joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e6ed
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push ebx
push eax
mov ebx, ecx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [ebp - 4], eax
je 0x40e73f
push eax
call fcn.0040b334
pop ecx
mov dword [ebx + 0x40], eax
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x40e73f
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x412590
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x40e743
xor al, al
jmp 0x40e7a4
push esi
push edi
mov edi, ebx
lea eax, [ebx + 4]
neg edi
sbb edi, edi
mov esi, dword [ebp - 0xc]
push 0xd
and edi, eax
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push str.VarFileInfoTranslation
rep movsd dword es:[edi], dword [esi]
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueA
pop edi
pop esi
test eax, eax
je 0x40e7a2
mov eax, dword [ebp - 4]
shr eax, 2
mov dword [ebx + 0x3c], eax
shl eax, 2
push eax
call fcn.0040b334
mov dword [ebx + 0x38], eax
xor eax, eax
cmp dword [ebx + 0x3c], eax
pop ecx
jbe 0x40e7a2
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x38]
mov edx, dword [edx + eax*4]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [ebx + 0x3c]
jb 0x40e790
mov al, 1
pop ebx
leave
ret 4
Function at 0x412310
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
jmp 0x412336
pop ebp
ret
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
jmp 0x41232d

Function at 0x41ae70
Capabilities:
Set registry value

Disassembly:
je 0x41b126
jne 0x41b126
mov eax, 0xa10640
mov dword [ebp + 0x14], 0x10005acf
mov dword [0xe492e8], eax
push 0x10317638
mov ebp, 0x7c83c35d
lcall 0xafe, 0x54de0008
cmp eax, 0x68e58b5b
xchg ebx, eax
scasb al, byte es:[edi]
inc ecx
add bl, al
push 0x100847e0
push 0x697c2414
call dword [0xa7e304]
test byte [esi*2 + 0xbaa718], 4
push 0xd3
mov eax, dword [0x83088b66]
rol byte [edx], 0x66
test ecx, ecx
pop ebx
mov esp, ebp
push 0x41ae93
ret
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41aec6
sub eax, edx
sar eax, 1
lea eax, [eax*2 + 2]
push eax
je 0x41af2b
jne 0x41af2b
sbb eax, 0x3e004171
push 0x100e28d8
mov byte [0xcf3ea9], 1
push 0x697a4d58
cmp byte [0x1032fa69], 0
fisubr word [edi + 0x7f]
mov cl, 0xe8
pop esi
je 0x41ae9f
jne 0x41ae9f
mov eax, 0x54bc70
push 0x104a7484
pop esp
test eax, 0x562bd4c6
push esi
mov esi, dword [ebp - 0x20]
push 1
push 0
push 0x43c920
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
push 0x41af7b
ret
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41b144
ret
Function at 0x438694
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4997cc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00431bf5
mov dword [ebp - 0x14], eax
cmp dword [0x49b660], edi
jne 0x438785
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x438712
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x438865
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x438865
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x438865
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x49b660], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x49b664], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x49b668], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x49b670], eax
test eax, eax
je 0x438782
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x49b66c], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4387aa
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x43879d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x4387bf
push 4
pop eax
jmp 0x438867
cmp dword [ebp - 0x14], edi
je 0x4387bf
push dword [0x49b660]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4387a4
mov eax, dword [0x49b66c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x43881d
cmp dword [0x49b670], esi
je 0x43881d
push eax
call ebx
push dword [0x49b670]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x43881d
test eax, eax
je 0x43881d
call ecx
test eax, eax
je 0x438812
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x438812
test byte [ebp - 8], 1
jne 0x43881d
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x43884d
mov eax, dword [0x49b664]
cmp eax, esi
je 0x43884a
push eax
call ebx
test eax, eax
je 0x43884a
call eax
mov edi, eax
test edi, edi
je 0x43884a
mov eax, dword [0x49b668]
cmp eax, esi
je 0x43884a
push eax
call ebx
test eax, eax
je 0x43884a
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x49b660]
call ebx
test eax, eax
je 0x438865
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x438867
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042dbc5
leave
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0xa0d0ae2
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x14214338
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x6a385d
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], edx
jmp 0x6a3874
mov eax, dword [ebp + 8]
movzx edx, byte [eax]
movzx esi, byte [eax + 1]
movzx edi, byte [eax + 5]
shl edx, 8
xor edx, esi
Function at 0x6b4d9f
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x6b4e15
sub esp, 0x16
jbe 0x6b4de3
xchg byte [esp + 6], bh
lea esp, [esp + 2]
jmp 0x6b4dcd
mov ebp, esp
mov dx, 0x7582
neg dx
jne 0x6b4e68
je 0x6b4eea
jge 0x6b4e13
sub esp, 0xa8
jmp 0x6b4db0
xchg byte [esp + 6], bh
lea esp, [esp + 2]
call 0x6b4df1
push ebx
cmp ebp, 0x2fa96724
btc ax, si
lea ebp, reloc.iphlpapi.dll_GetAdaptersInfo
xchg dword [esp], edi
mov ch, dh
jmp 0x6b4e2a
pop esi
xchg esp, eax
mov edi, dword [esp + 0x30]
xchg cx, bx
mov al, 0xaa
lea esi, [esp + 4]
lea edx, [esi + edi]
jmp 0x6b4da1
mov ebp, 0x198ed0bf
add dl, 0xb8
lea edi, [edi - 0x23]
mov bl, dl
push esp
bswap ebp
jmp 0x6b4e7f
push dword [esp]
ret 4
mov bx, 0xabcf
pop edx
mov dx, word [esp]
xchg dword [esp], edi
rdtsc
xchg bp, bx
bsr dx, bx
jmp 0x6b4e62
mov bx, 0xabcf
jmp fcn.006b4e6c

