joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410f8c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004057b0
mov eax, dword [0x425040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0040fbd3
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x410fce
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41112a
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0041a360
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x499258]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.00411f89
mov ecx, dword [esi*4 + 0x499258]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x411123
cmp eax, dword [ecx + edi + 0x24]
jne 0x411123
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x411123
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00411f89
add esp, 0x14
test edx, edx
jl 0x411123
jg 0x411099
test eax, eax
jb 0x411123
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x411123
jl 0x4110b3
cmp dword [ebp - 0x1008], eax
ja 0x411123
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4110d1
test ebx, ebx
je 0x41110a
cmp ecx, edi
jae 0x41110a
mov al, byte [ecx]
cmp al, 0xd
jne 0x4110eb
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4110f7
cmp byte [ecx + 1], 0xa
jne 0x4110f7
inc ecx
jmp 0x4110f7
movzx eax, al
movsx eax, byte [eax + 0x4252f8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4110d1
cmp edx, ebx
jne 0x4110d1
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x411128
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00404a93
leave
ret
Function at 0x411421
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x499258]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x411461
cmp byte [ebx], 0xa
jne 0x411461
or byte [edi + eax + 0x28], 4
jmp 0x411466
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x411565
mov dl, byte [eax]
cmp dl, 0x1a
je 0x411548
inc eax
cmp dl, 0xd
je 0x411492
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x4114b8
cmp eax, ecx
jae 0x4114c6
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x41147a
jmp 0x411565
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x411543
cmp dword [ebp - 0x10], 0
je 0x411543
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x499258]
test byte [eax + edi + 0x28], 0x48
je 0x41151d
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x411508
mov byte [esi], dl
jmp 0x411519
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x499258]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x411565
cmp byte [ebp - 1], 0xa
jne 0x41152c
cmp esi, ebx
jne 0x41152c
mov byte [esi], 0xa
jmp 0x411564
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00411fa7
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x411565
mov byte [esi], 0xd
jmp 0x411564
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x499258]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x411562
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x411565
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41156e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x499258]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4115b4
cmp word [ebx], dx
jne 0x4115b4
or byte [eax + edi + 0x28], 4
jmp 0x4115b9
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x41171c
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x4116fc
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x4115fa
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x411630
cmp eax, edx
jae 0x41163e
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x4115d5
jmp 0x41171c
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4116f7
cmp dword [ebp - 0x18], 0
je 0x4116f7
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x499258]
test byte [eax + edi + 0x28], 0x48
je 0x4116cd
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x411691
mov word [esi], cx
jmp 0x4116c8
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x499258]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x499258]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x499258]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x41171c
pop eax
cmp word [ebp - 4], ax
jne 0x4116dd
cmp esi, ebx
jne 0x4116dd
mov word [esi], ax
jmp 0x411719
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00411fa7
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x41171c
push 0xd
pop eax
jmp 0x4116d8
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x499258]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x411716
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x41171c
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x414667
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x425040]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x4146b2
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00414802
test al, al
jne 0x4146ac
sub edx, 2
cmp edx, edi
jne 0x414692
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x4146d4
lea eax, [edi + 2]
cmp edx, eax
je 0x4146d4
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.004145b3
add esp, 0x10
jmp 0x4147ce
push esi
lea ecx, [ebp - 0x255]
call fcn.00414802
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x414717
push dword [ebp - 0x25c]
jmp 0x4146c4
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x414754
cmp word [ebp - 0x226], 0
je 0x414775
cmp word [ebp - 0x226], ax
jne 0x414754
cmp word [ebp - 0x224], 0
je 0x414775
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.004145b3
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x4147c1
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x41472e
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x4147a9
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4147ce
push 0x4143e3
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00418490
add esp, 0x10
jmp 0x41479e
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404a93
leave
ret

Function at 0x4173d2
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0040ee9a
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x417441
cmp esi, dword [ebp - 4]
je 0x41743c
cmp dword [ebp + 0xc], 0
je 0x41743c
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x417419
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.00416f24
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x417443
xor eax, eax
inc eax
jmp 0x417443
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x4174a8
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x425040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.0040ee9a
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0040ee9a
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x41751f
cmp word [ecx], dx
je 0x41751f
mov eax, dword [0x41e944]
push edi
dec eax
push eax
push 0x41e830
call fcn.00417447
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x417592
cmp word [eax], dx
je 0x417592
mov eax, dword [edi]
test eax, eax
je 0x417543
cmp word [eax], dx
je 0x417543
lea eax, [ebp - 0x10]
push eax
call fcn.00416e2a
jmp 0x41754c
lea eax, [ebp - 0x10]
push eax
call fcn.00416ec5
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x4175bc
mov eax, dword [0x41e82c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x41e520
call fcn.00417447
add esp, 0xc
test al, al
je 0x4175bc
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x417587
cmp word [eax], di
je 0x417587
lea eax, [ebp - 0x10]
push eax
call fcn.00416e2a
pop ecx
jmp 0x4175be
lea eax, [ebp - 0x10]
push eax
call fcn.00416ec5
jmp 0x417584
mov eax, dword [edi]
test eax, eax
je 0x4175a9
cmp word [eax], dx
je 0x4175a9
lea eax, [ebp - 0x10]
push eax
call fcn.00416ddf
pop ecx
jmp 0x4175bc
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x417687
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.004172cc
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x417687
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x417687
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x417687
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x417614
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.0040f740
test ebx, ebx
je 0x417682
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.0040f740
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x417687
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x417687
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.00418afd
add esp, 0x10
xor eax, eax
inc eax
jmp 0x417689
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404a93
leave
ret
Function at 0x41a320
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41a34d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41a34d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941

Function at 0x406937
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x40b138
call fcn.00406c3c
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x40dbfc
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x4066d6
cmp eax, esi
jne 0x4066c9
xor esi, esi
inc esi
mov ebx, esi
jmp 0x4066d9
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4066b0
xor esi, esi
inc esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x4066ec
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x40671b
mov eax, dword [0x40dbf8]
test eax, eax
jne 0x406715
mov dword [0x40dbf8], esi
push 0x4072cc
push 0x4072c4
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40671b
jmp 0x406843
mov dword [0x40c2cc], esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x40673f
push 0x4072c0
push 0x4072b8
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x40dbf8], 2
test ebx, ebx
jne 0x40674b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x40dc08], 0
je 0x40676f
push 0x40dc08
call fcn.00406bc2
pop ecx
test eax, eax
je 0x40676f
push 0
push 2
push 0
call dword [0x40dc08]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x4067cb
test al, al
je 0x406789
cmp dword [ebp - 0x1c], 0
jne 0x4067cb
mov al, byte [esi]
test al, al
je 0x406799
cmp al, 0x20
ja 0x406799
inc esi
mov dword [ebp - 0x20], esi
jmp 0x406789
test byte [ebp - 0x3c], 1
je 0x4067a5
movzx eax, word [ebp - 0x38]
jmp 0x4067a8
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x40c2c8], eax
cmp dword [0x40c2bc], 0
jne 0x40681f
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x4067da
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x4067ed
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x406776
cmp dword [0x40c2cc], 0
jne 0x40682e
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x40c2c8]
jmp 0x40684f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00406c81
ret
call fcn.0049d000
jmp 0x406676
Function at 0x8651d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov esi, eax
xor ecx, ecx
xor edx, edx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x1c]
lea edx, [ebp - 0x34]
mov ecx, 0x24
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dl, 1
mov eax, dword [0x481c20]
call fcn.00408a94
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x481c20]
call fcn.00408a94
mov dword [ebp - 0x10], eax
mov dl, 1
mov eax, dword [0x6392f8]
call 0x63a1f4
mov dword [ebp - 8], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx]
sub eax, 0x24
sbb edx, 0
push edx
push eax
mov edx, esi
mov eax, dword [ebp - 0x10]
call 0x4a2694
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x1c]
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x1c]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call 0x65e418
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x1c]
xor edx, edx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 4]
xor eax, eax
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x34]
mov ecx, 0x24
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x10]
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x1c]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov edx, dword [ebp - 0xc]
mov eax, esi
call 0x4a2694
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [ebp - 0xc], edx
call fcn.00408ac4
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0x10], edx
call fcn.00408ac4
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [ebp - 8], edx
call fcn.00408ac4
mov eax, esi
mov edx, dword [eax]
call dword [edx]
mov edi, eax
dec edi
sub edi, 0x24
jl 0x86532e
inc edi
mov ebx, 0x24
mov eax, dword [esi + 4]
add eax, ebx
movzx eax, byte [eax]
mov byte [ebp - 1], al
imul ax, bx, 0x1e
movzx edx, byte [ebp - 0x1d]
lea edx, [edx + edx*4]
add ax, dx
add ax, 0x2f1
movzx edx, byte [ebp - 1]
not dl
xor dl, al
mov byte [ebp - 1], dl
ror byte [ebp - 1], 2
mov eax, 1
mov edx, dword [esi + 4]
add edx, ebx
lea ecx, [ebp - 1]
xchg ecx, eax
call fcn.00407394
inc ebx
dec edi
jne 0x8652eb
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, esi
mov edx, dword [eax]
call dword [edx]
mov edi, eax
dec edi
test edi, edi
jl 0x865366
inc edi
xor ebx, ebx
mov eax, dword [ebp - 0x1c]
xor edx, edx
push edx
push eax
mov eax, dword [esi + 4]
add eax, ebx
movzx eax, byte [eax]
imul ebx
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x1c], eax
inc ebx
dec edi
jne 0x865343
xor ecx, ecx
xor edx, edx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x1c]
lea edx, [ebp - 0x34]
mov ecx, 0x24
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x10]
xor ecx, ecx
xor edx, edx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x1c]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x995a40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x41c000]
mov dword [edi + 0x4aac3c], 0x459c4837
push edi
or ebp, 0xffffffff
jmp 0x995a6a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x995a71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x995a60
mov eax, 1
add ebx, ebx
jne 0x995a83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x995a94
jne 0x995ab3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x995ab3
dec eax
add ebx, ebx
jne 0x995aa0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x995a78
add ebx, ebx
jne 0x995aaf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x995b05
xor ecx, ecx
sub eax, 3
jb 0x995acb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x995b3a
sar eax, 1
mov ebp, eax
jmp 0x995ad6
add ebx, ebx
jne 0x995ad6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x995aa4
inc ecx
add ebx, ebx
jne 0x995ae4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x995aa4
add ebx, ebx
jne 0x995af1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x995ae6
jne 0x995b02
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x995ae6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x995b24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x995b16
jmp 0x995a66
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x995b24
add edi, ecx
jmp 0x995a66
pop esi
mov edi, esi
mov ecx, 0x44e3bc
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x995b5f
cmp byte [edi], 0x8e
jne 0x995b44
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x995b42
lea edi, [esi + 0x590000]
mov eax, dword [edi]
or eax, eax
je 0x995ba7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x59e6f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x59e838]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x995b65
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x59e83c]
or eax, eax
je 0x995ba1
mov dword [ebx], eax
add ebx, 4
jmp 0x995b82
call dword [esi + 0x59e84c]
mov ebp, dword [esi + 0x59e840]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x995bdb
sub esp, 0xffffff80
jmp fcn.008aa59c
Function at 0x401e40
Capabilities:
Encode data using xor

