax, ebp
movzx ebp, byte [edi + 3]
add ecx, eax
add ebp, eax
movzx eax, byte [edi + 4]
add ecx, ebp
add eax, ebp
movzx ebp, byte [edi + 5]
add ecx, eax
add ebp, eax
movzx eax, byte [edi + 6]
add ecx, ebp
add eax, ebp
movzx ebp, byte [edi + 7]
add ecx, eax
add ebp, eax
movzx eax, byte [edi + 8]
add ecx, ebp
add eax, ebp
movzx ebp, byte [edi + 9]
add ecx, eax
add ebp, eax
movzx eax, byte [edi + 0xa]
add ecx, ebp
add eax, ebp
movzx ebp, byte [edi + 0xb]
add ecx, eax
add ebp, eax
movzx eax, byte [edi + 0xc]
add ecx, ebp
add eax, ebp
movzx ebp, byte [edi + 0xd]
add ecx, eax
add ebp, eax
movzx eax, byte [edi + 0xe]
add ecx, ebp
add eax, ebp
movzx ebp, byte [edi + 0xf]
add ecx, eax
add ebp, eax
add ecx, ebp
add edi, 0x10
add ebx, 0xfffffff0
cmp ebx, 0x10
jge 0x449bdd
test ebx, ebx
je 0x449c7e
movzx eax, byte [edi]
add ebp, eax
add ecx, ebp
add edi, 1
add ebx, 0xffffffff
jne 0x449c6f
mov eax, 0x80078071
mul ebp
mov eax, 0x80078071
shr edx, 0xf
mov ebx, edx
shl ebx, 0xc
sub ebx, edx
add ebx, ebx
add ebx, ebx
add ebx, ebx
add ebx, ebx
add edx, ebx
sub ebp, edx
mul ecx
shr edx, 0xf
mov ebx, edx
shl ebx, 0xc
sub ebx, edx
add ebx, ebx
add ebx, ebx
add ebx, ebx
add ebx, ebx
add edx, ebx
sub ecx, edx
test esi, esi
jne 0x449bc1
mov ebx, dword [esp + 8]
mov esi, dword [esp]
mov edi, dword [esp + 4]
shl ecx, 0x10
or ecx, ebp
mov eax, ecx
add esp, 0xc
pop ebp
ret
mov eax, 1
add esp, 0xc
pop ebp
ret
Function at 0x46a781
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x480fe0
cmp edx, dword [eax]
je 0x46a7a3
add eax, 8
inc ecx
cmp eax, 0x481070
jl 0x46a794
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x480fe0]
jne 0x46a8d1
mov eax, dword [0x494be8]
cmp eax, 1
je 0x46a8ab
test eax, eax
jne 0x46a7d4
cmp dword [0x47e948], 1
je 0x46a8ab
cmp edx, 0xfc
je 0x46a8d1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x46a80b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0046ba80
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004691b0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x46a84e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004691b0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x47b2a4
push edi
call fcn.00463d50
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0046ba80
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0046ba90
lea eax, [ebp - 0xa0]
push 0x47b284
push eax
call fcn.0046ba90
push dword [esi + 0x480fe4]
lea eax, [ebp - 0xa0]
push eax
call fcn.0046ba90
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0046cb9d
add esp, 0x2c
pop edi
jmp 0x46a8d1
lea eax, [ebp + 8]
lea esi, [esi + 0x480fe4]
push 0
push eax
push dword [esi]
call fcn.004691b0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40600a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x7a125c], esi
push edi
jne 0x406044
mov ecx, 0x7a1258
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x406020
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x7a1658
jl 0x40601b
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x406079
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x7a1258]
xor eax, esi
inc ecx
dec edx
jne 0x40605c
pop edi
pop esi
not eax
ret 0xc

Function at 0x595efd
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x59106f59
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x3dc3642c
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x10010be0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10090540
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x30]
push ebp
push esi
push edi
mov ecx, dword [eax]
push ecx
lea ecx, [esp + 0x10]
call fcn.10085746
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
xor ebp, ebp
call fcn.100133f0
mov ecx, dword [esp + 0x40]
mov byte [esp + 0x2c], 1
cmp ecx, 3
ja case.default.0x10010c34
jmp dword [ecx*4 + 0x10010d9c]
mov al, byte [esi]
test al, al
je 0x10010c62
cmp al, 0x20
je 0x10010c4e
cmp al, 0xa1
jne 0x10010c62
cmp byte [esi + 1], al
jne 0x10010c62
test al, 0x80
je 0x10010c5a
mov al, byte [esi + 1]
inc esi
test al, al
je 0x10010c62
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x10010c41
test ecx, ecx
je case.default.0x10010c34
mov dl, byte [esi]
xor ecx, ecx
test dl, dl
mov eax, esi
je case.default.0x10010c34
mov edi, dword [esp + 0x3c]
mov dl, byte [eax]
test dl, 0x80
je 0x10010ca8
cmp dl, 0xa1
jne 0x10010c9c
cmp byte [eax + 1], 0xa1
jne 0x10010c9c
test ecx, ecx
jne 0x10010c94
mov edi, eax
mov ecx, 1
inc eax
jmp 0x10010cbc
mov dl, byte [eax + 1]
inc eax
xor ecx, ecx
test dl, dl
je 0x10010cd6
jmp 0x10010cbc
cmp dl, 0x20
jne 0x10010cba
test ecx, ecx
jne 0x10010cb3
mov edi, eax
mov ecx, 1
jmp 0x10010cbc
xor ecx, ecx
mov dl, byte [eax + 1]
inc eax
test dl, dl
jne 0x10010c7c
cmp ecx, 1
jne case.default.0x10010c34
mov dl, byte [edi]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x10010c34
mov dl, byte [eax - 1]
lea edi, [eax - 1]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x10010c34
mov al, byte [esi]
test al, al
je 0x10010d2e
test al, 0x80
mov byte [esp + 0x3c], al
je 0x10010d14
mov cl, byte [esi + 1]
test cl, cl
je 0x10010d2e
cmp al, 0xa1
jne 0x10010d04
cmp cl, al
