joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe4a60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0x10b010]
push edi
push 0x1149f0
call esi
push 0x1149f0
call esi
push 0x1149f0
call esi
push 0x1149f0
call esi
push 0x1149f0
call esi
mov edi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
push 0
call 0xa7027f
nop
push eax
call 0x7733e026
nop
mov ebx, eax
push 0x1149f0
mov dword [ebp - 4], ebx
call esi
push 0x1149f0
call esi
push 0x1149f0
call esi
push 0x1149f0
call esi
push 0x1149f0
call esi
push 0x1149f0
mov byte [ebx + edi], 0
call esi
push 0x1149f0
call esi
push 0x1149f0
call esi
push 0x1149f0
call esi
push 0x1149f0
call esi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0xe4b7a
mov eax, dword [ebp + 8]
sub eax, ebx
mov dword [ebp - 8], eax
push 0x1149f0
call esi
push 0x1149f0
call esi
push 0x1149f0
call esi
push 0x1149f0
call esi
push 0x1149f0
call esi
mov ecx, dword [ebp + 0xc]
push ecx
add ebx, edi
nop
call 0x756d43d3
mov ecx, eax
xor edx, edx
mov eax, edi
div ecx
mov eax, dword [ebp + 0xc]
add esp, 4
push 0x1149f0
mov cl, byte [edx + eax]
mov edx, dword [ebp - 8]
xor cl, byte [edx + ebx]
mov byte [ebx], cl
call esi
push 0x1149f0
call esi
push 0x1149f0
call esi
push 0x1149f0
call esi
push 0x1149f0
call esi
mov ebx, dword [ebp - 4]
inc edi
cmp edi, dword [ebp + 0x10]
jb 0xe4b06
push 0x1149f0
call esi
push 0x1149f0
call esi
push 0x1149f0
call esi
push 0x1149f0
call esi
push 0x1149f0
call esi
lea eax, [ebp - 0xc]
push eax
push 0x100
push 4
push ebx
mov dword [ebp - 0xc], 0
call 0xa70284
nop
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xe6ef0
Capabilities:
Parse pe header

Disassembly:
cmp dword [ebx + 4], 0x40
jb 0xe6f91
mov eax, dword [ebx]
push 0x40
push eax
push esi
nop
call 0x756c9910
mov ecx, 0x5a4d
add esp, 0xc
cmp word [esi], cx
jne 0xe6fc0
mov eax, dword [esi + 0x3c]
test eax, eax
je 0xe6fc0
lea edx, [eax + 0xf8]
cmp edx, dword [ebx + 4]
ja 0xe6f91
mov ecx, dword [ebx]
push edi
push 0xf8
add ecx, eax
push ecx
lea edi, [esi + 0x40]
push edi
nop
call 0x756c9910
add esp, 0xc
cmp dword [edi], 0x4550
pop edi
jne 0xe6fc0
mov edx, 0x10b
cmp word [esi + 0x58], dx
jne 0xe6fc0
movzx eax, word [esi + 0x46]
test ax, ax
je 0xe6fc0
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
add eax, eax
push eax
push 8
mov dword [esi + 0x140], eax
call dword [fcn.003190f4]
push eax
call dword [fcn.00319088]
mov dword [esi + 0x138], eax
test eax, eax
jne 0xe6f97
mov eax, 3
ret
mov eax, 1
ret
movzx ecx, word [esi + 0x54]
mov edx, dword [esi + 0x3c]
lea ecx, [ecx + edx + 0x18]
mov edx, dword [esi + 0x140]
push ebx
push edx
push ecx
push eax
mov dword [esi + 0x13c], ecx
call fcn.000e7590
add esp, 0x10
neg eax
sbb eax, eax
inc eax
ret
mov eax, 2
ret
Function at 0x5d8d00
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [0x3190e0]
test esi, esi
jne 0x5d8d18
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x5d8d11
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
jne 0x5d8d11
mov eax, dword [eax + esi + 0x78]
mov ecx, dword [eax + esi + 0x1c]
add eax, esi
add ecx, esi
push ebx
mov ebx, dword [eax + 0x20]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [eax + 0x18]
push edi
add ecx, esi
add ebx, esi
xor edi, edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x5d8d7a
jmp 0x5d8d60
mov eax, dword [ebx + edi*4]
mov ecx, dword [0x318bf0]
add eax, esi
call fcn.005d67e0
test eax, eax
je 0x5d8d83
inc edi
cmp edi, dword [ebp - 4]
jb 0x5d8d60
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + edi*2]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
pop edi
pop ebx
add eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x76ddcc
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x38], esi
push ebp
mov dword [esp], ecx
mov dword [esp], edx
lea esp, [esp]
jmp 0x76ddb5

Function at 0x77201c
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00771fbc
mov word [esp + 1], cx
mov dword [esp], edi
mov dword [esp], ecx
mov dword [esp + 0x2c], edi
jmp 0x772005
lea esp, [esp + 0x2c]
jmp 0x772040
pushal
lea esp, [esp + 0x1b]
push word [esp + 2]
jo 0x771fe8
jno 0x771fe8
pushfd
jmp 0x771378
Function at 0x772084
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [ebp*4]
jmp fcn.00772091

Function at 0x77974c
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x75fa3f
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x75fa59
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x75fa48
pop esi
jmp 0x75fa64
ret 4
mov byte [esp + 2], bl
mov word [esp + 1], si
lea esp, [esp + 4]
jmp 0x75fa32

Function at 0x79b7fa
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
cmp dl, 0x3d
jne 0x75d58d
je 0x75d5fb
jmp 0x79b6ce

Function at 0x79cda0
Capabilities:
Encode data using xor

Disassembly:
sub edx, 0x47
jmp 0x79c5c4
mov dword [esp], esi
jmp 0x79cdbe
lea esp, [esp + 4]
cmp bl, 0x5a
ja 0x79c625
jbe 0x79d072
add dword [edx + ebx*4], reloc.WINMM.dll_midiStreamOut
xor byte [ebx], dh
sub al, byte [ebp - 0xc]
sub edx, 0x41
jmp 0x79c5c4

Function at 0x849dd4
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
add ebx, 0x571f0eb3
mov byte [esp + 0x16], bh
mov dl, byte [esp + 1]
pop ebp
jmp 0x849d4e

Function at 0x84a09b
Capabilities:
Execute anti-debugging instructions

Disassembly:
cld
mov esi, 0x38c63c8b
lea esi, [edx*4]
neg eax
jmp 0x84a0d4
cpuid
bswap eax
mov byte [esp + 0x12], bh
lea ebx, [esi + 0x57]
mov cl, 0xcc
pop word [esp + 0xd]
jmp 0x84a0be

Function at 0x84a7ca
Capabilities:
Execute anti-debugging instructions

Disassembly:
not al
xchg ch, bh
mov ebx, edx
add esp, 0x17
xchg word [esp + 3], bx
jmp 0x84a76e
xchg si, di
bswap ebp
xchg di, ax
lea esi, [edx*4]
rdtsc
lea edx, [edx + esi]
jmp 0x84a742
lea ebx, [edx*4]
pushal
push eax
mov ebx, dword [esp + 7]
lea ebp, [ebp*4]
mov ebx, dword [esp + 0x14]
mov bp, word [esp + 0x10]
bsf ebp, esp
adc ax, 0xee8
shl al, 4
jmp 0x84a758
pop eax
bswap ebp
mov si, word [esp + 0xc]
jmp 0x84a790
Function at 0x509310
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x96000]
push edi
jmp 0x50932a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x509331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x509320
mov eax, 1
add ebx, ebx
jne 0x509343
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x509354
jne 0x509373
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x509373
dec eax
add ebx, ebx
jne 0x509360
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x509338
add ebx, ebx
jne 0x50936f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5093c5
xor ecx, ecx
sub eax, 3
jb 0x50938b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5093fa
sar eax, 1
mov ebp, eax
jmp 0x509396
add ebx, ebx
jne 0x509396
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x509364
inc ecx
add ebx, ebx
jne 0x5093a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x509364
add ebx, ebx
jne 0x5093b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5093a6
jne 0x5093c2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5093a6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5093e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5093d6
jmp 0x509326
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5093e4
add edi, ecx
jmp 0x509326
pop esi
mov edi, esi
mov ecx, 0x5322
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x509402
cmp byte [edi], 0x22
jne 0x509402
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x509407
lea edi, [esi + 0x106000]
mov eax, dword [edi]
or eax, eax
je 0x50947f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x11e2cc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11e3bc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x509434
mov ecx, edi
jns 0x509463
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x11e3c0]
or eax, eax
je 0x509479
mov dword [ebx], eax
add ebx, 4
jmp 0x509451
call dword [esi + 0x11e3d0]
mov ebp, dword [esi + 0x11e3c4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5094b3
sub esp, 0xffffff80
jmp 0x47ae9a
Function at 0x45ad00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x54b094
push dword [ebp + 8]
call fcn.0045aae0
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x45ad5a
push edi
push esi
call fcn.0045aae0
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x45ad59
push esi
call fcn.0045aae0
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x45ad59
push 0x461430
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call fcn.0044e900
add esp, 0xc
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push dword [ebp + 0xc]
call fcn.0045ad70
add esp, 4
pop esi
pop ebp
ret

Function at 0x45ad80
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x522ba6
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x56b910]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x118]
push eax
call fcn.0045a650
add esp, 4
push esi
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0
push ecx
mov ecx, eax
call fcn.00461880
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 2
call fcn.00461760
push 0
push 0x80
push 3
push 0
push 1
push closesocket
lea ecx, [ebp - 0x94]
call fcn.00413d00
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x45ae7a
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x45aeb5
cmp esi, 0x400000
ja 0x45aeb5
push esi
mov dword [ebp - 0x11c], 0
call fcn.004e1014
add esp, 4
mov edi, eax
lea eax, [ebp - 0x11c]
push 0
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x11c], esi
jne 0x45ae6f
push esi
push edi
call fcn.0045b150
add esp, 8
push edi
call fcn.004e3a13
add esp, 4
jmp 0x45aeb5
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x11c], 0
push eax
push esi
call fcn.0045a880
mov esi, eax
add esp, 8
test esi, esi
je 0x45aeb5
mov eax, dword [ebp - 0x11c]
cmp eax, 0xa
jbe 0x45aeb5
push eax
push esi
call fcn.0045b150
push esi
call fcn.004e3a13
add esp, 0xc
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
call fcn.00461760
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e1646
mov esp, ebp
pop ebp
ret

Function at 0x45b410
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
test ax, ax
mov ecx, 8
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x45b435
or esi, 2
push 1
call edi
test ax, ax
jns 0x45b441
or esi, 1
push 0x10
call edi
test ax, ax
jns 0x45b44d
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x45b459
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x4c1640
Capabilities:
Resolve dns

