joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010530
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x11c]
lea eax, [esp + 0x18]
mov ebx, edi
xor esi, esi
xor ecx, ecx
sub ebx, eax
mov eax, ecx
lea ebp, [esp + ecx + 0x18]
cdq
idiv dword [esp + 0x124]
mov eax, dword [esp + 0x120]
mov byte [ebx + ebp], cl
inc ecx
cmp ecx, 0x100
mov dl, byte [edx + eax]
mov byte [ebp], dl
jl 0x10010562
lea ebp, [esp + 0x18]
mov eax, edi
sub ebp, edi
mov dword [esp + 0x10], 0x100
mov cl, byte [eax]
xor edx, edx
mov dl, byte [eax + ebp]
mov byte [esp + 0x14], cl
mov ebx, dword [esp + 0x14]
add esi, edx
and ebx, 0xff
add esi, ebx
and esi, 0x800000ff
jns 0x100105c2
dec esi
or esi, 0xffffff00
inc esi
mov dl, byte [esi + edi]
mov byte [eax], dl
mov byte [esi + edi], cl
mov ecx, dword [esp + 0x10]
inc eax
dec ecx
mov dword [esp + 0x10], ecx
jne 0x10010599
xor al, al
mov byte [edi + 0x100], al
mov byte [edi + 0x101], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret

Function at 0x10010670
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x14]
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
xor esi, esi
mov byte [esp + 0x18], cl
test edi, edi
mov byte [esp + 8], dl
jle 0x1001070c
mov edx, dword [esp + 0x10]
push ebx
push ebp
mov cl, byte [esp + 0x20]
mov bl, byte [esp + 0x10]
inc cl
mov byte [esp + 0x20], cl
mov ecx, dword [esp + 0x20]
and ecx, 0xff
lea edi, [ecx + eax]
mov cl, byte [ecx + eax]
add bl, cl
mov byte [esp + 0x10], bl
mov ebx, dword [esp + 0x10]
and ebx, 0xff
lea ebp, [ebx + eax]
mov bl, byte [ebx + eax]
mov byte [edi], bl
mov byte [ebp], cl
mov bl, byte [edi]
add bl, cl
and ebx, 0xff
mov cl, byte [ebx + eax]
mov bl, byte [esi + edx]
xor bl, cl
mov ecx, dword [esp + 0x1c]
mov byte [esi + edx], bl
inc esi
cmp esi, ecx
jl 0x1001069b
mov dl, byte [esp + 0x20]
mov cl, byte [esp + 0x10]
pop ebp
pop ebx
pop edi
mov byte [eax + 0x100], dl
mov byte [eax + 0x101], cl
pop esi
pop ecx
ret
pop edi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop esi
pop ecx
ret
Function at 0x10048c10
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x10048d1c
test eax, eax
je 0x10048d1c
push esi
push edi
mov ecx, 0x10
mov esi, 0x10063fe8
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x10048d03
lea edi, [eax + 4]
jmp 0x10048c67
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x10048c7c
mov dword [ebp - 4], 2
jmp 0x10048c9d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x10048c93
mov dword [ebp - 4], 1
jmp 0x10048c9d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x10048d13
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x10048cd6
mov byte [ecx], 0x3d
jmp 0x10048ce2
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x10048ced
mov byte [ecx], 0x3d
jmp 0x10048cf3
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x10048c64
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x102947cd
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol edx, 2
jmp 0x100ab18c
sub edx, 0x548537e9
not edx
ror edx, 1
stc
cmp esp, edx
xor ebx, edx
add esi, edx
jmp 0x1014e91d
push esi
ret
sub edx, 0x581844a9
clc
jmp 0x1004a9be
push edx
seta dl
movsx dx, ah
push ebp
cdq
movzx edx, di
pushfd
jmp 0x102ced24
push ecx
bts dx, di
push eax
cwd
rol cx, 0xd6
push esi
bt esi, 0xa7
push ebx
cbw
push edi
mov bh, 0x34
stc
mov ecx, 0
stc
bswap di
push ecx
mov ebp, dword [esp + 0x28]
movsx ebx, dx
rol ebp, 1
cmc
bswap ebp
ror ebp, 3
adc edx, ebp
movsx ebx, di
lahf
neg ebp
rdtsc
setb dl
inc ebp
add ebp, ecx
sar eax, cl
mov edi, esp
inc bh
bsf edx, eax
rdtsc
sub esp, 0xc0
bt ebx, 0x6c
mov ebx, ebp
mov eax, 0
movsx dx, dl
sub ebx, eax
movzx esi, di
lea esi, [0x102ced8b]
xor dl, ch
lea ebp, [ebp - 4]
xor dh, 0xe6
sub edx, ebp
mov edx, dword [ebp]
xor edx, ebx
jmp 0x10242009
Function at 0x10354608
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ecx
bts dx, di
push eax
cwd
rol cx, 0xd6
push esi
bt esi, 0xa7
push ebx
cbw
push edi
