joyce8/EMBER2024-capa huggingface dataset:
Function at 0x483e50
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [esp + 0x10c]
push ebp
cmp dword [ebx + 0x7c], 2
mov ebp, dword [ebx]
je 0x484013
cmp byte [ebx + 0x231], 0
push esi
push edi
jne 0x483fc7
mov esi, dword [esp + 0x11c]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x98]
mov dword [esp + 0x14], pe_nt_image_headers32
push eax
push esi
call dword [sym.imp.WSOCK32.DLL_getpeername]
test eax, eax
je 0x483ecb
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
mov esi, eax
push esi
push ebx
call fcn.00495400
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebp
call fcn.00480aa0
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
push pe_nt_image_headers32
lea eax, [esp + 0x18]
mov dword [esp + 0x14], pe_nt_image_headers32
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.WSOCK32.DLL_getsockname]
test eax, eax
je 0x483f26
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
mov esi, eax
push esi
push ebx
call fcn.00495400
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebp
call fcn.00480aa0
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
lea eax, [ebx + 0xd8]
push eax
lea esi, [ebx + 0xa8]
lea eax, [esp + 0x98]
push esi
push eax
call fcn.00484500
add esp, 0xc
test al, al
jne 0x483f72
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebx
call fcn.00495400
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ebp
call fcn.00480aa0
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
lea edi, [ebx + 0x48]
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
lea eax, [ebx + 0x10c]
push eax
lea eax, [ebx + 0xdc]
push eax
lea eax, [esp + 0x1c]
movsw word es:[edi], word [esi]
push eax
call fcn.00484500
add esp, 0xc
test al, al
jne 0x483fc7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebx
call fcn.00495400
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebp
call fcn.00480aa0
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
mov edi, dword [ebx]
lea esi, [ebx + 0xa8]
add edi, 0x8654
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
mov ecx, 0xb
movsw word es:[edi], word [esi]
mov edi, dword [ebx]
lea esi, [ebx + 0xdc]
add edi, 0x8688
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, dword [ebx]
mov eax, dword [ebx + 0xd8]
pop edi
pop esi
mov dword [ecx + 0x8684], eax
mov ecx, dword [ebx]
mov eax, dword [ebx + 0x10c]
mov dword [ecx + 0x86b8], eax
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x484870
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
xor eax, eax
push edi
mov edi, dword [esp + 0x20]
push 4
cmp byte [esi + 0x398], al
setne al
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WSOCK32.DLL_setsockopt]
test eax, eax
jns 0x4848ba
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.00480b70
add esp, 0xc
pop edi
pop esi
add esp, 0x10
ret
push dword [esi + 0x39c]
mov dword [esp + 0x10], 1
call fcn.0048f570
push dword [esi + 0x3a0]
imul eax, eax, 0x3e8
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], eax
call fcn.0048f570
add esp, 8
imul eax, eax, 0x3e8
push 0
push 0
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0xc
lea eax, [esp + 0x24]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.DLL_WSAIoctl]
test eax, eax
je 0x484931
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.00480b70
add esp, 0x10
pop edi
pop esi
add esp, 0x10
ret

