joyce8/EMBER2024-capa huggingface dataset:
Function at 0x817d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x817d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x817d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x817d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x817d94
push eax
push esi
call fcn.0081a20b
add esp, 8
pop esi
ret 0x10

Function at 0x817da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x817e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x817e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x830320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00819dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x817dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x817e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x817ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x817eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x830320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00819dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x817eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x817e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x818000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x818131
push esi
call fcn.0081b145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.0080a080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x818131
push 0
push ebp
call fcn.0080a3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.0080a260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x81808b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.0080a2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x818121
push 0x830918
push edi
call fcn.008193f0
push eax
push ebx
push esi
call fcn.00817f60
push 0x8308f8
push edi
call fcn.008193f0
push eax
push ebx
push esi
call fcn.00817f60
push 0x8308d8
push edi
call fcn.008193f0
push eax
push ebx
push esi
call fcn.00817f60
push 0x8308c0
push edi
call fcn.008193f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00817f60
push 0x8308a0
push edi
call fcn.008193f0
push eax
push ebx
push esi
call fcn.00817f60
push 0x830888
push edi
call fcn.008193f0
push eax
push ebx
push esi
call fcn.00817f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x8191b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00819140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00819140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00819140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00819140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x819bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x819c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x82b87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x819c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x819c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x4010c0
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea eax, [esp + 0xc]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWARECanonCnmUninst
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x401117
mov ecx, dword [esp + 0xc]
push edi
push esi
push 1
push eax
push str.Uninstall_Driver
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
ret

Function at 0x4012b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x408a04
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
sete cl
mov eax, ecx
ret

Function at 0x4012d0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x54
push ebx
push esi
push edi
push eax
call fcn.00401120
mov al, byte [0x408b04]
xor ebx, ebx
add esp, 4
cmp al, bl
je 0x40143f
cmp byte [0x408a84], bl
je 0x40143f
cmp byte [0x408984], bl
je 0x40143f
cmp byte [0x408904], bl
je 0x40143f
mov ecx, 0x20
xor eax, eax
mov edi, 0x408a04
rep stosd dword es:[edi], eax
mov edi, 0x408a84
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, ebx
jle 0x40134d
mov esi, 0x408a04
mov dl, byte [eax + 0x408a84]
cmp dl, 0x22
je 0x401348
mov byte [esi], dl
inc esi
inc eax
cmp eax, ecx
jl 0x40133a
push 0x408984
call fcn.004010c0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 4
mov byte [0x408700], bl
push 0x408b04
push 0x408700
call esi
push 0x406274
push 0x408700
call esi
push 0x408a84
push 0x408700
call esi
push 0x406270
push 0x408700
call esi
push 0x408904
push 0x408700
call esi
lea ecx, [esp + 0xc]
lea edx, [esp + 0x1c]
push ecx
push edx
push ebx
push ebx
push 0x30
push ebx
push ebx
push ebx
push 0x408700
push ebx
mov dword [esp + 0x44], 0x44
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x70], ebx
mov word [esp + 0x76], bx
mov dword [esp + 0x78], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40143f
mov eax, dword [esp + 0xc]
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0xc]
push 0xffffffffffffffff
push ecx
call esi
lea edx, [esp + 0x6c]
mov eax, dword [esp + 0xc]
push edx
push eax
call edi
cmp eax, 1
jne 0x401427
cmp dword [esp + 0x6c], 0x103
jne 0x401430
push 0x1f4
call ebx
jmp 0x401403
call fcn.004012b0
cmp eax, 1
jne 0x40143f
call fcn.00401450
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x54
ret 0x10

