joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ad70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46d550
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0044a920
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.0044a9a0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.0044a9a0
lea ecx, [esi + 0xc]
call fcn.0045efd6
lea ecx, [esi + 0x10]
call fcn.0045efd6
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0044d1d0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0044d1d0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0044d1d0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0045f04b
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0045f04b
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x44ba18
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46d778
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x44ba28
call fcn.0044bf40
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x44bb0b
cmp byte [edi], 0
je 0x44bb0b
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x44ba4d
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.0044a740
test eax, eax
jne 0x44ba6d
push 0x4b3460
lea ecx, [esi + 0x38]
call fcn.0045f188
jmp 0x44bb0b
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.0044a790
test eax, eax
jne 0x44ba9c
mov ecx, esi
call fcn.0044a890
push edi
add esi, 0x38
push 0x4b343c
push esi
call fcn.0045cfe7
add esp, 0xc
jmp 0x44bb0b
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.0044c7c0
test eax, eax
je 0x44bb04
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.0044bbe0
test eax, eax
jne 0x44bb20
push edi
lea eax, [esi + 0x38]
push 0x4b3418
push eax
call fcn.0045cfe7
add esp, 0xc
mov ecx, esi
call fcn.0044bf40
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x44bbc8
mov ecx, dword [0x4b36d0]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.0045cfe7
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.0044a840
test eax, eax
jne 0x44bb8a
push 0x4b33fc
lea ecx, [esi + 0x38]
call fcn.0045f188
jmp 0x44bb9a
push 0xfa
mov ecx, esi
call fcn.0044c7c0
test eax, eax
jne 0x44bbb7
mov ecx, esi
call fcn.0044bf40
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.0045f04b
jmp 0x44bb0b
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.0045f04b
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x426904
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42690a
ret

Function at 0x43377c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43392d
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404870
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x433944
call fcn.004044cc
mov eax, ebx
call fcn.00424858
mov edi, eax
dec edi
test edi, edi
jl 0x433834
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0042482c
mov edx, dword [0x44a264]
call fcn.00403538
test al, al
je 0x433830
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.0042482c
lea edx, [ebp - 0x14]
call fcn.00456250
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404870
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404540
inc esi
dec edi
jne 0x4337e2
mov al, byte [0x433948]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x433954
mov eax, dword [ebp - 0xc]
call fcn.0040d5bc
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00404258
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00456250
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x433944
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.00456250
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x433944
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x433944
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x433960
call fcn.00409700
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433934
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004041e4
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004041e4
lea eax, [ebp - 0x14]
call fcn.004041c0
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004041e4
ret
Function at 0x4c4ebc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x4e2cb0]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4e2cb0]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4e2cb0]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4e2cb0]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4e2834]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x4c4ee7
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x4cf688
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4cf6b6
mov eax, ebx
call fcn.004d013c
cmp dword [ebx + 0x40], 0
je 0x4cf6af
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4cf727
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4cf719
cmp dword [ebx + 8], 0
je 0x4cf6d8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4cf6ea
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4cf719
cmp dword [ebx + 8], 0
je 0x4cf6cb
cmp eax, 3
je 0x4cf6fd
dec eax
jne 0x4cf6cb
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4cf6cb
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4cf6cb
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4cf745
cmp dword [ebx + 0x14], 0xcc
je 0x4cf745
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004cf750
pop ebx
ret
Function at 0x55f1f0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x540d6f
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x540d8b
mov edx, dword [esp + 4]
movzx edx, byte [ecx + edx]
rol eax, 7
xor eax, edx
inc ecx
cmp ecx, dword [esp + 8]
jb 0x540d77
jmp 0x540d96
ret
jmp 0x55f20c
lea esp, [esp + 4]
jmp 0x540d64

Function at 0x565d42
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov dword [esp + 1], ebx
push dword [esp + 1]
lea esp, [esp + 0xc]
jmp 0x565def
stc
pushal
call 0x565db4
lea esp, [esp + 0x24]
cmp dword [ebp - 4], ebx
pushal
push word [esp + 0x1b]
push bx
jmp 0x565e02
add ecx, 0x10
sub esp, 0x1e
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
sub edx, 0x10
jmp 0x565dce
lea esp, [esp + 0x24]
jl 0x53f4ef
mov eax, dword [ebp - 8]
jmp 0x53f4c7

Function at 0x565e6a
Capabilities:
Encrypt data using aes

Disassembly:
lea ecx, [eax - 1]
mov dh, byte [esp]
mov bl, ch
xchg dh, bl
bts edi, esi
jmp 0x565ee1
mov dword [esp], edx
lea esp, [esp + 4]
jle 0x53f51a
jmp 0x565e45
lea esp, [esp + 4]
mov ecx, 0xff
jmp 0x53f553
mov dword [ebp - 4], ecx
lea edx, [0x15130d86]
lea edi, [esi*4]
pushfd
jmp 0x565e96

Function at 0x56647f
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and edx, ecx
call 0x566487
xchg ebp, eax
jmp 0x56659b
not dx
mov edx, dword [esp]
push ebx
mov ebx, esi
jmp 0x566548
mov ebx, dword [ebx*4 + 0x548c48]
jmp 0x56652b
lea edi, [ebx*4]
not edi
jmp 0x5664e0
mov byte [esp + 0x14], ch
push dword [esp + 0x19]
lea esp, [esp + 2]
mov dword [esi + 8], edi
bswap di
jmp 0x5664f9
mov edi, edx
call fcn.0056657a
mov edi, dword [edi*4 + 0x548c48]
jmp 0x566556
lea ebx, [ebx + 0xc]
mov edx, dword [ebx]
pop ebx
sub esp, 8