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [eax], ebx
lea eax, [esp + 8]
push eax
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x4c17d2
push ebp
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x4c17bc
push esi
mov eax, dword [edi + 4]
cmp eax, 2
jne 0x4c168f
lea ebp, [eax + 0xe]
jmp 0x4c169b
cmp eax, 0x17
jne 0x4c1749
lea ebp, [eax + 5]
cmp dword [edi + 0x18], 0
je 0x4c1749
mov eax, dword [edi + 0x10]
test eax, eax
je 0x4c1749
cmp eax, ebp
jb 0x4c1749
push 0x20
call dword [0x56b300]
mov esi, eax
add esp, 4
test esi, esi
je 0x4c17b1
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push ebp
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebp
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
call dword [0x56b300]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x4c17a0
push ebp
push dword [edi + 0x18]
push eax
call fcn.004ebed0
mov eax, dword [edi + 0x14]
add esp, 0xc
test eax, eax
je 0x4c1735
push eax
call dword [0x56b30c]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x4c1786
mov eax, dword [esp + 0x10]
test ebx, ebx
cmove ebx, esi
test eax, eax
je 0x4c1745
mov dword [eax + 0x1c], esi
mov dword [esp + 0x10], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x4c1682
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
pop esi
test eax, eax
je 0x4c1768
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test ebp, ebp
je 0x4c17b8
push ebx
call fcn.004c1600
mov eax, dword [esp + 0x2c]
add esp, 4
xor ebx, ebx
mov dword [eax], ebx
mov eax, ebp
pop edi
pop ebp
pop ebx
add esp, 0xc
ret
push dword [esi + 0x18]
mov ebp, 8
call dword [0x56b304]
push esi
call dword [0x56b304]
add esp, 8
jmp 0x4c1758
push esi
mov ebp, 8
call dword [0x56b304]
add esp, 4
jmp 0x4c1758
mov ebp, 8
jmp 0x4c1758
test ebx, ebx
jne 0x4c17c8
mov ebp, 0x2af9
push ebp
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x28]
pop edi
mov dword [eax], ebx
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4c61f0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
push 0
mov byte [esp + 0x16], al
lea eax, [esp + 0x14]
mov edi, dword [esi]
push 3
push eax
push dword [esi + 0x198]
mov byte [esp + 0x20], 0xff
mov byte [esp + 0x21], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4c623c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.004b4cd0
add esp, 0xc
push dword [esp + 0x18]
push ebx
push str.SENT
push dword [esi]
call fcn.004c5b00
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x4c6370
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
cmp dword [esp + 0xc], 0x1f
mov eax, dword [esp + 8]
push ebx
mov eax, dword [eax]
mov dword [esp + 4], eax
mov ebx, dword [eax + 0x130]
jne 0x4c64bb
push ebp
push edi
lea ebp, [ebx + 0x1cb0]
lea edi, [ebx + 0x1eb0]
mov dword [edi], ebp
cmp ebp, edi
jae 0x4c63a7
mov byte [ebp], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4c63b2
mov byte [eax], 0xfa
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4c63bd
mov byte [eax], 0x1f
inc dword [edi]
movzx eax, word [ebx + 0x1ca8]
push esi
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
movzx eax, ax
mov dword [esp + 0x1c], eax
movzx eax, word [ebx + 0x1caa]
push eax
call esi
mov ecx, dword [esp + 0x1c]
movzx edx, ax
mov eax, dword [edi]
cmp eax, edi
jae 0x4c63f0
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4c63fa
mov byte [eax], ch
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4c6404
mov byte [eax], dl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4c640e
mov byte [eax], dh
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4c6419
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x4c6424
mov byte [eax], 0xf0
inc dword [edi]
mov eax, dword [edi]
mov esi, dword [esp + 0x10]
mov dword [ebx + 0x1eb4], eax
sub eax, ebp
sub eax, 2
mov dword [edi], ebp
push eax
lea eax, [ebx + 0x1cb2]
push eax
push 0x3e
push esi
call fcn.004c5c10
mov edi, dword [esp + 0x28]
add esp, 0x10
push 0
push 3
push ebp
push dword [edi + 0x198]
call dword [sym.imp.WS2_32.dll_send]
mov ebp, dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jns 0x4c647a
call ebp
push eax
push str.Sending_data_failed___d_
push esi
call fcn.004b4cd0
add esp, 0xc
push 4
lea eax, [ebx + 0x1cb3]
push eax
push edi
call fcn.004c6260
add esp, 0xc
lea eax, [ebx + 0x1cb7]
push 0
push 2
push eax
push dword [edi + 0x198]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4c64b8
call ebp
push eax
push str.Sending_data_failed___d_
push esi
call fcn.004b4cd0
add esp, 0xc
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4e81ae
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..data
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4a896c30
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data_1
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x5cae0eab
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x5012cc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esp
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [esp + 0x2c], 1
je 0x5012e5
movzx esi, word [esp + 0x30]
xor eax, eax
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x4c], 0x30
call fcn.005012c4
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x44], 0x501134
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], str.Jungo
mov dword [ebp - 0x20], eax
call fcn.005012b7
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
test eax, eax
je 0x5013b0
mov eax, 0x80000000
push edi
push dword [ebp - 0x38]
push edi
push edi
push eax
push eax
push eax
push eax
push 0
push str.180000
push str.Jungo
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push eax
mov dword [0x503758], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x503758]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x5013b0
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x501395
mov esp, ebp
pop ebp
ret
Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret

Function at 0x408977
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
add ebx, edx
add ebx, 0xdbf9f0b7
call fcn.004089a2
xor dword [eax], edi
add edx, 0x78353793
dec edx
inc eax
mov ebx, edx
add edx, edx
cmp eax, esi
jne fcn.00408977
add edx, 0x7ea11e83
ret
Function at 0x406200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
jmp 0x40612c
cld
jmp 0x40613b
call fcn.0040648a
nop
nop
pushal
nop
jmp 0x40614f
xor edx, edx
nop
jmp 0x406162
mov ebp, esp
nop
mov edx, dword fs:[edx + 0x30]
nop
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
nop
jmp 0x40617e
jmp 0x40618f
mov esi, dword [edx + 0x28]
movzx ecx, word [edx + 0x26]
jmp 0x4061a5
xor edi, edi
nop
jmp 0x4061b7
xor eax, eax
jmp 0x4061c4
lodsb al, byte [esi]
nop
jmp 0x4061d0
cmp al, 0x61
jmp 0x4061dd
jl 0x4061fb
jmp 0x4061ed
sub al, 0x20
jmp 0x4061fb
nop
ror edi, 0xd
add edi, eax
jmp 0x40620b
dec ecx
nop
jne 0x4061a8
nop
jmp 0x406220
nop
jmp 0x40622f
push edx
jmp 0x40623a
push edi
mov edx, dword [edx + 0x10]
jmp 0x40624e
mov eax, dword [edx + 0x3c]
nop
jmp 0x40625e
add eax, edx
nop
jmp 0x40626e
mov eax, dword [eax + 0x78]
test eax, eax
jmp 0x406281
je 0x406449
jmp 0x406291
add eax, edx
push eax
mov ecx, dword [eax + 0x18]
mov ebx, dword [eax + 0x20]
nop
jmp 0x4062a9
add ebx, edx
nop
jmp 0x4062b8
test ecx, ecx
nop
je 0x406448
nop
dec ecx
nop
jmp 0x4062ce
xor edi, edi
nop
mov esi, dword [ebx + ecx*4]
add esi, edx
nop
nop
xor eax, eax
nop
jmp 0x4062e8
lodsb al, byte [esi]
nop
jmp 0x4062f9
ror edi, 0xd
jmp 0x40630b
add edi, eax
nop
jmp 0x40631f
cmp al, ah
jmp 0x40632c
jne 0x4062d7
jmp 0x40633c
nop
jmp 0x40634f
add edi, dword [ebp - 8]
nop
jmp 0x406365
cmp edi, dword [ebp + 0x24]
nop
jmp 0x40637c
jne 0x4062ac
jmp 0x406396
jmp 0x4063a7
pop eax
nop
mov ebx, dword [eax + 0x24]
jmp 0x4063bd
add ebx, edx
jmp 0x4063d3
mov cx, word [ebx + ecx*2]
mov ebx, dword [eax + 0x1c]
add ebx, edx
mov eax, dword [ebx + ecx*4]
add eax, edx
nop
jmp 0x4063ef
mov dword [esp + 0x24], eax
jmp 0x406406
pop ebx
nop
pop ebx
popal
nop
jmp 0x40641e
pop ecx
nop
jmp 0x406434
pop edx
push ecx
nop
jmp eax
pop eax
pop edi
jmp 0x406458
pop edx
nop
mov edx, dword [edx]
nop
jmp 0x406471
jmp 0x40617e
nop
dec ecx
std
jmp 0x40611f