Function at 0x6b5537
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 1]
jb 0x6b550a
jae 0x6b550a
jge 0x6b552a
jns 0x6b555b
jmp 0x6b556f
in al, 0xcf
invalid
Function at 0x6bed54
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push eax
jmp 0x6a303c
mov cx, word [esp]
lea edx, [ecx*4]
movzx ecx, word [ebp + 0xc]
push ebx
jmp 0x6a2fcf
mov ebp, esp
mov eax, esp
movzx eax, word [ebp + 8]
inc edx
jmp 0x6a2fe5
ror dx, 0xd
push esi
mov esi, dword [ebp + 8]
neg edx
jmp 0x6a3060
mov eax, ebp
add eax, 0xc
mov ebx, dword [eax]
pop eax
jmp 0x6a3018
movzx esi, si
xor dx, si
lea edx, [esp + 0x69]
jmp 0x6a3074
shr esi, 0x10
shr ebx, 0x10
not dx
mov dx, 0x9e70
jmp 0x6a3046
mov edx, eax
movzx ebx, bx
call fcn.006a30a8
cmp al, 0x32
and eax, 0x4d901b72
jmp 0x6a3022
jmp 0x6bfff9
jmp 0x6a3092
lea esp, [esp + 4]
jmp 0x6a30c0
push ebp
mov dl, ch
jmp 0x6a300d

Function at 0x6bfb73
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x6a5907
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x6a5921
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x6a5910
pop esi
jmp 0x6a592c
ret 4
jmp 0x6a58fa