Function at 0x401450
Capabilities:
Delete file
Move file

Disassembly:
push 0x104
push 0x408800
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 4
push 0
push 0x408800
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
ret
Function at 0x493280
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5c000]
push edi
jmp 0x49329a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4932a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x493290
mov eax, 1
add ebx, ebx
jne 0x4932b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4932c4
jne 0x4932e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4932e3
dec eax
add ebx, ebx
jne 0x4932d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4932a8
add ebx, ebx
jne 0x4932df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x493335
xor ecx, ecx
sub eax, 3
jb 0x4932fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x49336a
sar eax, 1
mov ebp, eax
jmp 0x493306
add ebx, ebx
jne 0x493306
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4932d4
inc ecx
add ebx, ebx
jne 0x493314
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4932d4
add ebx, ebx
jne 0x493321
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x493316
jne 0x493332
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x493316
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x493354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x493346
jmp 0x493296
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x493354
add edi, ecx
jmp 0x493296
pop esi
mov edi, esi
mov ecx, 0x3021
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x493372
cmp byte [edi], 0x19
jne 0x493372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x493377
lea edi, [esi + 0x90000]
mov eax, dword [edi]
or eax, eax
je 0x4933ef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x941bc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x942d4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4933a4
mov ecx, edi
jns 0x4933d3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x942d8]
or eax, eax
je 0x4933e9
mov dword [ebx], eax
add ebx, 4
jmp 0x4933c1
call dword [esi + 0x942e8]
mov ebp, dword [esi + 0x942dc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x493423
sub esp, 0xffffff80
jmp 0x45282d
Function at 0x40cb2f
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov edx, 0x1505
jmp 0x40cb50
lea eax, [ecx - 0x61]
cmp eax, 0x19
ja 0x40cb48
and ecx, 0xffffffdf
imul edx, edx, 0x21
xor edx, ecx
add esi, 2
movzx ecx, word [esi]
test ecx, ecx
jne 0x40cb3d
mov eax, dword [ebp + 0x10]
movzx ecx, dl
mov edx, ecx
shr edx, 5
mov dword [eax], edx
mov eax, dword [ebp + 0x14]
xor edx, edx
and ecx, 0x1f
inc edx
shl edx, cl
pop esi
mov dword [eax], edx
pop ebp
ret 0x10

Function at 0x404735
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x85
inc ebp
add al, bl
push esi
invalid
mov eax, 0x41b23d
call 0x44923c4
sub esp, 0x8d80
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
mov dword [esi + 0x68], eax
call 0x124053b8
xor ebx, dword [ebx + 0x68]
in al, 0x2c
add byte [eax], al
mov byte [0x42cdc8], bl
call fcn.00411747
pop ecx
mov ecx, esp
mov dword [ebp], ecx
jnp 0x404726
mov dword [ebp - 4], edx
xor al, 8
push dword [esi + 0x68]
call fcn.00409fab
jmp 0x4046ec

Function at 0x409591
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, edx
dec edx
test eax, eax
je 0x4095cb
mov eax, dword [ecx + 0x6c]
push esi
lea esi, [edx + 1]
mov edx, dword [ebp + 8]
push edi
mov ecx, dword [ebp + 0x10]
movzx edi, byte [edx]
and ecx, 0xff
xor ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 8
mov ecx, dword [eax + ecx*4]
inc edx
xor edi, ecx
dec esi
mov dword [ebp + 0x10], edi
jne 0x4095a9
pop edi
pop esi
mov eax, dword [ebp + 0x10]
pop ebp
ret 0xc

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ed0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x16e52c89
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x14d11419
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x403960
Capabilities:
Check os version

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
mov edi, 0x40a4a8
rep stosd dword es:[edi], eax
push 0x40a4a8
mov dword [0x40a544], 0
mov dword [0x40a4a8], 0x94
call esi
test eax, eax
je 0x4039d1
mov eax, dword [0x40a4b8]
mov dword [0x40a4a0], 1
cmp eax, 2
jne 0x4039d1
cmp dword [0x40a4ac], 5
jb 0x4039d1
mov ecx, 0x27
xor eax, eax
mov edi, 0x40a4a8
push 0x40a4a8
rep stosd dword es:[edi], eax
mov dword [0x40a4a8], 0x9c
call esi
pop edi
pop esi
ret

Function at 0x4040b0
Capabilities:
Create udp socket
Get local ipv4 addresses
Get socket information
Initialize winsock library

Disassembly:
sub esp, 0x1a4
push ebx
push esi
mov esi, ecx
cmp byte [esi], 0
je 0x4040cc
pop esi
mov al, 1
pop ebx
add esp, 0x1a4
ret 8
lea eax, [esp + 0x1c]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4040f0
mov byte [esi], 0
pop esi
xor al, al
pop ebx
add esp, 0x1a4
ret 8
mov eax, dword [esi + 1]
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
mov byte [esi], 1
je 0x404104
push eax
call ebx
push 0
push 2
push 2
mov dword [esi + 1], 0xffffffff
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 1], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esi + 1], 0xffffffff
je 0x4040e3
mov ecx, dword [esp + 0x1b0]
mov word [esp + 0xc], 2
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0xe], ax
mov eax, dword [esp + 0x1b4]
test eax, eax
jne 0x404151
mov dword [esp + 0x10], eax
jmp 0x40415c
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 1]
lea edx, [esp + 0xc]
push 0x10
push edx
push eax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x404185
mov ecx, dword [esi + 1]
push ecx
call ebx
pop esi
xor al, al
pop ebx
add esp, 0x1a4
ret 8
mov ecx, dword [esi + 1]
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
push eax
push ecx
mov dword [esp + 0x14], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x4040e3
mov dx, word [esp + 0xe]
mov al, 1
mov word [esi + 0x11], dx
pop esi
pop ebx
add esp, 0x1a4
ret 8

Function at 0x404330
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push esi
mov esi, ecx
push eax
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x18]
mov word [esp + 6], ax
push ecx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [esp + 0x20]
lea edx, [esp + 4]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
push 0x10
push edx
mov edx, dword [esi + 1]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
pop esi
setne al
add esp, 0x10
ret 0x10
Function at 0x404390
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x14
mov ecx, dword [ecx + 1]
lea eax, [esp]
lea edx, [esp + 4]
push eax
mov eax, dword [esp + 0x24]
push edx
push 0
push 0x578
push eax
push ecx
mov dword [esp + 0x18], 0x578
call dword [sym.imp.WS2_32.dll_recvfrom]
mov edx, dword [esp + 0x24]
cmp eax, 0xffffffff
mov word [edx], ax
jne 0x4043cf
xor al, al
add esp, 0x14
ret 0x10
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 6]
mov ecx, dword [esp + 8]
push edx
mov dword [eax], ecx
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x1c]
mov word [ecx], ax
mov al, 1
add esp, 0x14
ret 0x10
Function at 0x404fd0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x128
push ebx
push ebp
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
lea eax, [esp + 0x10]
push eax
push ebp
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4050be
mov edi, dword [esp + 0x13c]
lea eax, [esp + 0x34]
mov esi, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x405035
test cl, cl
je 0x405031
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x405035
add eax, 2
add esi, 2
test cl, cl
jne 0x40500d
xor eax, eax
jmp 0x40503a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x405084
lea eax, [esp + 0x10]
push eax
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4050be
mov esi, edi
lea eax, [esp + 0x34]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x40507b
test cl, cl
je 0x405077
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40507b
add eax, 2
add esi, 2
test cl, cl
jne 0x405053
xor eax, eax
jmp 0x405080
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40503e
mov al, byte [esp + 0x140]
test al, al
je 0x4050aa
mov eax, dword [esp + 0x18]
push 0
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x128
ret
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x128
ret
Function at 0x1003fe8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
or ecx, 0xffffffff
sub ecx, dword [esp + 0xc]
test edx, edx
je 0x1004015
mov eax, dword [esp + 4]
push esi
push edi
movzx esi, byte [eax]
movzx edi, cl
xor esi, edi
shr ecx, 8
xor ecx, dword [esi*4 + 0x1014020]
inc eax
dec edx
jne 0x1003ffd
pop edi
pop esi
or eax, 0xffffffff
sub eax, ecx
ret 0xc

