joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56232c
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x56249a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [esi + 0x30], 0
je 0x56247f
xor eax, eax
mov dword [esi + 0x34], eax
mov eax, dword [0x5b4aec]
mov dword [esi + 0x38], eax
mov ax, word [0x5b4af0]
mov word [esi + 0x3c], ax
xor eax, eax
mov dword [esi + 0x40], eax
xor eax, eax
mov dword [esi + 0x44], eax
mov eax, dword [esi + 0x30]
cmp dword [eax + 0x38], 0
je 0x56247f
xor edi, edi
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x5623ad
mov eax, dword [ebp - 4]
call fcn.00402ed8
mov edi, eax
lea eax, [ebp - 4]
push eax
push edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x56247f
mov ebx, edi
test ebx, ebx
je 0x5623e3
lea eax, [ebp - 8]
lea edx, [ebx + 8]
mov ecx, 0x104
call fcn.00404ec0
mov eax, dword [ebp - 8]
mov edx, dword [esi + 0x30]
mov edx, dword [edx + 0x38]
call fcn.0040522c
test eax, eax
jne 0x5623e3
mov ebx, dword [ebx]
test ebx, ebx
jne 0x5623bb
test ebx, ebx
je 0x562474
cmp byte [ebx + 0x1b0], 0
je 0x562412
lea eax, [ebp - 0xc]
lea edx, [ebx + 0x1b0]
mov ecx, 0x10
call fcn.00404ec0
mov eax, dword [ebp - 0xc]
call fcn.005628fc
mov dword [esi + 0x34], eax
xor eax, eax
movzx edx, byte [ebx + eax + 0x194]
mov byte [esi + eax + 0x38], dl
inc eax
cmp eax, 6
jne 0x562414
cmp byte [ebx + 0x1c0], 0
je 0x56244d
lea eax, [ebp - 0x10]
lea edx, [ebx + 0x1c0]
mov ecx, 0x10
call fcn.00404ec0
mov eax, dword [ebp - 0x10]
call fcn.005628fc
mov dword [esi + 0x40], eax
cmp byte [ebx + 0x1d8], 0
je 0x562474
lea eax, [ebp - 0x14]
lea edx, [ebx + 0x1d8]
mov ecx, 0x10
call fcn.00404ec0
mov eax, dword [ebp - 0x14]
call fcn.005628fc
mov dword [esi + 0x44], eax
test edi, edi
je 0x56247f
mov eax, edi
call fcn.00402ef4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5624a1
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404c64
ret

Function at 0x567a10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x567a8a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x104
call fcn.00405370
mov eax, dword [ebx]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
test esi, esi
je 0x567a4a
sub esi, 4
mov esi, dword [esi]
mov eax, dword [ebx]
call fcn.004050e0
push eax
push esi
call sub.KERNEL32.DLL_GetTempPathA
mov edx, ebx
xchg edx, eax
call fcn.00405370
lea edx, [ebp - 8]
mov eax, dword [ebx]
call fcn.0054825c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00404c94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x567a91
lea eax, [ebp - 8]
call fcn.00404c40
ret
Function at 0x5785e4
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
mov byte [ebp - 7], cl
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
xor esi, esi
lea eax, [ebp - 0x107]
mov edx, esi
mov byte [eax], dl
inc esi
inc eax
cmp esi, 0x100
jne 0x578601
mov esi, 0x7f
lea ecx, [ebp - 0x88]
movzx eax, word [ebp - 6]
mov edx, esi
dec edx
mov ebx, edx
cdq
idiv ebx
mov eax, edx
inc eax
movzx edx, byte [ecx]
movzx ebx, al
movzx ebx, byte [ebp + ebx - 0x107]
mov byte [ecx], bl
movzx eax, al
mov byte [ebp + eax - 0x107], dl
movzx eax, word [ebp - 6]
mov edx, esi
dec edx
mov ebx, edx
cdq
idiv ebx
mov eax, edx
add al, 0x80
movzx edx, byte [ecx + 0x7f]
movzx ebx, al
movzx ebx, byte [ebp + ebx - 0x107]
mov byte [ecx + 0x7f], bl
movzx eax, al
mov byte [ebp + eax - 0x107], dl
dec esi
dec ecx
cmp esi, 1
jne 0x57861a
cmp byte [ebp - 7], 0
jne 0x5786b0
lea edx, [ebp - 0x207]
lea eax, [ebp - 0x107]
mov ecx, pe_nt_image_headers32
call fcn.004030c8
xor esi, esi
lea eax, [ebp - 0x207]
mov edx, esi
movzx ecx, byte [eax]
mov byte [ebp + ecx - 0x107], dl
inc esi
inc eax
cmp esi, 0x100
jne 0x57869a
mov ebx, dword [ebp - 4]
mov eax, ebx
test eax, eax
je 0x5786be
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp + 8]
xchg edx, eax
call fcn.00405370
mov eax, ebx
test eax, eax
je 0x5786d2
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x5786fd
mov esi, 1
mov eax, dword [ebp + 8]
call fcn.00405140
mov edx, dword [ebp - 4]
movzx edx, byte [edx + esi - 1]
movzx edx, byte [ebp + edx - 0x107]
mov byte [eax + esi - 1], dl
inc esi
dec ebx
jne 0x5786dd
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x578a80
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe48
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004050d0
xor eax, eax
push ebp
push 0x578b75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, 0x578b8c
call fcn.00404c94
lea eax, [ebp - 0x198]
push eax
push 2
call sub.wsock32.dll_WSAStartup
xor edx, edx
push ebp
push 0x578b50
