joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55c1f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa8
call fcn.00574ae0
mov eax, dword [0x63606c]
xor eax, esp
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xac]
push ebx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xb4]
push ebp
push esi
mov esi, dword [esp + 0xc4]
xor ebp, ebp
mov eax, dword [eax + 4]
push edi
mov edi, dword [esp + 0xc4]
mov dword [esp + 0x14], eax
sub eax, edi
mov dword [esp + 0x10], eax
cmp esi, edi
jae 0x55c256
push str.orig_len___md_size
push 0xf8
push str.._ssl_s3_cbc.c
call fcn.004ddf20
add esp, 0xc
cmp edi, 0x40
jbe 0x55c272
push str.md_size___EVP_MAX_MD_SIZE
push 0xf9
push str.._ssl_s3_cbc.c
call fcn.004ddf20
add esp, 0xc
lea eax, [esp + 0x34]
neg eax
lea ebx, [esp + 0x34]
and eax, 0x3f
add ebx, eax
lea eax, [edi + 0x100]
mov dword [esp + 0x20], ebx
cmp esi, eax
jbe 0x55c299
mov ebp, esi
sub ebp, edi
sub ebp, 0x100
mov eax, edi
xor edx, edx
and eax, 0xfffffffe
shl eax, 0x17
sub eax, ebp
add eax, dword [esp + 0x10]
div edi
push edi
mov esi, edx
push 0
push ebx
mov dword [esp + 0x38], esi
call fcn.0058c9e0
add esp, 0xc
mov dword [esp + 0x18], 0
cmp ebp, dword [esp + 0xc8]
jae 0x55c391
mov ecx, dword [esp + 0x10]
mov edx, ecx
mov ebx, dword [esp + 0x14]
mov esi, ebx
mov eax, dword [esp + 0xc0]
sub esi, ecx
shr edx, 0x1f
mov dword [esp + 0x1c], edx
mov edx, ebx
shr edx, 0x1f
mov eax, dword [eax + 0xc]
mov dword [esp + 0x14], edx
mov edx, ebp
sub edx, ebx
mov dword [esp + 0x24], esi
mov esi, dword [esp + 0x20]
add eax, ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0x28], eax
mov ebx, dword [esp + 0x24]
mov ecx, ebp
shr ecx, 0x1f
inc ebp
mov al, cl
xor al, byte [esp + 0x1c]
lea ebx, [ebx + edx]
shr edx, 0x1f
xor dl, byte [esp + 0x14]
shr ebx, 0x1f
xor bl, byte [esp + 0x1c]
or bl, al
mov al, cl
xor al, byte [esp + 0x14]
xor bl, cl
or dl, al
dec bl
mov eax, dword [esp + 0x10]
xor dl, cl
mov ecx, dword [esp + 0x28]
dec dl
not dl
mov al, byte [ecx + eax]
mov ecx, dword [esp + 0x18]
and dl, al
and dl, bl
or byte [ecx + esi], dl
mov edx, ecx
inc edx
mov ecx, edx
mov eax, edx
sub ecx, edi
xor eax, edi
xor ecx, edi
or ecx, eax
xor ecx, edx
shr ecx, 0x1f
neg ecx
and edx, ecx
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x10]
inc edx
mov dword [esp + 0x10], edx
cmp ebp, dword [esp + 0xc8]
jb 0x55c310
mov esi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x20]
xor edx, edx
test edi, edi
je 0x55c3ca
mov ebp, dword [esp + 0x30]
nop dword [eax + eax]
mov eax, esi
xor eax, 0x20
mov al, byte [eax + ebx]
movzx eax, byte [esi + ebx]
inc esi
mov byte [edx + ebp], al
mov ecx, esi
sub ecx, edi
mov eax, esi
xor ecx, edi
xor eax, edi
or ecx, eax
inc edx
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp edx, edi
jb 0x55c3a0
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00573b53
add esp, 0xa8
ret
Function at 0x55ce00
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.00574ae0
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
inc ebp
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 8]
mov eax, dword [eax + 0x64]
test byte [eax + 0x38], 1
je 0x55ce48
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 4]
lea eax, [ecx + ebp]
cmp eax, edx
jbe 0x55ce3b
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
add dword [esi + 0xc], ecx
add dword [esi + 0x10], ecx
sub edx, ecx
mov dword [esi + 4], edx
jmp 0x55ce4d
cmp ebp, dword [esi + 4]
ja 0x55ce34
test dword [edi + 0x100], 0x200
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 4]
push ebx
movzx ebx, byte [ecx + eax - 1]
je 0x55cea0
cmp dword [edi + 0x88], 0
jne 0x55cea0
mov eax, dword [edi + 0x58]
push 8
add eax, 8
push 0x60571c
push eax
call fcn.004ddb10
add esp, 0xc
test eax, eax
jne 0x55ce93
test bl, 1
jne 0x55ce93
mov eax, dword [edi + 0x58]
or dword [eax], 8
mov eax, dword [edi + 0x58]
test byte [eax], 8
je 0x55cea0
test ebx, ebx
je 0x55cea0
dec ebx
mov eax, dword [edi + 0x80]
push dword [eax]
call fcn.004e4370
add esp, 4
test eax, 0x200000
je 0x55ceca
or eax, 0xffffffff
sub eax, ebx
add dword [esi + 4], eax
mov eax, 1
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
mov edi, dword [esi + 4]
lea ecx, [ebx + ebp]
mov edx, edi
mov dword [esp + 0x10], edi
sub edx, ecx
mov eax, edi
xor edx, ecx
xor eax, ecx
or edx, eax
mov ebp, 0xff
xor edx, edi
lea eax, [edi - 1]
shr edx, 0x1f
dec edx
cmp eax, ebp
mov dword [esp + 0x24], edx
cmovb ebp, eax
xor edx, edx
test ebp, ebp
je 0x55cf4f
mov ecx, ebx
dec edi
shr ecx, 0x1f
add edi, dword [esi + 0xc]
mov dword [esp + 0x18], ecx
nop word [eax + eax]
mov ecx, ebx
lea edi, [edi - 1]
sub ecx, edx
mov eax, edx
shr ecx, 0x1f
inc edx
shr eax, 0x1f
xor cl, al
xor al, byte [esp + 0x18]
or cl, al
movzx eax, byte [edi + 1]
xor cl, byte [esp + 0x18]
xor eax, ebx
dec cl
movzx ecx, cl
and ecx, eax
mov eax, dword [esp + 0x24]
not ecx
and eax, ecx
mov dword [esp + 0x24], eax
cmp edx, ebp
jb 0x55cf10
mov edi, dword [esp + 0x10]
jmp 0x55cf53
mov eax, dword [esp + 0x24]
not eax
movzx eax, al
lea ecx, [eax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
lea eax, [ebx + 1]
neg ecx
and eax, ecx
sub edi, eax
shl eax, 8
or dword [esi], eax
mov eax, ecx
pop ebx
mov dword [esi + 4], edi
and eax, 1
pop edi
not ecx
pop esi
or eax, ecx
pop ebp
pop ecx
ret
Function at 0x55d370
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.00574ae0
push esi
push edi
lea eax, [esp + 0xc]
xor edi, edi
push eax
lea eax, [esp + 0xc]
xor esi, esi
push eax
push edi
call fcn.005446b0
add esp, 0xc
test eax, eax
je 0x55d58b
nop dword [eax + eax]
mov ecx, dword [esp + 8]
lea eax, [esi + 1]
shl ecx, 0xa
inc edi
and ecx, dword [esp + 0x20]
cmove eax, esi
mov esi, eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
push edi
call fcn.005446b0
add esp, 0xc
test eax, eax
jne 0x55d3a0
test esi, esi
je 0x55d58b
mov eax, dword [esp + 0x50]
cdq
idiv esi
mov edi, dword [esp + 0x5c]
cmp esi, 1
push ebx
push ebp
mov ebp, dword [esp + 0x5c]
mov esi, 0
cmovne esi, dword [esp + 0x58]
push edi
push 0
push ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], esi
call fcn.0058c9e0
lea eax, [esp + 0x20]
mov dword [esp + 0x2c], 0
push eax
lea eax, [esp + 0x20]
push eax
push 0
call fcn.005446b0
add esp, 0x18
test eax, eax
je 0x55d556
mov ebx, dword [esp + 0x60]
nop word [eax + eax]
mov eax, dword [esp + 0x10]
shl eax, 0xa
test dword [esp + 0x28], eax
je 0x55d532
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x55d563
push edi
push ebx
push dword [esp + 0x58]
and esi, 1
push dword [esp + 0x58]
add esi, dword [esp + 0x2c]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x58]
push esi
mov esi, dword [esp + 0x88]
push esi
push ecx
call fcn.0055d5b0
add esp, 0x3c
test eax, eax
je 0x55d581
add esi, dword [esp + 0x1c]
xor ecx, ecx
mov dword [esp + 0x54], esi
test edi, edi
jle 0x55d52e
cmp edi, 0x20
jb 0x55d50b
lea eax, [ebx - 1]
lea edx, [ebp - 1]
add eax, edi
add edx, edi
cmp ebp, eax
ja 0x55d4c1
cmp edx, ebx
jae 0x55d50b
mov eax, edi
and eax, 0x8000001f
jns 0x55d4cf
dec eax
or eax, 0xffffffe0
inc eax
mov edx, edi
mov esi, ebx
sub edx, eax
mov eax, ebp
sub esi, ebp
nop dword [eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [esi + eax - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm1, xmmword [ebx + ecx + 0x10]
add ecx, 0x20
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp ecx, edx
jl 0x55d4e0
cmp ecx, edi
jge 0x55d52e
mov esi, ebx
lea eax, [ecx + ebp]
mov edx, edi
sub esi, ebp
sub edx, ecx
nop word [eax + eax]
mov cl, byte [eax + esi]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x55d520
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
inc eax
push ecx
push eax
mov dword [esp + 0x2c], eax
call fcn.005446b0
add esp, 0xc
test eax, eax
jne 0x55d430
pop ebp
mov eax, 1
pop ebx
pop edi
pop esi
add esp, 0x14
ret
push 0x114
push str.._ssl_t1_enc.c
push 0x146
push 0x11c
push 0x14
call fcn.004d7180
add esp, 0x14
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret
push 0x109
push str.._ssl_t1_enc.c
push 0x44
push 0x11c
push 0x14
call fcn.004d7180
add esp, 0x14
xor eax, eax
pop edi
pop esi
add esp, 0x14
ret
Function at 0x576e65
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x5a96e8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005a9567

Function at 0x5ace03
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005acac3

Function at 0x5b43f0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov edi, dword [esp + 0xc]
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [edi + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push edi
mov esi, eax
call fcn.004cae10
add esp, 8
test esi, esi
jg 0x5b4447
je 0x5b4429
cmp esi, 0xffffffff
jne 0x5b4447
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.005b4680
add esp, 4
test eax, eax
je 0x5b4447
push 0xa
push edi
call fcn.004cb510
add esp, 8
pop edi
mov eax, esi
pop esi
ret

Function at 0x5b47e0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x20]
cmp dword [eax], 6
je 0x5b47fb
push eax
push esi
call fcn.005b4e90
add esp, 8
test eax, eax
jle 0x5b4843
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esi + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push esi
mov edi, eax
call fcn.004cae10
add esp, 8
test edi, edi
jg 0x5b4840
push edi
call fcn.005b4740
add esp, 4
test eax, eax
je 0x5b4840
push 0xa
push esi
call fcn.004cb510
add esp, 8
mov eax, edi
pop edi
pop esi
ret
Function at 0x5b6750
Capabilities:
Resolve dns

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, 1
push edi
push ebx
push esi
call fcn.005b6c10
mov edi, eax
add esp, 8
test edi, edi
jns 0x5b678b
push 0x7b
push str..crypto_bio_b_sock.c
push 0x6c
push 0x6a
push 0x20
call fcn.004d7180
add esp, 0x14
jmp 0x5b684c
call fcn.005b6b40
cmp eax, 1
jne 0x5b685c
test edi, edi
jle 0x5b67a4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
push 0x8e
push str..crypto_bio_b_sock.c
push 0x16
push 9
call fcn.004ddaa0
add esp, 0x10
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, eax
test ecx, ecx
jne 0x5b67e1
push 0x92
push str..crypto_bio_b_sock.c
push 0x66
push 0x6a
push 0x20
call fcn.004d7180
add esp, 0x14
jmp 0x5b6832
cmp word [ecx + 8], 2
je 0x5b6802
push 0x99
push str..crypto_bio_b_sock.c
push 0x6b
push 0x6a
push 0x20
call fcn.004d7180
add esp, 0x14
jmp 0x5b6832
mov eax, dword [ecx + 0xc]
xor ebp, ebp
mov eax, dword [eax]
movzx eax, byte [eax]
mov byte [ebx], al
mov eax, dword [ecx + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax + 1]
mov byte [ebx + 1], al
mov eax, dword [ecx + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax + 2]
mov byte [ebx + 2], al
mov eax, dword [ecx + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax + 3]
mov byte [ebx + 3], al
push 0xa2
push str..crypto_bio_b_sock.c
push 0x16
push 0xa
call fcn.004ddaa0
add esp, 0x10
test ebp, ebp
je 0x5b6863
push esi
push str.host
push 2
call fcn.004d67a0
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x5b6bc0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 8]
push esi
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 0x8004667e
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test esi, esi
jns 0x5b6c00
push 0x233
push str..crypto_bio_b_sock.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 5
push 2
call fcn.004d7180
add esp, 0x14
xor eax, eax
test esi, esi
pop esi
sete al
ret
Function at 0x4096e0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
jmp 0x409789
cmp dword [esi + 0x10], 0x1000
jne 0x409775
test byte [esi + 0x15], 1
jne 0x409775
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409734
cmp eax, 2
je 0x409734
cmp eax, 0x10
je 0x409734
cmp eax, 0x20
jne 0x409749
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409749
mov bl, 1
xor ebp, ebp
jmp 0x40975a
mov eax, dword [esi]
add eax, ebp
call fcn.004096d8
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x40974d
test bl, bl
je 0x409775
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40970c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1711dc0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd0f000]
push edi
or ebp, 0xffffffff
