joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420d16
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x420d47
mov eax, dword fs:[4]
mov dword [ebp + 8], eax
mov eax, dword fs:[8]
mov dword [ebp - 4], eax
cmp ebx, dword [ebp - 4]
jb 0x420d4e
cmp ebx, dword [ebp + 8]
jae 0x420d4e
xor eax, eax
jmp 0x420f3e
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x420d5f
xor eax, eax
inc eax
jmp 0x420f3d
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x420d75
cmp ecx, edx
jae 0x420eba
cmp dword [eax + 4], 0
je 0x420d7e
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x420d66
cmp dword [ebp + 8], 0
je 0x420da0
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x420eba
cmp eax, esi
jae 0x420eba
mov eax, dword [0x4253b0]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x420dc5
cmp dword [esi*4 + 0x4253b8], edi
je 0x420ebe
inc esi
cmp esi, eax
jl 0x420db3
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x420f3a
cmp dword [ebp - 8], 0x1000000
jne 0x420f3a
test byte [ebp - 0xc], 0xcc
je 0x420e43
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x420f3a
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x420f3a
cmp word [eax + 0x18], 0x10b
jne 0x420f3a
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x420f3a
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x420e43
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x420e43
test byte [ecx + 0x27], 0x80
jne 0x420eba
push 1
push 0x4253f8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x420d57
mov ecx, dword [0x4253b0]
test ecx, ecx
mov edx, ecx
jle 0x420e77
lea eax, [ecx*4 + 0x4253b4]
cmp dword [eax], edi
je 0x420e77
dec edx
sub eax, 4
test edx, edx
jg 0x420e6b
test edx, edx
jne 0x420ea8
push 0xf
pop ebx
cmp ecx, ebx
jg 0x420e84
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x420e9c
lea eax, [edx*4 + 0x4253b8]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x420e8a
cmp ecx, 0x10
jge 0x420ea8
inc ecx
mov dword [0x4253b0], ecx
push 0
push 0x4253f8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x420d57
xor eax, eax
jmp 0x420f3d
test esi, esi
jle 0x420d57
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x4253f8
call ebx
test eax, eax
jne 0x420d57
cmp dword [esi*4 + 0x4253b8], edi
je 0x420f14
mov eax, dword [0x4253b0]
lea esi, [eax - 1]
test esi, esi
jl 0x420f02
cmp dword [esi*4 + 0x4253b8], edi
je 0x420efe
dec esi
jns 0x420ef2
test esi, esi
jge 0x420f12
cmp eax, 0x10
jge 0x420f0d
inc eax
mov dword [0x4253b0], eax
lea esi, [eax - 1]
jmp 0x420f14
je 0x420f2c
xor ecx, ecx
test esi, esi
jl 0x420f2c
lea eax, [ecx*4 + 0x4253b8]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x420f1a
push 0
push 0x4253f8
call ebx
jmp 0x420d57
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x421ff4
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
call fcn.004212c4
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x42213b
push 2
push esi
push dword [ebp + 8]
call fcn.004212c4
add esp, 0xc
cmp eax, ebx
je 0x42213b
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x4220de
mov ebx, 0x1000
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [ebp - 4], eax
jne 0x42206f
call fcn.0041d53a
mov dword [eax], 0xc
or esi, 0xffffffff
jmp 0x422126
push 0x8000
push dword [ebp + 8]
call fcn.004221af
pop ecx
pop ecx
mov dword [ebp - 8], eax
cmp edi, ebx
mov eax, ebx
jge 0x422089
mov eax, edi
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.0041f4ff
add esp, 0xc
cmp eax, 0xffffffff
je 0x4220a5
sub edi, eax
test edi, edi
jg 0x422081
jmp 0x4220bd
call fcn.0041d548
cmp dword [eax], 5
jne 0x4220ba
call fcn.0041d53a
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.004221af
pop ecx
pop ecx
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x422126
jge 0x422126
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004212c4
push dword [ebp + 8]
call fcn.00420851
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x422126
call fcn.0041d53a
mov dword [eax], 0xd
call fcn.0041d548
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.004212c4
add esp, 0xc
mov eax, esi
pop edi
jmp 0x42213d
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x9c24ace
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x30d672ea
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4320c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x1406761
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov byte [esp + 4], bh
jmp 0x180e341
lea esp, [esp + 0x34]
ja 0x180de66
sar al, 1
sub ebx, edi
add di, si
bts di, di
sbb di, di
add ebx, esp
shrd di, cx, 1
sub di, 0xfdf8
mov edi, ebx
sar al, cl
mov al, 0x2e
push 0x45e589a3
repne scasb al, byte es:[edi]
call fcn.018ead97
add byte [eax], al
inc edi
je 0x180e3be
add byte [eax], al
add byte [edi + 0x65], al
je 0x180e3be
arpl word [ecx + ebp*2 + 0x76], si
dec edi
bound ebp, qword [edx + 0x65]
arpl word [eax + eax - 0x1d], si
dec edx
mov dl, 0x8e
add dl, byte [edx + 0x42]
or dh, byte [ebp - 0x4c]
or ecx, dword [eax - 0x2d]
mov eax, 0xabc57053
jge 0x180e376
mov esi, 0x87287afc
out dx, eax
ljmp 0x2f1c
rcl byte [ecx], cl
pushal
mov esi, 0x3bdd7a3b
test al, 0xe5
cmp byte [esi], bl
sbb edx, dword [ebx - 0xe5f9d4b]
push edx
mov cl, 0x20
sbb dword [esi - 0x1b], eax
ror byte [ecx + 0x79], 1
pop esp
aad 0xf2
in eax, dx
xlatb
rcr byte [0x1f90e948], 1
add al, 0x93
in al, dx
mov esi, 0x34fc3919
lodsb al, byte [esi]
cmpsd dword [esi], dword es:[edi]
adc al, 0xf9
pop esp
movsb byte es:[edi], byte [esi]
jg 0x180e40c
adc eax, dword [eax + 0x2af04e74]
and eax, 0xad3e7c8e
or edi, dword [eax + 0x5e]
push edi
popfd
xor byte [ebp + 0x649312a3], dl
fild qword [ecx - 0x5b]
movsd dword es:[edi], dword [esi]
inc esi
daa
jo 0x180e3d1
sub eax, 0x3edb13a6
test byte [edi - 0x20], dh
sbb eax, 0xf813ca6c
ja 0x180e442
invalid
jnp 0x180e4a8
xlatb
mov esp, 0x649b344f
out 0xcc, eax
push ebx
sbb al, 0x7f
dec eax
mov bh, 0xa0
sbb eax, dword [edi + ebp*2]
push ebp
pop ds
push edi
out dx, al
outsd dx, dword [esi]
fld qword [ecx + esi*4 + 0x7b]
fld xword [edx + 0x4f]
ret 0xe8d8
invalid
invalid

Function at 0x180ffef
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
push edi
lea esp, [esp + 0x2c]
jne 0x1810eb4
bsf eax, ecx
dec ah
btr ax, bp
xor edx, edx
sar al, 4
lahf
bts ax, bx
rol ah, cl
mov eax, edx
sar al, 4
dec al
add edi, 1
not al
neg al
mov al, byte [edi]
push edx
pushal
test al, al
mov byte [esp], 0xcf
call fcn.018d9ecd
add byte [eax], al
push esi
popal
insb byte es:[edi], dx
imul esp, dword [ecx + 0x74], 0x63655265
je fcn.0181003c

Function at 0x181003c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea edx, [esp + 0x66a62ef6]
pushal
add esi, eax
stc
bsr dx, dx
mov edx, dword [esi + 0x78]
mov dword [esp], 0xd7e8b5ac
cmc
pushfd
test edx, edx
pushfd
mov byte [esp], dl
push esi
lea esp, [esp + 0x30]
je 0x1812589
test al, ah
add edx, eax
sar cx, 9
mov ecx, dword [esi + 0x7c]
bt edi, 0x14
stc
add ecx, edx
clc
pushal
pushfd
mov dword [ebp - 0x10], ecx
push 0xf5b93e52
rcl cl, 3
mov ecx, dword [ebp + 0xc]
pushfd
cmp ecx, 0xffff
jmp 0x1813787
Function at 0x18ea594
Capabilities:
Encode data using xor

Disassembly:
stc
jmp 0x18da118
bt di, 3
sub dl, 0xcc
pushfd
push word [esp + 0x38]
popf
push dword [esp]
mov word [esp + 0x10], 0xca6f
inc esi
pushfd
call fcn.0181122b
add byte [eax], al
inc edi
je 0x18da191
outsb dx, byte [si]
inc edx
outsd dx, dword [esi]
js 0x18da145
or byte [ebx + 0x41], bl
test eax, 0x3951f5d0
add dword [eax - 0x42], esp
invalid
das
adc eax, 0x4ddccd19
jmp 0x18da145
lcall 0x661e, 0x9bd12d0d
out dx, al
out dx, al
out 0x6c, eax
add byte [eax], dh
outsd dx, dword [esi]
mov dh, 0x38
push cs
mov dh, 0x83
or al, 0xdd
jo 0x18da161
pop ss
std
out dx, al
push ebx
lock sub dl, byte [0x565d4ae7]
mov bh, 0x2a
add cl, byte [ecx - 0x4b8af3ad]
xor esi, dword [eax - 0x2d]
mov eax, 0xc0d76c2f
xor ebx, esi
xor eax, esp
invalid
xor dl, 0x37
jmp 0x1816886
Function at 0x18ead97
Capabilities:
Encode data using xor

Disassembly:
jmp 0x18d9c08
jne 0x15c3a76
movzx eax, dl
cwde
lea eax, [0x18e27a1]
pushal
mov dword [esp + 0x1c], 0x18114de
jmp 0x1813d8b
lea eax, [edi - 0x9c1730]
not al
lea eax, [0x18e27a1]
call fcn.015c3d18
add byte [eax], al
ror byte [ebp - 0x71d85efb], 1
add eax, ebp
std
mov al, byte [0xffce]
push edi
jb 0x18d9c89
je 0x18d9c87
push eax
jb 0x18d9c8e
jbe 0x18d9c88
je 0x18d9c8e
push eax
jb 0x18d9c9b
imul bp, word [ebp + 0x53], 0x7274
imul ebp, dword [esi + 0x67], 0x66130041
dec esp
mov ah, 0xd5
cmc
push ecx
lds ebp, [eax + 0xd47315]
jge 0x18d9cac
loop 0x18d9c6a
test dl, ah
pop edi
movsd dword es:[edi], dword cs:[esi]
add ebp, dword [ebx + ebp*4 + 0x2a]
mov ch, bl
ret 0x752d
mov word [esi - 0x4b], fs
push cs
fidiv word [0x21c0e493]
jg 0x18d9c3e
outsd dx, dword es:[esi]
or al, 0xa1
fisttp dword [ecx + esi - 0x58]
jno 0x18d9c80
pop esi
rcl dword [eax], cl
wait
sbb dword [edx - 0x417981b2], 0x6a850621
jle 0x18d9c0f
xchg byte [esi + 0x6a850621], bh
mov esi, 0x6a850621
cmc
fidiv dword [ebp + 0x5e]
mov ebp, 0x77306405
xchg esp, eax
jmp 0x4ab5d6c
sbb eax, 0xcc9ace03
rcl bl, 0x82
neg esp
cmp esp, dword [ecx]
mov byte [ebp + 0x3b], dh
mov edi, 0xccc8698f
cmpsb byte [esi], byte es:[edi]
add edx, ecx
imul ecx, eax, 0xca01a6cc
pop ecx
and dl, byte [ebp + 0x51c2dd5e]
cmp al, ch
stosd dword es:[edi], eax
jne 0x18d9d3b
push edx
mov ch, 0x33
mov byte [0xe4ffa2f3], al
inc edi
movsd dword es:[edi], dword [esi]
cli
loopne 0x18d9d13
aad 0xf5
push ecx
fmul dword [edi - 0x2360bd1c]
inc ebx
mov eax, dword [0x19bb3a0e]
jb 0x18d9cac
inc ecx
retf 0x1227
push ebx
sbb al, 0xa3
inc eax
mov ebx, 0xad6e2138
xor byte [edi], ah
scasb al, byte es:[edi]
wait
inc byte [esi + 0x21]
stosd dword es:[edi], eax
jb 0x18d9d25
dec dword [ecx + 0xaa1b0c5]
sbb eax, 0xda66716
mov ebp, eax
mov al, 0xa1
or bl, byte [0xda66716]
cmpsb byte [si], byte es:[di]
or eax, 0x26afc639
xchg ebx, eax
cmp esi, eax
scasd eax, dword es:[edi]
xchg ebx, eax
jl 0x18d9d28
mov ebx, 0x8a37fa87
call 0xc4129f7a
mov ch, al
cmp dword [edx], eax
test edx, eax
sub eax, 0xa53269f6
inc edi
and edx, dword [esi - 0x7023b884]
out 0x41, eax
sbb esi, dword [edx + 0x57]
sar byte [eax - 0x1a0148e1], cl
jnp 0x18d9dc6
mov ebp, 0xce700716
jo 0x18d9d2d
pop ds
call 0xce74f1d4
xor byte [bx - 0x58], bh
in al, 0x67
xor byte [edi + 0x53cc0394], ch
cmp al, 0xb7
pushfd
adc edi, eax
imul edx, dword [ecx + 0x1b], 0xffffffc0
adc eax, 0x8b2241dc
jo 0x18d9d5d
movsb byte es:[edi], byte [esi]
add esi, dword [edi - 0x38]
cmp esp, dword [ecx]
mov esp, edx
cmc
push ecx
lcall 0xec3, 0x8409ca7d
cmp ch, byte [ebx + 0x32b37609]
outsd dx, dword [esi]
into
jmp 0x18d9ddd
jecxz 0x18d9dcf
invalid
cld
fnstenv [eax]
xor al, 0xfd
adc al, 0xf7
pop esp
out 0x5f, al
enter 0xd8a, 0x55
push ebp
mov ah, 0xa
imul edx, esi, 0x6a03c63d
dec edi
ret 0xcdda
lea esp, [esp + 8]
jne 0x1815d64
movsx ax, cl
mov byte [edi - 1], 0
cwde
movzx ax, bl
push ebx
jmp 0x15c3c5c
Function at 0x401930
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040c0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x401943
push esp
mov dword [ebp - 0x24], 0x401660
mov eax, dword [0x4040c0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.zeenty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040c0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.upsent
push str.zeenty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040c8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4019e2
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x4019c3
pop ebp
ret 0x10

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x40de38
mov ecx, 0x3d0559f9
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data_1
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x35a64ea5
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x41bae0
Capabilities:
Get hostname

Disassembly:
sub esp, 0x42c
mov eax, dword [0x420004]
xor eax, esp
mov dword [esp + 0x428], eax
push ebp
mov ebp, dword [esp + 0x434]
push edi
cmp ebx, 0x182
jne 0x41bb14
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
jmp 0x41bb4e
cmp ebx, 0x19f
jne 0x41bb4e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
push str.comazumorelocikisacudilopofazib
push str.xocofuraferigoboyirekowuyohanemi
push str.sigesonotocukayujusipeli
push str.podixahihexewezabedonizuzanicob
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RaiseException]
xor edi, edi
test ebx, ebx
jle 0x41bbc4
push esi
jmp 0x41bb60
lea esi, [esp + 0x10]
mov dword [esp + 0xc], 5
mov dword [esp + 0x10], 0
call fcn.0041bad0
mov eax, dword [esp + 0x10]
add eax, 0x46
mov dword [esp + 0xc], eax
sub dword [esp + 0xc], 0x46
mov cl, byte [esp + 0xc]
xor byte [edi + ebp], cl
cmp ebx, 0xf
jne 0x41bbbe
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
inc edi
cmp edi, ebx
jl 0x41bb60
pop esi
pop edi
pop ebp
cmp ebx, 0x2d
jne 0x41bbdf
mov dword [0x4fa500], 0xa62e7790
mov dword [0x4fa504], 0xffffffff
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.00401000
add esp, 0x42c
ret
Function at 0x8ccbc2
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x8cc92e
mov edi, eax
call fcn.008ccc01
mov edi, 0x109afffc
xor dword [ecx], ebx
and eax, eax
add eax, eax
add eax, 0x31b462ad
add ecx, 1
add edi, 0xb6d2b190
sub edi, eax
cmp ecx, edx
jne fcn.008ccbc2
sub edi, 0xb828b783
ret
Function at 0x406624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406648
xor eax, eax
test eax, eax
je 0x40665b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40665b
xor ecx, ecx
jmp 0x40665e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406787
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4318ec], 0
push esi
jne 0x4067be
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406798
mov dword [ecx*4 + 0x4318e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406793
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067ef
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4318e8]
xor eax, esi
inc ecx
dec edx
jne 0x4067d1
pop edi
not eax
pop esi
ret 0xc

Function at 0x100010e3
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 8]
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov dword [ebp - 4], eax
or eax, eax
je 0x10001115
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x10001115
push dword [ebp - 4]
call fcn.100010c6
push 0