Function at 0x484940
Capabilities:
Set socket configuration

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push 4
mov esi, dword [edi]
movzx eax, byte [esi + 0x29a]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 1
push 6
push dword [esp + 0x20]
call dword [sym.imp.WSOCK32.DLL_setsockopt]
test eax, eax
jns 0x48498b
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
push eax
push edi
call fcn.00495400
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.00480b70
add esp, 0x14
pop edi
pop esi
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.00480b70
add esp, 8
pop edi
pop esi
ret
Function at 0x48b770
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov bl, byte [esi]
test bl, bl
je 0x48b821
mov cl, byte [edi]
test cl, cl
je 0x48b821
movsx eax, bl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x48b79a
jmp dword [eax*4 + 0x48b848]
mov bl, 0x41
jmp case.default.0x48b79a
mov bl, 0x42
jmp case.default.0x48b79a
mov bl, 0x43
jmp case.default.0x48b79a
mov bl, 0x44
jmp case.default.0x48b79a
mov bl, 0x45
jmp case.default.0x48b79a
mov bl, 0x46
jmp case.default.0x48b79a
mov bl, 0x47
jmp case.default.0x48b79a
mov bl, 0x48
jmp case.default.0x48b79a
mov bl, 0x49
jmp case.default.0x48b79a
mov bl, 0x4a
jmp case.default.0x48b79a
mov bl, 0x4b
jmp case.default.0x48b79a
mov bl, 0x4c
jmp case.default.0x48b79a
mov bl, 0x4d
jmp case.default.0x48b79a
mov bl, 0x4e
jmp case.default.0x48b79a
mov bl, 0x4f
jmp case.default.0x48b79a
mov bl, 0x50
jmp case.default.0x48b79a
mov bl, 0x51
jmp case.default.0x48b79a
mov bl, 0x52
jmp case.default.0x48b79a
mov bl, 0x53
jmp case.default.0x48b79a
mov bl, 0x54
jmp case.default.0x48b79a
mov bl, 0x55
jmp case.default.0x48b79a
mov bl, 0x56
jmp case.default.0x48b79a
mov bl, 0x57
jmp case.default.0x48b79a
mov bl, 0x58
jmp case.default.0x48b79a
mov bl, 0x59
jmp case.default.0x48b79a
mov bl, 0x5a
push ecx
call fcn.0048ba20
add esp, 4
cmp bl, al
jne 0x48b821
mov bl, byte [esi + 1]
inc esi
inc edi
test bl, bl
jne 0x48b785
movzx eax, byte [esi]
push eax
call fcn.0048ba20
movzx ecx, byte [edi]
mov bl, al
push ecx
call fcn.0048ba20
add esp, 8
xor ecx, ecx
cmp bl, al
sete cl
pop edi
pop esi
mov eax, ecx
pop ebx
ret
Function at 0x48b8b0
Capabilities:
Parse pe header

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
mov bl, byte [edi]
test bl, bl
je 0x48b976
lea ebx, [ebx]
mov cl, byte [ebp]
test cl, cl
je 0x48b976
test esi, esi
je 0x48b97a
movsx eax, bl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x48b8ee
jmp dword [eax*4 + 0x48b9ac]
mov bl, 0x41
jmp case.default.0x48b8ee
mov bl, 0x42
jmp case.default.0x48b8ee
mov bl, 0x43
jmp case.default.0x48b8ee
mov bl, 0x44
jmp case.default.0x48b8ee
mov bl, 0x45
jmp case.default.0x48b8ee
mov bl, 0x46
jmp case.default.0x48b8ee
mov bl, 0x47
jmp case.default.0x48b8ee
mov bl, 0x48
jmp case.default.0x48b8ee
mov bl, 0x49
jmp case.default.0x48b8ee
mov bl, 0x4a
jmp case.default.0x48b8ee
mov bl, 0x4b
jmp case.default.0x48b8ee
mov bl, 0x4c
jmp case.default.0x48b8ee
mov bl, 0x4d
jmp case.default.0x48b8ee
mov bl, 0x4e
jmp case.default.0x48b8ee
mov bl, 0x4f
jmp case.default.0x48b8ee
mov bl, 0x50
jmp case.default.0x48b8ee
mov bl, 0x51
jmp case.default.0x48b8ee
mov bl, 0x52
jmp case.default.0x48b8ee
mov bl, 0x53
jmp case.default.0x48b8ee
mov bl, 0x54
jmp case.default.0x48b8ee
mov bl, 0x55
jmp case.default.0x48b8ee
mov bl, 0x56
jmp case.default.0x48b8ee
mov bl, 0x57
jmp case.default.0x48b8ee
mov bl, 0x58
jmp case.default.0x48b8ee
mov bl, 0x59
jmp case.default.0x48b8ee
mov bl, 0x5a
push ecx
call fcn.0048ba20
add esp, 4
cmp bl, al
jne 0x48b976
mov bl, byte [edi + 1]
inc edi
dec esi
inc ebp
test bl, bl
jne 0x48b8d0
test esi, esi
jne 0x48b984
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
movzx eax, byte [edi]
push eax
call fcn.0048ba20
movzx ecx, byte [ebp]
mov bl, al
push ecx
call fcn.0048ba20
add esp, 8
xor ecx, ecx
cmp bl, al
sete cl
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
ret

Function at 0x48ba20
Capabilities:
Parse pe header

Disassembly:
mov cl, byte [esp + 4]
movsx eax, cl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x48ba2f
jmp dword [eax*4 + 0x48ba88]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret
mov al, cl
ret
Function at 0x48baf0
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, dword [esp + 0x10]
cmp esi, 1
jb 0x48bb9c
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
sub edi, edx
lea esp, [esp]
mov cl, byte [edx]
movsx eax, cl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x48bb1d
jmp dword [eax*4 + 0x48bba0]
mov cl, 0x41
jmp case.default.0x48bb1d
mov cl, 0x42
jmp case.default.0x48bb1d
mov cl, 0x43
jmp case.default.0x48bb1d
mov cl, 0x44
jmp case.default.0x48bb1d
mov cl, 0x45
jmp case.default.0x48bb1d
mov cl, 0x46
jmp case.default.0x48bb1d
mov cl, 0x47
jmp case.default.0x48bb1d
mov cl, 0x48
jmp case.default.0x48bb1d
mov cl, 0x49
jmp case.default.0x48bb1d
mov cl, 0x4a
jmp case.default.0x48bb1d
mov cl, 0x4b
jmp case.default.0x48bb1d
mov cl, 0x4c
jmp case.default.0x48bb1d
mov cl, 0x4d
jmp case.default.0x48bb1d
mov cl, 0x4e
jmp case.default.0x48bb1d
mov cl, 0x4f
jmp case.default.0x48bb1d
mov cl, 0x50
jmp case.default.0x48bb1d
mov cl, 0x51
jmp case.default.0x48bb1d
mov cl, 0x52
jmp case.default.0x48bb1d
mov cl, 0x53
jmp case.default.0x48bb1d
mov cl, 0x54
jmp case.default.0x48bb1d
mov cl, 0x55
jmp case.default.0x48bb1d
mov cl, 0x56
jmp case.default.0x48bb1d
mov cl, 0x57
jmp case.default.0x48bb1d
mov cl, 0x58
jmp case.default.0x48bb1d
mov cl, 0x59
jmp case.default.0x48bb1d
mov cl, 0x5a
mov byte [edi + edx], cl
mov al, byte [edx]
inc edx
test al, al
je 0x48bb9b
dec esi
jne 0x48bb10
pop edi
pop esi
ret
Function at 0x491600
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
push dword [esp + 0x108]
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x491649
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x491649
lea eax, [esp]
push eax
call dword [0x4fc104]
add esp, 4
add esp, 0x104
ret
xor eax, eax
add esp, 0x104
ret
Function at 0x496490
Capabilities:
Resolve dns

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebp
xor ebp, ebp
mov dword [esp + 4], ebp
mov dword [eax], ebp
lea eax, [esp + 8]
push eax
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.DLL_getaddrinfo]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x496623
push ebx
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x49660d
push esi
mov eax, dword [edi + 4]
cmp eax, 2
jne 0x4964df
lea ebx, [eax + 0xe]
jmp 0x4964eb
cmp eax, 0x17
jne 0x49659a
lea ebx, [eax + 5]
cmp dword [edi + 0x18], 0
je 0x49659a
mov eax, dword [edi + 0x10]
test eax, eax
je 0x49659a
cmp eax, ebx
jb 0x49659a
push 0x20
call dword [0x4fc0f8]
mov esi, eax
add esp, 4
test esi, esi
je 0x496602
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
call dword [0x4fc0f8]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x4965f1
push ebx
push dword [edi + 0x18]
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [edi + 0x14]
add esp, 0xc
test eax, eax
je 0x496585
push eax
call dword [0x4fc104]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x4965d7
test ebp, ebp
jne 0x49658b
mov ebp, esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x496596
mov dword [eax + 0x1c], esi
mov dword [esp + 0x10], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x4964d2
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
pop esi
test eax, eax
je 0x4965b9
push eax
call dword [sym.imp.WS2_32.DLL_freeaddrinfo]
test ebx, ebx
je 0x496609
push ebp
call fcn.00496450
mov eax, dword [esp + 0x2c]
add esp, 4
xor ebp, ebp
mov dword [eax], ebp
mov eax, ebx
pop edi
pop ebx
pop ebp
add esp, 0xc
ret
push dword [esi + 0x18]
mov ebx, 8
call dword [0x4fc0fc]
push esi
call dword [0x4fc0fc]
add esp, 8
jmp 0x4965a9
push esi
mov ebx, 8
call dword [0x4fc0fc]
add esp, 4
jmp 0x4965a9
mov ebx, 8
jmp 0x4965a9
test ebp, ebp
jne 0x496619
mov ebx, 0x2af9
push ebx
call dword [sym.imp.WSOCK32.DLL_WSASetLastError]
mov eax, dword [esp + 0x28]
pop edi
mov dword [eax], ebp
mov eax, ebx
pop ebx
pop ebp
add esp, 0xc
ret

Function at 0x496a70
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x264], 2
je fcn.00496a20
mov al, 1
ret
Function at 0x49d410
Capabilities:
Compress data via zlib inflate or deflate