Function at 0x6d6226
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push edx
jmp 0x6d61d2
mov dword [edx - 8], edi
lea edi, [ebx + 0x32]
mov di, si
mov di, word [esp]
cmc
jmp 0x6d6196
stc
jmp 0x6d61fb
mov edx, ecx
add edx, 0xfffffffc
mov edi, dword [edx]
pop edx
jmp 0x6d61bc
mov eax, dword [edx - 4]
push ax
mov byte [esp], dh
lea esp, [esp + 2]
jmp 0x6d61ac
mov dword [ecx - 4], eax
seto ah
lea eax, reloc.iphlpapi.dll_GetAdaptersInfo
mov eax, dword [edx]
jmp 0x6d620f
mov dword [edx - 4], edi
jmp 0x6d624f
mov dword [esp], ebx
mov dword [ecx - 8], eax
sub ax, 0x1e71
lea eax, [ebx*4]
jmp 0x6d61ed
mov edx, ecx
mov dword [edx], eax
pop edx
lea eax, [ecx + edi]
jmp 0x6d626b
mov edi, dword [ecx]
clc
push edx
jmp 0x6d6239
sub esp, 0x10
pop edi
mov dword [esp + 6], ebp
jmp 0x6d6277
mov eax, dword [edx + 4]
push edx
mov byte [esp + 2], dl
mov dword [edx], edi
jmp 0x6d6255
push ebp
mov ebp, ecx
add ebp, 4
jmp 0x6d6390
stc
sub esp, 0x1c
mov edi, dword [ebp]
pop ebp
mov dword [ecx + 4], eax
mov dword [edx + 4], edi
jmp 0x6d62bb

Function at 0x6d62de
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push word [esp]
lea esp, [esp + 2]
jmp 0x6d64de
add dword [ebp - 4], 4
call fcn.006d6226
add ecx, 0x10
sub edx, 0x10
call 0x6d62de
lds eax, [ebp - 0x2b]
mov esp, 0xf675fe4f
add edi, esi
cmp ah, byte [ebp - 0x15]
jnp 0x6d62d6
in eax, dx
sub byte [esi + 0x1cec83f9], cl
lea esp, [esp + 0x30]
sub ebx, 4
jmp 0x6d629d
jl 0x6a3e31
jge 0x6d6313
sbb bl, byte [ecx + 0x2e9b6809]
or dword [eax - 0x65], ebp
jl 0x6d62d2
jl 0x6d62d2
push 0x5b4ffa0f
mov dl, 0x8d
and al, 4
cmp dword [ebp - 4], ebx
jmp 0x6d62c8
mov eax, dword [ebp - 8]
jmp 0x6a3db9
mov edi, dword [esi]
pop esi
push ax
lea esp, [esp + 2]
lea esp, [esp + 4]
jmp 0x6d6294
push esi
mov esi, ecx
add esi, 0xfffffff8
jmp 0x6d6487
Function at 0x6d6377
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov dword [esp], edx
lea esp, [esp + 4]
popal
push eax
jmp 0x6d639f
shr edi, 0x18
sub esp, 0x1b
lea esp, [esp + 3]
mov edi, dword [edi*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
jmp 0x6d63ea
push ebp
jmp 0x6d63d1
and edi, ecx
sub esp, 7
push bx
lea esp, [esp + 1]
jmp 0x6d63b2

Function at 0x6d65e9
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push eax
jmp 0x6d65eb
jmp 0x6d65d3
mov eax, edx
lea eax, [eax*4]
lea eax, reloc.iphlpapi.dll_GetAdaptersInfo
mov edx, dword [eax]
jmp 0x6d662b
sub esp, 0x1c
mov edx, dword [esp + 0x11]
jmp 0x6d663b
pop eax
and edx, ecx
lea esp, [esp + 0x24]
xor edi, dword [edx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
jmp 0x6d6612
mov edx, dword [esi + 8]
mov dword [esi + 4], edi
mov ebx, dword [ebx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
jmp 0x6d6680
push esp
lea esp, [esp + 2]
lea esp, [esp + 2]
pushal
mov dword [esp], edx
jmp 0x6d666a

Function at 0x6d67f9
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 4]
xor edi, dword [ebx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
jmp 0x6d6843
lea esp, [esp + 4]
dec dword [ebp - 4]
jmp 0x6d682d
and edx, ecx
sub esp, 0
xor edi, dword [edx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
push eax
jmp 0x6d6806

Function at 0x6d6885
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jne 0x6a3dd9
je 0x6a3df1
add al, 0x9f
punpckhdq mm3, qword [ecx + 0x7c6d7216]
dec edi
pop word [esp]
lea esp, [esp + 2]
jmp 0x6d686f

Function at 0x6d6c02
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 8]
push ecx
jmp 0x6d6c11
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [esp], bl
pop dword [esp + 2]
jmp 0x6d6bec
push ecx
push ebx
push edi
jmp 0x6d6c1a
mov di, 0x788f
jmp 0x6d6c48
mov edi, eax
clc
mov al, byte [ecx]
call 0x6d6c53
xchg ebp, eax
lea esp, [esp]
jmp 0x6d6d97

Function at 0x6d6c53
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 8]
push ecx
jmp 0x6d6c11
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [esp], bl
pop dword [esp + 2]
jmp 0x6d6bec
push ecx
push ebx
push edi
jmp 0x6d6c1a
mov di, 0x788f
jmp 0x6d6c48
mov edi, eax
clc
mov al, byte [ecx]
call 0x6d6c53
xchg ebp, eax
lea esp, [esp]
jmp 0x6d6d97

Function at 0x6d6ca1
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 4]
cmp al, 0x5a
jbe 0x6a3f39
ja 0x6a3f59
mov esp, 0x29dabf2f
xchg edx, ebx
inc eax
salc
mov cl, 0x40
invalid
mov byte [esp + 2], ah
jmp 0x6d6c80
Function at 0x8c8e30
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 7]
rol ah, 1
xchg dh, al
add esp, 6
mov edx, dword [esp + 7]
jmp 0x8c8e3f
ror ah, 2
mov dword [esp + 8], edx
mov bp, 0xba8a
xchg dx, ax
jmp 0x8c8e1a
lea edx, reloc.iphlpapi.dll_GetAdaptersInfo
not edx
mov dword [esp + 4], esi
xchg byte [esp + 2], ah
sub esp, 3
lea edx, [eax + ebx]
jmp 0x8c8ed2
bsf eax, edi
mov edx, dword [esp + 4]
xchg byte [esp + 6], ah
mov al, 0xdd
mov dx, ax
pop dword [esp]
jmp 0x8c8ead
mov ah, cl
lea edx, [eax + edi]
rdtsc
mov edx, 0x377929ed
not ah
bswap edx
jmp 0x8c8e73
pop dx
shl edx, cl
lea edx, [esi*4]
xchg al, dl
cld
mov edx, esp
jmp 0x8c8f53
std
ror bp, 9
rol bp, cl
pop dword [esp]
bswap edx
mov dl, byte [esp + 3]
jmp 0x8c8e9b
mov eax, dword [esp + 5]
add esp, 0xc
xchg edx, eax
push word [esp + 1]
push dword [esp]
mov dword [esp + 1], edx
jmp 0x8c8f36
xchg dh, ah
rdtsc
bt edx, edx
mov eax, edx
sub esp, 0xe
xchg ebp, eax
jmp 0x8c8ee5
rdtsc
xchg byte [esp], ah
and dh, 0x13
bswap edx
btc edx, edi
xchg ah, dl
jmp 0x8c8f68
lea eax, [ecx*4]
std
not ah
lea edx, reloc.iphlpapi.dll_GetAdaptersInfo
clc
mov word [esp + 3], di
jmp 0x8c8f20
bsr ax, sp
mov word [esp + 1], si
pop word [esp]
inc eax
add esp, 0
rcr edx, cl
jmp 0x8c8f11
bts dx, di
lea esp, [esp + 4]
mov dx, bp
mov ax, 0x714e
lea eax, [edx + esi]
lea ebp, [eax*4]
jmp 0x8c92b8
sbb dl, dl
pop ax
add esp, 1
rdtsc
call fcn.008c9035
neg dl
xchg byte [esp], al
mov ax, cx
mov ax, word [esp]
call fcn.008c935b
pop es
scasb al, byte es:[edi]
mov ecx, 0x48afb98
and al, 0x66
mov eax, dword [esp]
mov eax, ebp
mov dl, 0x15
mov dh, ch
dec dl
jmp 0x8c92c6