mov bh, 0x34
stc
mov ecx, 0
stc
bswap di
push ecx
mov ebp, dword [esp + 0x28]
movsx ebx, dx
rol ebp, 1
cmc
bswap ebp
ror ebp, 3
adc edx, ebp
movsx ebx, di
lahf
neg ebp
rdtsc
setb dl
inc ebp
add ebp, ecx
sar eax, cl
mov edi, esp
inc bh
bsf edx, eax
rdtsc
sub esp, 0xc0
bt ebx, 0x6c
mov ebx, ebp
mov eax, 0
movsx dx, dl
sub ebx, eax
movzx esi, di
lea esi, [0x1034b0c3]
xor dl, ch
lea ebp, [ebp - 4]
xor dh, 0xe6
sub edx, ebp
mov edx, dword [ebp]
xor edx, ebx
jmp 0x10494f1a
push edx
seta dl
movsx dx, ah
push ebp
cdq
movzx edx, di
pushfd
jmp 0x1034b05c
push esi
ret
rol edx, 2
jmp 0x1044d811
sub edx, 0x548537e9
not edx
ror edx, 1
stc
cmp esp, edx
xor ebx, edx
add esi, edx
jmp 0x103b4728
sub edx, 0x581844a9
clc
jmp 0x103c3ace
Function at 0x41d8b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x41d8c3
pop dword [ebp - 0x3c]
mov eax, 0xbce6dfcd
sub eax, 0xbca5070a
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x3a2d3
push 0
mov eax, 0x5f0b40c9
add eax, 0xa1371057
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x3f2e
mov esi, eax
mov edi, 0xa4ca016f
sub edi, 0xa486d36f
add edi, dword [ebp - 0x3c]
mov edx, 0x1baed3dc
add dword [ebp - 0x10], 0x1e31bb44
mov ebx, dword [edi]
mov dword [ebp - 0x18], 0x2376f859
sub ebx, edx
sub dword [ebp - 0x1c], 0x79caedc1
mov dword [esi], ebx
xor dword [ebp - 8], 0x8929becd
add esi, 0x461f614d
add esi, 0xb9e09eb7
add edi, 0x6fa92e41
add edi, 0x9056d1c3
loop 0x41d916
add eax, 0xef8b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x69d1533a
sub ecx, 0x6991533a
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x100076b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x100076bf
pop dword [ebp - 0x14]
mov eax, 0x78d02cb0
sub eax, 0x68cfb5f1
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xcfa16e29
sub dword [ebp - 0x24], 0x814f28de
mov dword [ebp - 0x20], 0xd06f5f21
sub dword [ebp - 0x20], 0x9e3c12dc
mov dword [ebp - 0x1c], 0xc35a0172
add dword [ebp - 0x1c], 0x88f242bc
mov dword [ebp - 0x18], 0x8624a9b4
sub dword [ebp - 0x18], 0x8624a9b4
lea eax, [ebp - 0x24]
push eax
mov eax, 0xc9d53a99
sub eax, 0xb9d449e9
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x8b0a089
sub dword [ebp - 0x24], 0x943e3733
mov dword [ebp - 0x20], 0xb0844108
add dword [ebp - 0x20], 0x90e8206d
mov dword [ebp - 0x1c], 0xa8a778e6
add dword [ebp - 0x1c], 0xbac7f386
mov dword [ebp - 0x18], 0x930762e8
sub dword [ebp - 0x18], 0x930762e8
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3646c
push 0
call eax
mov ecx, 0x98123c19
sub ecx, 0x9811fe09
mov edi, eax
mov ebx, 0xee7a0347
add ebx, 0x218834b9
add ebx, dword [ebp - 0x14]
mov esi, 0xbca69947
mov dword [ebp - 0x10], 0x4ce4c93e
mov edx, dword [ebx]
add dword [ebp - 0xc], edi
xor edx, esi
sub dword [ebp - 8], esi
mov dword [edi], edx
add dword [ebp - 0xc], ecx
add edi, 0xb09a51e2
add edi, 0x4f65ae22
add ebx, 4
loop 0x100077d6
add eax, 0x5cd03c99
add eax, 0xa330ae7a
xor ebx, ebx
add ebx, eax
add eax, 0xb44daf65
add eax, 0x4bb250a0
mov ecx, 0x10000000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x1000b110
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
cmp eax, 0x1a
jl 0x1000b168
mov eax, dword [esi + 8]
cmp eax, dword [esi]
jl 0x1000b168
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
push 0x10
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi]
push eax
push dword [esi + 4]
push dword [esi]
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, edi
call fcn.100076b0
push 1
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
ret 4

Function at 0x1000b700
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xd
push dword [ecx + 0x38]
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebp
ret 8
Function at 0x4092f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421c88
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x42a520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x18]
push 0x426648
xor ebx, ebx
push eax
xor esi, esi
mov dword [ebp - 4], ebx
call fcn.00409790
add esp, 8
mov edi, dword [ebp - 0x18]
cmp dword [edi - 0xc], ebx
je 0x4093f6
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
lea ebx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.004094d0
mov ebx, dword [ebp - 0x24]
test eax, eax
jne 0x4093e9
test ebx, ebx
je 0x4093f4
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x4266a8
lea edi, [ebp - 0x14]
mov byte [ebp - 4], 3
jmp loc.0047646e
test ebx, ebx
je 0x4093f4
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40943c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43534b
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0042708b
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x435383
xor eax, eax
jmp 0x4353af
cmp esi, dword [ebp - 4]
je 0x4353ac
cmp dword [ebp + 0xc], 0
je 0x4353ac
push dword [edi + 0x9c]
call fcn.00434f59
push dword [edi + 0x9c]
mov esi, eax
call fcn.00424fcd
pop ecx
pop ecx
cmp esi, eax
je 0x43537f
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0xd61c18
Capabilities:
Encode data using xor

Disassembly:
jmp 0xd61c22
pushal
call 0xd61c28
pop ebp
sub ebp, 0x10
sub ebp, 0x961c18
jmp 0xd61c3e
mov eax, 0x961c18
add eax, ebp
add eax, 0x4c
mov ecx, 0x5a2
mov edx, 0x70d1ddd7
xor byte [eax], dl
inc eax
dec ecx
jne 0xd61c55
jmp 0xd61c68
pop esp
sbb bl, byte [esi + ebx*2 - 0x15]
xlatb
xlatb
xlatb
push esi
push ss
das
xlatb
xlatb
xlatb
aam 0x1a
outsd dx, dword [esi]
rcl edi, cl
xlatb
xlatb
insd dword es:[edi], dx
call edi
xlatb
xlatb
and byte [0x565c1fd4], dh
fcmovnbe st(0), st(7)
xlatb
xlatb
aam 0x12
xchg dword [edi - 0x37934041], eax
xlatb
mov edi, 0xd7a1b77a
salc
sti
mov edi, 0x4736b3d0
aas
rcl bh, cl
xlatb
xlatb
out 0xd7, eax
xlatb
xlatb
pop edx
mov bl, 0xf3
sub ebx, dword [esi - 5]
pop edx
mov ebx, 0x525cd7f3
invalid
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x419d50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x11000]
push edi
jmp 0x419d6a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419d71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419d60
mov eax, 1
add ebx, ebx
jne 0x419d83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419d78
jne 0x419d94
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419d78
xor ecx, ecx
sub eax, 3
jb 0x419da8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419e1a
mov ebp, eax
add ebx, ebx
jne 0x419db3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419dc0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419de4
inc ecx
add ebx, ebx
jne 0x419dd0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419dc5
jne 0x419de1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419dc5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419e04
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419df5
jmp 0x419d66
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419e04
add edi, ecx
jmp 0x419d66
pop esi
mov edi, esi
mov ecx, 0x7bd
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x419e22
cmp byte [edi], 7
jne 0x419e22
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x419e27
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419e96
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1b418]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1b4e4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419e54
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1b4ec]
or eax, eax
je 0x419e90
mov dword [ebx], eax
add ebx, 4
jmp 0x419e71
call dword [esi + 0x1b4e8]
mov ebp, dword [esi + 0x1b4f0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419eca
sub esp, 0xffffff80
jmp 0x40dc58
Function at 0x4014e0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401520
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp + 8], edi
call fcn.005438e0
mov dword [esp + 0xc], eax
test edi, edi
je 0x401520
lea eax, [esp + 8]
push eax
mov ecx, 0x5857d0
call fcn.00401360
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401e20
