joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x4e0a2ef2
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1f4c580e
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x408c70
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebx, dword [ebx - 0x3ca21ef8]
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xbc38b10]
invalid
Function at 0x40a23c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
xor ebp, ebp
xor edi, edi
lea eax, [ebx + 0x10]
call fcn.00403dcc
cmp ebp, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x40a2a5
mov eax, dword [ebx + 0x10]
mov edx, 0x40a3d8
call fcn.00404190
jne 0x40a274
lea eax, [ebx + 0x10]
call fcn.00403dcc
jmp 0x40a2ad
mov eax, dword [ebx + 0x10]
mov edx, 0x40a3e4
call fcn.00404190
jne 0x40a290
lea eax, [ebx + 0x10]
mov edx, 0x40a3d8
call fcn.00403e20
cmp dword [ebx + 0x10], 0
jne 0x40a2ad
lea eax, [ebx + 0x10]
mov edx, 0x40a3e4
call fcn.00403e20
jmp 0x40a2ad
lea eax, [ebx + 0x10]
call fcn.00403dcc
mov eax, ebx
call fcn.0040a08c
mov eax, dword [0x40b158]
inc dword [eax]
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov word [esp], 2
push 0x8b
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404244
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a307
or edi, 0xffffffff
jmp 0x40a394
mov eax, dword [0x40b170]
inc dword [eax]
mov word [esp], 2
push 0x1bd
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404244
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a34a
or edi, 0xffffffff
jmp 0x40a394
mov eax, dword [0x40b170]
inc dword [eax]
mov word [esp], 2
push 0x75d7
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404244
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a38d
or edi, 0xffffffff
jmp 0x40a394
mov eax, dword [0x40b170]
inc dword [eax]
test edi, edi
je 0x40a3b7
push esi
call sub.wsock32.dll_closesocket
lea eax, [ebx + 0x14]
mov ecx, dword [ebx + 0x10]
mov edx, 0x40a3f0
call fcn.00404090
mov eax, ebx
call fcn.00409f64
mov ebp, eax
push 0x200
call sub.kernel32.dll_Sleep
jmp 0x40a251

Function at 0x438cb3
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x438a14
sub edi, 0xab729d20
sub edi, edi
sub ebx, edi
call fcn.00438cf6
or ebx, edi
xor dword [eax], ecx
add edi, 0x681cac7b
and ebx, edi
inc eax
dec edi
dec ebx
add ebx, edi
cmp eax, edx
jne fcn.00438cb3
sub edi, 0xee0d81f3
add ebx, 0x8de13927
ret
Function at 0x4ca25f
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4c9fca
and edi, edi
dec ecx
add edi, ecx
call fcn.004ca297
or ecx, edi
sub ecx, 0x692abf05
and edi, ecx
xor dword [ebx], eax
mov edi, 0x686582e
and ecx, ecx
inc ebx
sub ecx, 0xd4fc8325
add ecx, 0x422e336c
cmp ebx, edx
jne fcn.004ca25f
and edi, ecx
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x43b64a
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x43b3c1
or edx, ecx
and ecx, ecx
sub ecx, ecx
call fcn.0043b67a
and edx, ecx
add ecx, edx
xor dword [eax], ebx
add ecx, 0x51b3e60b
or edx, ecx
sub edx, ecx
inc eax
add ecx, 0x1c5262b7
cmp eax, edi
jne fcn.0043b64a
inc edx
inc ecx
ret
Function at 0x156bdd0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf04000]
push edi
or ebp, 0xffffffff
jmp 0x156bdf2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x156bdf9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x156bde8
mov eax, 1
add ebx, ebx
jne 0x156be0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x156be1c
jne 0x156be3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x156be3b
dec eax
add ebx, ebx
jne 0x156be28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x156be00
add ebx, ebx
jne 0x156be37
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x156be8d
xor ecx, ecx
sub eax, 3
jb 0x156be53
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x156bec2
sar eax, 1
mov ebp, eax
jmp 0x156be5e
add ebx, ebx
jne 0x156be5e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x156be2c
inc ecx
add ebx, ebx
jne 0x156be6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x156be2c
add ebx, ebx
jne 0x156be79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x156be6e
jne 0x156be8a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x156be6e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x156beac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x156be9e
jmp 0x156bdee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x156beac
add edi, ecx
jmp 0x156bdee
pop esi
mov edi, esi
mov ecx, 0xf268
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x156beca
cmp byte [edi], 0x28
jne 0x156beca
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x156becf
lea edi, [esi + 0x1167000]
mov eax, dword [edi]
or eax, eax
je 0x156bf3e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x116e278]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x116e3d4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x156befc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x116e3dc]
or eax, eax
je 0x156bf38
mov dword [ebx], eax
add ebx, 4
jmp 0x156bf19
call dword [esi + 0x116e3d8]
mov ebp, dword [esi + 0x116e3e0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x156bf72
sub esp, 0xffffff80
jmp 0x5d9198
Function at 0x40a638
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a6450]
jne 0x40a642
repz ret
jmp fcn.0040da36