jmp 0x1711de2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1711de9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1711dd8
mov eax, 1
add ebx, ebx
jne 0x1711dfb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1711e0c
jne 0x1711e1c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1711e1c
dec eax
add ebx, ebx
jne 0x1711e18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1711df0
xor ecx, ecx
sub eax, 3
jb 0x1711e34
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1711ea6
sar eax, 1
mov ebp, eax
jmp 0x1711e3f
add ebx, ebx
jne 0x1711e3f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x1711e4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x1711e70
inc ecx
add ebx, ebx
jne 0x1711e5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1711e51
jne 0x1711e6d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1711e51
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1711e90
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1711e81
jmp 0x1711dde
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1711e90
add edi, ecx
jmp 0x1711dde
pop esi
mov edi, esi
mov ecx, 0x6cf56
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1711eae
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x1711eb3
lea edi, [esi + 0x130d000]
mov eax, dword [edi]
or eax, eax
je 0x1711f24
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1344fb4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1345144]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1711ed9
mov ecx, edi
jns 0x1711f08
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1345148]
or eax, eax
je 0x1711f1e
mov dword [ebx], eax
add ebx, 4
jmp 0x1711ef6
call dword [esi + 0x134514c]
popal
jmp 0xf4a4f6
Function at 0x414e60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf000]
push edi
jmp 0x414e7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414e81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414e70
mov eax, 1
add ebx, ebx
jne 0x414e93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414e88
jne 0x414ea4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414e88
xor ecx, ecx
sub eax, 3
jb 0x414eb8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414f2a
mov ebp, eax
add ebx, ebx
jne 0x414ec3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414ed0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414ef4
inc ecx
add ebx, ebx
jne 0x414ee0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414ed5
jne 0x414ef1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414ed5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414f14
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414f05
jmp 0x414e76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414f14
add edi, ecx
jmp 0x414e76
pop esi
mov edi, esi
mov ecx, 0x5a7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414f32
cmp byte [edi], 5
jne 0x414f32
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414f37
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414fa6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x15454]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1551c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414f64
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x15520]
or eax, eax
je 0x414fa0
mov dword [ebx], eax
add ebx, 4
jmp 0x414f81
call dword [esi + 0x15530]
mov ebp, dword [esi + 0x15524]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414fda
sub esp, 0xffffff80
jmp 0x40a764

Function at 0x408947
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
add ebx, ebx
call fcn.0040896e
dec ebx
xor dword [edx], ecx
inc eax
sub ebx, eax
inc edx
inc eax
sub eax, 0x9121dba8
cmp edx, edi
jne fcn.00408947
sub ebx, ebx
add eax, 0x9f91ccbd
ret
Function at 0x52c0e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x126000]
push edi
jmp 0x52c0fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x52c101
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52c0f0
mov eax, 1
add ebx, ebx
jne 0x52c113
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x52c124
jne 0x52c143
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52c143