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x34
push edi
test ecx, ecx
je 0x49ea46
mov edi, dword [ecx + 0x1c]
mov dword [esp + 0x14], edi
test edi, edi
je 0x49ea46
cmp dword [ecx + 0xc], 0
je 0x49ea46
cmp dword [ecx], 0
jne 0x49d448
cmp dword [ecx + 4], 0
jne 0x49ea46
cmp dword [edi], 0xb
jne 0x49d453
mov dword [edi], 0xc
mov eax, dword [ecx + 0xc]
mov edx, dword [edi + 0x38]
mov dword [esp + 0x18], eax
mov eax, dword [ecx + 0x10]
push ebx
mov ebx, dword [ecx]
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
xor eax, eax
push ebp
mov ebp, dword [ecx + 4]
mov dword [esp + 0x28], eax
mov eax, dword [edi]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edx
mov dword [esp + 0x38], ebp
push esi
mov esi, dword [edi + 0x3c]
cmp eax, 0x1e
ja 0x49ddc5
lea ebx, [edi + 0x54]
mov dword [esp + 0x40], ebx
mov ebx, dword [esp + 0x14]
jmp 0x49d4a0
jmp dword [eax*4 + 0x49ea50]
pop esi
pop ebp
pop ebx
mov eax, 0xfffffffe
pop edi
add esp, 0x34
ret
mov eax, 0xfffffffe
pop edi
add esp, 0x34
ret
Function at 0x438c93
Capabilities:
Encode data using xor

Disassembly:
push 0x438a14
pop esi
mov ecx, 0x1de1f57f
and ecx, ecx
call fcn.00438cdc
and edx, edx
sub edx, 0x7a412a39
sub ecx, 0xbd3f64b1
xor dword [edi], esi
add edx, ecx
sub edx, 0xa9bc43b6
or ecx, edx
add edi, 1
sub edx, edx
add edx, 1
cmp edi, ebx
jne fcn.00438c93
add edx, ecx
dec ecx
or ecx, edx
ret

