joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10130077
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x101f0858]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x101300b7
cmp byte [ebx], 0xa
jne 0x101300b7
or byte [edi + eax + 0x28], 4
jmp 0x101300bc
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x101301bb
mov dl, byte [eax]
cmp dl, 0x1a
je 0x1013019e
inc eax
cmp dl, 0xd
je 0x101300e8
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x1013010e
cmp eax, ecx
jae 0x1013011c
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x101300d0
jmp 0x101301bb
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10130199
cmp dword [ebp - 0x10], 0
je 0x10130199
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x101f0858]
test byte [eax + edi + 0x28], 0x48
je 0x10130173
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x1013015e
mov byte [esi], dl
jmp 0x1013016f
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x101f0858]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x101301bb
cmp byte [ebp - 1], 0xa
jne 0x10130182
cmp esi, ebx
jne 0x10130182
mov byte [esi], 0xa
jmp 0x101301ba
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1012e2ff
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x101301bb
mov byte [esi], 0xd
jmp 0x101301ba
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x101f0858]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x101301b8
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x101301bb
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x101301c4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x101f0858]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1013020a
cmp word [ebx], dx
jne 0x1013020a
or byte [eax + edi + 0x28], 4
jmp 0x1013020f
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x10130372
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x10130352
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x10130250
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x10130286
cmp eax, edx
jae 0x10130294
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x1013022b
jmp 0x10130372
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1013034d
cmp dword [ebp - 0x18], 0
je 0x1013034d
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x101f0858]
test byte [eax + edi + 0x28], 0x48
je 0x10130323
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x101302e7
mov word [esi], cx
jmp 0x1013031e
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x101f0858]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x101f0858]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x101f0858]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x10130372
pop eax
cmp word [ebp - 4], ax
jne 0x10130333
cmp esi, ebx
jne 0x10130333
mov word [esi], ax
jmp 0x1013036f
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.1012e2ff
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x10130372
push 0xd
pop eax
jmp 0x1013032e
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x101f0858]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x1013036c
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x10130372
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10131391
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10165bac
push 0x10165ba4
push str.FlsAlloc
push 0x1f
call fcn.10131219
mov esi, eax
add esp, 0x10
test esi, esi
je 0x101313c5
push dword [ebp + 8]
mov ecx, esi
call dword [0x10147218]
call esi
jmp 0x101313cb
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1013140f
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10165bbc
push 0x10165bb4
push str.FlsGetValue
push 0x21
call fcn.10131219
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10131446
push dword [ebp + 8]
mov ecx, esi
call dword [0x10147218]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1013144e
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10165bc4
push 0x10165bbc
push str.FlsSetValue
push 0x22
call fcn.10131219
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10131488
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10147218]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1013783d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x101378da
push ebx
push esi
call fcn.10137806
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10136641
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10137887
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x101378d9
push edi
push eax
call fcn.1013320e
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x101378a7
call fcn.10130f3a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x101378d8
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10136641
add esp, 0x20
test eax, eax
jne 0x101378c6
push edi
call fcn.10130f3a
jmp 0x101378ce
push ebx
call fcn.10130f3a
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10139fbe
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1012e6c7
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1013a02d
cmp esi, dword [ebp - 4]
je 0x1013a028
cmp dword [ebp + 0xc], 0
je 0x1013a028
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1013a005
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.10139b10
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x1013a02f
xor eax, eax
inc eax
jmp 0x1013a02f
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x1013a094
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1017c400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1012e6c7
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1012e6c7
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x1013a10b
cmp word [ecx], dx
je 0x1013a10b
mov eax, dword [0x10166374]
push edi
dec eax
push eax
push 0x10166260
call fcn.1013a033
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x1013a17e
cmp word [eax], dx
je 0x1013a17e
mov eax, dword [edi]
test eax, eax
je 0x1013a12f
cmp word [eax], dx
je 0x1013a12f
lea eax, [ebp - 0x10]
push eax
call fcn.10139a16
jmp 0x1013a138
lea eax, [ebp - 0x10]
push eax
call fcn.10139ab1
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1013a1a8
mov eax, dword [0x1016625c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10165f50
call fcn.1013a033
add esp, 0xc
test al, al
je 0x1013a1a8
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x1013a173
cmp word [eax], di
je 0x1013a173
lea eax, [ebp - 0x10]
push eax
call fcn.10139a16
pop ecx
jmp 0x1013a1aa
lea eax, [ebp - 0x10]
push eax
call fcn.10139ab1
jmp 0x1013a170
mov eax, dword [edi]
test eax, eax
je 0x1013a195
cmp word [eax], dx
je 0x1013a195
lea eax, [ebp - 0x10]
push eax
call fcn.101399cb
pop ecx
jmp 0x1013a1a8
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x1013a273
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10139eb8
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1013a273
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x1013a273
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x1013a273
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1013a200
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.1013158e
test ebx, ebx
je 0x1013a26e
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.1013158e
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1013a273
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1013a273
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.1013db87
add esp, 0x10
xor eax, eax
inc eax
jmp 0x1013a275
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100bf244
leave
ret
Function at 0x1013e001
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1013df7d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1013e170
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1013e170
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1013e125
jg 0x1013e05d
test eax, eax
je 0x1013e11b
push 1
push 0x1000
call fcn.10130edd
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1013e080
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1013e112
push 0x8000
push ebx
call fcn.1013deae
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1013e0a9
jg 0x1013e0a4
cmp ecx, 0x1000
jb 0x1013e0a9
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.10132244
add esp, 0x10
cmp eax, 0xffffffff
je 0x1013e0ee
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1013e0a4
jl 0x1013e0d5
test ecx, ecx
jne 0x1013e096
push dword [ebp - 0xc]
push ebx
call fcn.1013deae
push esi
call fcn.10130f3a
add esp, 0xc
xor ebx, ebx
jmp 0x1013e17e
cmp byte [edi + 0x24], 0
je 0x1013e105
cmp dword [edi + 0x20], 5
jne 0x1013e105
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1013e110
mov ebx, dword [edi + 0x18]
jmp 0x1013e112
xor ebx, ebx
push esi
call fcn.10130f3a
pop ecx
jmp 0x1013e17e
test ecx, ecx
jg 0x1013e0e7
jl 0x1013e125
test eax, eax
jae 0x1013e0e7
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1012e2ff
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1013e145
cmp byte [edi + 0x1c], 0
je 0x1013e0e7
jmp 0x1013e176
push ebx
call fcn.10137e5d
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1013e0e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1013e17e
cmp byte [edi + 0x1c], 0
je 0x1013e17b
mov ebx, dword [edi + 0x18]
jmp 0x1013e17e
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1012e2ff
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1013fb10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1013fb3d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1013fb3d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401747
Capabilities:
Encode data using xor

Disassembly:
jl 0x401743
int3
int3
jb 0x40173f
mov edi, 0x1f62668e
mov eax, dword [0x9c43aee2]
test dword [esi + 0x3b0efcb0], ebx
cmp word [ebp - 0x68], 0xd333
pop esp
push ebx
xor eax, 0xad552e86
out dx, eax
popfd
sub dword [eax], eax
adc byte [ecx - 0x4d], bl
std
pop fs
cdq
nop
push eax
xor dh, byte [eax + 0x3d]
mov gs, word [edx - 0x5cf5464e]
lea edx, [0xf96f7a50]
pop dword [esi + 0x5f]
mov dword [ebx - 0x40], edx
jno 0x401762
xor byte [esi + 0x1a92c3b6], ah
aam 0xbf
fisttp dword [eax - 0x5e]
mov dh, cl
stc
adc dword [edi + edx*4 + 0x58239d56], esi
les edx, [ebx + 0x73]
dec ecx
mov dword [0xe7d0fd4d], eax
xor al, 0x64
pushfd
retf

Function at 0x40e4f2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
push ebx
push ecx
push ecx
push ebx

Function at 0x41ad05
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push edx
push ebx
mov dword [esp + 0x120], 0x53525253
mov dword [esp + 0x120], 0x53525253
mov dword [esp + 0x120], 0x53525253
mov dword [esp + 0x120], 0x53525253
mov dword [esp + 0x120], 0x53525253
mov dword [esp + 0x120], 0x53525253
mov dword [esp + 0x120], 0x53525253
mov dword [esp + 0x120], 0x53525253
mov dword [esp + 0x120], 0x53525253
add byte [ebx + 0x52], dl
push edx
push ebx

Function at 0x427414
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
js 0x42748e
inc edx
xchg esp, eax
in al, 0xa3
fisttp qword [edx]
invalid
cmp edx, dword [esi + 0xc2aee05]
int 0x53
jne fcn.004273fd
insb byte es:[edi], dx
retf
bound edx, qword gs:[edx + 0x67]
test byte [edi], al
xchg ecx, eax
mov dh, 0x51
inc esi
add al, 7
rcl byte [eax]
push esi
jnp 0x42751d
in eax, dx
div byte [edx]
ja 0x42744c
or dword [ebx - 0x531b0d1f], 0x74
xchg edi, eax
xchg edx, eax
nop
idiv byte [esp + eax + 0x7d]
and eax, 0x4028774
dec edi
inc esp
jno 0x4274ed
inc edi
outsb dx, byte [esi]
hlt
push ebx
push ebx
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
mov dword [esp + 0x120], 0x53535353
invalid
test byte [eax], ah
add dword [eax], eax
invalid
push ebx

Function at 0x440d3d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
push ebx
push esi
push esi
push ebx
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
and al, 0x20
add dword [eax], eax
add byte [ebx + 0x56], dl
push esi
push ebx
Function at 0x44d5bb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [eax], ah
add dword [eax], eax
add byte [ebx + 0x57], dl
push edi
push ebx
mov dword [esp + 0x120], 0x53575753
mov dword [esp + 0x120], 0x53575753
mov dword [esp + 0x120], 0x53575753
mov dword [esp + 0x120], 0x53575753
mov dword [esp + 0x120], 0x53575753
mov dword [esp + 0x120], 0x53575753
mov dword [esp + 0x120], 0x53575753
mov dword [esp + 0x120], 0x53575753
mov dword [esp + 0x120], 0x53575753
mov dword [esp + 0x120], 0x53575753
mov dword [esp + 0x120], 0x53575753
mov dword [esp + 0x120], 0x53575753
mov dword [esp + 0x120], 0x53575753
mov dword [esp + 0x120], 0x53575753
mov dword [esp + 0x120], 0x53575753
mov dword [esp + 0x120], 0x53575753
invalid
test byte [eax], ah
add dword [eax], eax
add byte [ebx + 0x57], dl
push edi

Function at 0x45a0bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffa4
shr byte [ebx], 1
or byte [edx], bl
sbb ecx, dword [ebp + ebp + 0x1c]

