joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a140
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42758e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4305c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x10]
push eax
push 0
lea ecx, [edi + 4]
mov dword [ebp - 0x10], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
call fcn.0040a460
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
push 0
lea ecx, [edi + 0x24]
mov dword [ebp - 0x10], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.0040a460
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea ecx, [edi + 0x40]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x20]
mov byte [ebp - 4], 2
mov dword [edi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x58], esi
mov dword [edi + 0x60], edx
mov byte [edi + 0x64], 0
mov dword [edi + 0x68], eax
test byte [esi + 8], 8
je 0x40a254
test dl, 0x10
jne 0x40a254
mov eax, 1
jmp 0x40a256
xor eax, eax
mov byte [edi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x70], eax
push dword [esi + 0x18]
call fcn.0040a2f0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x40d5a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov edx, 0x811c9dc5
mov ecx, 0
sub esi, edi
je 0x40d5d1
lea esp, [esp]
movzx eax, byte [ecx + edi]
xor edx, eax
inc ecx
imul edx, edx, 0x1000193
cmp ecx, esi
jb 0x40d5c0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x41ed1c
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4305c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0041cb48
mov dword [ebp - 0x14], eax
cmp dword [0x4391c8], edi
jne 0x41ee0d
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x41ed9a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x41eeed
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x41eeed
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41eeed
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x4391c8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x4391cc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x4391d0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4391d8], eax
test eax, eax
je 0x41ee0a
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4391d4], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41ee32
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41ee25
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x41ee47
push 4
pop eax
jmp 0x41eeef
cmp dword [ebp - 0x14], edi
je 0x41ee47
push dword [0x4391c8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x41ee2c
mov eax, dword [0x4391d4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x41eea5
cmp dword [0x4391d8], esi
je 0x41eea5
push eax
call ebx
push dword [0x4391d8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41eea5
test eax, eax
je 0x41eea5
call ecx
test eax, eax
je 0x41ee9a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41ee9a
test byte [ebp - 8], 1
jne 0x41eea5
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x41eed5
mov eax, dword [0x4391cc]
cmp eax, esi
je 0x41eed2
push eax
call ebx
test eax, eax
je 0x41eed2
call eax
mov edi, eax
test edi, edi
je 0x41eed2
mov eax, dword [0x4391d0]
cmp eax, esi
je 0x41eed2
push eax
call ebx
test eax, eax
je 0x41eed2
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x4391c8]
call ebx
test eax, eax
je 0x41eeed
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x41eeef
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00410fdd
leave
ret
Function at 0x401dd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebx + 8]
push esi
mov esi, eax
xor eax, eax
push edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
cmp eax, ecx
ja 0x401dfd
jb 0x401df5
cmp esi, edx
jae 0x401dfd
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], eax
jmp 0x401e03
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], eax
ja 0x401e11
cmp dword [ebp - 0x10], eax
jbe 0x401e98
mov eax, dword [ebx]
or eax, dword [ebx + 4]
jne 0x401e2f
mov ecx, dword [ebp + 0x18]
mov edi, dword [ebp + 0x16]
mov esi, dword [ebp + 8]
push ecx
call fcn.00401ed0
add esp, 4
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov esi, dword [ebx + 4]
mov eax, dword [ebp - 0xc]
mov edi, dword [ebx]
cmp esi, eax
jb 0x401e47
ja 0x401e42
cmp edi, dword [ebp - 0x10]
jbe 0x401e47
mov edi, dword [ebp - 0x10]
mov esi, eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
push edx
push edi
lea ecx, [eax + 0x277b380]
push 1
push ecx
call fcn.00419c29
add esp, 0x10
xor ecx, ecx
cmp eax, edi
jne 0x401ea1
cmp ecx, esi
jne 0x401ea1
add dword [ebp - 0x18], edi
mov eax, dword [ebp - 0xc]
adc dword [ebp - 0x14], esi
add dword [ebp - 4], edi
sub dword [ebx], edi
sbb dword [ebx + 4], esi
sub dword [ebx + 8], edi
sbb dword [ebx + 0xc], esi
sub dword [ebp - 0x10], edi
sbb eax, esi
mov dword [ebp - 0xc], eax
test eax, eax
ja 0x401e11
jb 0x401e98
cmp dword [ebp - 0x10], ecx
ja 0x401e11
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
push edi
push str.Error_when_trying_to_read__llu_bytes_of_data_in_sparse_read_n
push 0x840
push str.sparse_read
push 1
call fcn.00401210
add esp, 0x18
push 1
call fcn.004017c0
int3

Function at 0x401ed0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4363f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xc
lea eax, [ebp - 0x10]
push 1
push eax
call fcn.00419c29
add esp, 0x10
cmp eax, 0xc
je 0x401f16
push str.Didnt_get_proper_amount_of_bytes_for_chunk_header_n
push 0x897
push str.read_chunk_header
push 1
call fcn.00401210
add esp, 0x10
push 1
call fcn.004017c0
movzx edi, di
cmp edi, 0xc
jbe 0x401f2f
push 1
lea ecx, [edi - 0xc]
push 0
push ecx
push esi
call fcn.0041935a
add esp, 0x10
mov edx, 0xcac3
cmp word [ebp - 0x10], dx
jne 0x401f76
lea ebx, [ebx]
push esi
push 0xc
lea eax, [ebp - 0x10]
push 1
push eax
call fcn.00419c29
add esp, 0x10
cmp eax, 0xc
jne 0x401f8d
cmp edi, eax
jbe 0x401f6b
push 1
lea ecx, [edi - 0xc]
push 0
push ecx
push esi
call fcn.0041935a
add esp, 0x10
mov edx, 0xcac3
cmp word [ebp - 0x10], dx
je 0x401f40
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp + 8]
xor ecx, ebp
xor edx, edx
call fcn.00417d45
mov esp, ebp
pop ebp
ret
push str.Didnt_get_proper_amount_of_bytes_for_chunk_header_n
push 0x8a8
jmp 0x401f00
Function at 0x401fa0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x1c]
push esi
push edi
push ebx
push 0x1c
lea ecx, [ebp - 0x28]
push 1
push ecx
mov dword [ebp - 4], eax
call fcn.00419c29
add esp, 0x10
cmp eax, 0x1c
je 0x401fe4
push str.Didnt_properly_read_the_sparse_header__n
push 0x865
push str.read_sparse_header
push 1
call fcn.00401210
add esp, 0x10
push 1
call fcn.004017c0
movzx eax, word [ebp - 0x20]
cmp eax, 0x1c
jbe 0x401ffe
push 1
add eax, 0xffffffe4
push 0
push eax
push ebx
call fcn.0041935a
add esp, 0x10
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push 0
push edx
push eax
mov ecx, 7
lea esi, [ebp - 0x28]
push ebx
rep movsd dword es:[edi], dword [esi]
call fcn.0041935a
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov di, word [eax + 0xa]
