joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455b40
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x14]
push ebx
push esi
push edi
mov ebx, eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.00455b10
push ebp
push 0x414300
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
xor edx, edx
call fcn.0040b100
call sub.kernel32.dll_GetEnvironmentStringsW
mov edi, eax
mov esi, edi
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00450eb0
jmp 0x455c18
lea edx, [ebp - 4]
mov eax, esi
call fcn.0040b0b0
mov edx, dword [ebp - 4]
mov ecx, 1
mov al, 0x3d
call fcn.0040bb80
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx - 1]
mov eax, dword [ebp - 4]
mov edx, 1
call fcn.0040b920
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00450eb0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.0040b760
test eax, eax
jne 0x455c08
push dword [ebp - 0x14]
mov eax, dword [ebp - 4]
test eax, eax
je 0x455bf6
mov eax, dword [eax - 4]
sub eax, ebx
mov ecx, eax
lea edx, [ebx + 1]
mov eax, dword [ebp - 4]
call fcn.0040b920
jmp 0x455c1f
mov eax, esi
call fcn.00404990
shl eax, 1
add eax, esi
add eax, 2
mov esi, eax
cmp word [esi], 0
jne 0x455ba0
push edi
call sub.kernel32.dll_FreeEnvironmentStringsW
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00455b10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x455c50
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x94]
mov dword [0x5f40f0], 0
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x84]
mov dword [0x5f3f50], eax
mov eax, dword [ebp - 0x90]
mov dword [0x5f3f60], eax
mov eax, dword [ebp - 0x8c]
mov dword [0x5f3f70], eax
mov eax, dword [ebp - 0x88]
mov dword [0x5f3f80], eax
mov edx, 0x5f3f91
lea eax, [ebp - 0x80]
mov ecx, pe_nt_image_headers32
call fcn.00403800
lea eax, [ebp - 0x80]
call fcn.00404970
mov byte [0x5f3f90], al
mov eax, 0x5a2440
push eax
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x5f4100], eax
test eax, eax
je 0x455cf0
mov eax, 0x5a244c
push eax
push dword [0x5f4100]
call sub.kernel32.dll_GetProcAddress
mov dword [0x5f40f0], eax
nop
cmp dword [0x5f3f60], 6
jae 0x455d04
mov dword [0x578770], 0
nop
cmp dword [0x5f3f60], 6
jb 0x455d20
cmp dword [0x5f3f70], 1
jb 0x455d20
mov dword [0x578780], 2
mov esp, ebp
pop ebp
ret
Function at 0x4924b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
lea esi, [ecx - 1]
test esi, esi
jl 0x4924e4
mov edi, 0xffffffff
nop
add edi, 1
mov cl, al
xor cl, byte [edx]
and ecx, 0xff
mov ebx, ecx
mov ecx, eax
shr ecx, 8
xor ecx, dword [ebx*4 + 0x5f4700]
mov eax, ecx
add edx, 1
cmp esi, edi
jg 0x4924c0
pop edi
pop esi
pop ebx
ret

Function at 0x4b1970
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov edx, eax
xor eax, eax
lea ebx, [edx + 1]
movzx ecx, byte [edx]
add ecx, 1
and ecx, 0xff
add edx, ecx
jmp 0x4b19a1
mov ecx, eax
shl ecx, 5
sub ecx, eax
movzx esi, byte [ebx]
xor ecx, esi
mov eax, ecx
add ebx, 1
cmp edx, ebx
ja 0x4b1990
pop esi
pop ebx
ret

Function at 0x4b3180
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
cmp edx, 1
jne 0x4b31a4
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
call dword [edx + 0x34]
mov dword [ebp - 8], eax
lea esi, [esi]
cmp dword [ebp - 8], 0
je 0x4b326a
mov esi, esi
xor eax, eax
push 0x4b324b
push ebp
push 0x414680
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.0040d0b0
mov eax, dword [ebp - 8]
mov byte [eax + 0xc], 0
mov eax, dword [ebp - 8]
mov byte [eax + 0xe], 0
mov edx, 1
mov eax, 0x59ce58
call fcn.0043ab30
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 8]
call fcn.004b3400
mov edx, dword [ebp - 8]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 8]
call fcn.004b3470
mov edx, dword [ebp - 8]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 8]
call fcn.004b34e0
mov edx, dword [ebp - 8]
mov dword [edx + 0x30], eax
mov dword [ebp - 0xc], 1
cmp dword [ebp - 8], 0
je 0x4b3240
cmp dword [ebp - 4], 0
je 0x4b3240
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x44]
nop
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
jmp 0x4b326a
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bbe30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 1
je 0x4bbe4b
jmp 0x4bbe58
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call dword [edx + 0x34]
mov dword [ebp - 0xc], eax
nop
cmp dword [ebp - 0xc], 0
je 0x4bbe60
jmp 0x4bbe68
jmp 0x4bbf16
xor eax, eax
push 0x4bbef3
push ebp
push 0x414680
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_LoadResource
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x14], 0
jne 0x4bbe9e
jmp 0x4bbec4
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_SizeofResource
mov ebx, eax
mov eax, dword [ebp - 0xc]
push dword [eax + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, dword [ebp - 0xc]
mov ecx, ebx
call fcn.00438990
mov esi, esi
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0xc], 0
jne 0x4bbed3
jmp 0x4bbee8
cmp dword [ebp - 8], 0
jne 0x4bbedb
jmp 0x4bbee8
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call dword [edx + 0x44]
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
jmp 0x4bbf16
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4bdc80
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov esi, eax
cmp dword [esi + 0x14], 0xca
jne 0x4bdcb4
mov eax, esi
call fcn.004c2200
cmp byte [esi + 0x40], 0
je 0x4bdcac
mov dword [esi + 0x14], 0xcf
mov bl, 1
jmp 0x4bdd65
mov dword [esi + 0x14], 0xcb
nop
cmp dword [esi + 0x14], 0xcb
jne 0x4bdd44
mov eax, dword [esi + 0x184]
cmp byte [eax + 0x10], 0
je 0x4bdd3c
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x4bdce8
mov eax, esi
mov edx, dword [esi + 8]
call dword [edx]
lea esi, [esi]
mov eax, esi
mov edx, dword [esi + 0x184]
call dword [edx]
mov edi, eax
test edi, edi
jne 0x4bdd00
xor bl, bl
jmp 0x4bdd65
cmp edi, 2
je 0x4bdd3a
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x4bdcd8
cmp edi, 3
je 0x4bdd18
cmp edi, 1
jne 0x4bdcd8
mov eax, dword [esi + 8]
add dword [eax + 4], 1
mov eax, dword [esi + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jl 0x4bdcd8
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x110]
add dword [edx + 8], eax
mov esi, esi
jmp 0x4bdcd8
mov esi, esi
mov eax, dword [esi + 0x70]
mov dword [esi + 0x78], eax
jmp 0x4bdd5c
cmp dword [esi + 0x14], 0xcc
je 0x4bdd5c
mov ecx, dword [esi + 0x14]
mov eax, esi
mov dl, 0x14
call fcn.004be0a0
lea esi, [esi]
mov eax, esi
call fcn.004bdd70
mov bl, al
mov al, bl
pop edi
pop esi
pop ebx
ret
Function at 0x4dae10
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 4]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0
jne 0x4dae26
jmp 0x4dae60
mov eax, dword [0x578120]
mov edx, dword [ebp - 4]
mov eax, dword [eax + 0x170]
cmp eax, dword [edx + 0x24]
je 0x4dae3b
jmp 0x4dae60
mov eax, dword [0x578120]
cmp byte [eax + 0x11c], 0
je 0x4dae4b
jmp 0x4dae60
mov eax, dword [0x578520]
mov edx, dword [0x578520]
mov edx, dword [edx]
call dword [edx + 0x6c]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov ebx, dword [ebp - 4]
mov eax, dword [0x578520]
mov edx, dword [0x578520]
mov edx, dword [edx]
call dword [edx + 0x6c]
cmp eax, dword [ebx]
je 0x4dae7c
jmp 0x4daf5a
mov eax, dword [0x578120]
cmp byte [eax + 0x11c], 0
je 0x4dae8f
jmp 0x4daf5a
mov eax, dword [0x578520]
mov edx, dword [0x578520]
mov edx, dword [edx]
call dword [edx + 0x6c]
call fcn.00550e70
mov eax, dword [0x578120]
cmp dword [eax + 0x170], 0
jne 0x4daeb4
jmp 0x4daf20
push 0x10
push 0
mov eax, dword [0x578120]
mov eax, dword [eax + 0x170]
push dword [eax + 0x254]
mov eax, dword [0x578120]
mov eax, dword [eax + 0x170]
push dword [eax + 0x248]
mov eax, dword [0x578120]
mov eax, dword [eax + 0x170]
push dword [eax + 0x12c]
push 0
mov eax, dword [ebp - 4]
push dword [eax]
call sub.user32.dll_SetWindowPos
mov eax, dword [0x578120]
mov eax, dword [eax + 0x170]
call fcn.004fc4f0
test al, al
jne 0x4daf0d
jmp 0x4daf20
push 0
mov eax, dword [0x578120]
call fcn.00421410
push eax
call sub.user32.dll_ShowWindow
nop
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
mov eax, dword [ebp - 4]
push dword [eax + 8]
push 0x112
mov eax, dword [ebp - 4]
push dword [eax]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x20]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x28], 0
mov eax, dword [0x578120]
call fcn.00424950
jmp 0x4daff8
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0
jne 0x4daf65
jmp 0x4dafb2
mov eax, dword [ebp - 4]
mov edx, dword [0x578120]
mov eax, dword [eax + 0x24]
cmp eax, dword [edx + 0x170]
je 0x4daf7b
jmp 0x4dafb2
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
mov eax, dword [ebp - 4]
push dword [eax + 8]
push 0x112
mov eax, dword [ebp - 4]
push dword [eax]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x20]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x28], 0
mov eax, dword [0x578120]
call fcn.00424950
jmp 0x4daff8
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 0
jne 0x4dafbd
jmp 0x4daff8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
test dword [eax + 0x48c], 8
jne 0x4dafd1
jmp 0x4daff8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
mov dword [eax + 0xc], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x28], 0
mov eax, dword [0x578520]
