joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404ab3
Capabilities:
Delete file
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add eax, 0xffffee6a
push ebp
mov ebp, dword [esp + 0xc]
xor ecx, 0x7ba
add ebp, 0x8cd
mov dword [esp + 0xc], eax
push esi
push edi
mov edi, dword [esp + 0x2c]
mov edx, edi
xor edx, 0x2d
lea eax, [ebp - 0x521]
xor edi, 0xbb6
mov dword [esp + 0xc], edx
mov dword [esp + 0x2c], edi
cmp ecx, eax
jl 0x404c3e
mov esi, dword [esp + 0x28]
xor edi, edi
mov dword [0x49c7b4], 0x464000
push ebx
mov ecx, dword [0x493c3c]
mov eax, dword [ecx + 0x94]
mov ebx, dword [eax + edi]
add edi, 4
mov eax, dword [esi + 0xa0]
sub eax, dword [0x49c800]
imul ebx, dword [esi + 0x60]
sub eax, 0x1583f7
imul eax, dword [ecx + 4]
mov edx, ebx
mov dword [ecx + 4], eax
mov eax, dword [0x49c7c8]
mov ecx, dword [esi + 0x84]
shr edx, 0x10
mov byte [eax + ecx], dl
mov ecx, 0x14cf97
inc dword [esi + 0x84]
mov edx, ebx
mov eax, dword [esi + 0x28]
dec eax
shr edx, 8
add dword [esi + 0x40], eax
mov eax, dword [0x493c3c]
sub ecx, dword [eax + 0x10c]
mov dword [esi + 0xe8], ecx
mov eax, dword [0x493c3c]
mov ecx, dword [eax + 0x84]
mov eax, dword [esi + 0xa8]
mov byte [ecx + eax], dl
mov eax, dword [0x493c3c]
inc dword [eax + 0x84]
mov eax, dword [esi + 0x108]
dec eax
add dword [esi + 0x14], eax
mov eax, dword [0x493c3c]
mov ecx, dword [eax + 0xa8]
mov eax, dword [esi + 0x84]
mov byte [ecx + eax], bl
inc dword [esi + 0x84]
mov ecx, dword [0x493c3c]
mov eax, dword [esi + 0x118]
sub eax, 0xacede0
or dword [ecx + 4], eax
mov eax, dword [esi + 0xfc]
mov ecx, dword [0x493c3c]
sub eax, 0x13
xor dword [ecx + 0x3c], eax
mov edx, dword [0x493c3c]
mov eax, dword [0x49c808]
add eax, 0xffe77b77
add eax, dword [edx + 0x70]
mov dword [0x49c808], eax
mov eax, dword [0x49c80c]
add eax, 0xffffffed
add dword [edx + 0xe8], eax
mov eax, dword [0x49c724]
sub dword [0x49c7e0], eax
mov eax, dword [esi + 0xe0]
add eax, 0x7a04
imul eax, dword [esi + 0xe4]
mov dword [esi + 0xe4], eax
cmp edi, 0x2ed40
jl 0x404b0e
mov edi, dword [esp + 0x30]
mov edx, dword [esp + 0x10]
pop ebx
mov esi, dword [esp + 0x1c]
lea eax, [esi + 0x351]
cmp dword [esp + 0x14], eax
jg 0x404caa
lea eax, [edx + 0x7bb]
cmp esi, eax
je 0x404c78
lea eax, [edi + 0x147f]
cmp ebp, eax
jl 0x404caa
mov ecx, dword [0x493c3c]
mov eax, dword [ecx + 0xcc]
add eax, 0xa7b17
mov dword [ecx + 0x60], eax
jmp 0x404caa
mov eax, esi
or eax, 0x162c
imul eax, eax, 0xbb6
cmp dword [0x49c74c], eax
jb 0x404caa
mov eax, dword [0x49c75c]
add eax, 0xffffe7c7
imul eax, eax, 0x1854
push ebp
or dword [0x49c808], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
lea eax, [esi + 0x151]
pop esi
pop ebp
pop ecx
ret
Function at 0x404cb5
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
push ebx
mov ebx, dword [esp + 0x2c]
mov eax, 0xcbc
sub eax, dword [0x49cfc0]
xor edx, edx
mov dword [esp + 0x14], eax
mov eax, 0x977
movzx ecx, bx
push ebp
mov ebp, dword [esp + 0x34]
push esi
push edi
mov edi, 0xffff
mov dword [esp + 0x24], ecx
sub eax, dword [ebp + ecx*4]
add ebx, edi
mov dword [esp + 0x30], eax
mov ax, word [0x49d028]
add ax, di
mov dword [esp + 0x38], ebx
mov word [0x49d028], ax
movzx eax, ax
mov dword [esp + 0x18], eax
mov eax, dword [0x49d014]
mov al, byte [eax + ecx*2]
mov byte [esp + 0x13], al
mov eax, 0xd8e
div ecx
mov ecx, dword [0x49cfec]
mov edx, dword [0x49cff8]
dec ecx
mov esi, eax
mov dword [0x49cfec], ecx
mov dword [esp + 0x1c], esi
mov eax, dword [ebp + ecx*4 + 0x4c]
mov ecx, dword [0x49cffc]
xor eax, dword [edx + ecx*4]
mov dword [esp + 0x28], eax
movzx eax, bx
mov dword [esp + 0x2c], eax
mov eax, 0x1cf8
cdq
idiv dword [0x49cff4]
mov ecx, dword [0x49d01c]
inc word [0x49d044]
mov dword [esp + 0x14], eax
movzx edi, word [esi + ecx*8 + 0x46]
mov ecx, dword [0x49d024]
dec ecx
mov dword [0x49d024], ecx
cmp edi, ecx
jle 0x404dd1
mov eax, dword [0x49d048]
xor edx, edx
movzx esi, bx
add ebx, 0xffff
lea ecx, [esi*4]
div dword [ecx + ebp]
mov dword [ecx + ebp], eax
mov eax, edi
and eax, dword [0x49d048]
mov ecx, dword [esp + 0x1c]
or word [ecx + esi*8], ax
inc edi
mov eax, dword [esp + 0x20]
movzx eax, word [eax]
mov dword [ebp + eax*4], 0x1a9a
mov eax, dword [0x49d024]
dec eax
mov dword [0x49d024], eax
cmp edi, eax
jg 0x404d81
mov dword [esp + 0x38], ebx
movzx eax, bx
movzx edi, byte [eax + eax + 0xe8b]
cmp edi, dword [esp + 0x14]
jge 0x404e89
mov ebx, dword [esp + 0x24]
lea ebp, [edi + edi]
mov eax, dword [esp + 0x28]
movzx esi, di
lea ecx, [eax + edi*4]
mov eax, ebp
cdq
idiv dword [ecx]
xor edx, edx
mov dword [ecx], eax
mov eax, 0xffffeec0
mov ecx, dword [0x49d034]
movzx eax, word [eax]
movzx ecx, word [ecx + ecx + 0x1c1d]
movzx eax, word [ebx + eax*2]
div ecx
xor eax, esi
xor esi, 0x88
xor word [0x49d018], ax
or esi, 0x1e41
mov eax, dword [esp + 0x18]
add esi, 0x14e9
add word [ebx + ebp], si
movzx eax, byte [eax + edi + 0x20]
add eax, dword [0x49d010]
add eax, dword [0x49cfc0]
add dword [0x49cfd0], eax
movzx eax, word [ebx + ebp]
xor eax, dword [0x49cfc0]
push eax
push 0x1ebd
push 0x1e8
call fcn.00419ccc
add esp, 0xc
add ebp, 2
inc edi
cmp edi, dword [esp + 0x14]
jl 0x404ded
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x3c]
mov eax, dword [esp + 0x2c]
xor edx, edx
pop edi
pop esi
lea ecx, [eax*4 + 4]
add eax, 0xffffe93e
div dword [ecx + ebp]
lea eax, [ebx - 1]
mov dword [ecx + ebp], edx
mov ecx, dword [esp + 0x28]
mov dl, byte [esp + 0xb]
movzx eax, ax
mov byte [eax + ecx], dl
mov ax, word [0x49cfc4]
imul ecx, dword [0x49d040], 0x1748
inc ax
mov word [0x49cfc4], ax
movzx eax, ax
mov dword [ebp + eax*4 + 0x68], ecx
mov eax, 0x1c1d
mov ecx, dword [esp + 0x10]
pop ebp
pop ebx
movzx eax, word [eax]
movzx eax, byte [eax + ecx]
and eax, dword [0x49cff4]
and eax, 0xa94
xor dword [0x49cfdc], eax
mov eax, 0x4ca
add esp, 0x24
ret
Function at 0x408763
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x20]
xor eax, 0x9b6
push ebp
mov ebp, dword [esp + 0x10]
add ebx, 0xffffe7ac
add ebp, 0xffffedee
push esi
mov esi, dword [esp + 0x20]
lea ecx, [ebp + 0xb9b]
cmp eax, ecx
jg 0x408844
push edi
mov edi, dword [esp + 0x28]
lea eax, [ebx + 0x9b6]
cmp edi, eax
je 0x4087de
mov ecx, dword [0x493c3c]
mov eax, dword [ecx + 0xc]
sub dword [0x49c7ac], eax
lea eax, [edi + 0x2b0]
push eax
mov eax, ebp
xor eax, 0x162c
push eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffff843
push eax
lea eax, [ebp + 0xf60]
push eax
push ecx
call fcn.004084fa
add esp, 0x14
jmp 0x408843
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esi + 0xe8]
sub eax, 0x865
or eax, dword [0x49c7d8]
push eax
mov eax, dword [0x49c82c]
add eax, 0xffffef84
or eax, 0x147f
push eax
mov eax, dword [esi + 0xb0]
or eax, 0xfa2
push eax
mov eax, dword [esi + 0x88]
imul eax, edi
push eax
mov eax, dword [0x49c7f8]
xor eax, edi
xor eax, 0xc0
add eax, dword [esi + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esi + 0x20]
imul eax, ebp
imul eax, eax, 0x107c
mov dword [0x49c720], eax
pop edi
mov eax, dword [esi + 0x118]
sub eax, 0x908144
imul eax, dword [esi + 0x64]
mov dword [esi + 0x64], eax
mov ecx, dword [0x493c3c]
mov eax, dword [ecx + 0x40]
cmp eax, dword [esi + 0xe8]
ja 0x408880
mov eax, dword [ecx + 0xcc]
add eax, dword [esi + 0x14]
xor eax, 0x160954
mov dword [ecx + 0x50], eax
mov ecx, dword [0x493c3c]
jmp 0x408891
mov eax, dword [ecx + 0x118]
add eax, dword [0x49c790]
mov dword [0x49c828], eax
mov edx, dword [ecx + 0xec]
xor ebx, 0xb9b
mov ecx, dword [ecx + 0x78]
mov eax, ebx
add ecx, 0xfffe3382
add ecx, edx
xor dword [esi + 0x50], ecx
pop esi
pop ebp
pop ebx
ret

Function at 0x4176a7
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
add ecx, 0xffffe7ac
push esi
mov esi, dword [esp + 0xc]
add ebp, 0x5e0
xor esi, 0x12d8
mov eax, esi
xor eax, 0x1196
cmp ecx, eax
jg 0x41770a
mov eax, dword [esp + 0x18]
push eax
xor dword [eax + 0x60], 0x3cfa50e5
lea eax, [esi + 0x1212]
push eax
lea eax, [ecx + 0x1196]
push eax
lea eax, [esi + 0x1356]
push eax
lea eax, [ebp - 0x552]
push eax
call fcn.00419b80
add esp, 0x14
xor esi, 0x1301
jmp 0x417766
push edi
mov edi, dword [esp + 0x1c]
mov eax, dword [edi + 0x6c]
or eax, esi
and eax, dword [edi + 0x14]
cmp ecx, eax
jne 0x417765
mov eax, dword [0x493c3c]
push ebx
mov ebx, dword [eax + 0x34]
mov eax, dword [edi + 0x68]
or eax, ebp
sub eax, 0x162c
cmp ebx, eax
je 0x417764
mov eax, dword [edi + 0x28]
xor eax, 0x202
or eax, 0x109d
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov eax, dword [edi + 0x2c]
add ebx, 4
xor eax, esi
imul eax, dword [edi + 0x14]
mov dword [edi + 0x14], eax
mov ecx, dword [edi + 0x68]
or ecx, ebp
sub ecx, 0x162c
cmp ebx, ecx
jne 0x417732
pop ebx
pop edi
xor esi, 0x1b75
mov eax, esi
pop esi
pop ebp
ret
Function at 0x417771
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
push ebx
push ebp
lea edx, [eax + 0x83f]
xor dword [esp + 0xc], 0x1854
lea ebp, [eax - 0xa9]
mov dword [esp + 0x10], edx
push esi
mov esi, dword [esp + 0x18]
lea ebx, [ecx - 0x952]
push edi
lea edi, [ecx + 0x34c]
xor ecx, 0x1ebe
mov dword [esp + 0x20], ecx
mov eax, dword [esi + 0x2c]
xor eax, dword [0x49c760]
xor eax, 0x7f336
add dword [esi + 0x100], eax
mov eax, 0xffffe994
mov ecx, dword [esi + 4]
mov edx, dword [0x493c3c]
xor ecx, dword [0x49c7e0]
sub eax, ecx
add dword [edx + 0x100], eax
lea eax, [edi - 0x3d5]
push eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffff3f1
push esi
push eax
mov eax, ebp
xor eax, 0x3ef
push eax
lea eax, [ebx + 0x722]
push eax
mov eax, ebp
xor eax, 0x1e93
push eax
mov eax, dword [esp + 0x3c]
xor eax, 0x1bc0
add eax, 0x6a3
push eax
call fcn.004049f8
lea ecx, [edi - 0x6be]
add esp, 0x1c
mov edx, eax
mov dword [esp + 0x1c], edx
cmp ebx, ecx
je 0x4178de
cmp ebp, edi
jg 0x417868
mov eax, dword [esi + 0x14]
add eax, 0x6b16f
xor dword [0x49c790], eax
mov eax, dword [0x493c3c]
mov ecx, dword [esi + 0x3c]
cmp ecx, dword [eax + 0xc0]
je 0x4178de
mov eax, 0x5c959
sub eax, ecx
add dword [esi + 0x100], eax
jmp 0x4178de
mov eax, dword [esi + 0x10c]
or eax, ebx
imul eax, eax, 0x12d8
cmp edi, eax
je 0x4178de
mov ecx, dword [0x493c3c]
mov ebp, dword [esp + 0x20]
mov eax, dword [ecx + 0x28]
add eax, dword [esi + 0xe8]
cmp dword [esi + 0x38], eax
jae 0x4178c9
mov eax, dword [ecx]
add eax, 0x1839
xor eax, dword [esp + 0x18]
push eax
mov eax, dword [ecx + 0xf0]
add eax, ebp
or eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [0x49c7e4]
mov edx, dword [esp + 0x1c]
imul eax, ebx
xor eax, edx
or dword [esi + 0x118], eax
mov ecx, dword [0x493c3c]
mov eax, dword [esi + 0x10c]
add edi, 4
or eax, ebx
imul eax, eax, 0x12d8
cmp edi, eax
jne 0x417884
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
add eax, 0x109d
pop ebx
ret
Function at 0x4196c4
Capabilities:
Create pipe

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
mov ecx, eax
mov edx, dword [esp + 0x18]
xor ecx, 0xcba
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
mov ebp, eax
add eax, 0xfffffccf
mov dword [esp + 0xc], ecx
push edi
mov edi, dword [esp + 0x1c]
mov ebx, esi
mov dword [esp + 0x20], eax
xor ebx, 0x9af
lea eax, [ecx - 0x523]
add edi, 0xffffef63
xor ebp, 0x13a2
add edx, 0x4e1
xor esi, 0x1839
cmp ebx, eax
jl 0x419890
mov eax, esi
xor eax, 0x874
cmp edx, eax
je 0x419794
mov ecx, dword [esp + 0x18]
xor esi, 0x865
xor edi, 0xf60
xor edx, 0x650
sub edx, 0x496
mov eax, dword [ecx + 0xa0]
xor eax, 0x150e86
mov dword [0x49c780], eax
mov eax, dword [ecx + 0xb0]
add eax, 0x458
add dword [ecx + 0x60], eax
lea eax, [esi + 0x151]
push eax
lea eax, [edi + 0x6cc]
push eax
lea eax, [esi + 0xa9c]
push eax
push ebx
lea eax, [edi + 0x11c]
push eax
push edx
push dword [0x493c3c]
call fcn.00408479
add esp, 0x1c
jmp 0x419890
mov ebx, dword [esp + 0x18]
mov eax, dword [ebx]
sub eax, esi
sub eax, edi
cmp dword [ebx + 0x9c], eax
ja 0x419890
mov eax, dword [0x493c3c]
mov eax, dword [eax + 0x104]
and eax, edx
cmp edi, eax
jae 0x419890
mov edx, dword [0x493c3c]
mov eax, dword [0x49c800]
mov ecx, dword [esp + 0x1c]
add eax, 0x1196
add ecx, 0xffffffdf
add eax, dword [edx + 8]
push eax
mov eax, dword [ebx + 0x34]
sub eax, dword [ebx + 0x10c]
sub eax, dword [esp + 0x24]
push eax
mov eax, dword [edx + 0x2c]
add eax, ecx
push eax
mov eax, esi
and eax, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x30]
add eax, esi
add eax, ebp
push eax
mov eax, dword [ebx + 0x118]
sub eax, dword [edx + 0xec]
sub eax, 0x12d8
push eax
mov eax, dword [ebx + 0x2c]
sub eax, 0x227a
push eax
mov eax, dword [edx + 0x10c]
or eax, dword [0x49c804]
or eax, 0x1212
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov eax, dword [ebx + 0xfc]
xor eax, dword [ebx + 0x2c]
or eax, dword [ebx + 0xe8]
mov ecx, dword [0x493c3c]
push eax
mov eax, dword [ebx + 0xd8]
or eax, esi
sub esi, dword [ecx + 0x2c]
push eax
mov eax, dword [ecx + 0xe0]
xor esi, ebp
add eax, ebp
and ebp, 0x1854
push esi
push eax
mov eax, dword [ebx + 0xe0]
sub ebp, 0x109d
sub eax, dword [ecx]
or eax, dword [ebx + 0x14]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
imul eax, edi, 0xc44
sub eax, 0xcbc5b4
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseActCtx]
lea eax, [edi + 0x523]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x419f16
Capabilities:
Clear file content

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x18]
add ecx, 0x5ac
xor dword [esp + 8], 0x1b06
add edx, 0x160
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
mov esi, dword [esp + 0x28]
add ebx, 0xb52
push edi
mov edi, dword [esp + 0x14]
lea eax, [ebx - 0x230]
lea ebp, [edi - 0x74b]
xor edi, 0x39c
cmp ecx, eax
je 0x41a041
mov eax, edx
xor eax, 0x18b7
cmp ebp, eax
je 0x419fd6
mov ebx, dword [esi + 0x108]
cmp ebx, dword [esi + 0x2c]
jae 0x419f86
mov eax, dword [0x493c3c]
mov dword [eax + 0x7c], 0x22a8c
jmp 0x419f99
mov eax, dword [esi + 0x104]
sub eax, ebx
xor eax, 0x1cd
sub dword [0x49c72c], eax
mov eax, dword [esp + 0x18]
xor edx, 0x196e
add eax, 0xfffffba7
push eax
push edx
lea eax, [ebp - 0x200]
push eax
lea eax, [edi - 0x13d]
xor edi, 0x1b2b
push eax
lea eax, [ecx + 0x8d7]
push eax
push edi
push dword [0x493c3c]
call fcn.0040493e
add esp, 0x1c
jmp 0x41a041
mov eax, edi
or eax, ecx
add eax, dword [0x49c800]
cmp ecx, eax
jne 0x41a041
mov eax, dword [esi + 0xe8]
sub eax, edx
add eax, 0x1839
cmp ecx, eax
ja 0x41a041
xor ebx, ecx
cmp ecx, ebx
jl 0x41a041
mov eax, dword [0x49c738]
xor eax, dword [esp + 0x18]
or eax, 0x874
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ecx, dword [0x493c3c]
mov eax, dword [ecx + 0xc8]
imul eax, dword [esi + 0xfc]
add eax, 0x1301
or dword [ecx + 0x64], eax
mov eax, dword [esi + 0x40]
xor eax, dword [esi + 8]
push eax
lea eax, [ebp + 0xf60]
and eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, dword [0x493c3c]
mov eax, dword [esi + 0x70]
cmp eax, dword [ecx + 0x40]
jbe 0x41a063
mov eax, dword [esi + 0xb0]
xor eax, 0x5057d
mov dword [esi + 0x54], eax
mov ecx, dword [0x493c3c]
mov eax, dword [ecx + 4]
cmp eax, dword [esi + 0xa0]
jae 0x41a081
mov eax, dword [0x49c828]
add eax, 0xffe5ced6
add eax, dword [esi + 0x64]
xor dword [0x49c774], eax
mov eax, dword [0x49c784]
add eax, 0x4054fb1c
add eax, dword [esi + 0x7c]
pop edi
pop esi
mov dword [0x49c77c], eax
mov eax, dword [esp + 0x1c]
pop ebp
add eax, 0x85c
pop ebx
ret
Function at 0x41a451
Capabilities:
Delete file
Encode data using xor

Disassembly:
push ecx
push ecx
mov edx, dword [esp + 0x14]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x2c]
add edx, 0xfffff95d
push edi
mov edi, dword [esp + 0x28]
mov ebp, edi
xor ebp, 0x1fc9
mov dword [esp + 0x24], edx
lea ebx, [esi - 0x1854]
mov dword [esp + 0x14], ebp
mov eax, ebx
mov dword [esp + 0x10], ebx
xor eax, 0x12d8
xor esi, 0x1410
cmp edx, eax
jge 0x41a690
mov ecx, edx
lea eax, [edi - 0x1a7]
mov edi, dword [esp + 0x2c]
xor ecx, 0x1ef4
cmp eax, ecx
je 0x41a4de
mov ecx, dword [edi + 0x88]
cmp ecx, dword [0x49c73c]
je 0x41a4d2
mov eax, dword [0x49c808]
sub eax, dword [0x49c74c]
imul eax, ecx
mov dword [edi + 0x88], eax
jmp 0x41a543
mov dword [edi + 0x94], 0x41b190
jmp 0x41a543
mov eax, dword [0x493c3c]
mov ecx, dword [0x49c74c]
mov dword [esp + 0x30], ecx
mov eax, dword [eax + 0xd8]
and eax, dword [edi]
cmp ecx, eax
jb 0x41a543
and ebp, 0xfa2
mov eax, dword [0x49c7f0]
cmp eax, ebp
jg 0x41a51f
mov ebx, ebp
sub ebx, eax
shr ebx, 2
inc ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
sub ebx, 1
jne 0x41a510
mov ecx, dword [esp + 0x30]
mov eax, dword [0x493c3c]
add ecx, 3
mov dword [esp + 0x30], ecx
mov eax, dword [eax + 0xd8]
and eax, dword [edi]
cmp ecx, eax
jae 0x41a4ff
mov ebp, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x10]
lea eax, [edx + 0x7c]
cmp esi, eax
jge 0x41a64f
xor ebx, ebx
mov eax, dword [edi + 0x94]
mov edx, dword [0x493c3c]
mov ecx, dword [ebx + eax]
add ebx, 4
mov eax, dword [edx + 0x88]
xor dword [0x49c804], eax
movzx edx, byte [edx + 0x60]
movzx eax, cl
mov ecx, dword [edi + 0x84]
imul edx, eax
mov eax, dword [edi + 0xa8]
mov byte [ecx + eax], dl
inc dword [edi + 0x84]
mov eax, dword [0x49c79c]
sub eax, dword [edi + 4]
xor eax, 0x59646
add dword [0x49c75c], eax
mov eax, dword [edi + 0x40]
sub dword [edi + 0x14], eax
mov eax, dword [0x49c824]
xor eax, 1
add dword [edi + 4], eax
mov eax, dword [edi + 0x3c]
xor eax, 0x5e25b
imul eax, dword [edi + 0xe0]
mov dword [edi + 0xe0], eax
mov eax, dword [edi + 0x64]
add eax, 0x716c2f65
or dword [0x49c7c0], eax
mov eax, dword [0x49c74c]
mov ecx, dword [edi + 0xfc]
add eax, 0xffffffed
add eax, ecx
or dword [edi + 0xc0], eax
mov eax, 0x59659
sub eax, ecx
mov ecx, 0x11d31a
sub eax, dword [edi + 0x7c]
add dword [edi], eax
mov eax, dword [0x493c3c]
sub ecx, dword [eax + 0x14]
add dword [edi + 0xe0], ecx
mov eax, dword [0x49c790]
dec eax
add eax, dword [edi + 0x108]
mov dword [0x49c790], eax
cmp ebx, 0x8700
jl 0x41a550
mov eax, dword [0x49c79c]
mov ebx, dword [esp + 0x10]
mov edx, dword [esp + 0x24]
cmp eax, dword [edi + 0x14]
je 0x41a64f
mov ecx, dword [edi + 0x3c]
xor ecx, dword [0x49c804]
mov eax, dword [0x493c3c]
add ecx, 0x3aeb6
mov dword [eax + 0x60], ecx
mov eax, dword [esp + 0x20]
add eax, 0xfffff42e
cmp esi, eax
je 0x41a690
xor ebp, 0x1bd9
cmp edx, ebp
jl 0x41a66e
add esi, 0x552
jmp 0x41a690
mov eax, esi
and eax, ebx
cmp dword [0x49c7c0], eax
jbe 0x41a690
mov edx, dword [0x493c3c]
mov ecx, dword [edx + 0x64]
sub ecx, dword [edx + 0xfc]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor esi, 0x515
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x4098c4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409997
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4099b0
push ebx
push 0x4099bc
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409944
mov al, 0x62
call fcn.0040949c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409898
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x40994d
call fcn.00409898
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40999e
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a50
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409b04
jmp 0x409af9
cmp dword [esi + 0x10], 0x1000
jne 0x409ae5
test byte [esi + 0x15], 1
jne 0x409ae5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409aa4
cmp eax, 2
je 0x409aa4
cmp eax, 0x10
je 0x409aa4
cmp eax, 0x20
jne 0x409ab9
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409ab9
mov bl, 1
xor ebp, ebp
jmp 0x409aca
mov eax, dword [esi]
add eax, ebp
call fcn.00409a48
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409abd
test bl, bl
je 0x409ae5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409b04
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a7c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x10001000
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Convert ip address from string
Create tcp socket
Initialize winsock library

Disassembly:
push ebx
push edi
push esi
sub esp, 0x1a0
mov esi, ecx
lea edi, [esp + 0x1b0]
lea eax, [esp + 0x10]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x10001079
lea ebx, [esp + 4]
mov word [ebx - 4], 2
movzx eax, word [edi + 0x18]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebx - 2], ax
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x10001059
mov eax, dword [edi]
push ebx
push eax
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
mov eax, esp
push 0x10
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
setne bl
jmp 0x1000107b
xor ebx, ebx
mov eax, dword [edi + 0x14]
cmp eax, 0x10
jb 0x1000108f
inc eax
push eax
push dword [edi]
call fcn.10002d8e
add esp, 8
mov eax, ebx
add esp, 0x1a0
pop esi
pop edi
pop ebx
ret 0x1c

Function at 0x100010c8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x2014
call fcn.1000ebc0
mov esi, ecx
mov edi, dword [esp + 0x2028]
call fcn.100185e1
mov ecx, dword [edi + 4]
sub ecx, dword [edi]
xor edi, edi
mov dword [esp + 0x10], eax
sar eax, 0x1f
mov dword [esp + 0xc], eax
mov ebp, ecx
test ecx, ecx
je 0x100011b2
mov eax, 0x1ff0
cmp ebp, eax
mov ebx, 0x1ff0
cmovl ebx, ebp
mov ecx, dword [esi + 8]
call fcn.100011c4
mov ecx, dword [esp + 0x2028]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
sub ecx, eax
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], ebx
add eax, edi
push ebx
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.10013e40
add esp, 0xc
mov eax, ebx
add eax, 0x10
je 0x10001180
mov dword [esp + 4], ebp
mov dword [esp + 8], edi
lea edi, [esp + 0x14]
mov dword [esp], eax
mov ebp, eax
push 0
push ebp
push edi
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x10001189
add edi, eax
sub ebp, eax
jne 0x10001166
jmp 0x1000118f
mov dword [esp], 0
jmp 0x10001197
xor eax, eax
dec eax
mov dword [esp], eax
mov edi, dword [esp + 8]
mov ebp, dword [esp + 4]
push dword [esi + 8]
call fcn.10010bdb
add esp, 4
add edi, ebx
mov ecx, ebp
sub ecx, ebx
cmp dword [esp], 0xffffffff
jne 0x100010f6
test ebp, ebp
sete al
add esp, 0x2014
pop esi
pop edi
pop ebx
pop ebp
ret 4