sub esp, 0x16
jmp 0x566517
and edi, ecx
mov edi, dword [edi*4 + 0x549048]
and ebx, ecx
jmp 0x566585
movzx ebx, byte [esi + 0xe]
pushal
pop dword [esp + 0xe]
pushfd
pop dword [esp + 0xd]
jmp 0x566624
lea esp, [esp + 0x58]
xor edi, dword [ebx*4 + 0x549848]
jmp 0x566563
sub esp, 6
lea esp, [esp + 2]
lea esp, [esp + 0x10]
xor edi, dword [edx*4 + 0x549c48]
shr dh, 0
jmp 0x56648c
lea esp, [esp + 0x28]
xor edi, dword [ebx*4 + 0x549448]
cmc
pushfd
mov byte [esp], bl
jmp 0x566603
mov edx, dword [edx*4 + 0x548c48]
and ebx, ecx
sub esp, 0
sub esp, 0xf
lea esp, [esp + 3]
jmp 0x5665b5
lea ecx, [ecx + 0x548c48]
mov ebx, dword [ecx]
pop ecx
and edx, ecx
jmp 0x5665d7
and edx, ecx
call 0x56660b
and al, 0x66
push edi
lea esp, [esp + 2]
jmp 0x5666af
push ecx
mov ecx, ebx
lea ecx, [ecx*4]
jmp 0x5665f6
Function at 0x566487
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and edx, ecx
call 0x566487
xchg ebp, eax
jmp 0x56659b
not dx
mov edx, dword [esp]
push ebx
mov ebx, esi
jmp 0x566548
mov ebx, dword [ebx*4 + 0x548c48]
jmp 0x56652b
lea edi, [ebx*4]
not edi
jmp 0x5664e0
mov byte [esp + 0x14], ch
push dword [esp + 0x19]
lea esp, [esp + 2]
mov dword [esi + 8], edi
bswap di
jmp 0x5664f9
mov edi, edx
call fcn.0056657a
mov edi, dword [edi*4 + 0x548c48]
jmp 0x566556
lea ebx, [ebx + 0xc]
mov edx, dword [ebx]
pop ebx
sub esp, 8
sub esp, 0x16
jmp 0x566517
and edi, ecx
mov edi, dword [edi*4 + 0x549048]
and ebx, ecx
jmp 0x566585
movzx ebx, byte [esi + 0xe]
pushal
pop dword [esp + 0xe]
pushfd
pop dword [esp + 0xd]
jmp 0x566624
lea esp, [esp + 0x58]
xor edi, dword [ebx*4 + 0x549848]
jmp 0x566563
sub esp, 6
lea esp, [esp + 2]
lea esp, [esp + 0x10]
xor edi, dword [edx*4 + 0x549c48]
shr dh, 0
jmp 0x56648c
lea esp, [esp + 0x28]
xor edi, dword [ebx*4 + 0x549448]
cmc
pushfd
mov byte [esp], bl
jmp 0x566603
mov edx, dword [edx*4 + 0x548c48]
and ebx, ecx
sub esp, 0
sub esp, 0xf
lea esp, [esp + 3]
jmp 0x5665b5
lea ecx, [ecx + 0x548c48]
mov ebx, dword [ecx]
pop ecx
and edx, ecx
jmp 0x5665d7
and edx, ecx
call 0x56660b
and al, 0x66
push edi
lea esp, [esp + 2]
jmp 0x5666af
push ecx
mov ecx, ebx
lea ecx, [ecx*4]
jmp 0x5665f6
Function at 0x566663
Capabilities:
Encrypt data using aes

Disassembly:
call fcn.00566688
mov edi, dword [esp + 4]
lea esp, [esp + 8]
pop esi
lea ebx, [esp - 0x8e]
jmp 0x56668d
btc edi, ebp
mov dh, ch
movzx ebx, byte [esi + 0x11]
jmp 0x565e79
not dl
mov ebx, dword [ebx*4 + 0x548c48]
bswap di
mov edx, 0x11440819
jmp 0x565ec3
mov edi, edx
call 0x565ead
inc edx
pushfd
jmp 0x565f17
add esi, 0x10
mov edx, dword [esi]
bswap edi
bswap edi
jmp 0x565ea5
mov edi, dword [edi*4 + 0x548c48]
sub esp, 0x16
mov word [esp + 7], si
lea esp, [esp + 2]
jmp 0x565f56
shr edi, 0x18
jmp 0x565ef4
lea esi, [esi*4]
lea esi, [esi + 0x549048]
mov edi, dword [esi]
pop esi
jmp 0x56600f
and edi, ecx
call fcn.00565f36
mov esi, edi
jmp 0x565f3e
mov byte [esp + 0xc], ah
mov dword [esp + 5], ecx
lea esp, [esp + 1]
jmp 0x565fee
mov ebx, dword [ebx*4 + 0x548c48]
sub esp, 0x11
mov dword [esp + 0xa], ebx
jmp 0x565f90
cmc
sub esp, 4
push word [esp + 2]
lea esp, [esp + 2]
jmp 0x565fa6
xor edi, dword [ebx*4 + 0x549848]
mov bx, 0x5005
mov bl, byte [esp]
bswap ebx
movzx ebx, byte [esi + 2]
jmp 0x565fbd
and ebx, ecx
call 0x565ff6
or ch, al
push cs
add dword [eax], eax
add byte [eax - 0xd], ch
arpl word [esi], ax
cmc
sbb byte [ebx + 0x21d2b727], ch
test al, 0xcb
dec edi
fistp qword [edx - 0x55c55bb7]
sub esp, 0
pushal
and ebx, ecx
lea esp, [esp + 0x40]
jmp 0x565fd7
dec dword [ebp - 4]
call fcn.00566630
lea esp, [esp + 0xc]
jne 0x53f553
je 0x53f51a
ljmp 0x4b9e:0x7784fd6d
lea ebx, [eax*4]
pop ebx
call fcn.005667c2
les eax, [ebp - 0x2b]
mov esp, 0x60e0b24f
not byte [ecx - 0x7efd7aa0]
adc dword [eax - 0x7d], esi
jl 0x56665b
cmp eax, esi
lea esp, [esp + 8]
xor edi, dword [edx*4 + 0x549c48]
pushfd
mov word [esp], bp
push word [esp + 2]
call fcn.00566686
mov edi, 0xb3a44b2e
mov al, 0x35
mov dh, 0x3e
pop ebx
mov edi, 0xdf4162c1
not dword [eax - 0x78]
in eax, dx
lodsb al, byte [esi]
mov dl, 0x74
mov ah, bl
sbb dword [0x97d313cd], edi
ljmp 0xdda0
Function at 0x56810a
Capabilities:
Encode data using xor

Disassembly:
jmp 0x71680e
call fcn.005681cf
add byte [eax], al
xor eax, 0xbe4324b6
inc ecx
inc eax
rcl byte [esi + 0x31], 0xc0
and eax, 0xa8c959da
pop ebx
test al, 0x5b
movsb byte es:[edi], byte [esi]
inc edi
jne 0x56764d
call 0x56810a
cmp dword [ebp + 0x32c7342d], edi
mov eax, dword [0x3900000a]
mov ebp, 0x32c7342d
pop esi
fisttp word [edi + 0x2a]
fld dword [esi]
push es
push ecx
je 0x5676a2
push ss
shr eax, cl
ja 0x567695
add byte [eax], al
mov byte [esi], bl
jns 0x567621
js 0x5676e4
int3
call fcn.00568ebd
ror byte [edx - 0x28], 0xbf
dec edx
int 8
mov bl, byte [eax]
jg 0x56763c
mov bh, byte [ecx + 0x6f]
jns 0x567723
je 0x56765e
jns 0x5676e1
out 0x19, al
bnd jb 0x5676b1
xchg dword [edx - 0x69], esi
fsubp st(1)
mov dh, 0xd
add byte [eax], al
add byte [edi], 0x97
add edx, esi
std
jns 0x5676cc
mov byte [ebx - 0x72], bh
jnp 0x567674
pop esp
invalid
jmp 0x567f8f
and al, 4
jmp 0x5680df
mov word [esp + 2], cx
pop dword [esp]
jmp 0x567f61
not ax
jmp 0x567fb3
lea esp, [esp + 4]
jne 0x56777b
mov eax, dword [esp]
setp al
bswap eax
jmp 0x567f4a
mov al, byte [edx + 1]
not ch
jmp 0x568000
ret 0x3750
test al, al
pushfd
lea esp, [esp + 4]
je 0x567664
jmp 0x567f75
std
jl 0x567fa9
xchg byte [ebx + esi*2], dl
invalid
jge 0x567f80
push esi
les esp, [ebx + 0x4ae9a15e]
mov ebx, 0x3824448a
mov al, byte [esp + 0x38]
cmc
sub edi, edx
jmp 0x5676ed
movzx ecx, byte [edx + edi + 1]
call fcn.00567fe3
rcr dword [ebx - 0x35], 1
scasb al, byte es:[edi]
pop ebp
stosd dword es:[edi], eax
in eax, dx
push 0x836899fe
cmc
jge 0x568006
fcos
invalid
je 0x567fa2
add cl, byte [edi]
imul esp, dword [edi], 0x44
daa
inc esp
popfd
lodsb al, byte [esi]
test eax, 0x7c2da51e
in eax, 0xc5
out 0x74, eax
sbb al, 0xa9
and dword [eax + 8], edi
dec esi
je 0x568048
test eax, 0x4e087821
push cs
sar byte [edi], cl
jne 0x568058
mov esp, 0x4ca4ca0a
mov ecx, 0xf083bfff
cmp byte [eax + 0x61], dl
jle 0x56802a
and byte [esi - 0x54], ah
lodsb al, byte [esi]
insb byte es:[edi], dx
xor byte [edi - 0x5f00d1e8], dl
aam 0xd7
mov ah, 0xf7
jo 0x56801e
xor eax, 0xbca863e4
jns 0x5680d3
arpl word [eax + 0x1c7679bc], bp
mov dword [ebx + 0x54], ebp
or byte [esi - 1], ah
sbb al, 0x89
imul edx, dword [eax + ecx + 0x66], 0xffffffff
push word [esp + 0xc]
lea esp, [esp + 1]
je 0x56808a
or al, 0x8d
and al, 1
jmp 0x5681c1
pop edx
cmpsd dword [esi], dword es:[edi]
mov ebx, dword [esp + 0x13]
not bl
lea esp, [esp + 0x1c]
movzx ebx, al
mov dh, 0xd8
sub esp, 0xf
jmp 0x568062
xchg ebp, eax
out dx, al
std
cli
insd dword es:[edi], dx
cdq
and dword [eax - 0x27], esi
jmp 0x9a1082cd
insb byte es:[edi], dx
jmp 0x568104
test ecx, ecx
pushfd
pushfd
lea esp, [esp + 8]
jge 0x56764a
jl 0x5680f3
jbe 0x56807d
test al, 0x28
push bx
lea esp, [esp + 2]
jmp 0x568134
jnp 0x56809c
popal
mov esp, 0x648d3671
and al, 4
mov ebx, dword [esp + 0x14]
jmp 0x56777b
or ecx, 0xffffffff
jmp 0x5676b8
lea esp, [esp + 0x10]
je 0x5676ed
jne 0x567664
lea ebx, [esi - 1]
push di
call fcn.0056820f
mov eax, dword [0x22d7b022]
fld qword [esp + eax*4]
sbb bh, byte [ebp - 0x74]
imul esp, dword [ebx - 0xa71f0ef], 0xc7fffff4
ret
sub ecx, ebx
push dx
mov word [esp], di
lea esp, [esp + 2]
jmp 0x56817f
Function at 0x6a4455
Capabilities:
Access peb ldr_data
Packed with generic packer
Parse pe header

Disassembly:
push word [esp + 2]
lea esp, [esp + 5]
mov byte [esp], dl
jmp 0x6a4493
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
mov ecx, 0x176d4c9f
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data_1
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x4a3d2533
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40bad0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x468b2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0045d4a6
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40bb52
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0045b31d
mov eax, dword [eax]
push 0x4801c0
push eax
call fcn.0044e184
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0045d731
test bl, bl
je 0x40bb52
push 0x4801c0
lea ecx, [esp + 0xc]
call fcn.0045dac1
push 0x483d3c
lea ecx, [esp + 0xc]
call fcn.0045dac1
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40bb8e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0045d731
jmp 0x40bc59
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40bc12
lea edx, [esp + 0x7c]
push 0x483d38
push edx
call fcn.0044e184
add esp, 8
test eax, eax
je 0x40bc12
lea eax, [esp + 0x7c]
push 0x483d34
push eax
call fcn.0044e184
add esp, 8
test eax, eax
je 0x40bc12
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40bba2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0045d731
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40c450
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40c4b2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40c4c0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x468bab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x48a1e8]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40c5f8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40c526
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045d731
xor eax, eax
jmp 0x40c66f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0045d86e
push esi
lea ecx, [esp + 0xc]
call fcn.0045dafd
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40c64d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push accept
call fcn.0040c450
test eax, eax
jne 0x40c64d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push accept
mov ecx, edi
call fcn.0040c450
test eax, eax
jne 0x40c64d
lea eax, [esp + 0x14]
push 0x483d50
push eax
call fcn.0044f1c0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40c62c
lea ecx, [esp + 0x14]
push 0x483d4c
push ecx
call fcn.0044f140
mov esi, eax
add esp, 8
test esi, esi
jne 0x40c62c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40c62f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0045d81e
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40c53e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045d731
xor eax, eax
jmp 0x40c66f
mov byte [esi], 0
push 0x483d48
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0045d731
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4