joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458230
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [ecx + 4]
push edx
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
neg eax
sbb eax, eax
add eax, 1
ret 8

Function at 0x458350
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push edx
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [ecx + 4]
push edx
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 0x10

Function at 0x4586d0
Capabilities:
Connect socket

Disassembly:
mov edx, dword [esp + 8]
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x38]
test ecx, ecx
push edx
je 0x4586f8
mov eax, dword [ecx]
mov edx, dword [esp + 0x10]
mov eax, dword [eax + 0x20]
push edx
call eax
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov esi, ecx
jmp 0x458711
mov eax, dword [esp + 0x10]
mov ecx, dword [edi + 4]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_connect]
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov esi, edx
test esi, esi
jne 0x458722
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x458729
mov dword [edi + 0x34], 2
pop edi
mov eax, esi
pop esi
ret 8

Function at 0x459100
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x485aab
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x49e128]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea edi, [esi + 0x48]
mov ecx, edi
mov dword [esi], vtable.CAsyncSocketEx.0
call fcn.00458ef0
mov dword [edi + 4], eax
xor eax, eax
mov dword [edi + 8], eax
mov dword [esp + 0x18], eax
or ecx, 0xffffffff
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
mov byte [esi + 0x18], al
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esp + 0x18], ecx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x45a770
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [ecx + 0x28]
test eax, eax
je 0x45a784
push eax
call dword [sym.imp.WS2_32.dll_WSASetLastError]
or eax, 0xffffffff
ret 0xc
mov eax, dword [ecx + 8]
test eax, eax
jne 0x45a79c
push 0x2736
call dword [sym.imp.WS2_32.dll_WSASetLastError]
or eax, 0xffffffff
ret 0xc
cmp eax, 1
je 0x45a7dc
cmp eax, 2
je 0x45a7dc
cmp eax, 3
je 0x45a7dc
cmp dword [ecx + 0x2c], 0
jne 0x45a7d2
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ecx, dword [ecx + 4]
push eax
mov eax, dword [esp + 8]
push edx
push eax
call fcn.00458290
push eax
call dword [sym.imp.WS2_32.dll_send]
ret 0xc
mov ecx, dword [ecx + 0x2c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x3c]
jmp edx
push 0x2749
call dword [sym.imp.WS2_32.dll_WSASetLastError]
or eax, 0xffffffff
ret 0xc

Function at 0x45a7f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [ecx + 0x28]
test eax, eax
je 0x45a804
push eax
call dword [sym.imp.WS2_32.dll_WSASetLastError]
or eax, 0xffffffff
ret 0xc
mov eax, dword [ecx + 8]
test eax, eax
jne 0x45a81c
push 0x2736
call dword [sym.imp.WS2_32.dll_WSASetLastError]
or eax, 0xffffffff
ret 0xc
cmp eax, 1
je 0x45a85c
cmp eax, 2
je 0x45a85c
cmp eax, 3
je 0x45a85c
cmp dword [ecx + 0x2c], 0
jne 0x45a852
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ecx, dword [ecx + 4]
push eax
mov eax, dword [esp + 8]
push edx
push eax
call fcn.00458290
push eax
call dword [sym.imp.WS2_32.dll_recv]
ret 0xc
mov ecx, dword [ecx + 0x2c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x38]
jmp edx
push 0x2749
call dword [sym.imp.WS2_32.dll_WSASetLastError]
or eax, 0xffffffff
ret 0xc
Function at 0x45aba0
Capabilities:
Connect socket

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
mov eax, dword [ecx + 4]
push edi
push eax
call fcn.004586a0
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 4]
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
push edx
call edi
mov eax, dword [esi + 4]
or ebx, 0xffffffff
mov dword [eax + 4], ebx
cmp dword [esi + 0x20], 0
mov dword [esp + 0xc], 0
je 0x45ad13
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_socket]
mov eax, dword [esi + 0x20]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
mov eax, dword [eax + 4]
push ecx
push edx
push eax
call ebp
mov ecx, dword [esi + 4]
mov dword [ecx + 4], eax
mov ecx, dword [esi + 4]
mov eax, dword [ecx + 4]
cmp eax, ebx
je 0x45acda
push eax
call fcn.00458680
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 4]
push edx
call fcn.00458770
test eax, eax
mov ecx, dword [esi + 4]
je 0x45acc2
cmp dword [ecx + 0x38], 0
je 0x45ac6b
mov edx, dword [ecx + 8]
push 0x3f
add edx, 0x403
push edx
call fcn.004582a0
push eax
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
test eax, eax
je 0x45ac6b
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 4]
push edx
call fcn.004586a0
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
push ecx
call edi
mov edx, dword [esi + 4]
mov dword [edx + 4], ebx
jmp 0x45acda
mov eax, dword [esi + 0x20]
mov edx, dword [eax + 4]
mov ecx, dword [esi + 4]
mov dword [ecx + 0xc], edx
mov eax, dword [esi + 0x20]
mov ecx, dword [eax + 4]
mov edx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
push edx
mov dword [esi + 0xc], ecx
mov ecx, dword [esi + 4]
push eax
call fcn.004583c0
test eax, eax
je 0x45ac4e
mov eax, dword [esi + 0x20]
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x18]
push ecx
mov ecx, dword [esi + 4]
push edx
call fcn.00458290
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, ebx
jne 0x45aced
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x45aced
mov ecx, dword [esi + 4]
mov eax, dword [ecx + 4]
push eax
call fcn.004586a0
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 4]
push edx
call edi
mov eax, dword [esi + 4]
mov dword [eax + 4], ebx
mov ecx, dword [esi + 0x20]
mov edx, dword [ecx + 0x1c]
test edx, edx
mov dword [esi + 0x20], edx
jne 0x45abe3
jmp 0x45ad12
mov eax, dword [esi + 8]
cmp eax, 2
mov dword [esi + 8], 2
je 0x45ad0a
push 0
push eax
push 2
push 0
mov ecx, esi
call fcn.0045a660
mov dword [esp + 0x10], 1
pop ebp
mov eax, dword [esi + 0x20]
test eax, eax
je 0x45ad20
mov eax, dword [eax + 0x1c]
mov dword [esi + 0x20], eax
cmp dword [esi + 0x20], 0
jne 0x45ad38
mov ecx, dword [esi + 0x1c]
push ecx
call dword [0x49f98c]
xor eax, eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x1c], eax
mov edx, dword [esi + 4]
cmp dword [edx + 4], ebx
pop edi
pop esi
pop ebx
je 0x45ad4d
cmp dword [esp], 0
je 0x45ad4d
mov al, 1
pop ecx
ret
xor al, al
pop ecx
ret
Function at 0x45b210
Capabilities:
Connect socket

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x2c]
test ecx, ecx
push edi
je 0x45b230
mov edx, dword [esp + 0x10]
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
push edx
mov edx, dword [esp + 0x10]
push edx
call eax
mov edi, eax
jmp 0x45b253
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ecx
mov ecx, dword [esi + 4]
push edx
call fcn.00458290
push eax
call dword [sym.imp.WS2_32.dll_connect]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov edi, ecx
test edi, edi
jne 0x45b264
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x45b281
mov eax, dword [esi + 8]
cmp eax, 2
mov dword [esi + 8], 2
je 0x45b281
push 0
push eax
push 2
push 0
mov ecx, esi
call fcn.0045a660
mov eax, edi
pop edi
pop esi
ret 8
Function at 0x45f877
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x49fb0c], 0
push esi
jne 0x45f7ea
call fcn.0045f715
test eax, eax
je 0x45f82d
mov eax, dword [0x49fb0c]
cmp eax, 1
jne 0x45f80b
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x45f82d
pop esi
ret
push eax
call dword [0x49fb14]
test eax, eax
jne 0x45f875
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x45f831
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x49fb0c]
call dword [0x49fb14]
mov edi, eax
test edi, edi
je 0x45f858
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x45f874
lea edi, [esi + 0xff0]
push esi
push dword [0x49fb0c]
call dword [0x49fb10]
add esi, 0x10
cmp esi, edi
jb 0x45f85e
mov eax, esi
pop edi
pop esi
ret
jmp 0x45f7d7

Function at 0x45f9c8
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x49e128]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0045f95d
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004611e0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x45fa17
cmp dword [ebp - 0x1c], 5
jb 0x45fa2f
jmp 0x45fa2b
cmp dword [ebp - 0x10], 1
jne 0x45fa2f
cmp dword [ebp - 0x1c], 4
ja 0x45fa2b
jne 0x45fa2f
cmp dword [ebp - 0x18], 0
jbe 0x45fa2f
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x48a8dc
call fcn.00421b30
test eax, eax
jge 0x45fa50
mov byte [0x49f8b4], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00460e4b
add ebp, 0x78
leave
ret

Function at 0x460e4b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x49e128]
jne 0x460e55
repz ret
jmp fcn.0046a72c
Function at 0x46e9da
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x49ed90]
je 0x46e9f5
inc edi
cmp edi, 0x17
jb 0x46e9e6
cmp edi, 0x17
jae 0x46eb75
push ebp
push 3
call fcn.00477ff3
cmp eax, 1
pop ecx
je 0x46eb41
push 3
call fcn.00477ff3
test eax, eax
pop ecx
jne 0x46ea29
cmp dword [0x49e1a0], 1
je 0x46eb41
cmp ebx, 0xfc
je 0x46eb74
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x4a0338
push ebp
call fcn.00463336
add esp, 0xc
test eax, eax
je 0x46ea5f
push esi
push esi
push esi
push esi
push esi
call fcn.00460736
add esp, 0x14
push 0x104
mov esi, 0x4a0351
push esi
push 0
mov byte [0x4a0455], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x46eaa3
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00463336
add esp, 0xc
test eax, eax
je 0x46eaa3
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00460736
add esp, 0x14
push esi
call fcn.004663b0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x46eae8
push esi
call fcn.004663b0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4a064c
push 0x48bbac
sub ecx, eax
push ecx
push eax
call fcn.004634f8
add esp, 0x14
test eax, eax
je 0x46eae8
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00460736
add esp, 0x14
jmp 0x46eaea
xor esi, esi
push 0x48bba8
push ebx
push ebp
call fcn.00463829
add esp, 0xc
test eax, eax
je 0x46eb0a
push esi
push esi
push esi
push esi
push esi
call fcn.00460736
add esp, 0x14
push dword [edi*8 + 0x49ed94]
push ebx
push ebp
call fcn.00463829
add esp, 0xc
test eax, eax
je 0x46eb2c
push esi
push esi
push esi
push esi
push esi
call fcn.00460736
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00477e36
add esp, 0xc
jmp 0x46eb74
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x46eb74
cmp ebp, 0xffffffff
je 0x46eb74
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x49ed94]
push dword [esi]
call fcn.004663b0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x477e36
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004695da
xor ebx, ebx
cmp dword [0x4a0998], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x477f0c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x477fec
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x477fec
push eax
call fcn.0046956c
mov dword [esp], 0x48cdb4
push edi
mov dword [0x4a0998], eax
call esi
push eax
call fcn.0046956c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4a099c], eax
call esi
push eax
call fcn.0046956c
mov dword [0x4a09a0], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00463c95
test eax, eax
pop ecx
pop ecx
je 0x477eda
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00460736
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x477f0c
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0046956c
cmp eax, ebx
pop ecx
mov dword [0x4a09a8], eax
je 0x477f0c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0046956c
pop ecx
mov dword [0x4a09a4], eax
mov eax, dword [0x4a09a4]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x477f91
cmp dword [0x4a09a8], ecx
je 0x477f91
push eax
call fcn.004695e3
push dword [0x4a09a8]
mov esi, eax
call fcn.004695e3
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x477f91
cmp edi, ebx
je 0x477f91
call esi
cmp eax, ebx
je 0x477f5e
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x477f5e
test byte [ebp - 0x18], 1
jne 0x477f91
lea eax, [ebp - 0x10]
push eax
call fcn.00463ccc
test eax, eax
pop ecx
je 0x477f79
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00460736
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x477f88
or dword [ebp + 0x10], 0x200000
jmp 0x477fcc
or dword [ebp + 0x10], 0x40000
jmp 0x477fcc
mov eax, dword [0x4a099c]
cmp eax, dword [ebp - 8]
je 0x477fcc
push eax
call fcn.004695e3
cmp eax, ebx
pop ecx
je 0x477fcc
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x477fcc
mov eax, dword [0x4a09a0]
cmp eax, dword [ebp - 8]
je 0x477fcc
push eax
call fcn.004695e3
cmp eax, ebx
pop ecx
je 0x477fcc
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4a0998]
call fcn.004695e3
cmp eax, ebx
pop ecx
je 0x477fec
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x477fee
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1003f74a
Capabilities:
Parse pe header

Disassembly:
jmp 0x10072da7
mov edi, edi
push ebp
jmp 0x10072dee
lea esp, [esp + 4]
jmp 0x10072d89
cmp word [ecx], ax
je 0x10072ff1
xor eax, eax
pop ebp
ret
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
jmp 0x10072dc5
cmp word [eax + 0x18], cx
sete dl
mov eax, edx
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x10072dce
xor edx, edx
mov ecx, 0x10b
jmp 0x10072ee6

Function at 0x1003f771
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x10072eaa
lea esp, [esp + 4]
jmp fcn.10072e65

Function at 0x1004249c
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x100424d4
jmp 0x100424b8
lea esp, [esp + 4]
jmp 0x1004247f
jmp 0x100424f0
jmp 0x1004250c
push ebx
jmp 0x10042528
jmp 0x10042544
push ebp
jmp 0x10042560
jmp 0x1004257c
push esi
jmp 0x10042598
jmp 0x10078157
push edi
movzx edx, byte [eax]
jmp 0x100782d9
shl edx, 8
movzx esi, byte [eax + 1]
jmp 0x1007833c
xor edx, esi
movzx esi, byte [eax + 2]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 3]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 5]
mov dword [ecx], edx
movzx edx, byte [eax + 4]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 6]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 7]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 9]
mov dword [ecx + 4], edx
movzx edx, byte [eax + 8]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xa]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xb]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xd]
mov dword [ecx + 8], edx
movzx edx, byte [eax + 0xc]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl edx, 8
xor edx, esi
shl edx, 8
xor edx, eax
mov dword [ecx + 0xc], edx
mov eax, edx
shr eax, 0x10
mov esi, 0xff
and eax, esi
mov eax, dword [eax*4 + 0x1004be1c]
xor eax, 0x1000000
mov edi, edx
shr edi, 8
and edi, esi
mov edi, dword [edi*4 + 0x1004be1c]
and edi, 0xff0000
mov ebx, dword [ecx + 4]
and eax, 0xff000000
xor eax, edi
mov edi, edx
shr edi, 0x18
movzx edi, byte [edi*4 + 0x1004be1c]
xor eax, edi
mov edi, edx
and edi, esi
mov edi, dword [edi*4 + 0x1004be1c]
mov ebp, 0xff00
and edi, ebp
xor eax, edi
xor eax, dword [ecx]
lea edi, [ecx + 0x10]
xor ebx, eax
mov dword [edi], eax
mov eax, dword [ecx + 8]
xor eax, ebx
mov dword [ecx + 0x14], ebx
mov dword [ecx + 0x18], eax
xor edx, eax
mov dword [ecx + 0x1c], edx
call fcn.10064ed8
mov eax, edi
mov edx, dword [eax + 0xc]
mov ecx, edx
shr ecx, 8
mov edi, edx
and ecx, esi
mov ecx, dword [ecx*4 + 0x1004be1c]
shr edi, 0x10
and edi, esi
mov edi, dword [edi*4 + 0x1004be1c]
and ecx, 0xff0000
and edi, 0xff000000
xor ecx, edi
mov edi, edx
and edx, esi
mov edx, dword [edx*4 + 0x1004be1c]
shr edi, 0x18
movzx edi, byte [edi*4 + 0x1004be1c]
xor ecx, edi
and edx, ebp
xor ecx, edx
xor ecx, dword [ebx]
lea edi, [eax + 0x10]
xor ecx, dword [eax]
add ebx, 4
mov dword [edi], ecx
mov edx, dword [eax + 4]
xor edx, ecx
mov dword [eax + 0x14], edx
mov ecx, dword [eax + 8]
xor ecx, edx
mov dword [eax + 0x18], ecx
mov edx, dword [eax + 0xc]
xor edx, ecx
mov dword [eax + 0x1c], edx
cmp ebx, 0x1004d644
jne 0x10078433
push 0xa
pop eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1005768a
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10056fbe
call 0x10056170
jmp 0x1005749f
call 0x100561b2
jmp 0x100574ab
call 0x10056234
jmp 0x100576fa
call 0x100562fb
jmp 0x10057760
call 0x10056332
jmp 0x1005783f
pop ecx
sub ecx, fcn.10055e9c
mov dword [ecx + 0x10056eeb], eax
jmp 0x100573e2
mov dword [esp + 0x24], eax
popal
inc dword [esp + 8]
popfd
ret
mov dword [ecx + 0x10056ef0], 0x82444ff
mov word [ecx + 0x10056ef4], 0xc39d
movzx ebx, byte [eax]
add ebx, 0x47805fac
cmp ebx, 0x47806078
je 0x10057462
jmp 0x100571c2
loop 0x100574cc
and eax, 0x9c02e958
add dword [esp + 4], 0x323b07c8
pushal
jmp 0x1005616b
pop eax
sub eax, 0xc85031bd
jmp 0x10057542
pop ecx
sub ecx, 0x100561b2
jmp 0x10057570
dec eax
popal
add eax, 0x75818910
jae 0x100574da
adc bh, al
cmp dword [esi - 0xeffa8d], 0xe9082444
add eax, 0x2444ff10
or cl, ch
pop ecx
invalid
call 0x10057554
inc ecx
inc esp
push esi
inc ecx
push eax
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
sbb ax, 0xc84e
jmp 0x10057672
mov dword [ecx + 0x10057464], eax
mov dword [ecx + 0x10057469], 0x82444ff
mov word [ecx + 0x1005746d], 0xc39d
movzx ebx, byte [eax]
add ebx, 0x2e0c16bc
cmp ebx, 0x2e0c1788
je 0x100575f6
jmp 0x10057637
add byte [eax], al
add byte [ecx + 0x44], al
add byte [eax], al
inc ecx
inc esp
push esi
inc ecx
push eax
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
jb 0x100575f5
sub eax, dword [ebx + ebp*8]
cmp edx, dword [eax - 0x18]
dec esp
push eax
call fcn.10047525
jmp 0x1005622f
mov dword [esp + 0x24], eax
popal
inc dword [esp + 8]
popfd
ret
call 0x1005768a
mov ebx, 0xd0b67f1c
add byte [eax + eax], dh
and esp, dword [ecx + 0x66]
jp 0x100576e8
xchg esp, eax
adc eax, 0x8e666972
push eax
call fcn.10047525
jmp 0x100561ad
mov dword [esp + 0x24], eax
popal
inc dword [esp + 8]
popfd
ret
or byte [eax + 0x3f98690e], bl
adc dword [eax + 0x43807116], eax
invalid
pop ecx
sub ecx, 0x10056234
mov dword [ecx + 0x100575cb], eax
mov dword [ecx + 0x100575d0], 0x82444ff
mov word [ecx + 0x100575d4], 0xc39d
movzx ebx, byte [eax]
add ebx, 0x12e751c3
cmp ebx, 0x12e7528f
je 0x10057787
jmp 0x100576d2
pop eax
sub eax, 0x9a51376b
jmp 0x100577ad
jne 0x100577b4
mov dl, 0x6d
pushal
jmp 0x100562f6
call 0x100577bf
inc ecx
inc esp
push esi
inc ecx
push eax
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
mov dword [ecx], esp
dec edi
lcall 0xfe9b, 0xb9b17eb
or eax, 0x71e17ca2
adc bl, ah
push esi
fiadd dword [esi - 0x2c]
mov bl, 0x4e
out 0xf8, eax
mov ch, 0x23
fst st(0)
call 0x100577f5
add al, 0xca
and dword [ebx - 0x3d3c4261], eax
les ebp, [edi + 0x3d]
in eax, dx
and cl, ch
mov byte [si + 0x7e], ch
jmp 0x1005781c
push eax
call fcn.10047525
jmp 0x1005632d
pop ecx
sub ecx, 0x10056332
mov dword [ecx + 0x1005777e], eax
jmp 0x10057d7a
mov dword [esp + 0x24], eax
popal
inc dword [esp + 8]
popfd
ret
mov dword [ecx + 0x10057783], 0x82444ff
mov word [ecx + 0x10057787], 0xc39d
movzx ebx, byte [eax]
add ebx, 0x50f47928
cmp ebx, 0x50f479f4
je 0x10057dfa
jmp 0x10057a31
mov dl, 0
add byte [eax], al
invalid
Function at 0x1005d5e3
Capabilities:
Encode data using xor

Disassembly:
push 0x60dea
call fcn.10058fdc
cmpsb byte [esi], byte es:[edi]

Function at 0x100662bd
Capabilities:
Enumerate pe sections

Disassembly:
call fcn.1003f74a
jmp 0x1003f76c

Function at 0x10067997
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call 0x10045963
jmp 0x10045aaf

Function at 0x100680ce
Capabilities:
Encode data using xor
Encrypt data using aes

Disassembly:
call fcn.10042463
jmp 0x10042497

Function at 0x10090ffd
Capabilities:
Access peb ldr_data
Packed with generic packer
Parse pe header

Disassembly:
invalid
pop eax
sub eax, 0x10090ba5
cmp dword [eax + 0x1003bc39], 0
je 0x10090bbb
lea esp, [esp + 8]
popal
cmp dword [esp + 8], 0
jne 0x10001f25
call fcn.100452c7
jmp 0x10001f25
call 0x10090ba5
jmp 0x10090a24
inc dword [eax + 0x1003bc39]
push 0xbf35f71c
add dword [esp], 0x50cd55fd
push 0
push 0
push 0xb75ae14e
add dword [esp], 0x58a83123
call fcn.100491d6
push 0x6720139
push 0x1009419d
jmp 0x10091185
push eax
jmp 0x10090ba0
movzx ebx, word [eax + 0x3c]
add ebx, eax
cmp word [ebx], 0x4550
je 0x10090c06
jmp 0x10090fb0
call 0x10090fa5
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
je 0x10090f79
sub eax, 0x10000
jmp 0x10090fa9
call 0x10090ffd
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x63694c20
outsb dx, byte gs:[esi]
jae 0x1009105c
jb 0x1009100f
inc esp
insd dword es:[edi], dx
outsd dx, dword [esi]
and byte [esi + 0x31], dh
cmp byte cs:[esi], ch
xor byte [esi], ch
xor byte [eax], al
lea esp, [esp + 4]
pushal
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x10090fa0
call 0x8a010b7c
jmp 0x14998bee
call 0x1009118a
pop ebx
sub ebx, 0x1009118a
add dword [esp], ebx
push 0x10000000
add dword [esp], ebx
call fcn.10045a83
call fcn.100485a7
popal
jmp 0x10001f25
Function at 0x401170
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413add
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x41c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
mov ebx, dword [ebp + 8]
test ebx, ebx
jle 0x40124f
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
cmp ebx, 0x7fffffff
ja 0x401261
push ebx
lea ecx, [ebp - 0x24]
call fcn.00401eb0
mov edi, dword [ebp - 0x1c]
xor esi, esi
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov cl, byte [esi + ecx]
not cl
mov byte [ebp + 0xb], cl
cmp eax, edi
je 0x4011f9
mov byte [eax], cl
inc eax
mov dword [ebp - 0x20], eax
jmp 0x40120c
lea ecx, [ebp + 0xb]
push ecx
push eax
lea ecx, [ebp - 0x24]
call fcn.00401f70
mov edi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
inc esi
cmp esi, ebx
jl 0x4011e2
mov esi, dword [ebp - 0x24]
lea eax, [ebp - 0x18]
push 0
push eax
push ebx
push esi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test esi, esi
je 0x40124f
sub edi, esi
mov eax, esi
cmp edi, 0x1000
jb 0x401245
mov esi, dword [eax - 4]
add edi, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401266
push edi
push esi
call fcn.00402384
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00401ea0
call fcn.0040598b
int3