joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411806
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040ad1a
and dword [ebp - 4], 0
cmp dword [0x810a38], 0
mov ebx, eax
jne 0x4118b7
push 0x40471c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x411968
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x404710
push edi
call esi
test eax, eax
je 0x411968
push eax
call fcn.0040aca8
mov dword [esp], 0x404700
push edi
mov dword [0x810a38], eax
call esi
push eax
call fcn.0040aca8
mov dword [esp], 0x4046ec
push edi
mov dword [0x810a3c], eax
call esi
push eax
call fcn.0040aca8
mov dword [esp], 0x4046d0
push edi
mov dword [0x810a40], eax
call esi
push eax
call fcn.0040aca8
pop ecx
mov dword [0x810a48], eax
test eax, eax
je 0x4118b7
push 0x4046b8
push edi
call esi
push eax
call fcn.0040aca8
pop ecx
mov dword [0x810a44], eax
mov eax, dword [0x810a44]
cmp eax, ebx
je 0x41190f
cmp dword [0x810a48], ebx
je 0x41190f
push eax
call fcn.0040ad23
push dword [0x810a48]
mov esi, eax
call fcn.0040ad23
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41190f
test edi, edi
je 0x41190f
call esi
test eax, eax
je 0x411906
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x411906
test byte [ebp - 0xc], 1
jne 0x41190f
or dword [ebp + 0x10], 0x200000
jmp 0x411948
mov eax, dword [0x810a3c]
cmp eax, ebx
je 0x411948
push eax
call fcn.0040ad23
pop ecx
test eax, eax
je 0x411948
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x411948
mov eax, dword [0x810a40]
cmp eax, ebx
je 0x411948
push eax
call fcn.0040ad23
pop ecx
test eax, eax
je 0x411948
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x810a38]
call fcn.0040ad23
pop ecx
test eax, eax
je 0x411968
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41196a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x40596d
pop dword [ebp - 0x38]
mov eax, 0x40596d
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x1d2d8df0
sub dword [ebp - 0x48], 0xcedb48a5
mov dword [ebp - 0x44], 0xd31f80c2
sub dword [ebp - 0x44], 0xa0ec347d
mov dword [ebp - 0x40], 0xcff934bb
sub dword [ebp - 0x40], 0x83acf08d
mov dword [ebp - 0x3c], 0x8dd551a2
add dword [ebp - 0x3c], 0x722aae5e
lea eax, [ebp - 0x48]
push eax
mov eax, 0x34984fb4
sub eax, 0x3457df54
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x8efab0a7
add dword [ebp - 0x48], 0xe577b8af
mov dword [ebp - 0x44], 0xd5d4f70e
sub dword [ebp - 0x44], 0x94689599
mov dword [ebp - 0x40], 0x7002fb8d
sub dword [ebp - 0x40], 0xc938f21
mov dword [ebp - 0x3c], 0xc55724fc
add dword [ebp - 0x3c], 0x3aa8db04
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3bd4f
push 0
call eax
mov ecx, 0x5c76
xor ebx, ebx
add ebx, eax
mov esi, 0x9ced88
add esi, 0xffa41278
add esi, dword [ebp - 0x38]
mov edi, 0xd3bcc3d7
mov edx, dword [esi]
sub dword [ebp - 0x20], 0xeaf0090
add edx, edi
sub dword [ebp - 0x10], esi
mov dword [ebx], edx
xor dword [ebp - 0x34], eax
add ebx, 4
add esi, 0x517ca76a
sub esi, 0x517ca766
loop 0x405a7b
add eax, 0x4e1695a9
add eax, 0xb1eacf02
xor ebx, ebx
add ebx, eax
add eax, 0xdfe142f7
sub eax, 0xdfe142f2
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x417650
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x459490
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x49c
mov eax, dword [0x46c008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x40a
push 0x46d788
call fcn.00419250
add esp, 8
push 0x406
push 0x46d380
call fcn.00419250
add esp, 8
mov dword [ebp - 0x430], 0
mov byte [ebp - 0x436], 0
mov eax, 1
test eax, eax
je 0x4177b5
movzx ecx, byte [ebp - 0x436]
test ecx, ecx
je 0x417794
mov edx, dword [ebp - 0x430]
add edx, 0xb
mov dword [ebp - 0x430], edx
lea eax, [ebp - 0x498]
push eax
push 0x40
mov ecx, dword [ebp - 0x430]
mov edx, dword [ecx - 0x14]
push edx
mov eax, dword [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x458], 0
jmp 0x41771d
mov ecx, dword [ebp - 0x458]
add ecx, 1
mov dword [ebp - 0x458], ecx
mov edx, dword [ebp - 0x430]
mov eax, dword [ebp - 0x458]
cmp eax, dword [edx - 0x14]
jae 0x417792
mov ecx, dword [ebp - 0x430]
movzx edx, byte [ecx - 0x15]
mov eax, dword [ebp - 0x430]
add eax, dword [ebp - 0x458]
movzx ecx, byte [eax - 4]
xor edx, ecx
mov eax, dword [ebp - 0x430]
add eax, dword [ebp - 0x458]
movzx ecx, byte [eax - 2]
xor edx, ecx
mov eax, dword [ebp - 0x430]
add eax, dword [ebp - 0x458]
movzx ecx, byte [eax - 3]
xor edx, ecx
mov eax, dword [ebp - 0x430]
add eax, dword [ebp - 0x458]
movzx ecx, byte [eax]
xor ecx, edx
mov edx, dword [ebp - 0x430]
add edx, dword [ebp - 0x458]
mov byte [edx], cl
jmp 0x41770e
jmp 0x4177b5
mov byte [ebp - 0x436], 1
jmp 0x4177a5
call 0x4177aa
pop dword [ebp - 0x430]
jmp 0x4176b7
add bh, bh
invalid
xor dword [esi + 0x302f8c5b], esp
add eax, 0x124b79d3
pop edx
inc ecx
xchg esp, eax
jge 0x4177b1
adc dword [ecx], eax
or dword [edx - 0x2c], ecx
fimul dword [ebp + 0x4f]
mov ss, word [ebx]
faddp st(4)
jg 0x417831
push ds
push esp
mov ecx, 0xa0eb456
pop ecx
or cl, byte [ebx - 0x42f7b]
dec dword [ebx - 0x167c13b8]
add dword [ecx - 0x43f73], ecx
invalid
mov dh, 0x42
invalid
Function at 0x419250
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
mov byte [ebp - 1], 0
mov eax, 1
test eax, eax
je 0x419310
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x4192f5
mov edx, dword [ebp - 8]
add edx, 0xb
mov dword [ebp - 8], edx
lea eax, [ebp - 0x18]
push eax
push 0x40
mov ecx, dword [ebp - 8]
mov edx, dword [ecx - 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0xc], 0
jmp 0x4192a8
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx - 0x14]
jae 0x4192f3
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx - 0x15]
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax - 4]
xor edx, ecx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax - 2]
xor edx, ecx
mov eax, dword [ebp - 8]
inc ebp
clc
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax - 3]
xor edx, ecx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
xor ecx, edx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0xc]
mov byte [edx], cl
jmp 0x41929f
jmp 0x419310
mov byte [ebp - 1], 1
jmp 0x419303
call 0x419308
add byte [eax], al
add byte [eax], al
pop dword [ebp - 8]
jmp 0x419261
mov dword [ebp - 0x14], 0x1f5a9c8e
sbb bl, bh
xchg edx, eax
push ebp
ja 0x4192d3
adc cl, bl
aam 0xf5
push esi
mov ah, 0x9f
cmp al, 0xe3
xchg ebp, eax
sbb edi, dword fs:[eax + 0x790bbc7a]
dec ecx
cwde
xor byte [ecx + 0x3bb316d0], bl
sub byte [edx + ecx*2 + 0x3e641cdc], 0x71
push eax
mov bl, 0xe6
sbb al, 0x50
cmp byte [edx], ch
std
stosb byte es:[edi], al
xchg ebx, eax
out dx, al
jno 0x41939b
mov bl, 0xe6
pop esp
pushfd
cmp esp, 0x71e58856
inc eax
and al, 0x42
sub byte [ebx], ah
jb 0x419304
dec edi
mov al, byte [0xf2a1a51f]
mov eax, dword [0x8bf8458b]
dec eax
in al, dx
sub ecx, 1
mov dword [ebp - 0x10], ecx
jmp 0x41937a
mov edx, dword [ebp - 0x10]
sub edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jl 0x4193c0
mov eax, dword [ebp - 8]
movzx ecx, byte [eax - 0x15]
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x10]
movzx eax, byte [edx - 4]
xor ecx, eax
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x10]
movzx eax, byte [edx - 2]
xor ecx, eax
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x10]
movzx eax, byte [edx - 3]
xor ecx, eax
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x10]
movzx eax, byte [edx]
xor eax, ecx
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x10]
mov byte [ecx], al
jmp 0x419371
inc edx
invalid
mov esp, ebp
pop ebp
ret
Function at 0x41af00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4595a0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0xdc
mov eax, dword [0x46c008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov dword [0x487698], eax
mov dword [ebp - 0x5c], 0
mov byte [ebp - 0x5f], 0
mov ecx, 1
test ecx, ecx
je 0x41affb
movzx edx, byte [ebp - 0x5f]
test edx, edx
je 0x41afe0
mov eax, dword [ebp - 0x5c]
add eax, 0xb
mov dword [ebp - 0x5c], eax
lea ecx, [ebp - 0xe4]
push ecx
push 0x40
mov edx, dword [ebp - 0x5c]
mov eax, dword [edx - 0x14]
push eax
mov ecx, dword [ebp - 0x5c]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x6c], 0
jmp 0x41af93
mov edx, dword [ebp - 0x6c]
add edx, 1
mov dword [ebp - 0x6c], edx
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x6c]
cmp ecx, dword [eax - 0x14]
jae 0x41afde
mov edx, dword [ebp - 0x5c]
movzx eax, byte [edx - 0x15]
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0x6c]
movzx edx, byte [ecx - 4]
xor eax, edx
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0x6c]
movzx edx, byte [ecx - 2]
xor eax, edx
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0x6c]
movzx edx, byte [ecx - 3]
xor eax, edx
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0x6c]
movzx edx, byte [ecx]
xor edx, eax
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x6c]
mov byte [eax], dl
jmp 0x41af8a
jmp 0x41affb
mov byte [ebp - 0x5f], 1
jmp 0x41afee
call 0x41aff3
pop dword [ebp - 0x5c]
jmp 0x41af45
push 0x16
push 0x7af4aa4f
mov esp, 0xdc3e2cb1
mov bh, 0x46
jmp 0x41afbd

Function at 0x430040
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x43005d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x430064
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x43007b
mov ecx, dword [ebp - 4]
push ecx
call fcn.00423bc0
add esp, 4
or eax, 0xffffffff
jmp 0x43007d
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x455fa0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
lea edi, [ebp - 0xc0]
mov ecx, 0x30
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx], 0x67452301
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0xefcdab89
mov eax, 4
shl eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0x98badcfe
mov eax, 4
imul ecx, eax, 3
mov edx, dword [ebp + 8]
mov dword [edx + ecx], 0x10325476
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x10], 0
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 0x10], 0
push 0x40
push 0
mov eax, dword [ebp + 8]
add eax, 0x18
push eax
call fcn.00428200
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0xc0
cmp ebp, esp
call fcn.00457480
mov esp, ebp
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0x543c4730
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..tls
nop
mov ebx, 0x42cd70
mov ecx, 0x1ec26e95
nop
nop
nop
nop
nop
test eax, eax
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.0040eb78
push str._JAVA_LAUNCHER_DEBUG
mov eax, dword [eax]
mov dword [0x433680], eax
call fcn.0041723a
xor ebp, ebp
pop ecx
test eax, eax
je 0x401059
push str.Windows_original_main_args:_n
call fcn.00401112
pop ecx
mov esi, ebp
call fcn.0040e6c7
cmp dword [eax], ebp
jle 0x401059
call fcn.0040e6cd
mov eax, dword [eax]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call fcn.00401112
add esp, 0xc
inc esi
call fcn.0040e6c7
cmp esi, dword [eax]
jl 0x401037
call dword [sym.imp.kernel32.dll_GetCommandLineA]
push eax
call fcn.0040121d
call fcn.00401285
mov ebx, eax
lea ecx, [ebx*4 + 4]
push ecx
call fcn.00401135
pop ecx
pop ecx
mov esi, eax
call fcn.0040128b
mov edx, ebp
test ebx, ebx
jle 0x401093
mov ecx, dword [eax + edx*8]
mov dword [esi + edx*4], ecx
inc edx
cmp edx, ebx
jl 0x401088
mov edi, dword [str.java]
mov dword [esi + edx*4], ebp
test edi, edi
jne 0x4010a2
mov edi, dword [esi]
mov edx, dword [section..data]
test edx, edx
jne 0x4010ae
mov edx, dword [esi]
mov ecx, dword [0x432990]
push ebp
xor ebp, ebp
inc ebp
test ecx, ecx
push ebp
push ebp
setne al
movzx eax, al
push eax
push edi
push edx
push 0x426274
push 0x426278
push dword [0x432994]
push ebp
push ecx
push ebp
push esi
push ebx
call fcn.00401d65
add esp, 0x38
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x404305
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push 2
push 0xffffffffffffffff
push 0xffffffffffffffea
push ebp
call fcn.0041723a
mov ebx, edx
add esp, 0x10
mov esi, eax
test ebx, ebx
jl 0x404478
jg 0x404334
test esi, esi
jb 0x404478
mov edi, dword [esp + 0x20]
push 0x16
push edi
push ebp
call fcn.004175dd
add esp, 0xc
test eax, eax
js 0x404478
movzx ecx, byte [edi + 3]
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x404396
push edi
call fcn.00404887
pop ecx
test eax, eax
je 0x40438d
push ebx
push esi
push edi
push ebp
call fcn.0041723a
add esp, 0x10
mov esi, eax
mov ebx, edx
mov eax, esi
mov edx, ebx
jmp 0x40447d
push 2
xor ebx, ebx
push ebx
push ebx
push ebp
call fcn.0041723a
mov ebp, eax
add esp, 0x10
mov eax, edx
mov dword [esp + 0x14], eax
cmp eax, ebx
jl 0x404478
jg 0x4043bf
cmp ebp, ebx
jb 0x404478
mov ecx, 0x10015
cmp eax, ebx
jg 0x4043d4
jl 0x4043ce
cmp ebp, ecx
jae 0x4043d4
mov esi, ebp
mov ecx, eax
jmp 0x4043d8
mov esi, ecx
mov ecx, ebx
mov eax, esi
neg eax
push 2
adc ecx, ebx
neg ecx
push ecx
push eax
push dword [esp + 0x28]
call fcn.0041723a
add esp, 0x10
cmp edx, ebx
jl 0x404478
jg 0x4043fe
cmp eax, ebx
jb 0x404478
push 0x10015
call fcn.0041723a
mov ebx, eax
pop ecx
test ebx, ebx
je 0x404478
push esi
push ebx
push dword [esp + 0x24]
call fcn.004175dd
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
js 0x404471
lea edx, [ebx + eax]
lea esi, [edx - 0x16]
jmp 0x40446d
cmp byte [esi], 0x50
jne 0x40446c
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x40446c
movzx ecx, byte [esi + 0x15]
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
lea eax, [esi + 0x16]
add eax, ecx
cmp eax, edx
je 0x404484
dec esi
cmp esi, ebx
jae 0x40442d
push ebx
call fcn.0041723a
pop ecx
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push 0x16
push esi
push edi
call fcn.0040a170
push ebx
call fcn.0041723a
mov eax, dword [esp + 0x20]
add eax, ebx
sub eax, esi
mov esi, dword [esp + 0x24]
cdq
sub ebp, eax
push edi
sbb esi, edx
call fcn.00404887
add esp, 0x14
test eax, eax
je 0x4044c4
push esi
push ebp
push edi
push dword [esp + 0x28]
call fcn.0041723a
add esp, 0x10
mov ebp, eax
mov esi, edx
mov eax, ebp
mov edx, esi
jmp 0x40447d
Function at 0x41723a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x417249
pop dword [ebp - 4]
mov eax, 0x417249
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x2f45f904
sub dword [ebp - 0x14], 0xe0f3b3b9
mov dword [ebp - 0x10], 0x2c93a6fe
sub dword [ebp - 0x10], 0xfa605ab9
mov dword [ebp - 0xc], 0xb14ea7e3
add dword [ebp - 0xc], 0x9afd9c4b
mov dword [ebp - 8], 0x88a72d66
add dword [ebp - 8], 0x7758d29a
lea eax, [ebp - 0x14]
push eax
mov eax, 0x1994db61
sub eax, 0x19527b0d
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0x9728c5cb
sub dword [ebp - 0x14], 0x22b65c75
mov dword [ebp - 0x10], 0x9fa28f2d
add dword [ebp - 0x10], 0xa1c9d248
mov dword [ebp - 0xc], 0xe1899edc
add dword [ebp - 0xc], 0x81e5cd90
mov dword [ebp - 8], 0x5284f15b
