joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53d400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov ebx, ecx
push edi
lea edi, [ebx + 0xb8]
mov ecx, edi
call fcn.0040a190
xor ebp, ebp
cmp dword [ebx + 0x88], ebp
jbe 0x53d583
fldz
fstp dword [esp + 0x20]
fld dword [esp + 0x3c]
fmul qword [0x584370]
fstp qword [esp + 0x14]
jmp 0x53d440
mov ecx, dword [ebx + 0x78]
mov edx, dword [ebx + 0x84]
xor eax, eax
test ecx, ecx
je 0x53d457
mov ecx, dword [ecx]
test ecx, ecx
je 0x53d457
mov eax, dword [ecx]
lea ecx, [edx + ebp]
test eax, eax
je 0x53d46a
mov eax, dword [eax]
test eax, eax
je 0x53d46a
mov eax, dword [eax]
test eax, eax
jne 0x53d46e
xor edx, edx
jmp 0x53d470
mov edx, dword [eax]
mov esi, dword [edx + 8]
mov eax, ecx
shr eax, 2
and ecx, 3
cmp esi, eax
ja 0x53d481
sub eax, esi
mov edx, dword [edx + 4]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
test eax, eax
jns 0x53d4a3
fadd dword [0x583680]
fmul dword [esp + 0x3c]
mov eax, dword [ebx + 0x78]
mov ecx, dword [ebx + 0x84]
xor edx, edx
fadd qword [esp + 0x14]
fstp dword [esp + 0x1c]
test eax, eax
je 0x53d4c6
mov eax, dword [eax]
test eax, eax
je 0x53d4c6
mov edx, dword [eax]
add ecx, ebp
test edx, edx
je 0x53d4d8
mov edx, dword [edx]
test edx, edx
je 0x53d4d8
mov edx, dword [edx]
test edx, edx
jne 0x53d4dc
xor edx, edx
jmp 0x53d4de
mov edx, dword [edx]
mov esi, dword [edx + 8]
mov eax, ecx
shr eax, 2
and ecx, 3
cmp esi, eax
ja 0x53d4ef
sub eax, esi
mov edx, dword [edx + 4]
mov eax, dword [edx + eax*4]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
test eax, eax
jns 0x53d511
fadd dword [0x583680]
fmul dword [esp + 0x3c]
mov ecx, dword [edi + 0x10]
inc ecx
fadd qword [esp + 0x14]
fstp dword [esp + 0x24]
cmp dword [edi + 8], ecx
ja 0x53d52f
push 1
mov ecx, edi
call fcn.0040a040
mov esi, dword [edi + 0xc]
add esi, dword [edi + 0x10]
mov eax, dword [edi + 8]
cmp eax, esi
ja 0x53d53e
sub esi, eax
mov edx, dword [edi + 4]
cmp dword [edx + esi*4], 0
jne 0x53d55b
push 0xc
call fcn.00565b01
add esp, 4
test eax, eax
je 0x53d59b
mov ecx, dword [edi + 4]
mov dword [ecx + esi*4], eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + esi*4]
lea edx, [esp + 0x1c]
push edx
push ecx
lea edx, [edi + 0x14]
push edx
call fcn.005204e0
inc dword [edi + 0x10]
inc ebp
add esp, 0xc
cmp ebp, dword [ebx + 0x88]
jb 0x53d440
mov esi, dword [esp + 0x38]
push edi
mov ecx, esi
call fcn.0053f040
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x14], 0
call fcn.00566032
push 0x5ac4c8
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x30], vtable.std::bad_alloc.0
call fcn.00566120
int3
Function at 0x54d010
Capabilities:
Set current directory

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, ecx
cmp esi, 0x12
jb 0x54d02e
push 0
push 0x72
push str.DirectoryManager.cpp
call fcn.005160e0
add esp, 0xc
cmp esi, dword [edi + 0x50]
je 0x54d046
cmp esi, 0x11
je 0x54d046
mov eax, dword [edi + esi*4 + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [edi + 0x50], esi
pop edi
pop esi
ret 4
Function at 0x55dc30
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
sub esp, 0x804
mov eax, dword [0x6a1068]
xor eax, esp
mov dword [esp + 0x800], eax
push ebx
push ebp
xor ecx, ecx
push esi
lea eax, [ecx + 1]
push edi
lea ecx, [ecx]
mov edx, eax
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
lea esi, [eax + eax]
and edx, 0x1b
mov dword [esp + ecx*4 + 0x410], eax
mov dword [esp + eax*4 + 0x10], ecx
xor edx, esi
xor eax, edx
inc ecx
and eax, 0xff
cmp ecx, 0x100
jl 0x55dc50
mov eax, 1
mov ecx, 0x6df910
lea esp, [esp]
mov edx, eax
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
mov dword [ecx], eax
add eax, eax
and edx, 0x1b
xor eax, edx
add ecx, 4
and eax, 0xff
cmp ecx, 0x6df938
jl 0x55dc90
mov byte [0x6df010], 0x63
mov byte [0x6e119b], 0
mov ebx, 1
mov ecx, dword [esp + ebx*4 + 0x10]
add ecx, ecx
add ecx, ecx
lea edx, [esp + 0x80c]
sub edx, ecx
mov eax, dword [edx]
mov ecx, eax
sar ecx, 7
lea edx, [eax + eax]
or ecx, edx
and ecx, 0xff
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
and edx, 0xff
xor eax, edx
mov ecx, edx
add edx, edx
sar ecx, 7
or ecx, edx
and ecx, 0xff
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
xor edx, 0x63
and edx, 0xff
xor eax, edx
mov byte [ebx + 0x6df010], al
mov byte [eax + 0x6e1138], bl
inc ebx
cmp ebx, 0x100
jl 0x55dcc8
xor ecx, ecx
lea ebx, [ebx]
movzx esi, byte [ecx + 0x6df010]
mov edx, esi
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
and edx, 0x1b
lea eax, [esi + esi]
xor edx, eax
and edx, 0xff
mov eax, edx
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, edx
mov dword [ecx*4 + 0x6e0d38], eax
rol eax, 8
mov dword [ecx*4 + 0x6e0938], eax
rol eax, 8
mov dword [ecx*4 + 0x6e0538], eax
rol eax, 8
mov dword [ecx*4 + 0x6e0138], eax
movzx eax, byte [ecx + 0x6e1138]
test eax, eax
je 0x55ddf6
mov esi, dword [esp + eax*4 + 0x10]
mov edx, dword [esp + 0x48]
lea eax, [esi + edx]
cdq
mov edi, 0xff
idiv edi
mov eax, dword [esp + 0x34]
add eax, esi
mov ebp, dword [esp + edx*4 + 0x410]
cdq
idiv edi
mov ebx, dword [esp + edx*4 + 0x410]
mov edx, dword [esp + 0x44]
lea eax, [esi + edx]
cdq
idiv edi
mov eax, dword [esp + 0x3c]
add eax, esi
mov esi, 0xff
mov edi, dword [esp + edx*4 + 0x410]
cdq
idiv esi
mov edx, dword [esp + edx*4 + 0x410]
jmp 0x55ddfe
xor ebp, ebp
xor ebx, ebx
xor edi, edi
xor edx, edx
shl edx, 8
xor edx, edi
shl edx, 8
xor edx, ebx
shl edx, 8
xor edx, ebp
mov dword [ecx*4 + 0x6dfd38], edx
rol edx, 8
mov dword [ecx*4 + 0x6df938], edx
rol edx, 8
mov dword [ecx*4 + 0x6df510], edx
rol edx, 8
mov dword [ecx*4 + 0x6df110], edx
inc ecx
cmp ecx, 0x100
jl 0x55dd40
mov ecx, dword [esp + 0x810]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00565a22
add esp, 0x804
ret
Function at 0x55e3c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x11c
mov eax, dword [0x6a1068]
xor eax, esp
mov dword [esp + 0x118], eax
mov edx, dword [esp + 0x128]
mov ecx, dword [esp + 0x124]
mov eax, edx
sub eax, 0x80
push edi
mov edi, dword [esp + 0x124]
je 0x55e411
sub eax, 0x40
je 0x55e409
sub eax, 0x40
jne 0x55e5c4
mov dword [edi], 0xe
jmp 0x55e417
mov dword [edi], 0xc
jmp 0x55e417
mov dword [edi], 0xa
push esi
push edx
push ecx
lea eax, [esp + 0x10]
lea esi, [edi + 8]
push eax
mov dword [edi + 4], esi
call fcn.0055de60
mov eax, dword [esp + 0x14]
shl eax, 4
add eax, dword [esp + 0x18]
add esp, 0xc
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0xc], edx
mov ecx, dword [edi]
dec ecx
add esi, 0x10
sub eax, 0x10
test ecx, ecx
jle 0x55e5ad
nop
movzx edx, byte [eax + 3]
movzx edx, byte [edx + 0x6df010]
mov edx, dword [edx*4 + 0x6df110]
movzx edi, byte [eax + 2]
movzx edi, byte [edi + 0x6df010]
xor edx, dword [edi*4 + 0x6df510]
movzx edi, byte [eax + 1]
movzx edi, byte [edi + 0x6df010]
xor edx, dword [edi*4 + 0x6df938]
mov edi, dword [eax]
and edi, 0xff
movzx edi, byte [edi + 0x6df010]
xor edx, dword [edi*4 + 0x6dfd38]
dec ecx
mov dword [esi], edx
mov edx, dword [eax + 4]
movzx edi, byte [eax + 7]
movzx edi, byte [edi + 0x6df010]
and edx, 0xff
movzx edx, byte [edx + 0x6df010]
mov edx, dword [edx*4 + 0x6dfd38]
xor edx, dword [edi*4 + 0x6df110]
movzx edi, byte [eax + 6]
movzx edi, byte [edi + 0x6df010]
xor edx, dword [edi*4 + 0x6df510]
movzx edi, byte [eax + 5]
movzx edi, byte [edi + 0x6df010]
xor edx, dword [edi*4 + 0x6df938]
add esi, 0x10
mov dword [esi - 0xc], edx
mov edx, dword [eax + 8]
movzx edi, byte [eax + 0xb]
movzx edi, byte [edi + 0x6df010]
and edx, 0xff
movzx edx, byte [edx + 0x6df010]
mov edx, dword [edx*4 + 0x6dfd38]
xor edx, dword [edi*4 + 0x6df110]
movzx edi, byte [eax + 0xa]
movzx edi, byte [edi + 0x6df010]
xor edx, dword [edi*4 + 0x6df510]
movzx edi, byte [eax + 9]
movzx edi, byte [edi + 0x6df010]
xor edx, dword [edi*4 + 0x6df938]
sub eax, 0x10
mov dword [esi - 8], edx
mov edx, dword [eax + 0x1c]
movzx edi, byte [eax + 0x1f]
movzx edi, byte [edi + 0x6df010]
and edx, 0xff
movzx edx, byte [edx + 0x6df010]
mov edx, dword [edx*4 + 0x6dfd38]
xor edx, dword [edi*4 + 0x6df110]
movzx edi, byte [eax + 0x1e]
movzx edi, byte [edi + 0x6df010]
xor edx, dword [edi*4 + 0x6df510]
movzx edi, byte [eax + 0x1d]
movzx edi, byte [edi + 0x6df010]
xor edx, dword [edi*4 + 0x6df938]
mov dword [esi - 4], edx
test ecx, ecx
jg 0x55e460
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0xc], edx
pop esi
mov ecx, dword [esp + 0x11c]
pop edi
xor ecx, esp
call fcn.00565a22
add esp, 0x11c
ret
Function at 0x55f350
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x730
mov eax, dword [0x6a1068]
xor eax, esp
mov dword [esp + 0x72c], eax
mov eax, dword [esp + 0x738]
push ebx
mov ebx, dword [esp + 0x738]
push esi
mov esi, ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], eax
test ebx, ebx
jne 0x55f389
xor eax, eax
jmp 0x55f51e
test eax, eax
je 0x55f382
push edi
push ebx
push 1
lea eax, [esp + 0x1a]
push 1
push eax
call fcn.00565f05
push 0x200
xor edi, edi
lea ecx, [esp + 0x54c]
push edi
push ecx
add esi, 0x10
call fcn.00565470
lea edx, [esp + 0x30]
push edx
push str._02X
push esi
call fcn.00567822
add esp, 0x28
test eax, eax
jle 0x55f3fe
lea esp, [esp]
cmp edi, 0x200
jge 0x55f3fe
mov al, byte [esp + 0x14]
lea ecx, [esp + 0x14]
push ecx
add esi, 2
push str._02X
mov byte [esp + edi + 0x540], al
push esi
inc edi
call fcn.00567822
add esp, 0xc
test eax, eax
jg 0x55f3d0
push ebp
push 0x100
lea edx, [esp + 0x540]
push edx
lea eax, [esp + 0x2c]
push eax
call fcn.0055e3c0
mov ebp, dword [esp + 0x758]
mov cl, byte [esp + 0x75c]
add esp, 0xc
xor edi, edi
mov byte [esp + 0x13], cl
test ebp, ebp
jle 0x55f4dd
push ebx
push 0x10
lea edx, [esp + 0x144]
push 1
push edx
call fcn.00565f05
add esp, 0x10
cmp eax, 0x10
jne 0x55f506
lea eax, [esp + 0x13c]
push eax
mov ecx, eax
push ecx
lea edx, [esp + 0x2c]
push 0
push edx
call fcn.0055e5e0
mov ecx, dword [esp + 0x30]
xor eax, eax
add esp, 0x10
xor dl, dl
mov byte [esp + 0x15], al
mov byte [esp + 0x14], al
lea esi, [ecx + edi + 1]
mov cl, byte [esp + eax + 0x13c]
add byte [esp + 0x13], cl
mov byte [esi + eax - 1], cl
mov cl, byte [esp + eax + 0x13d]
add byte [esp + 0x14], cl
mov byte [esi + eax], cl
mov cl, byte [esp + eax + 0x13e]
add byte [esp + 0x15], cl
mov byte [esi + eax + 1], cl
mov cl, byte [esp + eax + 0x13f]
mov byte [esi + eax + 2], cl
add eax, 4
add dl, cl
cmp eax, 0x10
jl 0x55f481
add dl, byte [esp + 0x15]
mov ebx, dword [esp + 0x1c]
add dl, byte [esp + 0x14]
add edi, 0x10
add byte [esp + 0x13], dl
cmp edi, ebp
jl 0x55f435
push ebx
push 1
lea edx, [esp + 0x1f]
push 1
push edx
call fcn.00565f05
mov al, byte [esp + 0x26]
add esp, 0x10
cmp al, byte [esp + 0x17]
jne 0x55f506
cmp al, byte [esp + 0x13]
jne 0x55f506
mov eax, 1
jmp 0x55f51c
push 0
push str.Error__
push str.Header_Version_Error__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop ebp
pop edi
mov ecx, dword [esp + 0x734]
pop esi
pop ebx
xor ecx, esp
call fcn.00565a22
add esp, 0x730
ret 0x10

Function at 0x565a22
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6a1068]
jne 0x565a2c
repz ret
jmp fcn.0056e1e3
Function at 0x572243
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6a1068]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00570175
and dword [ebp - 0x14], 0
cmp dword [0x6e16ec], 0
mov dword [ebp - 0x18], eax
jne 0x5722f6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x57239e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x57239e
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x59a1dc
push ebx
mov dword [0x6e16ec], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x6e16f0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x6e16f4], eax
call edi
push eax
call esi
mov dword [0x6e16fc], eax
test eax, eax
je 0x5722f6
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x6e16f8], eax
mov eax, dword [0x6e16f8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x57234f
cmp dword [0x6e16fc], ecx
je 0x57234f
push eax
call esi
push dword [0x6e16fc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x57234f
test ebx, ebx
je 0x57234f
call edi
test eax, eax
je 0x572346
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x572346
test byte [ebp - 8], 1
jne 0x57234f
or dword [ebp + 0x10], 0x200000
jmp 0x572382
mov eax, dword [0x6e16f0]
cmp eax, dword [ebp - 0x18]
je 0x572382
push eax
call esi
test eax, eax
je 0x572382
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x572382
mov eax, dword [0x6e16f4]
cmp eax, dword [ebp - 0x18]
je 0x572382
push eax
call esi
test eax, eax
je 0x572382
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x6e16ec]
call esi
test eax, eax
je 0x57239e
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x5723a0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00565a22
leave
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41b004]
jne 0x40100a
repz ret
jmp fcn.004016a5

Function at 0x408058
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404164
and dword [ebp - 4], 0
cmp dword [0x41d188], 0
mov ebx, eax
jne 0x408109
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4081ba
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4081ba
push eax
call fcn.004040f2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41d188], eax
call esi
push eax
call fcn.004040f2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41d18c], eax
call esi
push eax
call fcn.004040f2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41d190], eax
call esi
push eax
call fcn.004040f2
pop ecx
mov dword [0x41d198], eax
test eax, eax
je 0x408109
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004040f2
pop ecx
mov dword [0x41d194], eax
mov eax, dword [0x41d194]
cmp eax, ebx
je 0x408161
cmp dword [0x41d198], ebx
je 0x408161
push eax
call fcn.0040416d
push dword [0x41d198]
mov esi, eax
call fcn.0040416d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408161
test edi, edi
je 0x408161
call esi
test eax, eax
je 0x408158
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408158
test byte [ebp - 0xc], 1
jne 0x408161
or dword [ebp + 0x10], 0x200000
jmp 0x40819a
mov eax, dword [0x41d18c]
cmp eax, ebx
je 0x40819a
push eax
call fcn.0040416d
pop ecx
test eax, eax
je 0x40819a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40819a
mov eax, dword [0x41d190]
cmp eax, ebx
je 0x40819a
push eax
call fcn.0040416d
pop ecx
test eax, eax
je 0x40819a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41d188]
call fcn.0040416d
pop ecx
test eax, eax
je 0x4081ba
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4081bc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000876e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1000877d
pop dword [ebp - 0x20]
mov eax, 0xf7d4f3d
add eax, 0x833840
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x2f3d2932
add dword [ebp - 0x30], 0x1f151c19
mov dword [ebp - 0x2c], 0x60b89b7d
add dword [ebp - 0x2c], 0xd17ab0c8
mov dword [ebp - 0x28], 0x63e328d4
sub dword [ebp - 0x28], 0x1796e4a6
mov dword [ebp - 0x24], 0xc6768a9f
sub dword [ebp - 0x24], 0xc6768a9f
lea eax, [ebp - 0x30]
push eax
mov eax, 0xc6a6b94f
add eax, 0x49595831
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x34e7d5d1
add dword [ebp - 0x30], 0x3f8a9385
mov dword [ebp - 0x2c], 0x8fee2832
add dword [ebp - 0x2c], 0xb17e3943
mov dword [ebp - 0x28], 0xe93fb406
sub dword [ebp - 0x28], 0x85d0479a
mov dword [ebp - 0x24], 0xf520b56d
sub dword [ebp - 0x24], 0xf520b56d
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3d32b
push 0
call eax
mov ecx, 0x471a
mov ebx, eax
mov esi, 0x6c126518
add esi, 0xa3ef68e8
add esi, dword [ebp - 0x20]
mov edi, 0xc8503682
mov edx, dword [esi]
sub edx, edi
xor dword [ebp - 0x1c], edi
mov dword [ebx], edx
xor dword [ebp - 0x10], esi
add ebx, 0x644e37e1
sub ebx, 0x644e37dd
add esi, 0x7787fd03
add esi, 0x88780301
loop 0x1000888e
add eax, 0x993352a3
sub eax, 0x99324368
mov ebx, eax
add eax, 0xf21ca72f
sub eax, 0xf21ca72a
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x412f50
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push 0x82f814
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x43ce50
call fcn.00439ba7
add esp, 0x28
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
test ebx, ebx
je 0x412fb7
push ebx
call fcn.00439b95
add esp, 4
pop eax
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
push 0x82f85d
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ecx, 2
call fcn.0040106f
add esp, 8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
push eax
push 1
push 0
push dword [ebp - 0xc]
mov eax, 0
call fcn.00439b89
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x413005
push ebx
call fcn.00439b95
add esp, 4
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x413019
push ebx
call fcn.00439b95
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x5349ea
push dword [ebp - 4]
call fcn.00401104
add esp, 8
cmp eax, 0
je 0x413164
push reloc.WS2_32.dll_bind
push 0
push 0
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x413063
mov eax, 0x5349ea
push eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x413077