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004050e0
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x578b46
mov ebx, eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebx + 0xc]
mov esi, dword [eax]
movzx eax, byte [esi]
mov dword [ebp - 0x1b8], eax
mov byte [ebp - 0x1b4], 0
movzx eax, byte [esi + 1]
mov dword [ebp - 0x1b0], eax
mov byte [ebp - 0x1ac], 0
movzx eax, byte [esi + 2]
mov dword [ebp - 0x1a8], eax
mov byte [ebp - 0x1a4], 0
movzx eax, byte [esi + 3]
mov dword [ebp - 0x1a0], eax
mov byte [ebp - 0x19c], 0
lea edx, [ebp - 0x1b8]
mov ecx, 3
mov eax, 0x578b9c
call fcn.0040a898
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x578b5a
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x578b7c
lea eax, [ebp - 4]
call fcn.00404c40
ret
Function at 0x578e9c
Capabilities:
Encrypt data using des

Disassembly:
push ebx
mov ecx, edx
and cl, 0x20
mov ebx, edx
and bl, 0x1e
movzx ebx, bl
shr ebx, 1
or cl, bl
and dl, 1
shl edx, 4
or cl, dl
mov edx, ecx
movzx edx, dl
movzx eax, al
add eax, eax
add eax, eax
add eax, eax
lea eax, [eax*8 + 0x5b590c]
movzx eax, byte [eax + edx]
and al, 0xf
pop ebx
ret

Function at 0x578ed4
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x578eec
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x578ee5
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.004035fc
xor edx, edx
mov eax, 0x5b5b0c
movzx ebx, byte [eax]
mov ecx, ebx
and cl, 7
movzx ecx, cl
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
movzx ecx, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x578f53
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp - 8]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x578f0a
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x579194
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x5791ad
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x5791a6
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x5791bf
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x5791b8
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.00578d8c
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
movzx ecx, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x5791d9
movzx eax, byte [ebp - 0xa]
movzx edx, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
movzx edx, byte [ebp - 9]
movzx ecx, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
add edx, edx
add edx, edx
movzx eax, byte [ebp - 8]
movzx ecx, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
movzx eax, byte [ebp - 7]
movzx edx, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
movzx edx, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
movzx eax, byte [ebp - 6]
and al, 0xf
add eax, eax
add eax, eax
movzx edx, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
movzx eax, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
movzx edx, byte [esi]
call fcn.00578e9c
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x579261
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
movzx ecx, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x57927f
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.00578e1c
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x5792a9
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5792c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x5792d9
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x5792d2
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
movzx edx, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x5792ed
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.00578c8c
test bl, bl
jne 0x5793c7
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x5bee84
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x579325
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x57933a
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.00579194
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
movzx ebx, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x57936d
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x57931a
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x579391
mov eax, 4
mov edx, dword [ebp + 0xc]
movzx ecx, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x5793a3
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x5793b8
jmp 0x579488
cmp bl, 1
jne 0x579488
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x5beede
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x5793e7
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x5793fc
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.00579194
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