Function at 0x8c8f8c
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 4
sub esp, 0xa
sub esp, 0xe
xchg byte [esp + 0x13], ah
not ax
lea edx, [eax + ebp]
bswap ebp
pop eax
jmp 0x8c8b50
lea eax, reloc.iphlpapi.dll_GetAdaptersInfo
lea eax, [eax + esi]
pop dx
push word [esp + 5]
cmp edx, ecx
pop dword [esp + 4]
jmp 0x8c8b7f
cmc
push esp
push dword [esp + 0xf]
mov ax, 0xf4e5
mov dl, 0x8c
cld
jmp 0x8c8bed
mov dl, byte [esp]
mov dword [esp + 2], edx
lea eax, [ebp*4]
and eax, 0x595e9722
jmp 0x8c8c9c

Function at 0x8c95b5
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x8c954a
lea esp, [esp + 2]
mov dword [esp + 4], edi
lea esp, [esp + 4]
jmp 0x8c9560
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
insb byte es:[edi], dx
inc ebp
or byte [ebx + 0x40c0240d], cl
add byte [eax - 0x7d], dl
rol dword [eax + 0x68], 0x35
rol byte [eax], cl
rcr byte [ebp + 0x6a], 0x80
test byte [eax], 0xa1
lodsb al, byte [esi]
add ah, byte [edi]
sub dword [eax + 0x74c0850c], 0xf
push eax
push str.Total_of__d_requests_completed_n
call dword [0x401f77]
add esp, 0xffffff8a
push 0xffffffffffffffbc
call dword [sym.imp.MSVCRT.dll_exit]
nop
push ebp
mov ebp, esp
sub esp, 0x4c
sar dword [eax + 2], cl
jp 0x401765
push esi
sar byte [ebp - 0x23], 0x40
scasd eax, dword es:[edi]
add byte [eax + esi*2 + 0x68], dh
inc eax
cmp eax, 0xe85000a6
sahf
inc eax
add byte [eax], al
mov cx, word [0x419774]
jmp 0x4017cf
mov dword [0x411808], eax
mov eax, dword [0x410288]
push ebx
jp 0x40182b
cmc
rol dword fs:[eax], 0x66
mov dword [0x790bb4], ecx
mov al, al
push edi
jne 0x40184a
mov edx, dword [0x411800]
mov esi, 0x40d498d8
add bh, bh
lodsd eax, dword [esi]
mov eax, dword [0x410278]
add esp, 8
les ecx, [eax]
test eax, eax
je 0x40181c
mov eax, dword [0x410274]
cmp dword [eax + 0x40], ebp
inc eax
cmp al, 0x41
mov byte [eax - 0x7c], ch
aam 0x40
add bh, bh
cwde
add esp, 0xc
mov eax, dword [0xf040d514]
test dword [0x406f80b8], ebp
add byte [ebp + 5], dh
mov eax, 0x40d47c
push eax
push ebx
jl 0x401801
inc eax
add byte [eax + 0x53], dl
insb byte es:[edi], dx
aam 0x95
add bh, bh
salc
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
add ecx, 0x20
or eax, 0xc13ee5ff
mov ebp, 0x99c46900
mov edx, dword [0x40d018]
mov esi, dword [sym.imp.MSVCRT.dll_calloc]
push 0x860
call esi
mov dword [0x410bb0], eax
mov eax, dword [0x40d010]
push 0x28
push eax
call esi
mov ecx, dword [0x414014]
mov edx, dword [0x40d018]
add esp, 0x10
mov dword [0xf6410bc8], eax
cmp esp, dword [ebp + 0x51]
xchg ecx, eax
push 0x41fcf8
xor al, byte [ecx - 0x114cb4b9]
sal byte [edx + edx - 9], 0x68
sbb ah, dl
inc eax
int 0xe8
mov byte [0x83000005], al
les ecx, [eax]
insd dword es:[edi], dx
jl 0x4018a6
inc ebp
add cl, bh
stc
sal byte [ebp + 0x35], 0xa1
lodsb al, byte [esi]
or eax, dword [ecx]
xchg edi, eax
or eax, 0x410b9c
mov edx, dword [0xad414034]
push 0
push 0x40d19c
push eax
dec ecx
dec esp
inc eax
inc ecx
add byte [ecx + 0x68], cl
dec eax
mov ecx, 0x50c10017
call fcn.00405890
add esp, 0x1c
mov dword [0xf5324048], eax
jmp 0x4018c3

Function at 0x406200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc ecx
xor ecx, dword [ecx + 0x74330448]
pop ebx
pop ebp
ret 8
push ebp
mov ebp, esp
sub esp, 8
pop esi
inc ebp
jb 0x40625d
push esi
push edi
cmp dword [eax + 4], 1
jne 0x40638d
mov ebx, dword [eax + 0xc]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [eax + 4]
mov edi, dword [ebx + 4]
test edx, edx
mov dword [ebp + 9], edi
jbe 0x406240
loop 0x4061dd
sbb al, 0x30
add byte [eax], al
add esi, 0xc
cmp ebx, dword [esi]
stc
or ch, byte [esi]
fbstp tbyte [esi - 0x40]
invalid
sbb byte [ecx], bh
int3
aad 0xeb
or edi, dword [edx]
push 0xc1369411
pop ebp
mov ebx, edx
std
mov word [eax - 0x7bf014a0], ss
jg 0x406251
push 0xb180d4a1
iretd
je 0x406407
adc byte [eax], ah
xchg ecx, eax
leave
Function at 0x406721
Capabilities:
Encode data using xor

Disassembly:
pop esi
push esi
xor dword [esi], ebx
lodsd eax, dword [esi]
add ebx, eax
test eax, eax
jne 0x406723
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x19a17669
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
mov esi, 0xbf2365c
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x40144c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 4, 0
mov esi, eax
lea edx, [eax + 1]
imul edx, dword [0x402050]
mov ebx, eax
mov eax, 0x402054
call fcn.0040139e
lea edx, [ebp - 4]
push edx
mov edx, esi
or dl, 0x40
mov edi, 0x401e27
push edx
sub edi, fcn.004015f2
push edi
xor eax, eax
push fcn.004015f2
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp - 4], 0
je 0x4014b8
mov eax, fcn.004015f2
mov ebx, esi
mov edx, edi
call fcn.0040139e
mov edx, 0x1be00
mov eax, 0x402054
mov ebx, esi
call fcn.0040126b
leave
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x401535
Capabilities:
Encode data using base64 via winapi
Initialize winsock library

Disassembly:
push ebx
push ecx
push edx
enter 0x13c, 0
push 0
push 0x202
call dword [sym.imp.WS2_32.DLL_WSAStartup]
xor eax, eax
push eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push 0x7f00
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x1c], 6
push eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.USER32.DLL_LoadIconA]
push 0x7f00
push 0
mov dword [ebp - 0x24], eax
call dword [sym.imp.USER32.DLL_LoadCursorA]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.DLL_RegisterClassW]
push 0
push 0
call dword [sym.imp.USER32.DLL_LoadAcceleratorsA]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push 1
lea eax, [ebp - 0x13c]
push eax
mov dword [ebp - 4], 0xa
mov byte [ebp - 0x13c], 0
call dword [sym.imp.CRYPT32.DLL_CryptBinaryToStringA]
movzx eax, byte [ebp - 0x10]
lea ebx, [eax - 0x47]
call dword [sym.imp.WS2_32.DLL_WSACleanup]
mov eax, dword [ebp - 4]
add eax, ebx
leave
pop edx
pop ecx
pop ebx
ret