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a0
mov eax, dword [0x5ad880]
xor eax, esp
mov dword [esp + 0x19c], eax
push 0x5b7310
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x401e63
lea eax, [esp + 8]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
push eax
push 0x5b7314
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp byte [ebp + 0xc], 0
je 0x401e94
push 0
push 0x5b7314
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
test eax, eax
je 0x401e94
mov dword [esp], eax
call fcn.005438e0
lea ecx, [esp]
push ecx
mov ecx, str.winsock
mov dword [esp + 8], eax
call fcn.00401360
mov ecx, dword [esp + 0x19c]
mov eax, dword [ebp + 8]
xor ecx, esp
call fcn.005232d4
mov esp, ebp
pop ebp
ret 8

Function at 0x4035f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55322b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5ad880]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0054312a
push 4
mov dword [ebp - 4], 0
call fcn.004302c3
mov edi, eax
add esp, 4
test edi, edi
je 0x40366c
call fcn.0054343f
mov dword [edi], eax
call fcn.005431fe
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00542f4e
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x403662
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.00542f76
jmp 0x40366e
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x404c50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x554740
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5ad880]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.005233f0
mov dword [ebp - 4], 0
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x10], ecx
push 0xffffffffffffffff
lea ecx, [esi + 0x14]
push 0
lea edx, [edi + 0x14]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push edx
mov byte [ecx], 0
call fcn.004066b0
mov dword [ebp - 4], 1
mov dword [esi + 0x30], vtable.boost::exception.0
mov ecx, dword [edi + 0x34]
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x404cdc
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov ecx, dword [edi + 0x3c]
mov dword [esi + 0x3c], ecx
mov edx, dword [edi + 0x40]
mov dword [esi + 0x40], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.1.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x405620
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5549e8
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5ad880]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
push edi
mov ecx, esi
call fcn.005233f0
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x10], ecx
push 0xffffffffffffffff
lea ecx, [esi + 0x14]
push ebx
add edi, 0x14
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push edi
mov byte [ecx], bl
call fcn.004066b0
mov dword [esi + 0x30], vtable.boost::exception.0
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], 0xffffffff
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.1.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x407690
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
lea edx, [ebp + 0x10]
push edx
mov edx, dword [ebp + 8]
push esi
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0xc]
push eax
push 0
mov dword [edi], 0
mov eax, dword [ecx]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x407702
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x4076d1
cmp eax, 2
jne 0x4076ec
mov eax, dword [ebp + 0x10]
test esi, esi
je 0x4076fc
test eax, eax
je 0x4076f7
test al, 1
jne 0x4076ec
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x4076fc
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x407b60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x407b7b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x407bb2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x407bae
jmp 0x407ba0
cmp esi, eax
jae 0x407bb2
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x407ba0
cmp esi, eax
jb 0x407bb9
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret