joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fc80
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov eax, 0x22dc
push edi
push esi
push ebx
call fcn.004024f0
sub esp, eax
mov dword [esp], str.worldtimeapi.org
call dword [sym.imp.WS2_32.dll_gethostbyname]
sub esp, 4
test eax, eax
je 0x40fe8f
mov dword [esp + 8], 0
mov ebp, eax
mov dword [esp + 4], 1
mov dword [esp], 2
call dword [sym.imp.WS2_32.dll_socket]
sub esp, 0xc
mov ebx, eax
cmp eax, 0xffffffff
je 0x40fe8f
mov eax, 2
lea edi, [esp + 0x34]
mov esi, 0x412100
xor edx, edx
mov ecx, 0x4f
mov word [esp + 0x24], ax
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x4e
jmp 0x40fd07
lea ecx, [eax - 1]
cmp ecx, edx
jl 0x40fd1f
mov eax, ecx
sub eax, edx
sar eax, 1
add eax, edx
cmp dword [esp + eax*4 + 0x34], 0x57
je 0x40fd1f
jg 0x40fd00
lea edx, [eax + 1]
cmp ecx, edx
jge 0x40fd07
mov dword [esp], 0x50
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [ebp + 0xc]
movsx ecx, word [ebp + 0xa]
sub esp, 4
mov edx, dword [edx]
mov word [esp + 0x26], ax
lea eax, [esp + 0x28]
lea esi, [esp + 0x24]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._memcpy
mov dword [esp + 8], 0x10
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_connect]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x40fe87
lea esi, [esp + 0x2d0]
mov dword [esp + 0x10], str.worldtimeapi.org
mov dword [esp + 0xc], str._api_timezone_Europe_London.txt
mov dword [esp + 8], str.GET__s_HTTP_1.1_r_nHost:__s_r_nConnection:_close_r_n_r_n
mov dword [esp + 4], 0x1000
mov dword [esp], esi
call sym._snprintf.constprop.0
mov dword [esp], esi
call sym._strlen
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
cmp eax, 0xffffffff
je 0x40fe87
mov esi, dword [sym.imp.WS2_32.dll_recv]
lea ebp, [esp + 0x12d0]
jmp 0x40fdf0
mov byte [esp + eax + 0x12d0], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xfff
mov dword [esp + 4], ebp
mov dword [esp], ebx
call esi
sub esp, 0x10
test eax, eax
jg 0x40fde8
lea eax, [esp + 0x20]
mov dword [esp], ebp
lea edi, [esp + 0x170]
mov esi, 0x412240
mov dword [esp + 8], eax
mov dword [esp + 4], str.unixtime
call sym._extractField
mov ecx, 0x58
xor edx, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x57
jmp 0x40fe4f
lea ecx, [eax - 1]
cmp ecx, edx
jl 0x40fe6a
mov eax, ecx
sub eax, edx
sar eax, 1
add eax, edx
cmp dword [esp + eax*4 + 0x170], 0x49
je 0x40fe6a
jg 0x40fe48
lea edx, [eax + 1]
cmp ecx, edx
jge 0x40fe4f
mov dword [esp], ebx
call sym._close
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [esp + 0x20]
add esp, 0x22dc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call sym._close
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [esp], 1
call sym._exit
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x4179b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x4179c3
pop dword [ebp - 8]
mov eax, 0xf5d58639
add eax, 0xa6bf38a
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x3d525
push 0
mov eax, 0xc40c6d46
add eax, 0x3c35e4d2
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x8906573
sub ecx, 0x8901f32
xor esi, esi
add esi, eax
mov edx, 0x5fa5b40f
sub edx, 0x5f62600f
add edx, dword [ebp - 8]
mov ebx, 0x1e308871
sub dword [ebp - 4], esi
mov edi, dword [edx]
sub dword [ebp - 4], edi
xor edi, ebx
xor dword [ebp - 4], ecx
mov dword [esi], edi
xor dword [ebp - 4], esi
add esi, 0x9dbbc543
add esi, 0x62443ac1
add edx, 0x4ada46e3
add edx, 0xb525b921
loop 0x417a1e
add eax, 0x89431c4c
sub eax, 0x89421075
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x10140c00
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x10140dc4
pushal
mov esi, section.UPX1
lea edi, [esi - 0x67000]
push edi
jmp 0x10140c2a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10140c31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10140c20
mov eax, 1
add ebx, ebx
jne 0x10140c43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10140c38
jne 0x10140c54
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10140c38
xor ecx, ecx
sub eax, 3
jb 0x10140c68
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x10140cda
mov ebp, eax
add ebx, ebx
jne 0x10140c73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x10140c80
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x10140ca4
inc ecx
add ebx, ebx
jne 0x10140c90
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10140c85
jne 0x10140ca1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10140c85
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10140cc4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10140cb5
jmp 0x10140c26
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10140cc4
add edi, ecx
jmp 0x10140c26
pop esi
mov edi, esi
mov ecx, 0x257
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10140ce2
cmp byte [edi], 7
jne 0x10140ce2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10140ce7
lea edi, [esi + 0x13e000]
mov eax, dword [edi]
or eax, eax
je 0x10140d56
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x140000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x140120]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10140d14
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x140124]
or eax, eax
je 0x10140d50
mov dword [ebx], eax
add ebx, 4
jmp 0x10140d31
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10140d87
cmp al, 0xef
ja 0x10140d7a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x10140d5c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10140d69
mov ebp, dword [esi + 0x140128]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10140dbb
sub esp, 0xffffff80
jmp 0x1000d9c9
Function at 0x401800
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0xc08
push ebx
push ebp
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 8], edx
push esi
push edi
test ecx, ecx
je 0x40184b
xor esi, esi
lea edi, [esp + 0x818]
mov al, byte [esi + ecx]
test al, al
je 0x40183b
cbw
inc esi
mov word [edi], ax
add edi, 2
cmp esi, 0x1ff
jb 0x401821
jmp 0x401840
xor eax, eax
mov word [edi], ax
lea edx, [esp + 0x818]
mov dword [esp + 0x10], edx
xor edi, edi
xor ebp, ebp
test edx, edx
je 0x40189b
mov edi, edx
lea ecx, [edi + 2]
jmp 0x401860
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x401860
sub edi, ecx
sar edi, 1
cmp edi, 0x200
jb 0x40187c
mov edi, 0x1ff
push edi
push edx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00402790
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x4018bd
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x401930
mov esi, dword [ebx]
cmp esi, ebx
je 0x401930
test esi, esi
je 0x401930
cmp word [esi + 0x24], 2
jbe 0x40192a
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x40192a
cmp dword [esi + 0x18], 0
je 0x40192a
test ebp, ebp
je 0x4018e5
cmp ebp, eax
jne 0x40192a
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00402790
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40190a
cmp eax, dword [esi + 0x18]
jne 0x40192a
cmp dword [esp + 0x10], 0
je 0x40193d
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00402730
add esp, 8
test eax, eax
je 0x40193d
mov esi, dword [esi]
cmp esi, ebx
jne 0x4018c3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc08
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc08
ret
Function at 0x401b90
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Get windows directory from kuser_shared_data

Disassembly:
mov eax, dword [0x7ffa08]
sub esp, 0x20c
push ebp
mov ebp, ecx
push esi
push edi
test eax, eax
je 0x401d3d
cmp dword [0x7ffa0c], 0
jne 0x401d29
xor eax, eax
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
mov byte [esp + 0x1e], al
lea eax, [esp + 0x20]
push eax
call fcn.00401e00
add esp, 0xc
xor edi, edi
xor eax, eax
nop
mov byte [esp + eax + 0x18], al
inc eax
cmp eax, 0x100
jb 0x401be0
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x18]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41d0d4]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + edi + 0x18], dl
cmp esi, 0x100
jb 0x401bf0
xor esi, esi
xor edi, edi
xor edx, edx
lea eax, [esi + 1]
movzx esi, al
mov cl, byte [esp + esi + 0x18]
movzx eax, cl
add eax, edi
movzx edi, al
movzx eax, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
mov byte [esp + edi + 0x18], cl
movzx eax, byte [esp + esi + 0x18]
movzx ecx, cl
add ecx, eax
movzx eax, cl
movzx eax, byte [esp + eax + 0x18]
xor al, byte [edx + 0x41d0d8]
mov byte [esp + edx + 0xc], al
inc edx
cmp edx, 0xb
jb 0x401c25
push 0x200
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00401e00
mov edx, 0x7ffe0030
add esp, 0xc
xor ecx, ecx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x401c84
sub edx, esi
sar edx, 1
je 0x401d3d
mov esi, ebp
lea edi, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x401ca0
sub esi, edi
add edx, 0xc
add edx, esi
cmp edx, 0x200
ja 0x401d3d
xor eax, eax
push ebx
test edx, edx
je 0x401cd8
movzx ebx, word [eax + eax + 0x7ffe0030]
test bx, bx
je 0x401cd8
mov byte [esp + eax + 0x1c], bl
inc ecx
inc eax
cmp eax, edx
jb 0x401cc1
xor eax, eax
test edx, edx
je 0x401cf2
mov edi, edi
mov bl, byte [esp + eax + 0x10]
test bl, bl
je 0x401cf2
mov byte [esp + ecx + 0x1c], bl
inc eax
inc ecx
cmp eax, edx
jb 0x401ce0
xor eax, eax
test edx, edx
je 0x401d0f
lea ecx, [esp + ecx + 0x1c]
lea esp, [esp]
mov bl, byte [eax + ebp]
test bl, bl
je 0x401d0f
mov byte [ecx], bl
inc eax
inc ecx
cmp eax, edx
jb 0x401d00
push 8
push 0
lea eax, [esp + 0x24]
push eax
call dword [0x7ffa08]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
push 0x800
push 0
push ebp
call eax
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20c
ret
Function at 0x401e30
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0x808
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edx
xor ebp, ebp
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x401e8b
mov edi, ecx
lea edx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x401e50
sub edi, edx
sar edi, 1
cmp edi, 0x200
jb 0x401e6c
mov edi, 0x1ff
push edi
push ecx
lea eax, [esp + 0x420]
push eax
lea ebp, [edi + edi]
call fcn.00402790
add esp, 0xc
xor eax, eax
mov word [esp + ebp + 0x418], ax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
jne 0x401ead
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0x14
je 0x401f1f
mov esi, dword [ebx]
cmp esi, ebx
je 0x401f1f
test esi, esi
je 0x401f1f
cmp word [esi + 0x24], 2
jbe 0x401f19
movzx eax, word [esi + 0x2c]
cmp eax, 2
jbe 0x401f19
cmp dword [esi + 0x18], 0
je 0x401f19
test ebp, ebp
je 0x401ed5
cmp ebp, eax
jne 0x401f19
push edi
push dword [esi + 0x30]
lea eax, [esp + 0x20]
push eax
call fcn.00402790
mov edx, dword [esp + 0x1c]
xor eax, eax
add esp, 0xc
mov word [esp + edi*2 + 0x18], ax
test edx, edx
je 0x401efa
cmp edx, dword [esi + 0x18]
jne 0x401f19
cmp dword [esp + 0x14], eax
je 0x401f2c
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x41c]
push eax
call fcn.00402730
add esp, 8
test eax, eax
je 0x401f2c
mov esi, dword [esi]
cmp esi, ebx
jne 0x401eb3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x808
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x808
ret
Function at 0x4035f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [0x800780]
sub esp, 0x11c
test eax, eax
jne 0x4036ee
push ebx
push esi
push edi
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], ax
lea eax, [esp + 0x30]
push eax
call fcn.00401e00
add esp, 0xc
xor edi, edi
xor eax, eax
lea ebx, [ebx]
mov byte [esp + eax + 0x28], al
inc eax
cmp eax, 0x100
jb 0x403640
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x28]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + str.u3R5]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x28]
mov byte [esp + esi + 0x28], al
inc esi
mov byte [esp + edi + 0x28], dl
cmp esi, 0x100
jb 0x403650
xor edi, edi
xor ebx, ebx
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [esp + edi + 0x28]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
movzx eax, byte [esp + ebx + 0x28]
mov byte [esp + edi + 0x28], al
mov byte [esp + ebx + 0x28], cl
movzx eax, byte [esp + edi + 0x28]
add eax, edx
movzx eax, al
movzx eax, byte [esp + eax + 0x28]
xor al, byte [esi + 0x41d104]
mov byte [esp + esi + 0xc], al
inc esi
cmp esi, 0x1a
jb 0x403685
xor edx, edx
lea ecx, [esp + 0xc]
call fcn.00401e30
pop edi
pop esi
pop ebx
test eax, eax
je 0x4036e9
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4036e9
mov dword [0x800780], eax
add esp, 0x11c
ret
mov eax, dword [0x800780]
add esp, 0x11c
ret

Function at 0x403700
Capabilities:
Check os version

Disassembly:
mov ecx, 1
mov edx, 0x7ffb48
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x403829
cmp dword fs:[0xc0], eax
je 0x40372b
mov dword [0x7ffb44], 1
mov eax, dword fs:[0x18]
push ebx
push esi
mov ebx, 1
mov esi, dword [eax + 0x30]
mov eax, dword [esi + 0xa4]
mov dword [0x7ffa2c], eax
mov eax, dword [esi + 0xa8]
mov dword [0x7ffa30], eax
movzx edx, word [esi + 0xac]
mov dword [0x7ffa34], edx
mov eax, dword [esi + 0xb0]
mov dword [0x7ffa38], eax
mov eax, dword [esi + 0x1f4]
test eax, eax
je 0x40378b
push 0x7f
push eax
push 0x7ffa3c
call fcn.00402790
mov edx, dword [0x7ffa34]
add esp, 0xc
jmp 0x403793
xor eax, eax
mov word [0x7ffa3c], ax
movzx eax, byte [esi + 0xaf]
mov ecx, 0xff
mov word [0x7ffb3c], ax
movzx eax, word [esi + 0xae]
and ax, cx
mov word [0x7ffb3e], ax
movzx eax, word [0x7ffe02d0]
mov word [0x7ffb40], ax
mov ecx, eax
mov byte [0x7ffb42], 0
cmp byte [0x7ffe0268], 0
je 0x4037da
mov ebx, dword [0x7ffe0264]
pop esi
mov byte [0x7ffb42], bl
cmp ebx, 1
pop ebx
jne 0x4037f4
and ecx, 0xffef
mov word [0x7ffb40], cx
test edx, edx
jne 0x403829
call fcn.00403700
cmp dword [0x7ffa2c], 6
ja 0x403829
jb 0x403811
cmp dword [0x7ffa30], 4
jae 0x403829
call fcn.00403700
cmp dword [0x7ffa2c], 0xa
jae 0x403829
mov dword [0x7ffa34], 1
ret
Function at 0x403b70
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
sub esp, 0x40
push ebx
push esi
push edi
test ecx, ecx
jle 0x403b98
mov eax, dword [ebp + 0x10]
lea edx, [ebp + 0x18]
dec ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0xc], eax
jmp 0x403ba6
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
test ecx, ecx
jle 0x403bbf
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x403bcd
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
test ecx, ecx
jle 0x403be6
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x403bf4
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
test ecx, ecx
jle 0x403c0d
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x24], eax
jmp 0x403c1b
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov eax, edx
mov dword [ebp - 0x30], 0
cdq
mov dword [ebp - 0x40], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x403c62
add dword [esp], 5
retf
Function at 0x41caa2
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40150b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x88], 0
call fcn.0040144f
test eax, eax
jne 0x4015a5
lea eax, [ebp - 0x8c]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, 0x40203e
sub eax, 0x4015dc
mov dword [esp], 0x4015dc
mov dword [esp + 4], eax
mov dword [ebp - 0x8c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x4015a5
lea ebx, [ebp - 0x88]
mov dword [esp], 0
call fcn.0040133e
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.004013c2
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1b600
mov dword [esp], 0x40300c
call fcn.00401d41
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x163a5a22
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data_1
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x3d1941b9
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x404ae5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x404af4
pop dword [ebp - 0x1c]
mov eax, 0x5d0877eb
add eax, 0xa337d309
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x55132
push 0
mov eax, 0x637a59b7
sub eax, 0x6335a6fb
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x5cb8
xor edx, edx
add edx, eax
mov esi, 0xb229632f
add esi, 0x4e1f1ad1
add esi, dword [ebp - 0x1c]
mov ebx, 0x4862f1ce
add ebx, 0xf559d5af
mov dword [ebp - 0x10], 0x2e80059a
mov edi, dword [esi]
add dword [ebp - 0x18], 0x5aa18af8
add edi, ebx
mov dword [ebp - 0xc], 0x25ea3cb7
mov dword [edx], edi
xor dword [ebp - 0x18], ebx
add edx, 0xa158c69e
add edx, 0x5ea73966
add esi, 0x2219603a
add esi, 0xdde69fca
loop 0x404b4f
add eax, 0xad1b4488
add eax, 0x52e6212b
xor ebx, ebx
add ebx, eax
add eax, 0x6f486776
sub eax, 0x6f486771
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret