joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4013cb
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push edi
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov edi, eax
cmp edi, 0xffffffff
jne 0x4013f8
call sub.WSOCK32.dll_WSAGetLastError
push eax
call fcn.004012d8
add esp, 4
mov dword [0x4108c0], 0xffffffe9
jmp 0x401477
push 0x33
push dword [esp + 0x14]
push dword [esp + 0x14]
push edi
call sub.WSOCK32.dll_WSAAsyncSelect
cmp eax, 0xffffffff
jne 0x401424
call sub.WSOCK32.dll_WSAGetLastError
push eax
call fcn.004012d8
mov dword [0x4108c0], 0xffffffe8
jmp 0x40146b
push esi
mov esi, dword [esp + 0xc]
push dword [esp + 0x18]
mov word [esi], 2
call sub.WSOCK32.dll_htons
push 0x10
push esi
push edi
mov word [esi + 2], ax
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
pop esi
jne 0x401477
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x401477
call sub.WSOCK32.dll_WSAGetLastError
push eax
call fcn.004012d8
mov dword [0x4108c0], 0xffffffe7
add esp, 4
push edi
call sub.WSOCK32.dll_closesocket
or edi, 0xffffffff
mov eax, edi
pop edi
ret

Function at 0x40147b
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
xor ebx, ebx
cmp dword [0x41043c], ebx
push edi
mov edi, 0x410940
je 0x4014c5
cmp byte [0x410940], bl
je 0x4014d2
push 9
pop esi
cmp dword [section..data], 0xffffffff
je 0x4014f5
test esi, esi
jle 0x4014f5
push 0
mov eax, esi
sub eax, ebx
push eax
push edi
push dword [section..data]
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
je 0x4014d6
add ebx, eax
cmp ebx, esi
jl 0x4014a5
jmp 0x4014f5
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
test esi, esi
jne 0x401498
xor eax, eax
jmp 0x401502
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x4014f5
push eax
call fcn.004012d8
add esp, 4
mov dword [0x4108c0], 0xffffffe6
cmp ebx, esi
jne 0x401500
and byte [0x410940], 0
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x401506
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, dword [esp + 0x20]
xor esi, esi
mov ebx, 0x2733
jmp 0x40154f
push 0
mov ecx, edi
sub ecx, eax
push ecx
add eax, ebp
push eax
push dword [esp + 0x20]
call sub.WSOCK32.dll_recv
mov esi, eax
cmp esi, 0xffffffff
je 0x40155a
test esi, esi
je 0x40157b
cmp dword [0x41043c], 0
jne 0x40154f
add dword [0x410928], esi
push esi
call fcn.0040109b
pop ecx
mov eax, dword [0x410928]
cmp eax, edi
jl 0x40151b
jmp 0x40157b
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, ebx
je 0x40157b
call sub.WSOCK32.dll_WSAGetLastError
push eax
call fcn.004012d8
add esp, 4
mov dword [0x4108c0], 0xffffffe0
cmp dword [0x41043c], 0
jne 0x4016f3
add edi, 0xfffffa4c
cmp dword [0x410928], edi
jg 0x4015ac
cmp esi, 0xffffffff
jne 0x4015a4
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, ebx
jne 0x4015ac
test esi, esi
jne 0x4016f3
cmp dword [0x410434], 0
mov esi, ebp
jne 0x4016c5
mov dword [0x410434], 1
mov al, byte [ebp]
jmp 0x4015d1
cmp al, 9
je 0x4015d5
inc esi
mov al, byte [esi]
cmp al, 0x20
jne 0x4015ca
mov al, byte [esi]
cmp al, 0x20
je 0x4015df
cmp al, 9
jne 0x4015e2
inc esi
jmp 0x4015d5
cmp byte [esi], 0x32
je 0x401695
mov eax, dword [0x41814c]
test eax, eax
mov dword [0x4108c0], 0xfffffffd
je 0x4016bd
cmp dword [0x410414], 0
je 0x401621
push str.ServerError
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [0x41814c]
add eax, 0xc
jmp 0x401635
push str._r_n_r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [0x41814c]
add eax, 4
mov cl, byte [esi]
mov edx, esi
jmp 0x40165b
cmp cl, 0xd
je 0x40165f
cmp cl, 0xa
je 0x40165f
mov edi, eax
sub edi, dword [0x41814c]
cmp edi, 0xfa
jge 0x40165f
mov byte [eax], cl
inc eax
inc edx
mov cl, byte [edx]
test cl, cl
jne 0x40163b
and byte [eax], 0
cmp dword [0x410414], 0
je 0x4016bd
push 0x4061e0
push dword [0x41814c]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [0x41814c]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add dword [0x41814c], eax
jmp 0x4016bd
cmp al, 0xa
je 0x40169b
inc esi
mov al, byte [esi]
cmp al, 0xd
jne 0x401690
mov al, byte [esi]
lea ecx, [esi + 1]
cmp al, byte [ecx]
je 0x4016b6
cmp al, byte [esi + 2]
je 0x4016ba
cmp al, 0xd
jne 0x4016af
mov esi, ecx
cmp byte [esi], 0xa
jne 0x401695
jmp 0x401694
inc esi
inc esi
jmp 0x4016bd
add esi, 4
sub ebp, esi
add dword [0x410928], ebp
cmp dword [esp + 0x18], 0xffffffff
je 0x4016ec
push dword [0x410928]
push esi
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll__lwrite]
cmp eax, 0xffffffff
jne 0x4016ec
mov dword [0x4108c0], 0xfffffffc
and dword [0x410928], 0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x4028bf
Capabilities:
Hash data with crc32

Disassembly:
push 0x400
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [0x408be8], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [0x408bec], eax
and dword [eax], 0
xor eax, eax
inc eax
push 8
mov ecx, eax
pop edx
test cl, 1
je 0x4028f7
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x4028f9
shr ecx, 1
dec edx
jne 0x4028e8
mov edx, dword [0x408bec]
mov dword [edx + eax*4], ecx
inc eax
cmp eax, 0x100
jl 0x4028e3
ret

Function at 0x402927
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x402934
or eax, 0xffffffff
jmp 0x402963
mov eax, dword [0x408050]
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x402962
push edi
mov edi, dword [0x408bec]
xor edx, edx
mov dl, byte [ecx]
xor edx, eax
and edx, 0xff
mov edx, dword [edi + edx*4]
shr eax, 8
xor eax, edx
inc ecx
dec esi
jne 0x402943
pop edi
pop esi
mov dword [0x408050], eax
not eax
ret 8

Function at 0x402c39
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
and byte [esi], 0
cmp dword [0x408800], 0
je 0x402cc3
push ebx
mov ebx, dword [ebp + 0xc]
push edi
push 4
pop eax
xor edi, edi
cmp ebx, eax
jle 0x402c71
movzx ecx, byte [eax + 0x408b60]
add edi, ecx
cmp eax, 0xa
jne 0x402c6c
push 0x12
pop eax
inc eax
cmp eax, ebx
jl 0x402c5b
mov esi, dword [sym.imp.KERNEL32.dll__llseek]
push 1
push 0
push dword [0x408bd8]
call esi
mov dword [ebp - 4], eax
mov eax, dword [0x408b84]
push 0
add eax, edi
push eax
push dword [0x408bd8]
call esi
movzx eax, byte [ebx + 0x408b60]
push eax
push dword [ebp + 8]
push dword [0x408bd8]
call dword [sym.imp.KERNEL32.dll__lread]
push 0
push dword [ebp - 4]
push dword [0x408bd8]
call esi
mov esi, dword [ebp + 8]
pop edi
pop ebx
jmp 0x402cdf
push dword [ebp + 0x10]
push 0x100
push esi
push 0x40645d
push dword [ebp + 0x14]
push str.WiseInstaller
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esi], 0
jne 0x402cf9
push 0x100
push esi
push dword [ebp + 0x18]
push dword [0x408810]
call dword [sym.imp.USER32.dll_LoadStringA]
pop esi
leave
ret
Function at 0x402e3d
Capabilities:
Accept command line arguments
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerRunOnceEntries
push closesocket
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x402eab
lea eax, [ebp - 0x48]
push eax
push dword [ebp + 8]
call fcn.00402cfc
pop ecx
pop ecx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402ea2
cmp dword [ebp - 8], 1
jbe 0x402ea2
inc edi
push dword [ebp - 4]
call esi
cmp edi, ebx
jne 0x402f0a
mov edi, dword [ebp + 0xc]
cmp edi, ebx
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
je 0x402ebc
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push ebx
lea ecx, [ebp - 4]
push ecx
push ebx
push 0xf003f
push ebx
push 0x40645d
push ebx
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x402f0a
cmp edi, ebx
jne 0x402eea
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push edi
push 1
push ebx
push str.WiseStubReboot
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4030e7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [ebp + 8]
push esi
xor esi, esi
cmp dword [0x408800], esi
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], esi
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x40
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], esi
jne 0x403179
push 0x100
lea eax, [ebp - 0x144]
push eax
push dword [0x408810]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [ebp - 0x144], 0
je 0x403170
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x144]
jmp 0x40315e
cmp byte [eax], 0x5c
je 0x40316d
dec eax
lea ecx, [ebp - 0x144]
cmp eax, ecx
ja 0x403158
cmp byte [eax], 0x5c
jne 0x403170
and byte [eax], 0
lea eax, [ebp - 0x144]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x24], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x4031ec
call fcn.00402a98
cmp dword [ebp + 0x10], esi
je 0x4031da
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
push edi
mov ebx, 0x1f4
push ebx
push dword [ebp - 8]
call esi
mov edi, 0x102
jmp 0x4031c6
call fcn.00402a98
cmp dword [0x408b80], 0
jne 0x4031cc
push ebx
push dword [ebp - 8]
call esi
cmp eax, edi
je 0x4031b2
jmp 0x4031d8
push 0
push dword [ebp + 0x14]
call fcn.00402e3d
pop ecx
pop ecx
pop edi
pop ebx
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call fcn.00402a98
mov eax, dword [ebp - 4]
pop esi
leave
ret

Function at 0x4031f2
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
cmp edi, 3
jle 0x40321e
push esi
lea esi, [edi - 4]
shr esi, 2
inc esi
mov eax, esi
neg eax
lea edi, [edi + eax*4]
call fcn.00402b24
xor dword [ebx], eax
add ebx, 4
dec esi
jne 0x403210
pop esi
test edi, edi
jle 0x403237
call fcn.00402b24
cdq
mov ecx, 0xff
idiv ecx
inc dl
xor byte [ebx], dl
inc ebx
dec edi
jne 0x403222
pop edi
pop ebx
ret

Function at 0x403282
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
lea eax, [ebp - 0x194]
push eax
mov dword [ebp - 0x194], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x184], 1
jne 0x403307
push esi
push 0x100
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [ebp + eax - 0x101], 0x5c
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x4032e9
push 0x406680
lea eax, [ebp - 0x100]
push eax
call esi
push str.WININIT.INI
lea eax, [ebp - 0x100]
push eax
call esi
lea eax, [ebp - 0x100]
push eax
call fcn.00402f0f
pop ecx
pop esi
leave
ret
xor eax, eax
leave
ret
Function at 0x405c70
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push ebx
xor eax, eax
mov ebx, dword [esp + 8]
push esi
push edi
cmp byte [ebx], al
je 0x405caf
push ebx
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
jne 0x405caf
mov edi, str.255.255.255.255
mov ecx, 0x10
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x405caf
push ebx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x405cad
mov eax, dword [eax + 0xc]
pop edi
mov ecx, dword [eax]
pop esi
pop ebx
mov eax, dword [ecx]
ret
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x7c6058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x7c61a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7c607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7c606a
add dl, dl
jne 0x7c6089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7c60dc
xor eax, eax
add dl, dl
jne 0x7c6096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7c617d
add dl, dl
jne 0x7c60a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c60b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c60bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c60c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7c60d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7c6075
mov eax, 1
add dl, dl
jne 0x7c60ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c60f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7c60e1
sub eax, ebx
mov ebx, 1
jne 0x7c6128
mov ecx, 1
add dl, dl
jne 0x7c610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7c6119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7c6105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7c6075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7c613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7c614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7c6136
cmp eax, 0x7d00
jae 0x7c616d
cmp eax, 0x500
jb 0x7c6168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7c6075
cmp eax, 0x7f
ja 0x7c6170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7c6075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7c619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7c6075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10001b50
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
movzx ecx, word [edx + 0x14]
lea edx, [eax + ecx + 0x18]
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], 0
jmp 0x10001b8f
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
add ecx, 0x28
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
movzx ecx, word [eax + 6]
cmp dword [ebp - 0x10], ecx
jge 0x10001cab
mov edx, dword [ebp - 4]
cmp dword [edx + 0x10], 0
jne 0x10001c1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x38]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jle 0x10001c17
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + 0x34]
push eax
push 4
push 0x1000
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x1c]
call edx
add esp, 0x14
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10001bf0
xor eax, eax
jmp 0x10001cb0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.10001930
add esp, 0xc
jmp 0x10001b7d
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0x10]
push ecx
mov eax, dword [ebp + 0xc]
push eax
call fcn.10001b30
add esp, 8
test eax, eax
jne 0x10001c3d
xor eax, eax
jmp 0x10001cb0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x34]
push edx
push 4
push 0x1000
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x1c]
call edx
add esp, 0x14
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10001c74
xor eax, eax
jmp 0x10001cb0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.10001980
add esp, 0xc
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 8], edx
jmp 0x10001b7d
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x100027b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0xc000
mov ecx, dword [ebp - 4]
push ecx
push 0x10004070
call fcn.10001000
add esp, 8
mov dword [ebp - 0xc], eax
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..data
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5e5a6294
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..text
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x5c939b7
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x6bde08c1
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
mov ecx, 0x680b0c9e
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x430002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408e84
nop
mov ecx, 0x60702f70
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x58d96017
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408ed0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x5a4a1dc5
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x6d121e2f
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x42e004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x8fd2c83
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
mov ecx, 0x6dd23400
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40280f
Capabilities:
Check for time delay via queryperformancecounter
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 8], eax
push 0
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [0x409040]
add eax, 7
mov dword [0x40903c], eax
and dword [ebp - 0x14], 0
jmp 0x40285e
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
add eax, 0x28
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x14], eax
jge 0x4029e7
push 0x410770
call dword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
mov eax, dword [0x409040]
xor edx, edx
push 0xc
pop ecx
div ecx
mov dword [0x409040], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x10], 0
jne 0x402965
mov eax, dword [0x409040]
add eax, 7
mov dword [0x40903c], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x38]
mov dword [ebp - 4], eax
mov eax, dword [0x409040]
imul eax, dword [0x409040]
sub eax, 3
mov dword [0x40903c], eax
cmp dword [ebp - 4], 0
jle 0x402953
mov eax, dword [0x40903c]
imul eax, dword [0x409040]
mov ecx, dword [0x409040]
imul ecx, ecx, 5
sub eax, ecx
mov dword [0x40903c], eax
push 4
push 0x1000
push dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov dword [ebp - 0xc], eax
mov eax, dword [0x409040]
shl eax, 1
mov dword [0x40903c], eax
push 0
push 0
push 0
call fcn.004035ec
add esp, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
mov eax, dword [0x409040]
add eax, 7
mov dword [0x40903c], eax
mov eax, dword [0x40903c]
imul eax, eax, 0x63
mov dword [0x40903c], eax
push dword [ebp - 4]
push 0
push dword [ebp - 0xc]
call fcn.0040362a
add esp, 0xc
mov eax, dword [0x409040]
add eax, 7
mov dword [0x40903c], eax
jmp 0x40284e
mov eax, dword [0x409040]
imul eax, dword [0x409040]
sub eax, 3
mov dword [0x40903c], eax
push 4
push 0x1000
mov eax, dword [ebp - 8]
push dword [eax + 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov dword [ebp - 0xc], eax
mov eax, dword [0x40903c]
sub eax, 4
mov dword [0x409040], eax
mov eax, dword [0x409040]
shl eax, 3
mov dword [0x409040], eax
mov eax, dword [ebp - 8]
push dword [eax + 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0xc]
call fcn.004035ec
add esp, 0xc
push 0x410770
call dword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
jmp 0x40284e
push 0
push 0
push 0
call fcn.0040362a
add esp, 0xc
leave
ret