mov eax, 0x5349ea
push eax
push 4
mov ebx, 0x43a7a0
call fcn.00439ba7
add esp, 0x34
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4130b6
push 0x5349ea
mov ebx, dword [ebp + 8]
push dword [ebx]
call fcn.00401104
add esp, 8
cmp eax, 0
je 0x4130b6
xor eax, eax
jmp 0x4130bb
mov eax, 1
test eax, eax
je 0x41312a
push dword [ebp - 4]
push 0x5349e8
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ecx, 3
call fcn.0040106f
add esp, 0xc
mov dword [ebp - 0xc], eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x4130f3
mov eax, 0x5349ea
push eax
push 1
mov ebx, 0x43bd70
call fcn.00439ba7
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x413119
push ebx
call fcn.00439b95
add esp, 4
cmp dword [ebp - 0x10], 0
je 0x41312a
mov dword [ebp - 8], 1
lea eax, [ebp - 0x20]
push eax
push 1
push 0
push 0
mov eax, 0
call fcn.00439b89
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41315b
push ebx
call fcn.00439b95
add esp, 4
pop eax
mov dword [ebp - 4], eax
jmp 0x41301d
mov eax, dword [ebp - 8]
jmp 0x41316c
push eax
push dword [ebp - 0x20]
mov eax, 1
call fcn.00439b89
add esp, 4
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41318d
push ebx
call fcn.00439b95
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x421c61
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.00421aac
and eax, 1
xor eax, 1
test eax, eax
je 0x421c9a
mov edx, 0
mov eax, 0
jmp 0x421cd4
push 0x33
call 0x421ca1
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret

Function at 0x421cd8
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.00421aac
and eax, 1
xor eax, 1
test eax, eax
je 0x421d11
mov edx, 0
mov eax, 0
jmp 0x421d49
push 0x33
call 0x421d18
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret 0x14

Function at 0x421d4f
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
call fcn.00421aac
and eax, 1
xor eax, 1
test eax, eax
je 0x421d7c
mov eax, 0
jmp 0x421db1
push 0x33
call 0x421d83
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret 0x14

Function at 0x421ee1
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.00421aac
and eax, 1
xor eax, 1
test eax, eax
je 0x421f02
jmp 0x421fa3
cmp dword [ebp + 8], 0
jne 0x421f0c
cmp dword [ebp + 0xc], 0
je 0x421f36
cmp dword [ebp + 0x10], 0
jne 0x421f1c
cmp dword [ebp + 0x14], 0
je 0x421f36
cmp dword [ebp + 0x18], 0
jne 0x421f2c
cmp dword [ebp + 0x1c], 0
je 0x421f36
xor eax, eax
jmp 0x421f3b
mov eax, 1
test eax, eax
je 0x421f48
jmp 0x421fa3
push 0x33
call 0x421f4f
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret 0x18

Function at 0x422626
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
call fcn.00421aac
and eax, 1
xor eax, 1
test eax, eax
je 0x422653
mov eax, 0
jmp 0x422686
push 0x33
call 0x42265a
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret 0x14

Function at 0x4226a8
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
call fcn.00421aac
and eax, 1
xor eax, 1
test eax, eax
je 0x4226d5
mov eax, 0
jmp 0x42271d
mov dword [ebp - 4], 0
push 0x33
call 0x4226e3
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret 0x10

Function at 0x422757
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
call fcn.00421aac
and eax, 1
xor eax, 1
test eax, eax
je 0x42279e
mov edx, 0
mov eax, 0
jmp 0x4228a0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
push 0x33
call 0x4227c1
add dword [esp], 5
retf
mov esp, ebp
pop ebp
ret 0x1c