Function at 0x45a1c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add dword [eax], eax
add byte [ebx + 0x55], dl
push ebp
push ebx
mov dword [esp + 0x120], 0x53555553
mov dword [esp + 0x120], 0x53555553
mov dword [esp + 0x120], 0x53555553
mov dword [esp + 0x120], 0x53555553
mov dword [esp + 0x120], 0x53555553
mov dword [esp + 0x120], 0x53555553
mov dword [esp + 0x120], 0x53555553
mov dword [esp + 0x120], 0x53555553
mov dword [esp + 0x120], 0x53555553
test byte [eax], ah
add dword [eax], eax
add byte [ebx + 0x55], dl
push ebp
push ebx
mov dword [esp + 0x120], 0x53555553
mov dword [esp + 0x120], 0x53555553
mov dword [esp + 0x120], 0x53555553
mov dword [esp + 0x120], 0x53555553
mov dword [esp + 0x120], 0x53555553
mov dword [esp + 0x120], 0x53555553
mov dword [esp + 0x120], 0x53555553
mov dword [esp + 0x120], 0x53555553
mov dword [esp + 0x120], 0x53555553
mov dword [esp + 0x120], 0x53555553
mov dword [esp + 0x120], 0x53555553
mov dword [esp + 0x120], 0x53555553
mov dword [esp + 0x120], 0x53555553
mov dword [esp + 0x120], 0x53555553
mov dword [esp + 0x120], 0x53555553
mov dword [esp + 0x120], 0x53555553
mov dword [esp + 0x120], 0x53555553
mov dword [esp + 0x120], 0x53555553
mov dword [esp + 0x120], 0x53555553
mov dword [esp + 0x120], 0x53555553
mov dword [esp + 0x120], 0x53555553
invalid
invalid
invalid
Function at 0x467e5b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x46f108
cmp edx, dword [eax]
je 0x467e7d
add eax, 8
inc ecx
cmp eax, 0x46f198
jl 0x467e6e
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x46f108]
jne 0x467fab
mov eax, dword [0x1081488]
cmp eax, 1
je 0x467f85
test eax, eax
jne 0x467eae
cmp dword [0x46f06c], 1
je 0x467f85
cmp edx, 0xfc
je 0x467fab
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x467ee5
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00468400
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00468570
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x467f28
lea eax, [ebp - 0x1a4]
push eax
call fcn.00468570
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x46c9b0
push edi
call fcn.00469200
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00468400
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00468410
lea eax, [ebp - 0xa0]
push 0x46c990
push eax
call fcn.00468410
push dword [esi + 0x46f10c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00468410
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0046916e
add esp, 0x2c
pop edi
jmp 0x467fab
lea eax, [ebp + 8]
lea esi, [esi + 0x46f10c]
push 0
push eax
push dword [esi]
call fcn.00468570
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x408b40
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xffffff9c
mov dh, 0x4d
or al, 0x56
mov esi, dword [ebp - 0x13]
add byte [eax], 0xa6
push ebp
pop esp
push 0
mov eax, dword [esi]
push edx
mov edx, dword [ebp + 0x78]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
mov dword [ebp - 0xc], ecx
cmp cl, byte [ebx - 0x2c2cfbbe]
invalid

Function at 0x408db0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp - 0x66]
xor ecx, ecx
test dword [ebx - 0x763e6af1], esp
mov ah, byte [ebx + edx*8 + 0x4d]
or al, 0x83
stc
dec ebp
push esi
jg 0x4090b0
wbinvd
pop es
add al, byte [eax]
xchg esi, eax
dec ecx
cmp ecx, 0x7a
ja 0x4090de
xor edx, edx
mov ah, byte [esi + 0x10]
xchg ecx, eax
inc eax
shr dword [esp + 0x1d], 0xf0
nop
mov cl, 0xee
mov esi, dword [ebp + 8]
xor edx, edx
mov ecx, dword [esi + 0x38]
xor dword [ebx], 0x1a
sbb cl, 2
xchg ebp, eax
xchg esp, eax
ret 0x7c3b
or byte [ebp + 0x4641055], cl
push edx
mov ecx, dword [eax + 4]
push 0xd41002
push 0x4afdffff
lahf
call dword [sym.imp.WSOCK32.dll_setsockopt]
cmp eax, 0xffffffff
movzx ebx, word [ebp - 3]
push dword [ebx - 0x4d]
invalid
nop
push ss
add byte [eax], al
and al, 0x8b
in eax, 0x5d
ret 0xe1

Function at 0x409ebd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x409ebd
lcall 0x5de5, 0x8b10c483
jmp fcn.0076d6b4

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219