je 0x10010d11
mov ax, word [esi]
lea ecx, [esp + 0x10]
push eax
call fcn.100136c0
inc esi
jmp 0x10010d26
cmp al, 0x20
je 0x10010d26
mov ecx, dword [esp + 0x3c]
push ecx
lea ecx, [esp + 0x14]
call fcn.10013700
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x10010ced
push 0
lea ecx, [esp + 0x14]
call fcn.10013700
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10029210
mov edx, dword [esp + 0x38]
add esp, 4
test ebp, ebp
mov dword [edx], eax
je 0x10010d61
mov al, byte [esp + 0x3c]
mov byte [ebp], al
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
mov dword [esp + 0x10], 0x1009d4c8
call fcn.100135f0
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.100856d8
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x100118b0
Capabilities:
Access peb ldr_data
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x10090578
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x100bc6f4]
push ebx
push esi
push edi
mov dword [esp + 0xc], eax
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
lea ecx, [esp + 0x2c]
push esi
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
push edi
mov dword [esp + 0x30], 0
call fcn.10011750
add esp, 0x14
dec esi
neg esi
sbb esi, esi
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x24]
add esi, 3
lea edx, [esp + 0x30]
lea ecx, [esi + esi*2]
push edx
push 0x20006
push 0
lea esi, [edi + ecx*4]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov dword [ebx], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10011952
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x30]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x10011a0b
mov edx, dword [esi + 8]
push edx
call fcn.10027f90
add esp, 4
test eax, eax
mov eax, dword [esi + 8]
je 0x100119a2
cmp eax, 0x80000301
jne 0x10011970
mov eax, dword [esi]
jmp 0x1001197d
push 0
push esi
push 0x7d1
call fcn.1002d4c0
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x24]
push 4
push ecx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x10011a00
jmp 0x100119fa
cmp eax, reloc.ODBC32.dll_SQLBindCol
jne 0x100119d1
mov esi, dword [esi]
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x30]
not ecx
push ecx
mov ecx, dword [esp + 0x30]
push esi
push 1
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x10011a00
jmp 0x100119fa
cmp eax, reloc.WS2_32.dll_getpeername
jne 0x10011a00
mov esi, dword [esi]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov eax, dword [esi + 4]
add esi, 8
push eax
push esi
push 3
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x10011a00
mov dword [ebx], 1
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.100856d8
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x1001d100
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1009103d
push eax
mov dword fs:[0], esp
sub esp, 0x13c
push ebx
push ebp
mov ebx, ecx
push esi
push edi
xor edi, edi
cmp dword [ebx + 0x78], edi
jne 0x1001d16e
push 8
call fcn.10085419
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, edi
mov dword [esp + 0x154], edi
je 0x1001d14a
mov ecx, eax
call fcn.10084011
jmp 0x1001d14c
xor eax, eax
push 0xff00ff
push edi
push 0x10
push 0x407
mov ecx, eax
mov dword [esp + 0x164], 0xffffffff
mov dword [ebx + 0x78], eax
call fcn.100840d6
mov eax, dword [ebx + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0xffff0000
push edi
push 0x1101
push eax
mov dword [esp + 0x20], edi
call ebp
mov eax, dword [ebx + 0x40]
lea esi, [ebx + 0x40]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x1001d1bc
lea ecx, [esp + 0x48]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x1001d2ce
lea edx, [esp + 0x48]
mov ecx, esi
push edx
call fcn.10085815
jmp 0x1001d1e3
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x48]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x10]
mov eax, dword [ebx + 0x78]
test eax, eax
je 0x1001d1ed
mov eax, dword [eax + 4]
mov ecx, dword [ebx + 0x1c]
push eax
push 0
push 0x1109
push ecx
call ebp
push eax
call fcn.100840a3
lea edx, [esp + 0x48]
push 0x100b2234
push edx
mov esi, 0xffff0000
call fcn.10076577
add esp, 8
test eax, eax
je 0x1001d270
mov ecx, dword [ebx + 0x1c]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], esi
push eax
push 0
push 0x1100
push ecx
mov dword [esp + 0x28], 0xffff0002
mov dword [esp + 0x44], 2
mov dword [esp + 0x48], 3
mov dword [esp + 0x2c], 0x23
call ebp
push 0x100b2234
push 0
mov esi, eax
inc edi
call fcn.10076577
add esp, 8
test eax, eax
jne 0x1001d21c
mov dword [esp + 0x10], edi
mov edx, dword [ebx + 0x1c]
xor edi, edi
push edi
push edi
push 0x110a
push edx
call ebp
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x1001d2b8
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x1c]
push esi
push 2
push 0x1102
push eax
mov edi, esi
call ebp
mov ecx, dword [ebx + 0x1c]
push esi
push 4
push 0x110a
push ecx
call ebp
mov esi, eax
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
jne 0x1001d28d
mov edx, dword [ebx + 0x1c]
push edi
push 9
push 0x110b
push edx
call ebp
push edi
mov ecx, ebx
call fcn.1001d2f0
mov ecx, dword [esp + 0x14c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x148
ret