Function at 0x40c95f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a6450]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004089d9
and dword [ebp - 0x14], 0
cmp dword [0x4a8a24], 0
mov dword [ebp - 0x18], eax
jne 0x40ca12
push 0x403e24
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40caba
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403e18
push ebx
call edi
test eax, eax
je 0x40caba
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403e08
push ebx
mov dword [0x4a8a24], eax
call edi
push eax
call esi
push 0x403df4
push ebx
mov dword [0x4a8a28], eax
call edi
push eax
call esi
push 0x403dd8
push ebx
mov dword [0x4a8a2c], eax
call edi
push eax
call esi
mov dword [0x4a8a34], eax
test eax, eax
je 0x40ca12
push 0x403dc0
push ebx
call edi
push eax
call esi
mov dword [0x4a8a30], eax
mov eax, dword [0x4a8a30]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40ca6b
cmp dword [0x4a8a34], ecx
je 0x40ca6b
push eax
call esi
push dword [0x4a8a34]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40ca6b
test ebx, ebx
je 0x40ca6b
call edi
test eax, eax
je 0x40ca62
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40ca62
test byte [ebp - 8], 1
jne 0x40ca6b
or dword [ebp + 0x10], 0x200000
jmp 0x40ca9e
mov eax, dword [0x4a8a28]
cmp eax, dword [ebp - 0x18]
je 0x40ca9e
push eax
call esi
test eax, eax
je 0x40ca9e
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40ca9e
mov eax, dword [0x4a8a2c]
cmp eax, dword [ebp - 0x18]
je 0x40ca9e
push eax
call esi
test eax, eax
je 0x40ca9e
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4a8a24]
call esi
test eax, eax
je 0x40caba
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40cabc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a638
leave
ret
Function at 0x4a1e50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov eax, 0x6b
mov edx, 0x72
mov word [0x82cab0], ax
mov word [0x82cab4], dx
mov ecx, 0x6e
mov edx, 0x65
xor eax, eax
push 0x82cab0
mov dword [0x82cabc], 0x320033
mov dword [0x82cac4], 0x6c006c
mov word [0x82cab6], cx
mov dword [0x82cab8], 0x6c0065
mov dword [0x82cac0], 0x64002e
mov word [0x82cab2], dx
mov word [0x82cac8], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [0x82caac]
lea ecx, [esp]
push ecx
push 0x40
mov dword [0x82caa8], eax
mov eax, dword [0x4adafc]
push edx
push eax
mov byte [0x4a8d73], 0x65
mov dword [0x4a8d69], 0x75747269
mov word [0x4a8d6d], 0x6c61
mov byte [0x4a8d68], 0x56
mov word [0x4a8d74], 0x7463
mov byte [0x4a8d76], 0
mov dword [0x4a8d6f], 0x746f7250
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x4a1f40
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x1050
call fcn.0040d1b0
cmp dword [0x82caac], 0x37
jne 0x4a200c
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x4047ac
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
mov ecx, dword [esp]
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_MapUserPhysicalPages]
push 0
lea edx, [esp + 0x454]
push edx
push 0x4047b4
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea edx, [esp + 8]
push edx
push 0x4047c8
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
push 0x4047dc
push 0x4047ec
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
push 0
lea eax, [esp + 0x854]
push eax
push 0
push 0x404814
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push 0
push 0
push 0
push 0x404840
push 0x40485c
push 0x40486c
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
mov ecx, dword [0x82daa0]
mov dword [esp], ecx
mov eax, 0x5d1
add dword [esp], eax
mov edx, dword [esp]
mov al, byte [edx + esi]
mov ecx, dword [0x4adafc]
mov byte [ecx + esi], al
add esp, 0x1050
ret
Function at 0x4a21d0
Capabilities:
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x82caac]
sub esp, 0x48c
push ebx
push ebp
push esi
mov esi, dword [0x4adafc]
shr eax, 3
push edi
test eax, eax
je 0x4a23a0
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], eax
jmp 0x4a2204
mov esi, dword [esp + 0x14]
cmp dword [0x82caac], 0x1c
jne 0x4a2221
lea eax, [esp + 0x34]
push eax
push 0
lea ecx, [esp + 0x44]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov edx, dword [0x4a7220]
mov eax, dword [0x4a7224]
mov ecx, dword [0x4a7228]
mov ebx, dword [esi]
mov edi, dword [esi + 4]
mov dword [esp + 0x20], edx
mov edx, dword [0x4a722c]
mov ebp, 0xc6ef3720
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x18], 0x20
mov eax, ebx
shl eax, 4
add eax, dword [esp + 0x24]
mov esi, ebx
shr esi, 5
cmp dword [0x82caac], 0x1b
mov dword [esp + 0x10], eax
jne 0x4a229d
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x9c]
push ecx
push 0
push 0x404680
push 0x4046c0
push 0x404700
call dword [sym.imp.KERNEL32.dll_SearchPathA]
mov eax, dword [esp + 0x10]
add esi, dword [esp + 0x28]
lea ecx, [ebx + ebp]
xor esi, ecx
xor esi, eax
sub edi, esi
mov eax, edi
shl eax, 4
mov dword [0x82ca1c], 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x20]
add dword [esp + 0x10], eax
cmp dword [0x82caac], 0x1be
jne 0x4a22e2
lea ecx, [esp + 0x38]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov esi, edi
shr esi, 5
add esi, dword [esp + 0x2c]
cmp dword [0x82caac], 0x979
mov dword [0x82ca20], 0xff6b3619
mov dword [0x82ca24], 0xffffffff
jne 0x4a231f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea eax, [edi + ebp]
xor esi, eax
mov eax, dword [esp + 0x10]
xor eax, esi
sub ebx, eax
add ebp, 0x61c88647
dec dword [esp + 0x18]
mov dword [esp + 0x10], eax
jne 0x4a225a
cmp dword [0x82caac], 0x8d4
jne 0x4a2357
lea edx, [esp + 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov esi, dword [esp + 0x14]
mov dword [esi], ebx
mov dword [esi + 4], edi
cmp dword [0x82caac], 0x17
jne 0x4a238f
push 0
push 0
push 0
push 0x404764
push 0x404784
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
lea eax, [esp + 0x98]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
add esi, 8
dec dword [esp + 0x1c]
mov dword [esp + 0x14], esi
jne 0x4a2200
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48c
ret
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
nop
nop
nop
cli
mov ebp, esp
mov esi, dword [esp + esi]
mov cl, 0x56
enter 0x40c0, 1
push eax
add ecx, 0x40
push 0x40d074
sbb al, 0xff
adc eax, 0xf540c180
mov eax, dword [0x41a6ac]
add esp, 0x2e
test eax, eax
je 0x401787
push eax
push 0x640d254
call dword [0x402364]
add esp, 8
push 1
call dword [sym.imp.MSVCRT.dll_exit]
nop
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [0x410278]
test eax, eax
mov eax, dword [0x41404c]
jecxz 0x4017bb
push 0x413c40
push eax
jb 0x40174d
inc eax
ret 0x6600
mov esp, edx
push 0x524e4118
test eax, 0x4088e8
add byte [esi - 0x75], ah
or eax, 0x4117f4
xchg ecx, esi
sbb byte [edx], dh
add byte [edi - 0x78], ch
add ah, byte [eax]
mov edx, 0x64358b56
rol dword [eax], 0x66
mov dword [0xed0bb4], ecx
test dword [ecx - 0x74a28aa9], ecx
daa
add byte [eax], bl
aas
inc esi
push edx
lds ebx, [eax - 0xffbf2c]
salc
mov eax, dword [0x70286]
and dword [edi + 8], 0xffffff85
sal byte [ebp + edx - 0x5f], 0x74
rol dword [ecx], 0x50
push 0x413e40
sahf
test ah, dl
inc eax
add byte [eax - 0x7d], ah
les ecx, [ecx]
adc al, 0xd0
inc eax
add byte [ebp - 0x2b7f4740], al
inc eax
add byte [ebp + 5], dh
mov eax, 0x40d4f9
push eax
push 0x40276c
call esi
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
add ecx, 0xffffffb3
insb byte es:[edi], dx
pop es
adc eax, sym.imp.MSVCRT.dll_fflush
add esp, 0xffffff89
mov edx, dword [0x40d018]
fnstenv [sym.imp.MSVCRT.dll_calloc]
push 0x860
push edx
sub esi, edx
dec ebx
mov al, 0xb
inc ecx
dec edx
test al, 0x10
rol byte [eax], 1
pop ecx
and byte [ebx - 1], bh
salc
mov ecx, dword [0x414046]
cmp edx, dword [0x911f18]
mov esp, 0xc8a37bc4
or eax, dword [ecx - 0x23]
xchg edx, eax
pop ebx
push ecx
push edx
push 0x4117f8
call 0x9a6010
invalid

Function at 0x401dc5
Capabilities:
Terminate process

Disassembly:
cmp eax, 0x414db8
mov edx, dword [0x4102cc]
inc edi
inc edx
mov dword [0x41029b], edi
and al, 0xd3
mov dh, 2
inc ecx
add byte [esi - 0x18], dl
retf 0x1a
xlatb
jl 0x401dd5
mov edx, dword [0x4180a0]
pop ecx
or ah, ch
cmp edx, ecx
jae 0x401d77
cmp ebx, dword [esi]
or al, 0xd0
inc eax
add byte [edi], cl
xchg esi, eax
adc bh, dh
aad 0xff
imul ecx, dword [0x40d014], 0xffffff85
leave
je 0x401e05
test al, 0xeb
enter 0x40c0, 0
add eax, 0x40
push str.Finished__d_requests_n
push eax
call dword [0x7c63c165]
adc dl, 0x40
add byte [eax - 1], dl
adc eax, 0x7c63c165
add dword [edi + 0x1f], 0x19
xchg dword [eax + 0x78], ebp
rol byte [eax], cl
push str...done_n
push cs
adc eax, 0xe840c164
add esp, 4
mov ecx, 0x410288
test dword [esi], esp
je 0x401e28
call fcn.00408f2f
pop edi
xchg ebp, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call 0xf370fa
loopne 0x401df5
jnp 0x401e92
pop esi
pop ebx
mov esi, dword [ebx*2 - 0x6f6fda83]
nop
idiv ch
nop
add byte [esi], al
Function at 0x401e40
Capabilities:
Terminate process

Disassembly:
push ebp
xor ah, ch
sub esp, 0x78
push esi
mov esi, dword [ebp + 0xc]
mov esp, 0x6a96458d
js 0x401ea1
push esi
call fcn.0040587e
mov ecx, dword [ebp + 8]
mov edx, dword [0x2dc0c8]
push eax
add edx, edx
dec ebp
inc eax
push 0xb440d4ac
dec ecx
call dword [0xd9c180]
mov eax, dword [0x4102ac]
sub eax, 0x14
test eax, eax
je 0x401e8c
push eax
jns 0x401ed4
sal byte [edx + 0x647fff00], cl
shl dword [eax + eax], 0x83
invalid
push esi
call dword [sym.imp.MSVCRT.dll_exit]
push es
nop
nop
nop
nop
nop
nop
push cs
nop
nop
nop
nop
nop
push ecx
call fcn.00403213
mov dword [esi + 0x838], ebx
mov dword [esi + 0x21083c], edi
mov dword [esi + 0x18], 0x2f
mov ah, 0x15
mov edx, dword [edi]
str word [ecx + 0x60a11456]
add al, byte [ecx - 0x3b]
test edx, eax
je 0x401f3a
mov eax, dword [0xc40270]
mov ecx, edx
add esi, dword [ecx]
mov dword [ebp - 0x749514ec], esi
invalid
mov esi, dword [ebx]
dec edx
mov ebx, dword [0x40d530]
mov eax, dword [esi + 4]
lea ecx, [ebp + 8]
add ebp, dword [ecx + edx*2 + 0x6de85065]
imul eax, dword [eax], 0x66
test eax, eax
je 0x401f8a
cmp eax, 0xb
je 0x401f8a
cmp eax, 0xafd3f
je 0x401f8a
xchg edx, eax
frndint
ret
mov ebp, edi
or byte [eax + eax*8 + 0x3f02a0], cl
mov edi, dword [0x5d41f7a4]
add ebx, eax
adc edi, 0
mov dword [esi], eax
and al, byte [edx]
inc ecx
add byte [ebx + 0x4102a43d], cl
add byte [edi + 0x4e811856], dh
adc al, 3
shr byte [ebx], 1
enter 0x5689, 0x18
pop ds
dec esi
adc al, 0xf
adc al, byte [edi]
invalid

Function at 0x405f20
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3298
mov eax, dword [0xdf0388]
mov ecx, eax
inc eax
test ecx, ecx
mov dword [0x9d410388], eax
je 0x405f40
pop esi
ror byte [ebx - 0x723ca2f9], 0x1e
lea ebx, [esi]
push edx
adc edx, edi
inc edi
add byte [eax], al
add esp, 4
test eax, eax
jne 0x87633f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0xa80954], eax
call fcn.00404940
test dword [eax + 0x50687375], ebx
push eax
lea eax, [ebp + 0x71]
push eax
call fcn.00403e60
test eax, eax
wait
or dword [eax + 0xf22], edi
and ebp, esp
pop ebp
ret

Function at 0x40ae78
Capabilities:
Encode data using xor

Disassembly:
pop esi
push esi
xor dword [esi], ebx
lodsd eax, dword [esi]
add ebx, eax
test eax, eax
jne 0x40ae7a
ret