movzx ecx, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x57942f
sub ebx, 6
inc dword [ebp - 8]
jne 0x5793dc
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x579457
mov eax, 4
mov ebx, dword [ebp + 0xc]
movzx edx, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x579469
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x57947e
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.00578d0c
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x57dc3c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x57dc8d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x57dc74
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x57dc64
jmp 0x57dc8d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x57dc75
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x58e074
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x58e0a2
mov eax, ebx
call fcn.0058eb28
cmp dword [ebx + 0x40], 0
je 0x58e09b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x58e113
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x58e105
cmp dword [ebx + 8], 0
je 0x58e0c4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x58e0d6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x58e105
cmp dword [ebx + 8], 0
je 0x58e0b7
cmp eax, 3
je 0x58e0e9
dec eax
jne 0x58e0b7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x58e0b7
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x58e0b7
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x58e131
cmp dword [ebx + 0x14], 0xcc
je 0x58e131
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0058e13c
pop ebx
ret
Function at 0x5a2428
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x5a261d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x5b6714]
mov edx, dword [edx]
mov eax, dword [ebx + 0x414]
call fcn.00561874
mov eax, dword [ebx + 0x414]
cmp byte [eax + 0x30], 0
je 0x5a2469
call fcn.005636c4
mov eax, dword [ebx + 0x414]
mov eax, dword [eax + 0x88]
call fcn.00563318
mov eax, dword [ebx + 0x414]
call fcn.0056361c
mov eax, dword [ebx + 0x36c]
mov eax, dword [eax + 0x278]
call fcn.0047f638
dec eax
test eax, eax
jl 0x5a25d2
inc eax
mov dword [ebp - 0xc], eax
xor esi, esi
mov eax, dword [ebx + 0x36c]
mov eax, dword [eax + 0x278]
mov edx, esi
call fcn.0047f670
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x10]
mov edx, 1
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x10]
mov edx, 0x5a2634
call fcn.00405078
je 0x5a25c8
mov eax, dword [ebx + 0x36c]
mov eax, dword [eax + 0x278]
mov edx, esi
call fcn.0047f670
mov eax, dword [eax + 8]
lea ecx, [ebp - 4]
xor edx, edx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebx + 0x36c]
mov eax, dword [eax + 0x278]
mov edx, esi
call fcn.0047f670
mov edx, dword [eax + 0x24]
lea eax, [ebp - 8]
call fcn.00404cd8
cmp dword [ebp - 4], 0
jne 0x5a257d
push 0x5a2644
push dword [ebp - 8]
push 0x5a2658
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404fe4
mov edx, dword [ebp - 0x14]
mov eax, ebx
call fcn.0059ff8c
lea edx, [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00578a80
mov eax, dword [ebp - 4]
mov edx, 0x5a2670
call fcn.00405078
je 0x5a257d
mov eax, dword [ebx + 0x36c]
mov eax, dword [eax + 0x278]
mov edx, esi
call fcn.0047f670
mov eax, dword [eax + 8]
mov ecx, dword [ebp - 4]
xor edx, edx
mov edi, dword [eax]
call dword [edi + 0x20]
mov eax, dword [ebp - 4]
mov edx, 0x5a2670
call fcn.00405078
jne 0x5a25b3
mov eax, dword [ebx + 0x36c]
mov eax, dword [eax + 0x278]
mov edx, esi
call fcn.0047f670
mov eax, dword [eax + 8]
mov ecx, 0x5a2680
mov edx, 2
mov edi, dword [eax]
call dword [edi + 0x20]
jmp 0x5a25c8
mov eax, dword [ebp - 4]
call fcn.005628fc
mov edx, eax
mov eax, dword [ebx + 0x414]
call fcn.005637d0
inc esi
dec dword [ebp - 0xc]
jne 0x5a24a5
call sub.KERNEL32.DLL_GetTickCount
mov ebx, eax
jmp 0x5a25e7
mov eax, dword [0x5b6de0]
mov eax, dword [eax]
call fcn.0046d54c
call sub.KERNEL32.DLL_GetTickCount
sub eax, ebx
cmp eax, 0xbb8
jb 0x5a25db
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a2624
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404c64
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404c64
ret
Function at 0x401000
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebp
mov ebp, dword [eax + 4]
mov eax, dword [eax]
movzx ecx, word [eax + 0x14]
xor edx, edx
lea ecx, [ecx + eax + 0x18]
mov dword [esp + 4], 0
cmp dx, word [eax + 6]
jae 0x4010c5
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push esi
push edi
lea esi, [ecx + 0x10]
mov ecx, dword [esi]
test ecx, ecx
jne 0x40106e
mov eax, dword [esp + 0x1c]
mov edi, dword [eax + 0x38]
test edi, edi
jle 0x4010a4
mov eax, dword [esi - 4]
add eax, ebp
cmp dword [0x5dfeb0], ecx
je 0x401055
test eax, eax
jne 0x401060
push 4
push 0x1000
push edi
push eax
call ebx
push edi
push 0
push eax
mov dword [esi - 8], eax
call fcn.00410d00
jmp 0x4010a1
mov eax, dword [esi - 4]
add eax, ebp
cmp dword [0x5dfeb0], 0
je 0x401080
test eax, eax
jne 0x40108b
push 4
push 0x1000
push ecx
push eax
call ebx
mov edx, dword [esi + 4]
mov ecx, dword [esi]
add edx, dword [esp + 0x18]
push ecx
mov edi, eax
push edx
push edi
call fcn.0040cb60
mov dword [esi - 8], edi
add esp, 0xc
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx]
mov eax, dword [esp + 0x10]
movzx ecx, word [edx + 6]
inc eax
add esi, 0x28
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x401033
pop edi
pop esi
pop ebx
pop ebp
pop ecx
ret

Function at 0x4010d0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [eax]
movzx ecx, word [ebx + 0x14]
push ebp
xor edx, edx
xor ebp, ebp
lea eax, [ecx + ebx + 0x18]
cmp dx, word [ebx + 6]
jae 0x401199
push esi
push edi
lea edi, [eax + 0x24]
mov eax, dword [edi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x401130
cmp dword [0x5dfeb0], 0
jne 0x401181
mov eax, dword [edi - 0x14]
mov ecx, dword [edi - 0x1c]
push 0x4000
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x401181
test ecx, ecx
jne 0x401139
mov esi, 1
lea edx, [edx + ecx*2]
lea ecx, [esi + edx*2]
mov esi, dword [ecx*4 + 0x5df11c]
test eax, 0x4000000
je 0x401153
or esi, 0x200
mov edx, dword [edi - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x40116e
test al, 0x40
je 0x401165
mov ecx, dword [ebx + 0x20]
jmp 0x40116c
test al, al
jns 0x401181
mov ecx, dword [ebx + 0x24]
test ecx, ecx
jbe 0x401181
mov ecx, dword [edi - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [esp + 0x18]
mov ebx, dword [edx]
movzx eax, word [ebx + 6]
inc ebp
add edi, 0x28
cmp ebp, eax
jl 0x4010f4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x401410
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [0x5dfea8]
sub esp, 0x100
test eax, eax
jne 0x4014b4
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor esi, esi
lea ecx, [ecx]
push 1
push 0x2000
push 1
push 0
call edi
or dword [0x5dfea8], eax
mov dword [esp + esi*4 + 8], eax
inc esi
cmp esi, 0x40
jl 0x401430
mov edi, dword [sym.imp.KERNEL32.dll_VirtualFree]
xor esi, esi
mov eax, dword [esp + esi*4 + 8]
push 0x8000
push 1
push eax
call edi
inc esi
cmp esi, 0x40
jl 0x401455
mov eax, dword [0x5dfea8]
xor ecx, ecx
mov edx, 1
shl edx, cl
test eax, edx
jne 0x401483
inc ecx
cmp ecx, 0x20
jl 0x401470
jmp 0x4014a4
mov edx, 1
rol edx, cl
cmp ecx, 0x20
jge 0x4014a4
mov esi, 0x20
sub esi, ecx
or eax, edx
rol edx, 1
sub esi, 1
jne 0x401496
mov dword [0x5dfea8], eax
pop edi
pop esi
test eax, eax
jne 0x4014b4
mov eax, 0x10000
mov dword [0x5dfea8], eax
add esp, 0x100
ret
Function at 0x402f20
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x2c
xor eax, eax
push esi
push edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x10]
push eax
mov esi, 1
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov eax, dword [esp + 8]
cmp eax, dword [esp + 0xc]
jne 0x402fad
cmp eax, dword [esp + 0x20]
jne 0x402fad
cmp eax, esi
jb 0x402f8f
add esi, esi
inc edi
cmp esi, eax
jbe 0x402f88
cmp dword [esp + 0x24], edi
jne 0x402fad
cmp dword [esp + 0x3c], 0
je 0x402fa2
cmp dword [esp + 0x38], edi
jne 0x402fad
pop edi
mov eax, 1
pop esi
add esp, 0x2c
ret
pop edi
xor eax, eax
pop esi
add esp, 0x2c
ret

Function at 0x403ef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [0x5f6314]
test edi, edi
je 0x403f31
cmp edi, esi
jae 0x403f09
mov esi, edi
test esi, esi
je 0x403f31
mov eax, dword [ebp + 0xc]
mov ebx, dword [0x5f6318]
push esi
push eax
push ebx
call fcn.0040cb60
sub edi, esi
add esp, 0xc
add ebx, esi
mov dword [0x5f6314], edi
mov dword [0x5f6318], ebx
mov ecx, dword [ebp + 0x10]
jcxz 0x403f54
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lodsb al, byte [esi]
xor al, bl
and eax, 0xff
shr ebx, 8
xor ebx, dword [eax*4 + 0x5f6320]
loop 0x403f3d
mov dword [ebp + 8], ebx
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x408ce0
Capabilities:
Encode data using xor

Disassembly:
movzx eax, word [0x41a218]
cmp eax, 0x4b50
je 0x408d1c
mov ecx, 0xc21a5ce5
xor eax, eax
jmp 0x408d00
xor dword [eax + 0x41a218], ecx
add ecx, 0xcb714b84
add eax, 4
xor ecx, 0x8cd5354f
cmp eax, 0x1c40a4
jb 0x408d00
movzx ecx, word [0x41a218]
cmp ecx, 0x4b50
je 0x408d2e
xor eax, eax
ret
mov edx, dword [esp + 4]
mov dword [edx], 0x1c40a4
mov eax, 0x41a218
ret