pop dword [ebp - 4]
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x10001134
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push 0x44
lea eax, [ebp - 0x44]
push eax
call fcn.1000111c
push 0x10
lea eax, [ebp - 0x54]
push eax
call fcn.1000111c
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
push 0
call sub.kernel32.dll_CreateProcessA
lea edi, [ebp - 0x54]
push dword [edi]
push dword [edi + 4]
call sub.kernel32.dll_CloseHandle
call sub.kernel32.dll_CloseHandle
leave
ret 4
Function at 0x100013b0
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x1000a30a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x198
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 4]
call fcn.10001000
lea ecx, [esi + 0x2c]
mov dword [esp + 0x1a4], 0
call fcn.10001000
lea ecx, [esi + 0x54]
mov byte [esp + 0x1a4], 1
call fcn.10001000
lea ecx, [esi + 0x7c]
mov byte [esp + 0x1a4], 2
call fcn.10001000
lea eax, [esp + 0xc]
mov dword [esi], 0x1000b248
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov byte [esp + 4], 0x47
mov byte [esp + 5], 0x68
mov byte [esp + 6], 0x30
mov byte [esp + 7], 0x73
mov edx, dword [esp + 4]
lea ecx, [esi + 0xb0]
mov dword [esi + 0xac], eax
mov al, 0x74
mov dword [ecx], edx
mov byte [esi + 0xb5], 0
mov dword [esi + 0xa8], 0xffffffff
mov byte [ecx + 4], al
mov ecx, dword [esp + 0x19c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1a4
ret
Function at 0x10001570
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.10001960
mov eax, dword [esi + 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov byte [esi + 0xb5], 0
mov eax, dword [0x1000e840]
test eax, eax
je 0x100015b1
cmp eax, 4
je 0x100015b1
cmp eax, 5
je 0x100015b1
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x20
ret 8
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0xa8], eax
jne 0x100015d4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x20
ret 8
mov eax, dword [0x1000e840]
mov ebx, dword [esp + 0x34]
test eax, eax
je 0x100015e8
push 0x1000e844
jmp 0x100015e9
push ebx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
test edi, edi
jne 0x10001601
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x20
ret 8
mov eax, dword [0x1000e840]
mov ebp, dword [esp + 0x38]
test eax, eax
mov word [esp + 0x20], 2
je 0x1000161f
mov cx, word [0x1000d010]
push ecx
jmp 0x10001620
push ebp
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x22], ax
mov edx, dword [edi + 0xc]
push 0x10
mov eax, dword [edx]
lea edx, [esp + 0x24]
push edx
mov ecx, dword [eax]
mov eax, dword [esi + 0xa8]
push eax
mov dword [esp + 0x30], ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1000165b
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x20
ret 8
cmp dword [0x1000e840], 5
jne 0x1000167b
push ebp
push ebx
mov ecx, esi
call fcn.10001b60
test al, al
jne 0x1000167b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8
mov edx, dword [esi + 0xa8]
lea ecx, [esp + 0x13]
push 1
push ecx
push 8
push 0xffff
push edx
mov byte [esp + 0x27], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x100016db
push eax
mov edx, dword [esi + 0xa8]
push eax
lea eax, [esp + 0x1b]
push eax
push 0
push 0
lea ecx, [esp + 0x28]
push 0xc
push ecx
push 0x98000004
push edx
mov dword [esp + 0x38], 1
mov dword [esp + 0x3c], 0x2bf20
mov dword [esp + 0x40], 0x1388
call dword [sym.imp.WS2_32.dll_WSAIoctl]
push 1
push 0
push 0
push esi
push 0x10001e70
push 0
push 0
mov byte [esi + 0xb5], 1
call fcn.100043f0
add esp, 0x1c
mov dword [esi + 0xa4], eax
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8