Function at 0x1006629
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov esi, 0x1000
push esi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [edi], ebx
call dword [sym.imp.msvcrt.dll_malloc]
cmp eax, ebx
pop ecx
mov dword [ebp + 0xc], eax
jne 0x1006672
push dword [ebp + 8]
push 0x1001850
push 0x10023e0
push dword [ebp + 0x10]
call fcn.010087a6
add esp, 0x10
xor eax, eax
jmp 0x10066fb
lea eax, [ebp - 0xc]
push eax
push 0x8000
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll__open]
mov ebx, eax
add esp, 0xc
cmp ebx, 0xffffffff
jne 0x10066ce
push dword [ebp + 8]
push 0x1001850
push 0x10023c8
push dword [ebp + 0x10]
call fcn.010087a6
add esp, 0x10
jmp 0x10066ee
push esi
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.msvcrt.dll__read]
add esp, 0xc
cmp eax, 0xffffffff
je 0x1006702
test eax, eax
je 0x10066ce
push dword [ebp - 4]
push eax
push dword [ebp + 0xc]
call fcn.01003fe8
mov dword [ebp - 4], eax
push ebx
call dword [sym.imp.msvcrt.dll__eof]
test eax, eax
pop ecx
je 0x10066a8
mov eax, dword [ebp - 4]
mov dword [ebp - 8], 1
mov dword [edi], eax
push ebx
call dword [sym.imp.msvcrt.dll__close]
pop ecx
push dword [ebp + 0xc]
call dword [sym.imp.msvcrt.dll_free]
mov eax, dword [ebp - 8]
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
push dword [ebp + 8]
push 0x1001850
push 0x10023a4
push dword [ebp + 0x10]
call fcn.010087a6
add esp, 0x10
jmp 0x10066e6
Function at 0x100859e
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x1014ab0]
push ebx
push esi
mov esi, dword [sym.imp.msvcrt.dll_setvbuf]
push edi
xor ebx, ebx
push ebx
mov dword [ebp + 0x198], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 4
add eax, 0x20
push ebx
push eax
call esi
mov eax, dword [sym.imp.msvcrt.dll__iob]
push ebx
push 4
add eax, 0x40
push ebx
push eax
call esi
add esp, 0x20
lea eax, [ebp - 0x80]
push eax
call fcn.010087cf
push 0x610
mov dword [ebp + 0x184], ebx
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
cmp esi, ebx
pop ecx
jne 0x1008626
lea eax, [ebp - 0x80]
push 0x1002e98
push eax
call fcn.010087a6
pop ecx
pop ecx
lea eax, [ebp - 0x80]
push eax
push ebx
call fcn.01005f12
push 1
call dword [sym.imp.msvcrt.dll_exit]
push 0x13
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x84], ebx
mov word [esi + 0x80], bx
mov byte [esi + 0x504], bl
mov dword [esi + 0xac], ebx
mov dword [esi + 0x60c], ebx
pop ecx
mov eax, 0x20202020
lea edi, [esi + 0x3b4]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push esi
mov byte [esi + 0x403], bl
call fcn.01005e71
push 0x1002524
push 0x1001850
push 0x1002e30
lea edi, [esi + 0x1b4]
push 0x200
push edi
call fcn.0100bbdc
push edi
mov edi, dword [sym.imp.msvcrt.dll_printf]
call edi
add esp, 0x18
lea eax, [ebp - 0x80]
push eax
push esi
call fcn.01004985
cmp eax, ebx
je 0x1008721
mov dword [esi + 8], eax
lea eax, [ebp - 0x80]
push eax
push dword [ebp + 0x1a8]
push dword [ebp + 0x1a4]
push esi
call fcn.010074d1
test eax, eax
je 0x1008721
cmp dword [esi], 1
jne 0x1008701
push 0x1002bc8
call edi
xor eax, eax
jmp 0x100878f
call dword [sym.imp.msvcrt.dll_clock]
mov dword [esi + 0x74], eax
mov eax, dword [esi]
dec eax
dec eax
je 0x1008730
dec eax
jne 0x100874a
lea eax, [ebp - 0x80]
push eax
push esi
call fcn.010082f5
test eax, eax
jne 0x100874a
lea eax, [ebp - 0x80]
push eax
push esi
call fcn.01005f12
xor eax, eax
inc eax
jmp 0x1008790
lea eax, [ebp - 0x80]
push eax
push esi
call fcn.010064f3
test eax, eax
je 0x100872b
lea eax, [ebp - 0x80]
push eax
push esi
call fcn.010070e6
jmp 0x100871d
xor eax, eax
cmp dword [esi + 0x38], ebx
setg al
mov edi, eax
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x1008765
lea ecx, [ebp - 0x80]
push ecx
push eax
call fcn.0100c31e
mov eax, dword [esi + 0x84]
cmp eax, ebx
je 0x1008775
push eax
call fcn.01009aab
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x1008786
lea ecx, [ebp - 0x80]
push ecx
push eax
call fcn.010088cc
push esi
call dword [sym.imp.msvcrt.dll_free]
mov eax, edi
pop ecx
mov ecx, dword [ebp + 0x198]
pop edi
pop esi
pop ebx
call fcn.0100c7cd
add ebp, 0x19c
leave
ret