dec eax
add ebx, ebx
jne 0x52c130
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x52c108
add ebx, ebx
jne 0x52c13f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x52c195
xor ecx, ecx
sub eax, 3
jb 0x52c15b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x52c1ca
sar eax, 1
mov ebp, eax
jmp 0x52c166
add ebx, ebx
jne 0x52c166
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52c134
inc ecx
add ebx, ebx
jne 0x52c174
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52c134
add ebx, ebx
jne 0x52c181
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x52c176
jne 0x52c192
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x52c176
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x52c1b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x52c1a6
jmp 0x52c0f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x52c1b4
add edi, ecx
jmp 0x52c0f6
pop esi
mov edi, esi
mov ecx, 0x26f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x52c1d2
cmp byte [edi], 0
jne 0x52c1d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x52c1d7
lea edi, [esi + 0x12a000]
mov eax, dword [edi]
or eax, eax
je 0x52c24f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12d0f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12d1b0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x52c204
mov ecx, edi
jns 0x52c233
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12d1b8]
or eax, eax
je 0x52c249
mov dword [ebx], eax
add ebx, 4
jmp 0x52c221
call dword [esi + 0x12d1b4]
mov ebp, dword [esi + 0x12d1bc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x52c283
sub esp, 0xffffff80
jmp 0x40333d
Function at 0x43b65e
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x43b3c1
dec edx
mov edx, edx
call fcn.0043b69f
or edi, edi
xor dword [eax], ebx
dec edi
and edi, edx
add edx, 0x426b7d92
inc eax
and edi, edx
sub edx, 1
add edi, 0xc74429ee
cmp eax, ecx
jne fcn.0043b65e
mov edx, 0xb7dc5b56
sub edx, 1
sub edi, 0x172b98dc
ret
Function at 0x401123
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [esp + 0x14]
lea eax, [esp + 0x18]
mov edi, ecx
push eax
call fcn.0040117e
xor ebp, ebp
pop ecx
pop ecx
mov ebx, dword [eax]
mov dword [eax], ebp
cmp dword [esp + 0x14], ebp
je 0x401152
push 4
push dword [esp + 0x18]
call fcn.0040219e
pop ecx
pop ecx
lea esi, [edi + 4]
push esi
push ebp
push ebx
push 0x401107
push ebp
push ebp
call fcn.00407377
add esp, 0x18
mov dword [edi], eax
test eax, eax
je 0x401174
pop edi
pop esi
pop ebp
pop ebx
ret 4
push 6
mov dword [esi], ebp
call fcn.00401ecb
int3

Function at 0x40157f
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jbe 0x40167a
push ebx
push ebp
push edi
mov edi, dword [esp + 0x14]
mov ebx, 0xb83bf
mov ebp, str._d_The_remote_protocol_ID:
push ebx
push ebp
call fcn.00401924
xor byte [esi + edi], 0x5d
push ebx
push ebp
call fcn.00401924
xor byte [esi + edi], 0x80
push ebx
push ebp
call fcn.00401924
add byte [esi + edi], 0x2c
push ebx
push ebp
call fcn.00401924
add byte [esi + edi], 0x49
push ebx
push ebp
call fcn.00401924
xor byte [esi + edi], 0x72
push ebx
push ebp
call fcn.00401924
xor byte [esi + edi], 0xbd
push ebx
push ebp
call fcn.00401924
xor byte [esi + edi], 0x70
push ebx
push ebp
call fcn.00401924
xor byte [esi + edi], 0xde
add esp, 0x40
push ebx
push ebp
call fcn.00401924
xor byte [esi + edi], 0x69
push ebx
push ebp
call fcn.00401924
add byte [esi + edi], 0xb
push ebx
push ebp
call fcn.00401924
add byte [esi + edi], 0xed
push ebx
push ebp
call fcn.00401924
add byte [esi + edi], 0xb
push ebx
push ebp
call fcn.00401924
add byte [esi + edi], 0x7d
push ebx
push ebp
call fcn.00401924
xor byte [esi + edi], 0x2c
push ebx
push ebp
call fcn.00401924
add byte [esi + edi], 0xd
push ebx
push ebp
call fcn.00401924
add byte [esi + edi], 0xa1
add esp, 0x40
push ebx
push ebp
call fcn.00401924
add byte [esi + edi], 0x7c
push ebx
push ebp
call fcn.00401924
xor byte [esi + edi], 0xe3
add esp, 0x10
inc esi
cmp esi, dword [esp + 0x18]
jb 0x40159d
pop edi
pop ebp
pop ebx
pop esi
ret