Function at 0x406dd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
jae 0x406e33
or al, 0x56
lea esi, [ebp - 0x38]
push edi
mov edi, dword [ebp + 0x10]
sub al, byte [ebp + 0x104e89ff]
mov word [esi + 0x28], bx
je fcn.00406dfa
push edi
call dword [0xc040c193]
mov word [eax + 0x7e89662a], dx
or al, 0x71
jno 0x406df7
add byte [eax], al
push ebp
add byte [edi - 0x39], dl
push ds
add byte [ebx - 0x4747100], bh
add dword [ebx - 1], 0x33
shl byte [esi - 0x15], 2
add al, ah
repne scasb al, byte es:[edi]
mov ecx, 0x748d49d6
sbb edi, edi
aas
mov edi, esi
jb 0x406e95
and byte [edx + edi*8 + 0x40], dh
add byte [ebx + 0x12fc0138], al
xor ecx, ecx
push 4
mov cl, byte [edi]
push ecx
call dword [sym.imp.MSVCRT.dll__isctype]
add esp, 8
stc
adc dword [ecx + sym.imp.MSVCRT.dll__pctype], esp
xor edi, dword [esi - 0x76]
pop ss
mov ecx, dword [eax]
sub al, byte [ecx + edx*2]
and eax, 4
test eax, eax
add byte [edi], 0x4f
cmp edi, ebx
jae 0x406e59
jmp 0x406e95
push ebx
call dword [0x5fc16c]
add esp, 0xffffffcb
cmp eax, 0x5c
jl 0x406ec7
cmp eax, 0xffff
jg 0x406ec7
mov edx, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
push cs
add dh, byte [ebx]
rcr byte [ebp - 0x35], 1
adc al, 0
cmp byte [edi], 0x3a
jne 0x406ef5
cmp edi, esi
jae 0x406ee7
cmp edi, ebx
pop edx
or al, 0xab
stosd dword es:[edi], eax
pop esi
mov eax, 0x8d0016
pop ebx
inc eax
ret 0x14
in al, 0
add byte [edi + 0x104d8bdb], ah
lea esi, [edi - 1]
mov word [ecx], ax
sub esi, ebx
mov eax, dword [ebp + 0x18]
test byte [ebx + 0x1537cde], cl
push edx
push eax
sahf
pop ecx
invalid
Function at 0x41d910
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x416015
lea edi, [esi - 0x15015]
push edi
jmp 0x41d92a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41d931
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41d920
mov eax, 1
add ebx, ebx
jne 0x41d943
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41d938
jne 0x41d954
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41d938
xor ecx, ecx
sub eax, 3
jb 0x41d968
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41d9da
mov ebp, eax
add ebx, ebx
jne 0x41d973
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41d980
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41d9a4
inc ecx
add ebx, ebx
jne 0x41d990
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41d985
jne 0x41d9a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41d985
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41d9c4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41d9b5
jmp 0x41d926
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41d9c4
add edi, ecx
jmp 0x41d926
pop esi
mov edi, esi
mov ecx, 0x2f7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41d9e2
cmp byte [edi], 6
jne 0x41d9e2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41d9e7
lea edi, [esi + 0x1b000]
mov eax, dword [edi]
or eax, eax
je 0x41da56
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1d000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1d050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41da14
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1d054]
or eax, eax
je 0x41da50
mov dword [ebx], eax
add ebx, 4
jmp 0x41da31
call dword [esi + 0x1d064]
mov ebp, dword [esi + 0x1d058]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41da8a
sub esp, 0xffffff80
jmp 0x407f40
Function at 0x16aa058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.016aa1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x16aa07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x16aa06a
add dl, dl
jne 0x16aa089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x16aa0dc
xor eax, eax
add dl, dl
jne 0x16aa096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x16aa17d
add dl, dl
jne 0x16aa0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x16aa0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x16aa0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x16aa0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x16aa0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x16aa075
mov eax, 1
add dl, dl
jne 0x16aa0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x16aa0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x16aa0e1
sub eax, ebx
mov ebx, 1
jne 0x16aa128
mov ecx, 1
add dl, dl
jne 0x16aa10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x16aa119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x16aa105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x16aa075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x16aa13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x16aa14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x16aa136
cmp eax, 0x7d00
jae 0x16aa16d
cmp eax, 0x500
jb 0x16aa168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x16aa075
cmp eax, 0x7f
ja 0x16aa170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x16aa075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x16aa19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x16aa075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0x4b9379af
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x65960cc1
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x438ca8
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x438a14
sub eax, esi
call fcn.00438cce
sub eax, 0x6675abec
and esi, eax
xor dword [ecx], ebx
or esi, eax
inc ecx
push esi
pop eax
cmp ecx, edx
jne fcn.00438ca8
dec esi
or esi, esi
dec esi
ret
Function at 0x112fa
Capabilities:
Create device object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x160b4]
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
push 9
pop ecx
mov esi, 0x112ae
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
push 8
pop ecx
mov esi, 0x112d2
lea edi, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
movsw word es:[edi], word [esi]
xor esi, esi
cmp ebx, 2
mov dword [ebp - 0x5c], eax
jne 0x1134d
cmp dword [0x160e8], esi
jne 0x11456
lea eax, [ebp - 0x4c]
jmp 0x11361
cmp ebx, 3
jne 0x1135e
cmp dword [0x160ec], esi
jne 0x11456
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push esi
push esi
push 0x21
push 1
push 3
push esi
lea eax, [ebp - 0x64]
mov dword [ebp - 0x74], eax
push esi
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x100000
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x7c], 0x18
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x70], 0x40
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], esi
call dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
jl 0x11416
push esi
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push 1
push dword [ebp - 0x50]
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
jl 0x1140d
push dword [ebp - 0x58]
call dword [sym.imp.ntoskrnl.exe_IoGetRelatedDeviceObject]
mov edi, eax
cmp edi, esi
je 0x11404
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push dword [edi + 0x2c]
push esi
push 0x14
push dword [ebp - 0x5c]
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
jl 0x11404
mov eax, dword [ebp - 0x54]
and byte [eax + 0x1c], 0x7f
push edi
push dword [ebp - 0x54]
call dword [sym.imp.ntoskrnl.exe_IoAttachDeviceToDeviceStack]
cmp eax, esi
jne 0x1141a
mov ecx, dword [ebp - 0x58]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push dword [ebp - 0x50]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
xor al, al
jmp 0x11458
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ecx + 0x28]
mov dword [ecx + 8], 0x5c
mov dword [ecx + 4], eax
mov byte [ecx + 0xc], 1
mov dword [ecx], ebx
mov ecx, dword [ebp - 0x58]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push dword [ebp - 0x50]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
cmp ebx, 2
mov eax, dword [ebp - 0x54]
jne 0x11451
mov dword [0x160e8], eax
jmp 0x11456
mov dword [0x160ec], eax
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.00014d59
leave
ret 8