mov edx, dword [0x578520]
mov edx, dword [edx]
call dword [edx + 0x8c]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e1ca0
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov byte [ebp - 0xc], 0
mov eax, dword [ebp - 8]
push dword [eax - 8]
call sub.user32.dll_GetClipboardData
mov edx, dword [ebp - 8]
mov dword [edx - 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x14], 0
jne 0x4e1cce
jmp 0x4e1d3c
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalSize
mov edx, dword [ebp - 8]
mov dword [edx - 0x1c], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x1c], 0
jg 0x4e1cea
jmp 0x4e1d3c
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalLock
mov edx, dword [ebp - 8]
mov dword [edx - 0x18], eax
xor eax, eax
push fcn.004e1c80
push ebp
push 0x414300
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax - 0x18]
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 0x1c]
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
call dword [ebx + 0x84]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004e1c80
mov byte [ebp - 0xc], 1
mov al, byte [ebp - 0xc]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e2440
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x2c]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
xor eax, eax
push fcn.004e2420
push ebp
push 0x414300
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
push eax
push 2
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4e2493
jmp 0x4e2510
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0x1c]
call fcn.0046cc20
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x2c]
call fcn.0046cb70
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
call fcn.0046d330
mov ebx, eax
mov eax, str._DataSize
push eax
push dword [ebp - 0x18]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x24]
mov edx, str.TWin32WidgetSet.ClipboardGetOwnerShip_DataHandle
mov eax, ebx
call fcn.0046e7e0
mov eax, dword [ebp - 0xc]
mov byte [eax - 0x10], 0
jmp 0x4e2567
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x14], eax
xor eax, eax
push fcn.004e2400
push ebp
push 0x414300
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx]
call dword [ebx + pe_nt_image_headers32]
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004e2400
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.user32.dll_SetClipboardData
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004e2420
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50db90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 1
je 0x50dbab
jmp 0x50dbb8
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call dword [edx + 0x34]
mov dword [ebp - 0xc], eax
nop
cmp dword [ebp - 0xc], 0
je 0x50dbc0
jmp 0x50dbc8
jmp 0x50dc7a
xor eax, eax
push 0x50dc57
push ebp
push 0x414680
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0xc]
mov edx, 0
call fcn.0040d0b0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x20], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x34], 0
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0xc], 0
jne 0x50dc39
jmp 0x50dc4c
cmp dword [ebp - 8], 0
jne 0x50dc41
jmp 0x50dc4c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call dword [edx + 0x44]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
jmp 0x50dc7a
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5512c0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
xor eax, eax
push fcn.005512a0
push ebp
push 0x414300
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextLengthW
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.0040a930
cmp dword [ebp - 0xc], 0
jg 0x55130c
jmp 0x55132c
mov eax, dword [ebp - 0xc]
lea eax, [eax + 1]
push eax
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x55131f
mov eax, 0x5ef2f0
push eax
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextW
mov dword [ebp - 0xc], eax
nop
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.0040a930
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x18]
call fcn.0040b070
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
test edx, edx
je 0x551355
mov edx, dword [edx - 4]
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x551361
mov eax, 0x5ef2f0
call fcn.00430a30
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.005512a0
mov esp, ebp
pop ebp
ret
Function at 0x5529c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov edx, 0x5de670
call fcn.0040e7c0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.005529b0
push ebp
push 0x414300
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0xc]
lea eax, [eax + 0x34]
mov edx, 0
call fcn.00408bb0
mov eax, dword [ebp - 0xc]
mov edx, fcn.004defe0
mov dword [eax + 0x2c], edx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov dword [edx + 0x24], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [edx + 0x28], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
mov dx, 0
call fcn.00409500
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
lea eax, [eax + 0x30]
call fcn.00408bb0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov dword [edx + 0x10], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
mov dword [edx + 0x18], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0xc]
lea ecx, [eax + 0x10]
mov eax, dword [ebp - 0xc]
lea edx, [eax + 0xc]
mov eax, dword [ebp - 4]
call fcn.00550930
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00553050
mov eax, dword [ebp - 4]
test dword [eax + 0x28], 0x10
je 0x552ac5
jmp 0x552ae4
mov eax, dword [ebp - 4]
call fcn.00501410
test al, al
je 0x552ad3
jmp 0x552ae4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x24]
or eax, 0x8000000
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x24], eax
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.005529b0
mov esp, ebp
pop ebp
ret
Function at 0x570e30
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push edx
push eax
call sub.ws2_32.dll_connect
mov esp, ebp
pop ebp
ret
Function at 0x409650
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7000]
push edi
or ebp, 0xffffffff
jmp 0x409672
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x409679
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x409668
mov eax, 1
add ebx, ebx
jne 0x40968b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x409680
jne 0x40969c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x409680
xor ecx, ecx
sub eax, 3
jb 0x4096b0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x409722
mov ebp, eax
add ebx, ebx
jne 0x4096bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4096c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4096ec
inc ecx
add ebx, ebx
jne 0x4096d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4096cd
jne 0x4096e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4096cd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40970c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4096fd
jmp 0x40966e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40970c
add edi, ecx
jmp 0x40966e
pop esi
mov edi, esi
mov ecx, 8
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40972a
cmp byte [edi], 2
jne 0x40972a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40972f
lea edi, [esi + 0x7000]
mov eax, dword [edi]
or eax, eax
je 0x4097a7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa40c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa448]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40975c
mov ecx, edi
jns 0x40978b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa44c]
or eax, eax
je 0x4097a1
mov dword [ebx], eax
add ebx, 4
jmp 0x409779
call dword [esi + 0xa450]
popal
jmp 0x401294
Function at 0x4068db
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068ff
xor eax, eax
test eax, eax
je 0x406912
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406912
xor ecx, ecx
jmp 0x406915
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406a38
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43110c], 0
push esi
jne 0x406a6f
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a49
mov dword [ecx*4 + 0x431108], eax
inc ecx
cmp ecx, 0x100
jl 0x406a44
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406aa0
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431108]
xor eax, esi
inc ecx
dec edx
jne 0x406a82
pop edi
not eax
pop esi
ret 0xc

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0xfc759b
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0xe5e098f
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x414dc0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
push ebx
push esi
push edi
lea edi, [ebp - 0x170]
mov ecx, 0x5c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov dword [ebp - 4], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 0x130]
push ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x414e53
mov esi, esp
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
cmp esi, esp
call fcn.004401d0
test eax, eax
jne 0x414e3c
mov ecx, dword [ebp - 0x124]
mov dword [ebp - 4], ecx
lea edx, [ebp - 0x12c]
push edx
mov eax, dword [ebp - 0x130]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x414e15
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
add esp, 0x170
cmp ebp, esp
call fcn.004401d0
mov esp, ebp
pop ebp
ret