joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4461b0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebp
xor ebp, ebp
mov dword [esp + 4], ebp
mov dword [eax], ebp
lea eax, [esp + 8]
push eax
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.DLL_getaddrinfo]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x446343
push ebx
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x44632d
push esi
mov eax, dword [edi + 4]
cmp eax, 2
jne 0x4461ff
lea ebx, [eax + 0xe]
jmp 0x44620b
cmp eax, 0x17
jne 0x4462ba
lea ebx, [eax + 5]
cmp dword [edi + 0x18], 0
je 0x4462ba
mov eax, dword [edi + 0x10]
test eax, eax
je 0x4462ba
cmp eax, ebx
jb 0x4462ba
push 0x20
call dword [0x5aeea4]
mov esi, eax
add esp, 4
test esi, esi
je 0x446322
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
call dword [0x5aeea4]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x446311
push ebx
push dword [edi + 0x18]
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [edi + 0x14]
add esp, 0xc
test eax, eax
je 0x4462a5
push eax
call dword [0x5aeeb0]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x4462f7
test ebp, ebp
jne 0x4462ab
mov ebp, esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4462b6
mov dword [eax + 0x1c], esi
mov dword [esp + 0x10], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x4461f2
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
pop esi
test eax, eax
je 0x4462d9
push eax
call dword [sym.imp.WS2_32.DLL_freeaddrinfo]
test ebx, ebx
je 0x446329
push ebp
call fcn.00446170
mov eax, dword [esp + 0x2c]
add esp, 4
xor ebp, ebp
mov dword [eax], ebp
mov eax, ebx
pop edi
pop ebx
pop ebp
add esp, 0xc
ret
push dword [esi + 0x18]
mov ebx, 8
call dword [0x5aeea8]
push esi
call dword [0x5aeea8]
add esp, 8
jmp 0x4462c9
push esi
mov ebx, 8
call dword [0x5aeea8]
add esp, 4
jmp 0x4462c9
mov ebx, 8
jmp 0x4462c9
test ebp, ebp
jne 0x446339
mov ebx, 0x2af9
push ebx
call dword [sym.imp.WSOCK32.DLL_WSASetLastError]
mov eax, dword [esp + 0x28]
pop edi
mov dword [eax], ebp
mov eax, ebx
pop ebx
pop ebp
add esp, 0xc
ret

Function at 0x446790
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x264], 2
je fcn.00446740
mov al, 1
ret
Function at 0x44c1eb
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov edi, ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
mov esi, 0x5b1234
cmp dword [0x5b1230], edi
jne 0x44c21a
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x5b1230], 1
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x5b122c]
test esi, esi
je 0x44c275
test edi, edi
jne 0x44c3bc
xor eax, eax
lea ecx, [esi + 0x114]
inc eax
cmp ebx, dword [ecx]
je 0x44c24b
inc eax
add ecx, 4
cmp eax, 0x40
jl 0x44c23c
jmp 0x44c267
push dword [esp + 0x1c]
add eax, 0x84
push dword [esp + 0x1c]
lea eax, [esi + eax*4]
push eax
call fcn.0044c194
xor edi, edi
add esp, 0xc
inc edi
mov esi, dword [esi]
test esi, esi
jne 0x44c22b
test edi, edi
jne 0x44c3bc
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [esp + 0x10]
push ebp
push ebp
push 0x100000
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x44c3bc
mov esi, dword [0x5b122c]
jmp 0x44c2b6
cmp dword [esi + 0xc], 0x3f
jl 0x44c357
mov esi, dword [esi]
test esi, esi
jne 0x44c2aa
push 0x310
push 8
push dword [0x5b0950]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
test esi, esi
je 0x44c3b6
push ebp
push 1
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov dword [esi + 8], eax
test eax, eax
je 0x44c3a8
push ebp
push ebp
push esi
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x1c]
push 0x44c3cf
mov dword [esi + 0x114], ebx
lea ebx, [esi + 0x214]
push 0x1000
mov dword [esi + 0x14], eax
mov dword [ebx], ebp
push ebp
mov dword [esi + 0xc], 2
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x44c3a3
push eax
call edi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push ebx
call fcn.0044c194
mov eax, dword [0x5b122c]
add esp, 0xc
mov dword [esi + 4], ebp
mov dword [esi], eax
test eax, eax
je 0x44c34f
mov dword [eax + 4], esi
mov dword [0x5b122c], esi
jmp 0x44c3bc
mov ecx, dword [esi + 0xc]
mov eax, dword [esp + 0x10]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
mov dword [esi + ecx*4 + 0x10], eax
mov eax, dword [esi + 0xc]
mov dword [esi + eax*4 + 0x110], ebx
mov eax, dword [esi + 0xc]
mov dword [esi + eax*4 + 0x210], ebp
mov eax, dword [esi + 0xc]
add eax, 0x84
lea eax, [esi + eax*4]
push eax
call fcn.0044c194
add esp, 0xc
inc dword [esi + 0xc]
push ebp
push 1
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
jmp 0x44c3bc
push dword [esi + 8]
call edi
push esi
push ebp
push dword [0x5b0950]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x10]
call edi
push 0x5b1234
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x10039018
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
push ebp
mov ebp, esp
sub esp, 0x50
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], eax
push 0
push 0x41797261
push 0x7262694c
push 0x64616f4c
mov dword [ebp - 0x14], esp
push 0x7373
push 0x65726464
push 0x41636f72
push 0x50746547
mov dword [ebp - 0x1c], esp
push 0x73
push 0x7365636f
push 0x7250746e
push 0x65727275
push 0x43746547
mov dword [ebp - 0x18], esp
push 0x316e
mov dword [ebp - 0x20], esp
mov ecx, 0x1a800
mov dword [ebp - 0x38], ecx
mov ecx, 0x38f37
mov dword [ebp - 0x40], ecx
mov ecx, 0x1000
mov dword [ebp - 0x44], ecx
call 0x100390c1
pop eax
sub eax, dword [ebp - 0x40]
add eax, 0xe76
mov dword [ebp - 0x30], eax
mov ebx, eax
push eax
push ebx
xor ecx, ecx
mov ecx, dword [ebp - 0x38]
call fcn.10039204
test eax, eax
jne 0x100391f2
pop ebx
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
cmp byte [ebp - 0x2c], 1
jne 0x100390fc
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov ebx, eax
mov dword [ebp - 0x48], ebx
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov eax, dword [eax + 0x78]
add eax, ebx
mov ecx, dword [eax + 0x14]
sub ecx, 3
mov dword [ebp - 4], ecx
mov ecx, dword [eax + 0x1c]
add ecx, ebx
mov dword [ebp - 8], ecx
mov ecx, dword [eax + 0x20]
add ecx, ebx
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x24]
add ecx, ebx
mov dword [ebp - 0x10], ecx
xor eax, eax
xor ecx, ecx
mov eax, dword [ebp - 0x14]
push 0xc
call fcn.1003923a
test eax, eax
jne 0x1003914b
mov eax, 1
mov dword [ebp - 0x2c], eax
jmp 0x100390e4
add esp, 4
xor edx, edx
push edx
push 0x6c6c64
push 0x2e323349
push 0x5041746e
push 0x65696c43
push esp
nop
mov ebx, eax
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x1c]
push 8
call fcn.1003923a
test eax, eax
jne 0x10039187
mov eax, 1
mov dword [ebp - 0x2c], eax
jmp 0x100390e4
add esp, 4
mov ebx, dword [ebp - 0x24]
xor edx, edx
push edx
push dword [ebp - 0x20]
lea edx, [ebx]
push edx
nop
mov ebx, eax
push 0x9686a69b
push 0x8a2087b1
push 0xca5810be
push 0x7ac79f67
push esp
push 0xc77a
nop
add esp, 8
mov dword [ebp - 0x20], esp
push 0
call fcn.10039273
add esp, 4
mov ebx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x38]
xor edi, edi
mov dl, byte [ebx]
mov esi, ebp
sub esi, 0x20
cmp edi, 0x10
jne 0x100391da
xor edi, edi
mov eax, dword [esi]
mov eax, dword [eax + edi]
xor dl, al
mov byte [ebx], dl
inc ebx
inc edi
dec ecx
jne 0x100391cc
push 1
call fcn.10039273
add esp, 4
mov eax, dword [ebp - 0x30]
add eax, 0x984c
mov esp, ebp
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
push eax
ret
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, reloc.msvcrt.dll_iswupper
nop
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
jmp loc.00401219

Function at 0xd75058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00d751a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd7507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd7506a
add dl, dl
jne 0xd75089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd750dc
xor eax, eax
add dl, dl
jne 0xd75096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd7517d
add dl, dl
jne 0xd750a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd750b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd750bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd750c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd750d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd75075
mov eax, 1
add dl, dl
jne 0xd750ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd750f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd750e1
sub eax, ebx
mov ebx, 1
jne 0xd75128
mov ecx, 1
add dl, dl
jne 0xd7510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd75119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd75105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd75075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd7513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd7514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd75136
cmp eax, 0x7d00
jae 0xd7516d
cmp eax, 0x500
jb 0xd75168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd75075
cmp eax, 0x7f
ja 0xd75170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd75075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd7519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd75075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x6858140d
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0xb113168
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x411d22
Capabilities:
Encrypt data using rc4 prga
Inspect section memory permissions

Disassembly:
add byte [eax], al
push dword [ebp + 0xc]
push ebx
call dword [ebp - 0x88]
mov esi, eax
cmp esi, ebx
je 0x41200f
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.00411787
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x411d86
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
add al, 0xc1
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.00411787
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x411d53
call fcn.00411816
sbb al, 0x2c
adc cl, byte [ebx]
mov edi, dword [esi + 0x3c]
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x412005
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x411dbb
cmp dword [eax + 0xc], ebx
invalid
invalid
invalid

Function at 0x411d62
Capabilities:
Encrypt data using rc4 prga
Inspect section memory permissions

Disassembly:
add byte [eax], al
push dword [ebp + 0xc]
push ebx
call dword [ebp - 0x88]
mov esi, eax
cmp esi, ebx
je 0x41200f
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.00411787
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x411d86
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
add al, 0xc1
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.00411787
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x411d53
call fcn.00411816
sbb al, 0x2c
adc cl, byte [ebx]
mov edi, dword [esi + 0x3c]
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x412005
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x411dbb
cmp dword [eax + 0xc], ebx
invalid
invalid
invalid

Function at 0x411e98
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x411eca
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x411ec5
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
add byte [eax], al
add byte [eax], al
jne 0x411eaf
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x411eb7
cmp edx, ebx
jne 0x412005
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
or byte [edx - 0x3f], dh
add eax, dword [eax + 4]
jmp 0x411e73
mov dword [ebp + 0xc], ebx
jmp 0x411ed5
Function at 0x411ec2
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x411eca
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x411ec5
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
add byte [eax], al
add byte [eax], al
jne 0x411eaf
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x411eb7
cmp edx, ebx
jne 0x412005
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
or byte [edx - 0x3f], dh
add eax, dword [eax + 4]
jmp 0x411e73
mov dword [ebp + 0xc], ebx
jmp 0x411ed5

Function at 0x411f1b
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x411eed
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x411f0b
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov esp, 0xb5f7c18b
push esp
invalid
invalid
invalid
cmp eax, dword [ebp - 0x44]
ja 0x411f69
mov edx, edi
cmp eax, dword [ebp - 0x44]
jbe 0x411f45
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x411ecf
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x411fb6
dec eax
je 0x411fad
sub eax, 3
je 0x411fa4
mov dword [ebp - 4], 0x40
jmp 0x411fd3
mov dword [ebp - 4], 4
jmp 0x411fb9
mov dword [ebp - 4], 0x20
jmp 0x411fb9
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x412005
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x411f85
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00411816
push ecx
out 0x95, eax
jg 0x411ff9
push dword [ebp + 0x14]
jne 0x412010
push 1
push esi
call edi
mov eax, esi
jmp 0x412011
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret

Function at 0x411f2b
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x411f50
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x411f59
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x411f63
add ecx, eax
or byte [ecx], 4
inc eax
Function at 0x411f64
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x411eed
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x411f0b
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov esp, 0xb5f7c18b
push esp
invalid
invalid
invalid
cmp eax, dword [ebp - 0x44]
ja 0x411f69
mov edx, edi
cmp eax, dword [ebp - 0x44]
jbe 0x411f45
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x411ecf
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x411fb6
dec eax
je 0x411fad
sub eax, 3
je 0x411fa4
mov dword [ebp - 4], 0x40
jmp 0x411fd3
mov dword [ebp - 4], 4
jmp 0x411fb9
mov dword [ebp - 4], 0x20
jmp 0x411fb9
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x412005
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x411f85
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00411816
push ecx
out 0x95, eax
jg 0x411ff9
push dword [ebp + 0x14]
jne 0x412010
push 1
push esi
call edi
mov eax, esi
jmp 0x412011
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4120af
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [esp + edi*8 - 0x17af0001], ebp
insb byte es:[edi], dx
idiv edi
call [ecx + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004117db
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
invalid
invalid
dec edx

Function at 0xe252b4
Capabilities:
Encode data using xor

Disassembly:
jmp 0xe252be
pushal
call 0xe252c4
pop ebp
sub ebp, 0x10
sub ebp, 0xa252b4
jmp 0xe252da
mov eax, 0xa252b4
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d7
mov edx, 0x49867b05
xor byte [eax], dl
inc eax
dec ecx
jne 0xe252f1
jmp 0xe25304
mov cs, eax
mov cs, word [ecx + edi - 0x7bfafafb]
invalid
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x4acb03ca
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x264d227a
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x41cc00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bc070
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x516008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 4]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x41cd29
cmp byte [eax + 0x54], 0
je 0x41cd29
add eax, 0x1c
lea ecx, [ebp - 0x1c]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x1c], xmm0
call fcn.0041b520
mov dword [ebp - 4], 0
mov ecx, dword [esi + 4]
call fcn.004131e0
mov ecx, eax
call fcn.004131a0
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x41ccfd
push 0
mov edx, ebx
lea ecx, [ebp - 0x38]
call fcn.0048ea40
add esp, 4
mov byte [ebp - 4], 1
push 2
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [ebp - 0x38]
call fcn.004131e0
lea ecx, [ebp - 0x38]
mov ebx, dword [eax + 0x10]
call fcn.004131e0
mov esi, eax
mov ecx, esi
call fcn.00418040
test al, al
je 0x41ccdb
push dword [esi]
call fcn.00411ee0
add esp, 4
mov esi, eax
push 0
lea eax, [ebp - 0x20]
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.00417e60
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x41cd22
cmp byte [ebp - 0x18], 0
je 0x41cd22
mov eax, dword [esi]
test eax, eax
je 0x41cd1e
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [esi + 4], 0
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004b8ad3
mov esp, ebp
pop ebp
ret 4