push ecx
mov esi, ebx
call fcn.00401ed0
mov ecx, dword [ebp - 4]
add esp, 0x14
pop edi
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 4], edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402a20
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0x4000
call fcn.00418f16
mov dword [esi + 0xd50], eax
mov eax, dword [esi + 0x938]
imul eax, dword [esi + 0x914]
add esp, 4
xor ecx, ecx
add eax, dword [esi + 0x948]
push 0
adc ecx, dword [esi + 0x94c]
push ecx
push eax
push edi
call fcn.0041935a
push edi
push 0x200
lea edx, [esi + 0x950]
push 1
push edx
call fcn.00419c29
add esp, 0x20
cmp eax, 0x200
je 0x402a97
push str.ERROR___couldnt_properly_read_out_the_protective_MBR_n
push 0x98f
push str.ReadFFUGPT
push 1
call fcn.00401210
add esp, 0x10
push 1
call fcn.004017c0
push edi
push 4
lea eax, [esi + 0xb50]
push 1
push eax
call fcn.00419c29
add esp, 0x10
cmp eax, 4
je 0x402abc
push str.ERROR___couldnt_properly_read_out_the_Gpt_Header_n
push 0x996
jmp 0x402a81
mov ecx, dword [esi + 0xd50]
push edi
push 0x4000
push 1
push ecx
call fcn.00419c29
add esp, 0x10
cmp eax, 0x4000
je 0x402ae6
push str.ERROR___couldnt_properly_read_gpt_entries_n
push 0x99d
jmp 0x402a81
pop ecx
ret
Function at 0x40abc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, eax
xor edi, edi
mov dword [ebp - 4], edi
cmp esi, 0x100000
jbe 0x40abdd
mov esi, 0x100000
cmp byte [0x238a859], 0
push esi
je 0x40ac28
push str._n_nINTERACTIVE_Press_any_key_to_attempt_to_READ__d_bytes__q_to_quit_interactive_:
call fcn.0041984f
add esp, 8
call fcn.0041a881
push 2
push edi
push edi
mov bl, al
call fcn.00419036
push eax
call fcn.0041935a
add esp, 0x10
cmp bl, 0x71
jne 0x40ac19
mov byte [0x238a859], 0
push 0x42f210
call fcn.0041984f
add esp, 4
jmp 0x40ac47
mov eax, dword [0x238a844]
push eax
push str.CharsInBuffer_d_Trying_to_read_from_USB__ld_bytes
push 0x13ec
push str.ReadPort
push 5
call fcn.00401210
add esp, 0x18
xor ebx, ebx
cmp dword [0x437414], ebx
jl 0x40accf
jg 0x40ac5b
cmp dword [0x437410], ebx
jbe 0x40accf
mov edx, dword [ebp + 8]
mov eax, dword [0x238a824]
push 0
lea ecx, [ebp - 4]
push ecx
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov eax, dword [ebp - 4]
jne 0x40ac7c
add dword [ebp + 8], eax
sub esi, eax
test eax, eax
jne 0x40acbd
cmp dword [0x437414], eax
jl 0x40aca3
jg 0x40ac98
cmp dword [0x437410], 0x3e8
jbe 0x40aca3
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
add edi, 1
adc ebx, 0
cmp ebx, dword [0x437414]
jl 0x40ac5b
jg 0x40accf
cmp edi, dword [0x437410]
jb 0x40ac5b
jmp 0x40accf
cmp ebx, dword [0x437414]
jl 0x40acf4
jg 0x40accf
cmp edi, dword [0x437410]
jb 0x40acf4
push 0x23f7a60
push str.Could_not_read_from__s__Windows_API_ReadFile_failed__Your_device_is_probably_not_on_this_port_n_n
push 0x1426
push str.ReadPort
push 1
call fcn.00401210
add esp, 0x14
push 1
call fcn.004017c0
push eax
push str.CHANNEL_DATA___ld_bytes______TARGET_to_HOST
push 0x142a
push str.ReadPort
push 5
call fcn.00401210
mov eax, dword [ebp - 4]
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415cd0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x4363f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x238a862], 0
push ebx
push esi
push edi
mov esi, ecx
jne 0x415d37
lea eax, [ebp - 0x40]
push eax
push 0x23f8260
call fcn.00418acc
add esp, 8
test eax, eax
jne 0x415d37
push 0x23f8260
push str._s_already_exists_and___forceoverwrite_not_set._Leaving_file_as_is.
push 0x2a4a
push str.MyCopyFile
push 4
call fcn.00401210
add esp, 0x14
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00417d45
mov esp, ebp
pop ebp
ret
push 0x800
mov edx, 0x42e7e0
mov ecx, esi
call fcn.00410f40
add esp, 4
mov esi, eax
push 0x800
mov edx, 0x42d92c
mov ecx, 0x23f8260
mov dword [ebp - 0x48], esi
call fcn.00410f40
add esp, 4
push str._BEGIN_COPY
mov dword [ebp - 0x44], eax
call fcn.0041984f
add esp, 4
push esi
push 0x100000
push 1
push 0x253b2c0
xor ebx, ebx
call fcn.00419c29
push 0x42e8f8
mov esi, eax
xor edi, edi
call fcn.0041984f
mov ecx, esi
add esp, 0x14
or ecx, edi
je 0x415df0
mov edx, dword [ebp - 0x44]
push edx
push esi
push 1
push 0x253b2c0
call fcn.00419ea9
mov ebx, eax
add esp, 0x10
xor eax, eax
cmp ebx, esi
jne 0x415df0
cmp eax, edi
jne 0x415df0
mov eax, dword [ebp - 0x48]
push eax
push 0x100000
push 1
push 0x253b2c0
xor ebx, ebx
call fcn.00419c29
push 0x42e8f8
mov esi, eax
xor edi, edi
call fcn.0041984f
mov ecx, esi
add esp, 0x14
or ecx, edi
jne 0x415da2
mov edx, dword [ebp - 0x48]
push edx
call fcn.0041a4c4
mov eax, dword [ebp - 0x44]
add esp, 4
push eax
call fcn.0041a4c4
add esp, 4
cmp ebx, esi
jne 0x415e12
xor eax, eax
cmp eax, edi
je 0x415e26
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00417d45
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00417d45
mov esp, ebp
pop ebp
ret
Function at 0x417a20
Capabilities:
Hash data using sha256

Disassembly:
test ebx, ebx
je 0x417a54
push esi
push edi
push 0x8c
push 0
push ebx
call fcn.0041d060
add esp, 0xc
lea edi, [ebx + 8]
mov ecx, 8
mov esi, 0x42bf98
rep movsd dword es:[edi], dword [esi]
pop edi
mov dword [ebx], 0
mov dword [ebx + 4], 0
pop esi
ret

Function at 0x417d45
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4363f4]
jne 0x417d4f
repz ret
jmp fcn.0041aa1a

Function at 0x41ce85
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x41ceac
call fcn.004196e1
mov dword [eax], esi
call fcn.004196ce
push 0x16
pop esi
mov dword [eax], esi
call fcn.0041b765
mov eax, esi
jmp 0x41cf01
test dword [ebp + 0xc], 0xfffffff9
jne 0x41ce92
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41ced9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004196f4
pop ecx
call fcn.004196ce
mov eax, dword [eax]
jmp 0x41cf01
test al, 0x10
jne 0x41ceff
test al, 1
je 0x41ceff
test byte [ebp + 0xc], 2
je 0x41ceff
call fcn.004196e1
mov dword [eax], 5
call fcn.004196ce
mov dword [eax], 0xd
jmp 0x41ced0
xor eax, eax
pop esi
pop ebp
ret
Function at 0x424b44
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4363f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0041c38c
and dword [ebp - 0x14], 0
cmp dword [0x448f0c], 0
mov dword [ebp - 0x18], eax
jne 0x424bf7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x424c9f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x424c9f
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x448f0c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x448f10], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x448f14], eax
call edi
push eax
call esi
mov dword [0x448f1c], eax
test eax, eax
je 0x424bf7
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x448f18], eax
mov eax, dword [0x448f18]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x424c50
cmp dword [0x448f1c], ecx
je 0x424c50
push eax
call esi
push dword [0x448f1c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x424c50
test ebx, ebx
je 0x424c50
call edi
test eax, eax
je 0x424c47
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x424c47
test byte [ebp - 8], 1
jne 0x424c50
or dword [ebp + 0x10], 0x200000
jmp 0x424c83
mov eax, dword [0x448f10]
cmp eax, dword [ebp - 0x18]
je 0x424c83
push eax
call esi
test eax, eax
je 0x424c83
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x424c83
mov eax, dword [0x448f14]
cmp eax, dword [ebp - 0x18]
je 0x424c83
push eax
call esi
test eax, eax
je 0x424c83
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x448f0c]
call esi
test eax, eax
je 0x424c9f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x424ca1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00417d45
leave
ret
Function at 0x42e004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x74e57242
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0xed5299a
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x40eee0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444e4a
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x455014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
mov eax, dword [ebp + 8]
push 0x2f
mov esi, dword [eax - 0xc]
call dword [sym.imp.mfc140.dll_Ordinal_12826]
sub esi, eax
lea ecx, [ebp + 8]
dec esi
lea eax, [ebp - 0x14]
push esi
push eax
call dword [sym.imp.mfc140.dll_Ordinal_12863]
push ecx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call dword [sym.imp.mfc140.dll_Ordinal_300]
push ecx
lea eax, [ebp + 8]
mov byte [ebp - 4], 2
mov ecx, esp
push eax
call dword [sym.imp.mfc140.dll_Ordinal_300]
mov byte [ebp - 4], 1
call fcn.00442150
add esp, 4
mov byte [edi + 0x1878], 1
lea eax, [ebp - 0x14]
mov ecx, esp
mov edx, 0x457bc8
push eax
call fcn.0040faf0
add esp, 4
lea ecx, [edi + 0x998]
call fcn.00424f80
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
push eax
mov edx, 0x457bc8
call fcn.0040faf0
add esp, 4
lea ecx, [edi + 0x318]
call fcn.00410170
mov ecx, 0x457bc8
mov byte [ebp - 4], 3
call dword [sym.imp.mfc140.dll_Ordinal_5898]
push eax
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140.dll_Ordinal_305]
mov eax, dword [ebp - 0x14]
mov ecx, dword [0x457bc8]
mov dword [ebp - 0x1c], 4
push dword [eax - 0xc]
push eax
push dword [ecx - 0xc]
lea eax, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.mfc140.dll_Ordinal_3005]
add esp, 0x14
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov ecx, edi
call fcn.0040f040
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00443559
mov esp, ebp
pop ebp
ret 4
Function at 0x442540
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4485c9
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x455014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x24], ebx
push 0x449a14
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x24], ebx
call dword [sym.imp.mfc140.dll_Ordinal_310]
mov dword [ebp - 4], 0
push 0x66840
mov dword [ebp - 0x24], 0x288
call dword [sym.imp.mfc140.dll_Ordinal_265]
mov edi, eax
add esp, 4
test edi, edi
je 0x442721
mov esi, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
lea eax, [ebp - 0x24]
push eax
push edi
call esi
cmp eax, 0x6f
jne 0x4425eb
push 0x288
push edi
call fcn.00443567
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov edx, 0x288
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.mfc140.dll_Ordinal_265]
mov edi, eax
add esp, 0xc
test edi, edi
je 0x442721
lea eax, [ebp - 0x24]
push eax
push edi
call esi
test eax, eax
jne 0x442705
mov esi, edi
test edi, edi
je 0x442705
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140.dll_Ordinal_316]
mov byte [ebp - 4], 1
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
lea eax, [ebp - 0x14]
push str._02X:_02X:_02X:_02X:_02X:_02X
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
add esp, 0x20
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc140.dll_Ordinal_316]
lea eax, [esi + 0x1b0]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x1c]
push 0x449ebc
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
add esp, 0xc
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140.dll_Ordinal_316]
mov byte [ebp - 4], 3
lea eax, [edi + 0x1b0]
push dword [ebp - 0x14]
push eax
push dword [esi + 0x1a0]
lea eax, [ebp - 0x18]
push str.__d__Address0:__s__mac:__s_n
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
push dword [ebp - 0x14]
lea eax, [ebp - 0x20]
push 0x449ebc
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
add esp, 0x20
lea ecx, [ebp - 0x18]
cmp dword [esi + 0x1a0], 6
je 0x4426e9
mov esi, dword [esi]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0x14]
test esi, esi
je 0x4426fb
call dword [sym.imp.mfc140.dll_Ordinal_1044]
jmp 0x442604
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0x1c]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call dword [sym.imp.mfc140.dll_Ordinal_1044]
push 0x288
push edi
call fcn.00443567
add esp, 8
lea eax, [ebp - 0x20]
mov ecx, ebx
push eax
call dword [sym.imp.mfc140.dll_Ordinal_300]
jmp 0x44272b
push 0
mov ecx, ebx
call dword [sym.imp.mfc140.dll_Ordinal_310]
lea ecx, [ebp - 0x20]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00443559
mov esp, ebp
pop ebp
ret
Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
jmp 0x431219