Disassembly:
xor dword [edx], eax
add byte [eax], al
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebp, esp
dec edi
in al, dx
js 0x401e9d
mov esi, dword [ebp + 0x24]
sbb al, 0x8d
xchg esp, eax
mov byte [edx + 0x78], ch
push eax
push esi
call 0xc04086e0
xor cl, byte [ebp + 8]
enter 0xffffffffffffc833, 0xffffffffffffffc0
inc eax
add byte [eax + 0x51], dl
dec ebp
or al, cl
xor ecx, eax
rol byte [eax], 0x50
push ecx
or dword [edi + 0x40], 0x68
lodsb al, byte [esi]
jl 0x401e58
add al, bl
add byte [0x8640c180], dl
mov eax, dword [0x4102ac]
add esp, 0xffffff8d
test eax, eax
je 0x401e2b
push eax
push 0xdfd254
call dword [sym.imp.MSVCRT.dll_printf]
or dword [edx + 0x1595fa08], 0x70
rol dword [eax + 0x3b], 0x5e
nop
nop
xor eax, 0x93909090
nop
mov esi, ebx
nop
pause
insd dword es:[edi], dx
push ebp
mov ebp, esp
sub esp, 0xffffffcd
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebp, edi
and eax, 0xe80845e9
dec ecx
cli
dec ebp
mov fs, word [ebx + 0x410ba0]
or eax, dword [ecx]

Function at 0x406fa0
Capabilities:
Set socket configuration

Disassembly:
add ch, byte [esi]
rol ecx, 0xe9
xor al, 0xf3
pop ecx
mov ecx, eax
cmp edi, 3
mov ah, 0xc0
leave
mov ecx, dword [edx]
pop edi
pop esi
mov byte [ebx + ecx], 0
pop ebx
xchg esp, eax
mov byte [eax + eax], dl
push ebp
mov esp, dword [eax - 0x1de7b275]
push ebp
or byte [ebx + 0x758b56c1], cl
or al, 0x83
pushal
cmp byte [edi - 0x39], dl
add ah, byte [ebx]
jne 0x406f49
pop ss
sub ebx, dword [edx]
div byte [esp + ebx - 0x75]
jge 0x406f62
test edi, edi
jne 0x406f12
and dword [ebx], 3
vmread esi, esi
inc edx
sbb esi, dword [ebp + ebx - 0x1f]
mov eax, 0x1e587
xchg ebp, esp
add dword [eax], eax
pop esi
pop ebp
ret 0x18
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
cmp esi, ebx
push edi
mov dword [ebp - 0xc], esi
jne 0x406f40
or eax, dword [eax - 0x5f]
inc eax
add byte [edx + 0xf303c42], cl
invalid