add dword [ebp - 8], 0xad7b0ea5
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x3de38
push 0
call eax
mov ecx, 0x489e
xor ebx, ebx
add ebx, eax
mov esi, 0x43ea00
add esi, dword [ebp - 4]
mov edi, 0xbb1e9662
add edi, 0x2c43d71d
mov edx, dword [esi]
xor edx, edi
mov dword [ebx], edx
add ebx, 0xe82c879e
sub ebx, 0xe82c879a
add esi, 4
loop 0x417357
add eax, 0x5166359
add eax, 0xfaeab1f2
mov ebx, eax
add eax, 0x1ec2043e
add eax, 0xe13dfbc7
mov ecx, 0xf535801c
add ecx, 0xb0a7fe4
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x405f20
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and ebp, esp
cwde
add byte [eax], al
add byte [ecx + 0x5410388], ah
invalid

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x41726e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x41727d
pop dword [ebp - 0x1c]
mov eax, 0xaf3b2b6c
sub eax, 0xaef9b8ef
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x34c4b833
sub dword [ebp - 0x2c], 0xe67272e8
mov dword [ebp - 0x28], 0x5d2e6254
add dword [ebp - 0x28], 0xd504e9f1
mov dword [ebp - 0x24], 0xdfa75575
sub dword [ebp - 0x24], 0x935b1147
mov dword [ebp - 0x20], 0x78f20a9a
sub dword [ebp - 0x20], 0x78f20a9a
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xbc572e4f
sub dword [ebp - 0x2c], 0x47e4c4f9
mov dword [ebp - 0x28], 0x225b0e03
add dword [ebp - 0x28], 0x1f115372
mov dword [ebp - 0x24], 0x83d2b96a
add dword [ebp - 0x24], 0xdf9cb302
mov dword [ebp - 0x20], 0x473acee3
add dword [ebp - 0x20], 0xb8c5311d
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xffc67d26
add eax, 0x7ce50a
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x416c3
push 0
call eax
mov ecx, 0x1716fcf6
sub ecx, 0x1716bb76
mov esi, eax
mov edi, 0x5106cec5
sub edi, 0x50c106c5
add edi, dword [ebp - 0x1c]
mov ebx, 0xfb465596
sub ebx, 0x741eed34
xor dword [ebp - 0x14], 0x2852554a
mov edx, dword [edi]
add dword [ebp - 0xc], 0x5aa9a8f3
xor edx, ebx
sub dword [ebp - 0x18], eax
mov dword [esi], edx
sub dword [ebp - 0x14], edx
add esi, 0xc99a2c
add esi, 0xff3665d8
add edi, 0x5602e9e7
add edi, 0xa9fd161d
loop 0x41739a
add eax, 0xf8d3
xor ebx, ebx
add ebx, eax
add eax, 0x5bc13b98
add eax, 0xa43ec46d
mov ecx, 0x79170a30
sub ecx, 0x78d70a30
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40288e
pop dword [ebp - 0x34]
mov eax, 0x2f06813c
add eax, 0xd139a752
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xf669b55a
add dword [ebp - 0x44], 0x57e88ff1
mov dword [ebp - 0x40], 0xd42fe0b9
add dword [ebp - 0x40], 0x5e036b8c
mov dword [ebp - 0x3c], 0x18a788f8
sub dword [ebp - 0x3c], 0xcc5b44ca
mov dword [ebp - 0x38], 0xd1775d6e
add dword [ebp - 0x38], 0x2e88a292
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x3a825890
sub dword [ebp - 0x44], 0xc60fef3a
mov dword [ebp - 0x40], 0xd5842db2
sub dword [ebp - 0x40], 0x9417cc3d
mov dword [ebp - 0x3c], 0x5fdf7c8c
sub dword [ebp - 0x3c], 0xfc701020
mov dword [ebp - 0x38], 0xe9ef6041
sub dword [ebp - 0x38], 0xe9ef6041
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xb78966a4
add eax, 0x48b70a04
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3bf3a
push 0
call eax
mov ecx, 0x5d6c
xor edx, edx
add edx, eax
mov edi, 0xa95caa13
sub edi, 0xa91baa13
add edi, dword [ebp - 0x34]
mov esi, 0xd9cdd176
add esi, 0x355d311e
xor dword [ebp - 0x20], ecx
mov ebx, dword [edi]
xor dword [ebp - 4], 0xeadbe0e0
add ebx, esi
sub dword [ebp - 0x24], 0x88dee91d
mov dword [edx], ebx
sub dword [ebp - 0x30], 0xee2acd70
add edx, 4
add edi, 0xdf09755b
sub edi, 0xdf097557
loop 0x4029a7
add eax, 0x16883
mov ebx, eax
add eax, 0xf5eb873b
sub eax, 0xf5eb8736
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret