joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov dword [esp + 0x14], edx
mov esi, dword [edx + 4]
mov edx, 1
xor eax, eax
lock cmpxchg dword [esi + 8], edx
jne 0x4178da
mov dword [esi + 0xc], str.nvme.c_157
mov eax, dword [esi + 4]
mov edx, dword [esi + 0x18]
mov ebp, edx
shl ebp, 4
add ebp, dword [esi]
adc eax, 0
mov dword [esp], eax
xor eax, eax
cmp edx, dword [esi + 0x10]
lea edx, [edx + 1]
cmovae edx, eax
mov dword [esi + 0x18], edx
xchg dword [esi + 8], eax
cmp eax, 1
jne 0x4178f2
mov eax, dword [ecx + 4]
test eax, eax
je 0x417884
mov eax, dword [eax]
mov eax, dword [eax]
mov edx, dword [eax]
mov esi, dword [eax + 4]
cmp ebp, edx
mov edi, dword [esp]
sbb edi, esi
jb 0x417884
mov edi, ebp
sub edi, edx
mov ebx, dword [esp]
sbb ebx, esi
add edi, 0x10
adc ebx, 0
mov esi, dword [eax + 0xc]
cmp dword [eax + 8], edi
sbb esi, ebx
jb 0x417884
mov esi, dword [eax + 0x20]
test esi, esi
je 0x417832
mov dword [esp + 0x10], ecx
mov ecx, ebp
shr ecx, 0xc
mov edx, 1
shl edx, cl
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebp
shld dword [esp], ebp, 0xf
mov edx, 0xfffffffe
rol edx, cl
mov dword [esp + 0x18], edx
xor ecx, ecx
jmp 0x4177e5
inc ecx
cmp ecx, esi
jae 0x417828
mov edx, dword [eax + 0x18]
mov edx, dword [edx + ecx*4]
mov edi, dword [edx + 0x33e4]
test edi, edi
je 0x4177e0
mov ebp, dword [edx + 0x33e8]
and ebp, dword [esp]
mov ebx, dword [edx + 0x33e0]
mov ebx, dword [ebx + ebp*4]
test dword [esp + 8], ebx
je 0x4177e0
mov esi, dword [esp + 8]
lock or dword [edi + ebp*4], esi
mov edx, dword [edx + 0x33e0]
mov esi, dword [esp + 0x18]
lock and dword [edx + ebp*4], esi
mov esi, dword [eax + 0x20]
jmp 0x4177e0
mov edx, dword [eax]
mov ecx, dword [esp + 0x10]
mov ebp, dword [esp + 0xc]
mov eax, dword [eax + 0x10]
test eax, eax
je 0x417884
sub ebp, edx
movzx edx, word [eax + ebp + 0xe]
and edx, 1
mov ebx, dword [esp + 4]
shr ebx, 8
mov dword [eax + ebp], ebx
mov dword [eax + ebp + 4], 0
mov esi, dword [esp + 0x14]
movzx edi, word [esi + 0x2c]
mov word [eax + ebp + 8], di
movzx edi, word [esi + 0x2a]
mov word [eax + ebp + 0xa], di
movzx esi, word [esi + 0x28]
mov word [eax + ebp + 0xc], si
movzx esi, byte [esp + 4]
lea edx, [edx + esi*2]
xor edx, 1
mov word [eax + ebp + 0xe], dx
test byte [ecx + 0x18], 1
jne 0x4178d2
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x4178d2
mov eax, dword [ecx + 4]
test eax, eax
je 0x4178d2
cmp byte [eax + 0x30], 0
je 0x4178d2
mov ecx, dword [ecx]
mov edx, dword [eax + 0x20]
test edx, 0x400
jne 0x4178d2
lock or dword [eax + 0x1c], 8
mov edx, dword [eax]
mov eax, dword [eax + 0x30]
mov edx, dword [edx + 0x24]
lea eax, [edx + eax - 1]
and eax, 3
mov edx, dword [ecx + eax*4 + 8]
mov ecx, dword [ecx + 4]
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.004199a0
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esi + 8]
mov edi, ecx
mov ecx, eax
mov edx, str.nvme.c_157
call fcn.0040f5ee
mov ecx, edi
jmp 0x41772f
add esi, 8
mov edi, ecx
mov ecx, esi
mov edx, eax
call fcn.0040f821
mov ecx, edi
mov eax, dword [ecx + 4]
test eax, eax
jne 0x417767
jmp 0x417884
Function at 0x42ca60
Capabilities:
Set socket configuration

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, edx
mov edi, ecx
mov ecx, dword [esp + 0x28]
cmp byte [esp + 0x2c], 0
je 0x42ca86
call fcn.0042d650
mov ebx, eax
test eax, eax
jne 0x42ca95
jmp 0x42cc46
call fcn.0042e350
mov ebx, eax
test eax, eax
je 0x42cc46
mov eax, dword [ebx + 0xc]
mov dword [esp + 0x10], 1
lea ecx, [esp + 0x10]
push ecx
push 0x8004667e
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push 0x20
push 1
call sub.MSVCR70.dll_calloc
add esp, 8
test eax, eax
je 0x42cc75
mov esi, eax
mov dword [eax], ebx
movsd xmm0, qword [ebp]
movsd xmm1, qword [ebp + 8]
movsd qword [eax + 8], xmm0
movsd qword [eax + 0x10], xmm1
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x18], eax
mov ecx, 1
xor eax, eax
lock cmpxchg dword [edi], ecx
jne 0x42cb74
mov dword [edi + 4], str.tap_user.c_833
cmp byte [esp + 0x2c], 0
je 0x42cb8b
push 0x18
push 1
call sub.MSVCR70.dll_calloc
add esp, 8
test eax, eax
je 0x42cc75
mov dword [esi + 4], eax
mov byte [eax + 0x16], 1
mov ecx, dword [edi + 0x3c]
mov eax, dword [edi + 0x34]
mov edx, dword [edi + 0x38]
cmp ecx, edx
jb 0x42cb66
mov ebp, esi
mov ecx, edx
shr ecx, 1
add ecx, edx
mov esi, 2
cmovne esi, ecx
mov dword [edi + 0x38], esi
shl esi, 2
push esi
push eax
call sub.MSVCR70.dll_realloc
add esp, 8
test esi, esi
je 0x42cc5c
test eax, eax
je 0x42cc75
mov dword [edi + 0x34], eax
mov ecx, dword [edi + 0x3c]
mov esi, ebp
lea edx, [ecx + 1]
mov dword [edi + 0x3c], edx
mov dword [eax + ecx*4], esi
jmp 0x42cc2d
mov ecx, edi
mov edx, str.tap_user.c_833
call fcn.0040f5ee
cmp byte [esp + 0x2c], 0
jne 0x42cb06
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esi + 0x1c], 0xffff
lea ecx, [edi + 0x14]
movzx eax, word [ebp + 2]
mov edx, eax
shl edx, 0x15
mov dword [esp], eax
add eax, edx
shr edx, 0x11
xor edx, eax
mov ebp, dword [edi + 0x14]
mov dword [esp + 0xc], edi
mov edi, dword [edi + 0x18]
mov esi, 0x100
nop
mov eax, edx
and eax, edi
mov ebx, dword [esp]
cmp dword [ebp + eax*8], ebx
lea ebx, [ebp + eax*8 + 4]
je 0x42cc07
cmp dword [ebx], 0
je 0x42cc13
lea eax, [edx + 1]
and eax, edi
mov ebx, dword [esp]
cmp dword [ebp + eax*8], ebx
lea ebx, [ebp + eax*8 + 4]
je 0x42cc07
cmp dword [ebx], 0
je 0x42cc13
add edx, 2
add esi, 0xfffffffe
jne 0x42cbc0
mov edx, dword [esp]
mov esi, dword [esp + 4]
push esi
call fcn.00402e00
add esp, 4
jmp 0x42cc0d
mov esi, dword [esp + 4]
mov dword [ebx], esi
mov edi, dword [esp + 0xc]
jmp 0x42cc29
mov edi, dword [esp + 0xc]
inc dword [edi + 0x1c]
mov ecx, dword [esp]
mov dword [ebp + eax*8], ecx
mov esi, dword [esp + 4]
mov dword [ebp + eax*8 + 4], esi
mov ebx, dword [esp + 8]
xor edx, edx
xchg dword [edi], edx
cmp edx, 1
jne 0x42cc53
mov ecx, dword [edi + 0x10]
mov edx, dword [esi]
push esi
push 1
call fcn.0042e5d0
add esp, 8
test ebx, ebx
setne al
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, edi
call fcn.0040f821
jmp 0x42cc36
push str.Suspicious_0_byte_allocation
mov esi, eax
call fcn.00410c10
mov eax, esi
add esp, 4
test eax, eax
jne 0x42cb5e
push str.Out_of_memory_
call fcn.00410c90
int3
Function at 0x42d650
Capabilities:
Set socket configuration

Disassembly:
push edi
push esi
sub esp, 0x20
mov esi, ecx
mov ecx, 1
mov edx, esi
push 0
call fcn.0042d780
add esp, 4
cmp eax, 0xffffffff
je 0x42d748
mov edi, eax
mov dword [esp + 0x1c], 1
lea eax, [esp + 0x1c]
push 4
push eax
push 4
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test esi, esi
je 0x42d6d0
movzx eax, word [esi]
cmp eax, 1
je 0x42d6e3
test eax, eax
jne 0x42d741
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov word [esp], 2
movzx eax, word [esi + 2]
rol ax, 8
mov word [esp + 2], ax
mov eax, dword [esi + 4]
mov dword [esp + 4], eax
jmp 0x42d6dd
xorps xmm0, xmm0
movups xmmword [esp], xmm0
mov word [esp], 2
mov eax, esp
push 0x10
jmp 0x42d725
xorps xmm0, xmm0
movsd qword [esp + 0x14], xmm0
movsd qword [esp + 0xc], xmm0
movsd qword [esp + 4], xmm0
mov word [esp], 0x17
movzx eax, word [esi + 2]
rol ax, 8
mov word [esp + 2], ax
movsd xmm0, qword [esi + 4]
movsd xmm1, qword [esi + 0xc]
movsd qword [esp + 8], xmm0
movsd qword [esp + 0x10], xmm1
mov eax, esp
push 0x1c
push eax
push edi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x42d741
push 0x7fffffff
push edi
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
je 0x42d750
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
add esp, 0x20
pop esi
pop edi
ret
push 0x24
push 1
call sub.MSVCR70.dll_calloc
add esp, 8
test eax, eax
je 0x42d776
mov dword [eax + 0xc], edi
mov ecx, eax
mov edx, esi
mov esi, eax
call fcn.0042d8f0
mov eax, esi
add esp, 0x20
pop esi
pop edi
ret
push str.Out_of_memory_
call fcn.00410c90
Function at 0x42d780
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [0x4401f8]
cmp eax, 2
jne 0x42d89c
mov eax, 0xffffffff
cmp byte [0x4401fc], 0
je 0x42d895
movzx ebx, byte [esp + 0x1c]
test edx, edx
je 0x42d7c1
movzx ecx, word [edx]
cmp ecx, 1
je 0x42d81d
test ecx, ecx
jne 0x42d895
push 0x81
push 0
push 0
push 0
push esi
push 2
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov edi, eax
cmp eax, 0xffffffff
je 0x42d7e5
test bl, bl
jne 0x42d80f
jmp 0x42d877
push 0
push esi
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp eax, 0xffffffff
mov eax, 0xffffffff
je 0x42d895
push 0
push 1
push edi
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test bl, bl
je 0x42d877
mov dword [esp + 4], 1
lea eax, [esp + 4]
jmp 0x42d86a
push 0x81
push 0
push 0
push 0
push esi
push 0x17
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov edi, eax
cmp eax, 0xffffffff
jne 0x42d85a
push 0
push esi
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp eax, 0xffffffff
mov eax, 0xffffffff
je 0x42d895
push 0
push 1
push edi
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test bl, bl
je 0x42d877
mov dword [esp + 8], 1
lea eax, [esp + 8]
push eax
push 0x8004667e
push edi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp esi, 1
jne 0x42d893
mov dword [esp], 1
mov eax, esp
push 4
push eax
push 1
push 6
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, edi
add esp, 0xc
pop esi
pop edi
pop ebx
ret
mov edi, edx
mov ecx, 1
xor eax, eax
lock cmpxchg dword [0x4401f8], ecx
jne 0x42d8c3
call fcn.0042da20
mov byte [0x4401fc], al
mov dword [0x4401f8], 2
mov ecx, 0x4401f8
call fcn.00410d70
mov edx, edi
mov eax, 0xffffffff
cmp byte [0x4401fc], 0
jne 0x42d7a8
jmp 0x42d895
Function at 0x42d8f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push esi
sub esp, 0x20
mov esi, ecx
test edx, edx
je 0x42d942
movzx eax, word [edx]
cmp eax, 1
je 0x42d998
test eax, eax
jne 0x42d991
mov dword [esp], 0x10
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov word [esp + 4], 2
movzx eax, word [edx + 2]
rol ax, 8
mov word [esp + 6], ax
mov eax, dword [edx + 4]
mov dword [esp + 8], eax
jmp 0x42d958
mov dword [esp], 0x10
xorps xmm0, xmm0
movups xmmword [esp + 4], xmm0
mov word [esp + 4], 2
mov eax, esp
lea ecx, [esp + 4]
push eax
push ecx
push dword [esi + 0xc]
call dword [sym.imp.WS2_32.dll_getsockname]
xorps xmm0, xmm0
movsd qword [esi + 0x10], xmm0
movsd qword [esi + 0x18], xmm0
mov dword [esi + 0x20], 0
movzx eax, word [esp + 6]
rol ax, 8
mov word [esi + 0x12], ax
mov eax, dword [esp + 8]
mov dword [esi + 0x14], eax
mov eax, esi
add esp, 0x20
pop esi
ret
mov dword [esp], 0x1c
xorps xmm0, xmm0
movsd qword [esp + 8], xmm0
movsd qword [esp + 0x10], xmm0
movsd qword [esp + 0x18], xmm0
mov word [esp + 4], 0x17
movzx eax, word [edx + 2]
rol ax, 8
mov word [esp + 6], ax
movsd xmm0, qword [edx + 4]
movsd xmm1, qword [edx + 0xc]
movsd qword [esp + 0xc], xmm0
movsd qword [esp + 0x14], xmm1
mov eax, esp
lea ecx, [esp + 4]
push eax
push ecx
push dword [esi + 0xc]
call dword [sym.imp.WS2_32.dll_getsockname]
mov word [esi + 0x10], 1
movzx eax, word [esp + 6]
rol ax, 8
mov word [esi + 0x12], ax
movsd xmm0, qword [esp + 0xc]
movsd xmm1, qword [esp + 0x14]
movsd qword [esi + 0x1c], xmm1
movsd qword [esi + 0x14], xmm0
mov eax, esi
add esp, 0x20
pop esi
ret

Function at 0x42da20
Capabilities:
Initialize winsock library

Disassembly:
push esi
sub esp, 0x190
mov esi, esp
push 0x190
push 0
push esi
call sub.MSVCR70.dll_memset
add esp, 0xc
push esi
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
movzx esi, word [esp]
cmp esi, 0x202
je 0x42da5e
push str.Failed_to_initialize_WinSock
call fcn.00410c10
add esp, 4
movzx eax, si
cmp eax, 0x202
sete al
add esp, 0x190
pop esi
ret
Function at 0x42dbb0
Capabilities:
Connect socket

Disassembly:
push ebx
push edi
push esi
sub esp, 0x1c
xor esi, esi
test ecx, ecx
je 0x42dcb0
mov edi, ecx
mov ecx, 1
mov edx, edi
push 1
call fcn.0042d780
add esp, 4
cmp eax, 0xffffffff
je 0x42dcb0
mov ebx, eax
movzx eax, word [edi]
cmp eax, 1
je 0x42dc1e
test eax, eax
jne 0x42dca9
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov word [esp], 2
movzx eax, word [edi + 2]
rol ax, 8
mov word [esp + 2], ax
mov eax, dword [edi + 4]
mov dword [esp + 4], eax
mov eax, esp
push 0x10
jmp 0x42dc60
xorps xmm0, xmm0
movsd qword [esp + 0x14], xmm0
movsd qword [esp + 0xc], xmm0
movsd qword [esp + 4], xmm0
mov word [esp], 0x17
movzx eax, word [edi + 2]
rol ax, 8
mov word [esp + 2], ax
movsd xmm0, qword [edi + 4]
movsd xmm1, qword [edi + 0xc]
movsd qword [esp + 8], xmm0
movsd qword [esp + 0x10], xmm1
mov eax, esp
push 0x1c
push eax
push ebx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x42dc79
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x42dca9
push 0x24
push 1
call sub.MSVCR70.dll_calloc
add esp, 8
test eax, eax
je 0x42dcb9
mov esi, eax
mov dword [eax + 0xc], ebx
movsd xmm0, qword [edi]
movsd xmm1, qword [edi + 8]
movsd qword [eax + 0x10], xmm0
movsd qword [eax + 0x18], xmm1
mov eax, dword [edi + 0x10]
mov dword [esi + 0x20], eax
jmp 0x42dcb0
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
ret
push str.Out_of_memory_
call fcn.00410c90
int3

Function at 0x42e2f0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, 0xfffffffc
test ecx, ecx
je 0x42e30d
push 0
push dword [esp + 8]
push edx
push dword [ecx + 0xc]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
js 0x42e30e
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x42e337
mov ecx, eax
cmp eax, 0x2733
mov eax, 0xfffffffe
je 0x42e30d
cmp ecx, 0x2746
jne 0x42e33d
mov eax, 0xfffffffc
ret
mov eax, 0xfffffffe
ret
mov eax, 0xffffffff
ret
Function at 0x42e5d0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
sub esp, 0x10
xor ebx, ebx
test ecx, ecx
je 0x42e652
test edx, edx
je 0x42e652
mov esi, ecx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
and ecx, 2
mov dword [esp + 4], edx
mov dword [esp + 8], eax
or ecx, 1
mov dword [esp + 0xc], ecx
mov ecx, 1
xor eax, eax
lock cmpxchg dword [esi + 0x4028], ecx
jne 0x42e687
mov dword [esi + 0x402c], 0x43afb7
lea edx, [esp + 4]
mov ecx, esi
push 1
call fcn.0042deb0
add esp, 4
mov ebx, eax
xor edx, edx
xchg dword [esi + 0x4028], edx
cmp edx, 1
jne 0x42e69c
test bl, bl
je 0x42e652
mov eax, dword [esi + 0x4034]
test eax, eax
je 0x42e652
mov eax, 1
xchg dword [esi + 0x4030], eax
test eax, eax
je 0x42e65a
mov eax, ebx
add esp, 0x10
pop esi
pop ebx
ret
mov byte [esp + 3], 0
mov eax, dword [esi + 0x4024]
test eax, eax
je 0x42e652
lea ecx, [esp + 3]
push 0
push 1
push ecx
push dword [eax + 0xc]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x42e652
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x42e652
lea ecx, [esi + 0x4028]
mov edx, 0x43afb7
call fcn.0040f5ee
jmp 0x42e616
lea ecx, [esi + 0x4028]
call fcn.0040f821
test bl, bl
jne 0x42e639
jmp 0x42e652
Function at 0x4346c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [esp], edx
mov esi, ecx
mov eax, dword [0x4401f4]
test eax, eax
jle 0x43470b
mov ecx, dword [0x456344]
add ecx, 0x10
mov edx, eax
jmp 0x4346f6
add ecx, 0x14
dec edx
je 0x43470d
mov edi, dword [ecx - 4]
cmp edi, esi
ja 0x4346f0
mov ebx, dword [ecx]
add edi, dword [ebx + 8]
cmp edi, esi
jbe 0x4346f0
jmp 0x434817
xor eax, eax
mov ebx, dword [0x438004]
movzx ecx, word [ebx]
cmp ecx, 0x5a4d
jne 0x43482d
mov ecx, dword [ebx + 0x3c]
cmp dword [ebx + ecx], 0x4550
jne 0x43482d
add ebx, ecx
movzx ecx, word [ebx + 0x18]
cmp ecx, 0x10b
jne 0x43482d
movzx ecx, word [ebx + 6]
test ecx, ecx
je 0x43482d
mov edx, esi
sub edx, dword [0x438004]
movzx edi, word [ebx + 0x14]
lea ebp, [ebx + edi + 0x18]
jmp 0x43477a
add ebp, 0x28
dec ecx
je 0x43482d
mov edi, dword [ebp + 0xc]
cmp edi, edx
ja 0x434770
mov ebx, dword [ebp + 8]
add ebx, edi
cmp ebx, edx
jbe 0x434770
mov ecx, dword [0x456344]
lea ebx, [eax + eax*4]
mov dword [ecx + ebx*4 + 0x10], ebp
mov dword [ecx + ebx*4], 0
add edi, dword [0x438004]
mov dword [ecx + ebx*4 + 0xc], edi
lea eax, [esp + 4]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x434838
mov eax, dword [esp + 0x18]
cmp eax, 7
jle 0x4347d6
cmp eax, 8
je 0x434811
cmp eax, 0x40
je 0x434811
cmp eax, 0x80
je 0x434811
jmp 0x4347e5
mov ecx, 4
cmp eax, 2
je 0x4347ea
cmp eax, 4
je 0x434811
mov ecx, 0x40
mov eax, dword [esp + 4]
mov edx, dword [0x456344]
lea edi, [edx + ebx*4]
mov dword [edx + ebx*4 + 4], eax
mov ebp, dword [esp + 0x10]
mov dword [edx + ebx*4 + 8], ebp
push edi
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x43484e
inc dword [0x4401f4]
push dword [esp + 0x34]
push dword [esp + 4]
push esi
call sub.MSVCR70.dll_memcpy
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
push esi
push str.Address__p_has_no_image_section
call fcn.00434860
mov eax, dword [0x456344]
push dword [eax + ebx*4 + 0xc]
push dword [ebp + 8]
push str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00434860
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.__VirtualProtect_failed_with_code_0x_x
call fcn.00434860
int3

Function at 0x434860
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push eax
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x14]
mov dword [esp], eax
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call edi
add esp, 4
push eax
push 1
push 0x1b
push str.Mingw_w64_runtime_failure:_n
call sub.MSVCR70.dll_fwrite
add esp, 0x10
push 2
call edi
add esp, 4
push dword [esp]
push esi
push eax
call sub.MSVCR70.dll_vfprintf
add esp, 0xc
call sub.MSVCR70.dll_abort
int3
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x300093c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x30009436
mov eax, dword [ebp + 8]
test eax, 3
je 0x300093f8
cmp word [eax], 0
je 0x300093f1
lea eax, [eax + 2]
test eax, 3
je 0x300093f8
jmp 0x300093df
sub eax, dword [ebp + 8]
shr eax, 1
jmp 0x30009433
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x10001
xor edx, ecx
and edx, 0x80008000
je 0x300093f8
sub eax, dword [ebp + 8]
shr eax, 1
test cx, cx
lea eax, [eax - 2]
je 0x30009433
test ecx, 0xffff0000
lea eax, [eax + 1]
je 0x30009433
lea eax, [eax*2 + 2]
add eax, dword [ebp + 8]
jmp 0x300093f8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret 4
Function at 0x516580
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push eax
push 0x40
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0x5165a3
mov eax, 1
jmp 0x5166ae
mov edx, dword [ebp + 8]
movzx eax, word [edx]
cmp eax, 0x5a4d
jne 0x5165b9
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x3c], 0
jne 0x5165c3
mov eax, 2
jmp 0x5166ae
mov edx, dword [ebp + 0x10]
push edx
push 0xf8
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x40
push edx
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0x5165ee
mov eax, 1
jmp 0x5166ae
mov eax, dword [ebp + 8]
cmp dword [eax + 0x40], 0x4550
jne 0x516614
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 0x58]
cmp edx, 0x10b
jne 0x516614
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x46]
test ecx, ecx
jne 0x51661e
mov eax, 2
jmp 0x5166ae
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x46]
imul eax, eax, 0x28
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x140], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x140]
push eax
call fcn.00528ba0
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x138], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x138], 0
jne 0x51665f
mov eax, 3
jmp 0x5166ae
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x54]
lea ecx, [ecx + eax + 0x18]
mov edx, dword [ebp + 8]
mov dword [edx + 0x13c], ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x140]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x13c]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
push eax
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0x5166ac
mov eax, 1
jmp 0x5166ae
xor eax, eax
pop ebp
ret

Function at 0x517050
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
je 0x517066
xor eax, eax
jmp 0x5170a6
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0x4550
jne 0x51708b
mov edx, dword [ebp - 4]
movzx eax, word [edx + 0x18]
cmp eax, 0x10b
je 0x51708f
xor eax, eax
jmp 0x5170a6
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x78]
push ecx
call fcn.005170b0
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x529aa0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x529ad0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
jne 0x529ae3
xor eax, eax
jmp 0x529ba1
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x529afe
xor eax, eax
jmp 0x529ba1
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0x4550
je 0x529b1c
xor eax, eax
jmp 0x529ba1
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x78]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x1c], 0
jmp 0x529b5e
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [eax + 0x18]
jae 0x529b9f
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax*4]
push edx
call fcn.00528bc0
add esp, 8
test eax, eax
jne 0x529b9d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x529ba1
jmp 0x529b55
xor eax, eax
mov esp, ebp
pop ebp
ret