joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4010fc
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x13c
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0x186a0
mov byte [ebp - 0x11f], 8
mov byte [ebp - 0x11e], 0x20
mov byte [ebp - 0x11d], 8
mov byte [ebp - 0x120], 0x2a
mov edi, eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x114], 1
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov dword [esp], edx
call sub.msvcrt.dll_memset
lea edx, [ebp - 0x11c]
cmp dword [ebp + 8], 1
sbb eax, eax
and edx, eax
mov dword [ebp - 0x128], edx
mov esi, 0
mov eax, dword [sym.imp.ws2_32.dll_select]
mov dword [ebp - 0x12c], eax
jmp 0x40119f
mov byte [ebx], 0
cmp esi, dword [ebp - 0x130]
jge 0x40132a
mov eax, dword [ebp - 0x128]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x114]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [ebp - 0x12c]
call eax
sub esp, 0x14
test eax, eax
js 0x401325
je 0x40132a
mov eax, dword [ebp - 0x124]
lea ebx, [eax + esi]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], edi
call dword [sym.imp.ws2_32.dll_recv]
sub esp, 0x10
test eax, eax
jle 0x401334
movzx eax, byte [ebx]
test al, al
je 0x401190
cmp al, 0xa
je 0x401190
cmp al, 0x7f
je 0x401250
cmp al, 8
je 0x401250
cmp dword [ebp + 8], 1
je 0x4012b1
cmp dword [ebp + 8], 2
je 0x4012e0
cmp byte [ebx], 0xd
je 0x401315
add esi, 1
jmp 0x401193
mov byte [ebx], 0
cmp dword [ebp + 8], 0
je 0x4012a6
test esi, esi
jle 0x401193
sub esi, 1
mov eax, dword [ebp - 0x124]
mov byte [eax + esi], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
lea eax, [ebp - 0x11f]
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.ws2_32.dll_send]
sub esp, 0x10
test eax, eax
jns 0x401193
mov esi, 0xffffffff
jmp 0x40132a
mov byte [ebx], 8
add esi, 1
jmp 0x401193
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], edi
call dword [sym.imp.ws2_32.dll_send]
sub esp, 0x10
test eax, eax
jns 0x40123f
mov esi, 0xffffffff
jmp 0x40132a
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
lea eax, [ebp - 0x120]
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.ws2_32.dll_send]
sub esp, 0x10
test eax, eax
jns 0x40123f
mov esi, 0xffffffff
jmp 0x40132a
mov eax, dword [ebp - 0x124]
mov byte [eax + esi + 1], 0xa
add esi, 2
jmp 0x40132a
mov esi, 0xffffffff
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, 0xffffffff
jmp 0x40132a
Function at 0x401a9f
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov ebx, eax
mov dword [ebp - 0x1a], 0x650a0d03
mov dword [ebp - 0x16], 0xd746978
mov word [ebp - 0x12], 0xa
lea eax, [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x48]
mov dword [esp], eax
call sub.kernel32.dll_GetExitCodeProcess
sub esp, 8
cmp dword [ebp - 0xc], 0x103
je 0x401af8
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x48]
mov dword [esp], eax
call sub.kernel32.dll_TerminateProcess
sub esp, 8
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov eax, dword [ebx + 0x4c]
mov dword [esp + 4], eax
mov dword [esp], str.user_shell_still_active__send_Ctrl_Break_to_group_id__lu_n
call dword [sym.imp.msvcrt.dll_printf]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.kernel32.dll_CreateEventA
sub esp, 0x10
mov esi, eax
test eax, eax
je 0x401bfe
mov eax, dword [ebx + 0x4c]
mov dword [esp + 4], eax
mov dword [esp], 1
call sub.kernel32.dll_GenerateConsoleCtrlEvent
sub esp, 8
test eax, eax
je 0x401c0f
mov eax, dword [ebx + 0x4c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.kernel32.dll_GenerateConsoleCtrlEvent
sub esp, 8
test eax, eax
je 0x401c20
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xa
lea eax, [ebp - 0x1a]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x50]
mov dword [esp], eax
call sub.kernel32.dll_WriteFile
sub esp, 0x14
test eax, eax
je 0x401c31
mov dword [esp + 4], 0x1f4
mov dword [esp], esi
call sub.kernel32.dll_WaitForSingleObject
sub esp, 8
cmp eax, 0xffffffff
je 0x401c42
lea eax, [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x48]
mov dword [esp], eax
call sub.kernel32.dll_GetExitCodeProcess
sub esp, 8
cmp dword [ebp - 0xc], 0x103
je 0x401c53
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x48]
mov dword [esp], eax
call sub.kernel32.dll_TerminateProcess
sub esp, 8
jmp 0x401adb
mov dword [esp], str.CreateEvent_error
call sub.msvcrt.dll_puts
jmp 0x401b3d
mov dword [esp], str.Failed_to_send_Ctrl_break
call sub.msvcrt.dll_puts
jmp 0x401b5b
mov dword [esp], str.Failed_to_send_Ctrl_C
call sub.msvcrt.dll_puts
jmp 0x401b79
mov dword [esp], str.Error_writing_to_pipe
call sub.msvcrt.dll_puts
jmp 0x401bad
mov dword [esp], str.WaitForSingleObject_failed
call sub.msvcrt.dll_puts
jmp 0x401bc5
mov dword [esp], str.user_shell_still_active__attempt_to_terminate_it_now...
call sub.msvcrt.dll_puts
test esi, esi
je 0x401c72
mov dword [esp], esi
call sub.kernel32.dll_CloseHandle
sub esp, 4
test eax, eax
je 0x401c8d
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x48]
mov dword [esp], eax
call sub.kernel32.dll_TerminateProcess
sub esp, 8
jmp 0x401be3
mov dword [esp], str.CloseHandle
call dword [sym.imp.msvcrt.dll_printf]
jmp 0x401c72
Function at 0x401f64
Capabilities:
Create tcp socket
Create thread
Start tcp server
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov dword [esp], str.Attempting_to_start_Simple_TelnetD
call sub.msvcrt.dll_puts
mov dword [esp + 4], 1
mov dword [esp], section..text
call sub.kernel32.dll_SetConsoleCtrlHandler
sub esp, 8
call fcn.00401089
test al, al
je 0x402029
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
call dword [sym.imp.ws2_32.dll_socket]
sub esp, 0xc
mov dword [section..bss], eax
test eax, eax
js 0x402033
lea ebx, [ebp - 0x20]
mov dword [ebp - 0x1e], 0
mov dword [ebp - 0x1a], 0
mov dword [ebp - 0x16], 0
mov word [ebp - 0x12], 0
mov word [ebp - 0x20], 2
mov dword [esp], 0x17
call dword [sym.imp.ws2_32.dll_htons]
sub esp, 4
mov word [ebp - 0x1e], ax
mov dword [esp + 8], 0x10
mov dword [esp + 4], ebx
mov eax, dword [section..bss]
mov dword [esp], eax
call dword [sym.imp.ws2_32.dll_bind]
sub esp, 0xc
test eax, eax
jne 0x40203d
mov eax, dword [sym.imp.msvcrt.dll__iob]
lea edi, [eax + 0x40]
jmp 0x402071
mov eax, str.Unable_to_start_socket_interface_n
call fcn.00401032
mov eax, str.Cannot_create_socket
call fcn.00401032
mov eax, str.Cannot_bind_address_to_socket
call fcn.00401032
mov eax, str.Cannot_listen_on_socket
call fcn.00401032
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x1f
mov dword [esp + 4], 1
mov dword [esp], str.Failed_to_accept_incoming_call_n
call sub.msvcrt.dll_fwrite
mov dword [esp + 4], 1
mov eax, dword [section..bss]
mov dword [esp], eax
call dword [sym.imp.ws2_32.dll_listen]
sub esp, 8
test eax, eax
js 0x402047
mov dword [esp + 8], 0
lea eax, [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [section..bss]
mov dword [esp], eax
call dword [sym.imp.ws2_32.dll_accept]
sub esp, 0xc
mov ebx, eax
test eax, eax
js 0x402051
mov esi, dword [ebp - 0x1c]
movzx eax, word [ebp - 0x1e]
mov dword [esp], eax
call dword [sym.imp.ws2_32.dll_htons]
sub esp, 4
mov dword [esp + 0xc], esi
movzx eax, ax
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], str.user_connected_on_socket__d__port__d__address__lx_n
call dword [sym.imp.msvcrt.dll_printf]
mov dword [esp], 0x58
call sub.msvcrt.dll_malloc
mov esi, eax
test eax, eax
je 0x40213f
mov dword [eax + 0x40], ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x40133b
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.kernel32.dll_CreateThread
sub esp, 0x18
test eax, eax
je 0x402149
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
sub esp, 4
jmp 0x402071
mov eax, str.failed_to_allocate_memory_for_client
call fcn.00401032
mov dword [esp], esi
call sub.msvcrt.dll_free
jmp 0x402071
Function at 0x403a24
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 0
cmp word [edx], 0x5a4d
jne 0x403a4d
add edx, dword [edx + 0x3c]
cmp dword [edx], 0x4550
jne 0x403a4d
cmp word [edx + 0x18], 0x10b
sete al
movzx eax, al
pop ebp
ret

Function at 0x403a4f
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
add edx, dword [edx + 0x3c]
movzx eax, word [edx + 0x14]
lea eax, [edx + eax + 0x18]
movzx esi, word [edx + 6]
test esi, esi
je 0x403a97
mov ecx, 0
jmp 0x403a7e
add ecx, 1
add eax, 0x28
cmp ecx, esi
je 0x403a8e
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x403a74
add edx, dword [eax + 8]
cmp edx, ebx
jbe 0x403a74
jmp 0x403a93
mov eax, 0
pop ebx
pop esi
pop ebp
ret
mov eax, 0
jmp 0x403a93

Function at 0x40413c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
lea esi, [ebp + 0xc]
mov eax, dword [sym.imp.msvcrt.dll__iob]
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp + 8], esi
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_vfprintf]
call sub.msvcrt.dll_abort
Function at 0x404188
Capabilities:
Allocate or change rwx memory

Disassembly:
test ecx, ecx
jne 0x40418d
ret
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x54], edx
mov ebx, eax
mov esi, dword [0x40848c]
mov eax, dword [0x408490]
lea edx, [eax + 4]
mov ecx, 0
test esi, esi
jg 0x404292
mov esi, 0
mov dword [esp], ebx
call fcn.00403b3d
mov edi, eax
test eax, eax
je 0x4042a4
lea esi, [esi + esi*2]
shl esi, 2
mov eax, esi
add eax, dword [0x408490]
mov dword [eax + 8], edi
mov dword [eax], 0
call fcn.00403c09
add eax, dword [edi + 0xc]
mov edx, dword [0x408490]
mov dword [edx + esi + 4], eax
mov dword [esp + 8], 0x1c
lea edx, [ebp - 0x4c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.kernel32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x4042b4
mov eax, dword [ebp - 0x38]
cmp eax, 0x40
je 0x40422c
cmp eax, 4
jne 0x4042d4
add dword [0x40848c], 1
mov dword [esp + 8], 0x1c
lea eax, [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.kernel32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x404318
mov eax, dword [ebp - 0x18]
cmp eax, 0x40
je 0x404266
cmp eax, 4
jne 0x404330
mov eax, dword [ebp - 0x58]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x54]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_memmove
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add ecx, 1
add edx, 0xc
cmp ecx, esi
je 0x4041be
mov eax, dword [edx]
cmp ebx, eax
jb 0x404284
mov edi, dword [edx + 4]
add eax, dword [edi + 8]
cmp ebx, eax
jae 0x404284
jmp 0x404233
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0040413c
mov eax, dword [0x408490]
mov eax, dword [eax + esi + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp + 4], eax
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.0040413c
add esi, dword [0x408490]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x40
mov eax, dword [ebp - 0x40]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call sub.kernel32.dll_VirtualProtect
sub esp, 0x10
test eax, eax
jne 0x40422c
call sub.kernel32.dll_GetLastError
mov dword [esp + 4], eax
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
call fcn.0040413c
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.0040413c
lea eax, [ebp - 0x30]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x40
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sub.kernel32.dll_VirtualProtect
sub esp, 0x10
mov eax, dword [ebp - 0x58]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x54]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_memmove
mov eax, dword [ebp - 0x18]
cmp eax, 4
je 0x40427c
cmp eax, 0x40
je 0x40427c
lea eax, [ebp - 0x30]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sub.kernel32.dll_VirtualProtect
sub esp, 0x10
jmp 0x40427c
Function at 0x539b62
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x5b497b71]
mov esi, 0xfd65db7c
wait
cli
dec edi
mov cl, byte [edx]
cmp bh, byte [ebx + 1]
pop ebx
pop ds
in eax, dx
jp 0x539b0f
mov dword [esi - 0x73e1c598], ebx
bnd jp 0x539b8e
sahf
cvtpi2ps xmm5, qword [edx - 0x11afb9b7]
sub bh, byte [ebp + 0x78209acf]
push edx
lea edi, [0xff956494]
mov edx, 0x3eed11fe
xchg esi, eax
sbb al, byte [ebx - 0x36d79416]
sub dl, byte [ebp - 0x2b]
sbb ebx, dword [ebx - 0x56]
invalid
xchg esp, eax
xchg ebp, eax
invalid

Function at 0x5c6442
Capabilities:
Encode data using xor

Disassembly:
je 0x5c6486
fnstsw word [ecx + 0x1a8cec53]
push esp
int 0x65
clc
pop esi
add eax, 0x7a3bd0e5
in eax, dx
sub dword [esi - 0x6b], ebx
in eax, 0x50
js 0x5c647a
dec edx
add eax, 0x14658aa8
pop esi
mov dword [0x8d7ca24f], eax
cmp al, 0x3a
stosd dword es:[edi], eax
adc byte [edi - 0x79e00237], ch
or eax, 0xb190e3a
movsb byte es:[edi], byte [esi]
add eax, 0xc93862bd
sahf
mov ebp, 0x9ec93862
dec ebx
outsd dx, dword [esi]
cdq
outsd dx, dword [esi]
mov esp, dword [edx - 0x21caa848]
stc
das
std
push edi
xor eax, 0xfd2ff9de
insb byte es:[edi], dx
sti
stosd dword es:[edi], eax
mov esp, 0x398e5830
fidivr word [edi - 0x2b]
xor eax, 0xbd836b1e
dec edx
xchg dword [ebx + 0x58e9a4be], eax
dec edi
adc dword [ebx - 4], eax
jb 0x5c647f
push cs
outsb dx, byte [esi]
loopne 0x5c64e7
sbb edx, 0x4512065f
das
retf 0xf53d
or byte [esi + 0x28], ch
imul ebx, ecx, 0x1a
invalid

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40633c
pop dword [ebp - 0x20]
mov eax, 0x9a2f650d
add eax, 0x6610fe2f
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x498b76d
add dword [ebp - 0x30], 0x49b98dde
mov dword [ebp - 0x2c], 0x520c3fe9
add dword [ebp - 0x2c], 0xe0270c5c
mov dword [ebp - 0x28], 0xb2c7cf47
sub dword [ebp - 0x28], 0x667b8b19
mov dword [ebp - 0x24], 0xea8e5547
sub dword [ebp - 0x24], 0xea8e5547
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xa40ef42
sub dword [ebp - 0x30], 0x95ce85ec
mov dword [ebp - 0x2c], 0x7b61ad2d
add dword [ebp - 0x2c], 0xc60ab448
mov dword [ebp - 0x28], 0x5b70e8e4
sub dword [ebp - 0x28], 0xf8017c78
mov dword [ebp - 0x24], 0xc58e0aee
add dword [ebp - 0x24], 0x3a71f512
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x34d49
push 0
call eax
mov ecx, 0xf8f162c
sub ecx, 0xf8ed553
xor esi, esi
add esi, eax
mov edx, 0x11297e83
add edx, 0xef17817d
add edx, dword [ebp - 0x20]
mov ebx, 0xbddb6f91
add ebx, 0x738f6b26
xor dword [ebp - 8], 0x98e68dd7
mov edi, dword [edx]
mov dword [ebp - 0x18], 0x1b04010e
sub edi, ebx
sub dword [ebp - 0x18], edx
mov dword [esi], edi
xor dword [ebp - 0x14], 0x7df2fcda
add esi, 0xf82e1686
sub esi, 0xf82e1682
add edx, 4
loop 0x406456
add eax, 0x841fb263
sub eax, 0x841ebc2c
mov ebx, eax
add eax, 0xd64cb01e
sub eax, 0xd64cb019
mov ecx, 0x5d5f031c
sub ecx, 0x5d1f031c
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x949bf0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3f4000]
push edi
jmp 0x949c0a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x949c11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x949c00
mov eax, 1
add ebx, ebx
jne 0x949c23
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x949c34
jne 0x949c53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x949c53
dec eax
add ebx, ebx
jne 0x949c40
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x949c18
add ebx, ebx
jne 0x949c4f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x949ca5
xor ecx, ecx
sub eax, 3
jb 0x949c6b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x949cda
sar eax, 1
mov ebp, eax
jmp 0x949c76
add ebx, ebx
jne 0x949c76
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x949c44
inc ecx
add ebx, ebx
jne 0x949c84
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x949c44
add ebx, ebx
jne 0x949c91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x949c86
jne 0x949ca2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x949c86
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x949cc4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x949cb6
jmp 0x949c06
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x949cc4
add edi, ecx
jmp 0x949c06
pop esi
mov edi, esi
mov ecx, 0xcaa9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x949ce2
cmp byte [edi], 0x19
jne 0x949ce2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x949ce7
lea edi, [esi + 0x546000]
mov eax, dword [edi]
or eax, eax
je 0x949d5f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x54d7bc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x54d924]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x949d14
mov ecx, edi
jns 0x949d43
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x54d928]
or eax, eax
je 0x949d59
mov dword [ebx], eax
add ebx, 4
jmp 0x949d31
call dword [esi + 0x54d938]
mov ebp, dword [esi + 0x54d92c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x949d93
sub esp, 0xffffff80
jmp 0x519f5d
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp int.00401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x43a235
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x43a2e8
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]
Function at 0x45f010
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x52227b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0051448a
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x45f092
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.005119d0
mov eax, dword [eax]
push 0x1c81d60
push eax
call fcn.00503364
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00514715
test bl, bl
je 0x45f092
push 0x1c81d60
lea ecx, [esp + 0xc]
call fcn.00514af1
push 0x1c81d6c
lea ecx, [esp + 0xc]
call fcn.00514af1
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x45f0ce
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00514715
jmp 0x45f199
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x45f152
lea edx, [esp + 0x7c]
push 0x1c81d68
push edx
call fcn.00503364
add esp, 8
test eax, eax
je 0x45f152
lea eax, [esp + 0x7c]
push 0x1c81d64
push eax
call fcn.00503364
add esp, 8
test eax, eax
je 0x45f152
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x45f0e2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00514715
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x45f990
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x45f9f2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc